diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 0b528ae1..c63fdeef 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -26,15 +26,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 300
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Optional font build input, so the Japanese font tests run (they skip without it).
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: 8dcdacd5153e64560d109541a47d806f26f048c0
           path: craft-fonts
       - name: Build and test in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
         with:
           release: "14.3"
           usesh: true
diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index 0e2388a6..46ce3c90 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -23,7 +23,7 @@ jobs:
     env:
       ACTIONLINT_VERSION: 1.7.12
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install tools
         run: |
           sudo apt-get update
@@ -51,6 +51,11 @@ jobs:
           if grep -oE '<Icon Id="[^"]*"' packaging/windows/lightcraft.wxs | grep -vE '\.(ico|exe)"$'; then
             echo "::error::Icon Id must end in .ico or .exe"; exit 1
           fi
+          # The interactive installer asks where to install and ends on a completion page (issues #18, #399).
+          for want in '<UIRef Id="LightcraftUI" />' 'Value="InstallDirDlg"' '<Property Id="WIXUI_INSTALLDIR" Value="INSTALLFOLDER" />' \
+              'Key="Software\LightCraft" Name="InstallFolder"' 'Value="LaunchLightcraft"'; do
+            grep -qF "$want" packaging/windows/lightcraft.wxs || { echo "::error::lightcraft.wxs lost: $want"; exit 1; }
+          done
           desktop-file-validate packaging/linux/ai.storyteller.lightcraft.desktop
           sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.lightcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.lightcraft.metainfo.xml"
           appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.lightcraft.metainfo.xml"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b9c3a1ea..c81bf050 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
       date: ${{ steps.v.outputs.date }}
       prerelease: ${{ steps.v.outputs.prerelease }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: v
         name: Resolve version
         run: |
@@ -72,17 +72,17 @@ jobs:
       LIGHTCRAFT_VERSION: ${{ needs.version.outputs.version }}
       LIGHTCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Fonts (optional build input; required for releases): see craftrules standards/fonts.md.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: 8dcdacd5153e64560d109541a47d806f26f048c0 # bump deliberately
           path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
           targets: aarch64-apple-darwin, x86_64-apple-darwin
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: release-macos-universal
       - name: Apply version override
@@ -102,7 +102,7 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: packaging/macos/package.sh --arch universal
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-macos
           path: dist/release/*
@@ -130,23 +130,24 @@ jobs:
       LIGHTCRAFT_VERSION: ${{ needs.version.outputs.version }}
       LIGHTCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Fonts (optional build input; required for releases): see craftrules standards/fonts.md.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: 8dcdacd5153e64560d109541a47d806f26f048c0 # bump deliberately
           path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
           targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: release-windows-${{ matrix.arch }}
       - name: Apply version override
         if: inputs.version != ''
         shell: bash
         run: cargo xtask version set "$LIGHTCRAFT_VERSION"
+      # package.ps1 adds the matching WixToolset.UI/Util.wixext (5.0.2) to the global extension cache.
       - name: Install WiX
         shell: pwsh
         run: dotnet tool install --global wix --version 5.0.2
@@ -164,7 +165,7 @@ jobs:
           AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
           AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
         run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-windows-${{ matrix.arch }}
           path: dist/release/*
@@ -187,9 +188,9 @@ jobs:
       LIGHTCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
       NFPM_VERSION: 2.47.0
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Fonts (optional build input; required for releases): see craftrules standards/fonts.md.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: 8dcdacd5153e64560d109541a47d806f26f048c0 # bump deliberately
@@ -203,8 +204,8 @@ jobs:
           curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
             "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
           sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: release-linux-${{ matrix.arch }}
       - name: Apply version override
@@ -228,7 +229,7 @@ jobs:
             "$appimage" --appimage-updateinformation | grep -F 'gh-releases-zsync|'
             test -s "$appimage.zsync"
           done
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/release/*
@@ -250,8 +251,8 @@ jobs:
       LIGHTCRAFT_VERSION: ${{ needs.version.outputs.version }}
       LIGHTCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/linux
@@ -265,7 +266,7 @@ jobs:
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       - name: Build the Flatpak bundle
         run: packaging/linux/flatpak-bundle.sh "dist/linux/lightcraft-$LIGHTCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-flatpak-${{ matrix.arch }}
           path: dist/release/*.flatpak
@@ -282,16 +283,16 @@ jobs:
       LIGHTCRAFT_VERSION: ${{ needs.version.outputs.version }}
       LIGHTCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Fonts (optional build input; required for releases): see craftrules standards/fonts.md.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: 8dcdacd5153e64560d109541a47d806f26f048c0 # bump deliberately
           path: craft-fonts
       - name: Build and package in a FreeBSD VM (tar.gz)
         # vmactions/freebsd-vm v1.5.9, pinned by commit (it runs our build).
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
         with:
           release: "14.3"
           usesh: true
@@ -316,7 +317,7 @@ jobs:
             bash packaging/freebsd/package.sh
             tar -tzf dist/release/lightcraft-*-freebsd-x86_64.tar.gz \
               | grep -E '/bin/lightcraft$|/bin/lightcraft-cli$|/share/applications/ai\.storyteller\.lightcraft\.desktop$|/share/doc/lightcraft/LICENSE-MIT$'
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-freebsd-x86_64
           path: dist/release/*
@@ -331,17 +332,17 @@ jobs:
       LIGHTCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
       WASM_BINDGEN_VERSION: 0.2.129
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Fonts (optional build input; required for releases): see craftrules standards/fonts.md.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: 8dcdacd5153e64560d109541a47d806f26f048c0 # bump deliberately
           path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
           targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: release-web
       - name: Install wasm-bindgen CLI
@@ -359,7 +360,7 @@ jobs:
           CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
           CRAFT_FONTS_REQUIRED: "1"
         run: packaging/web/package.sh
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-web
           path: dist/release/*
@@ -378,7 +379,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GH_REPO: ${{ github.repository }}
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-*
           path: artifacts
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index d6067b3f..1cccd858 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -36,11 +36,11 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
           targets: aarch64-pc-windows-msvc
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: windows-arm64-package
       - name: Install WiX
@@ -51,7 +51,7 @@ jobs:
         env:
           DIST: ${{ github.workspace }}\dist\arm64
         run: ./packaging/windows/package.ps1 -Arch arm64
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: lightcraft-windows-arm64
           path: dist/arm64/*
@@ -64,7 +64,7 @@ jobs:
     runs-on: windows-11-arm
     timeout-minutes: 30
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: lightcraft-windows-arm64
           path: dist
diff --git a/AGENTS.md b/AGENTS.md
index 3ab653c7..b199c7f9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -74,9 +74,10 @@ of it. Full standard: `../craftrules/standards/never-crash.md`
   font files here (Inter, already in `assets/fonts/`, is the one exception); add new fonts to craft-fonts. LightCraft
   uses it as the optional build input `CRAFT_FONTS_DIR`: `git clone https://github.com/storytold/craft-fonts ../craft-fonts`
   then `CRAFT_FONTS_DIR=../craft-fonts cargo run -p lightcraft` (or any cargo/xtask command). `crates/engine/build.rs`
-  embeds the manifest's fonts as `lightcraft_engine::CRAFT_FONTS` (wasm32: BIZ UDPGothic Regular only); the UI
-  (`theme::font_definitions`) and the export watermark renderer use its CJK faces (picked by script) as fallbacks after Inter. Unset,
-  `CRAFT_FONTS` is empty: everything builds, tests and runs, but Japanese text has no glyphs. Releases always build
+  embeds the manifest's fonts as `lightcraft_engine::CRAFT_FONTS` (wasm32: BIZ UDPGothic Regular only); `cargo xtask web`
+  ships Noto Sans CJK SC Regular as a separate asset loaded by the UI before startup. The UI
+  (`theme::font_definitions`) and the export watermark renderer use CJK faces (picked by script) as fallbacks after Inter. Unset,
+  `CRAFT_FONTS` is empty: everything builds, tests and runs, but Chinese and Japanese text lack glyphs. Releases always build
   with it (`release.yml`, `CRAFT_FONTS_REQUIRED=1`) and ship the fonts' OFL licences. Tests that need these fonts skip
   without it; the FreeBSD CI job runs them with it. Rules: craftrules
   [`standards/fonts.md`](https://github.com/storytold/craftrules/blob/main/standards/fonts.md).
diff --git a/CLAUDE.md b/CLAUDE.md
index bdf7eceb..57745896 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -74,9 +74,10 @@ of it. Full standard: `../craftrules/standards/never-crash.md`
   font files here (Inter, already in `assets/fonts/`, is the one exception); add new fonts to craft-fonts. LightCraft
   uses it as the optional build input `CRAFT_FONTS_DIR`: `git clone https://github.com/storytold/craft-fonts ../craft-fonts`
   then `CRAFT_FONTS_DIR=../craft-fonts cargo run -p lightcraft` (or any cargo/xtask command). `crates/engine/build.rs`
-  embeds the manifest's fonts as `lightcraft_engine::CRAFT_FONTS` (wasm32: BIZ UDPGothic Regular only); the UI
-  (`theme::font_definitions`) and the export watermark renderer use its CJK faces (picked by script) as fallbacks after Inter. Unset,
-  `CRAFT_FONTS` is empty: everything builds, tests and runs, but Japanese text has no glyphs. Releases always build
+  embeds the manifest's fonts as `lightcraft_engine::CRAFT_FONTS` (wasm32: BIZ UDPGothic Regular only); `cargo xtask web`
+  ships Noto Sans CJK SC Regular as a separate asset loaded by the UI before startup. The UI
+  (`theme::font_definitions`) and the export watermark renderer use CJK faces (picked by script) as fallbacks after Inter. Unset,
+  `CRAFT_FONTS` is empty: everything builds, tests and runs, but Chinese and Japanese text lack glyphs. Releases always build
   with it (`release.yml`, `CRAFT_FONTS_REQUIRED=1`) and ship the fonts' OFL licences. Tests that need these fonts skip
   without it; the FreeBSD CI job runs them with it. Rules: craftrules
   [`standards/fonts.md`](https://github.com/storytold/craftrules/blob/main/standards/fonts.md).
@@ -102,6 +103,9 @@ of it. Full standard: `../craftrules/standards/never-crash.md`
   the running app). See `docs/mcp.md`. Quick non-UI checks: `lightcraft-cli render in.jpg -o out.jpg --set light.exposure=1`.
 - Export goes through `lightcraft_engine::export` (one encoder for app, CLI, MCP and web); UI-only commands live in
   `crates/ui-egui/src/menus.rs`.
+- Text boxes use `crates/ui-egui/src/text_field.rs` (`TextField`), not `egui::TextEdit`: it gives every field the
+  Cut / Copy / Paste / Select All menu, Esc restoring the text, and reports how an edit ended. Give each a widget id
+  that is unique on screen. Older fields still on `TextEdit` move over as they are touched.
 - Shell gotcha: `mv`/`cp` are aliased interactive here — use `/bin/mv -f` / `/bin/cp -f`.
 - Parallel agents: separate git worktrees and `CARGO_TARGET_DIR=target/agent-<name>`; each agent uses its **own control port** (pick one in 18000–19999, never the default 7980) and its own scratch subfolder (`<scratch>/<agent-name>/`) — never `rm -rf` shared paths; delete your target dir when done (disk is shared); keep every `Cargo.toml` valid at all times (the `crates/*` glob means one broken manifest breaks everyone).
 - Test corpora: `cargo xtask corpus --download` into `corpus/` (gitignored, CC0 only). Never commit media.
diff --git a/Cargo.lock b/Cargo.lock
index 397094ed..e8037a6f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2976,7 +2976,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "eframe",
  "egui",
@@ -2994,10 +2994,11 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-catalog"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "crc32fast",
  "lightcraft-develop",
+ "lightcraft-geom",
  "lightcraft-meta",
  "log",
  "proptest",
@@ -3009,7 +3010,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-cli"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "dhat",
  "lightcraft-codecs",
@@ -3024,8 +3025,9 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-codecs"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
+ "avif-serialize",
  "bytemuck",
  "image",
  "image-webp",
@@ -3039,6 +3041,7 @@ dependencies = [
  "moxcms 0.9.1",
  "png",
  "proptest",
+ "rav1e",
  "ravif",
  "rayon",
  "serde",
@@ -3050,7 +3053,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-color"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "lightcraft-geom",
  "proptest",
@@ -3059,7 +3062,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-denoise"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "faer-core",
  "lightcraft-denoise-core",
@@ -3076,7 +3079,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-denoise-core"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "lightcraft-raster",
  "miniz_oxide 0.8.9",
@@ -3091,7 +3094,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-develop"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "lightcraft-color",
  "lightcraft-geom",
@@ -3103,7 +3106,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-engine"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "ab_glyph",
  "harfrust",
@@ -3118,6 +3121,7 @@ dependencies = [
  "lightcraft-fetch",
  "lightcraft-geom",
  "lightcraft-gpu",
+ "lightcraft-heif",
  "lightcraft-merge",
  "lightcraft-meta",
  "lightcraft-pipeline",
@@ -3139,7 +3143,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-faces"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "matrixmultiply",
  "ndarray",
@@ -3153,7 +3157,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-fetch"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "log",
  "rustls",
@@ -3164,7 +3168,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-geom"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "proptest",
  "serde",
@@ -3172,7 +3176,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-gpu"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "bytemuck",
  "lightcraft-color",
@@ -3181,6 +3185,7 @@ dependencies = [
  "lightcraft-geom",
  "lightcraft-pipeline",
  "lightcraft-raster",
+ "lightcraft-raw",
  "lightcraft-scenes",
  "log",
  "pollster 1.0.1",
@@ -3189,14 +3194,15 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-heif"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "heic-rs",
+ "rayon",
 ]
 
 [[package]]
 name = "lightcraft-mcp"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "lightcraft-codecs",
  "lightcraft-engine",
@@ -3207,7 +3213,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-merge"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "lightcraft-codecs",
  "lightcraft-color",
@@ -3223,7 +3229,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-meta"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "lightcraft-geom",
  "lightcraft-tiff",
@@ -3235,7 +3241,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-pipeline"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "image",
  "lightcraft-color",
@@ -3252,7 +3258,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-preview"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "jpeg-encoder",
  "lightcraft-raster",
@@ -3264,7 +3270,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-raster"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "libc",
  "lightcraft-color",
@@ -3276,7 +3282,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-raw"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "jpeg-encoder",
  "jxl-oxide",
@@ -3298,7 +3304,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-scenes"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "image",
  "lightcraft-color",
@@ -3309,7 +3315,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-segment"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "candle-core",
  "candle-nn",
@@ -3322,11 +3328,11 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-sysmem"
-version = "0.4.0"
+version = "0.5.0"
 
 [[package]]
 name = "lightcraft-tiff"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "proptest",
  "serde",
@@ -3335,7 +3341,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-ui-egui"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "egui",
  "lightcraft-catalog",
@@ -3359,7 +3365,7 @@ dependencies = [
 
 [[package]]
 name = "lightcraft-web"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "crc32fast",
  "eframe",
@@ -6819,11 +6825,12 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "brotli",
  "flate2",
  "serde_json",
+ "sha2",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 5f7c85db..58e5383b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/*", "apps/*", "xtask"]
 
 [workspace.package]
-version = "0.4.0"
+version = "0.5.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.90"
@@ -68,6 +68,9 @@ moxcms = { version = "0.9", default-features = false, features = ["lut"] }
 jxl-oxide = { version = "0.12", default-features = false }
 zune-jpegxl = { version = "0.5", default-features = false, features = ["std"] } # MIT/Apache-2.0/Zlib lossless JXL encoder (test fixtures only)
 ravif = { version = "0.13", default-features = false, features = ["threading"] } # no "asm": it needs nasm (non-Rust)
+# HDR AVIF (PQ): ravif fixes the sRGB transfer curve, so HDR files drive its rav1e + avif-serialize directly
+rav1e = { version = "0.8.1", default-features = false, features = ["threading"] }
+avif-serialize = "0.8.6"
 
 # gpu (crates/gpu; native backends only, no GL: everything stays pure Rust)
 # SAM 3 inference (lightcraft-segment). 0.9.2: later releases pull `tokenizers` with the
diff --git a/README.md b/README.md
index e93683c6..217092fb 100644
--- a/README.md
+++ b/README.md
@@ -249,6 +249,20 @@ lightcraft --control 7980 ~/Pictures/trip
   path=out.jpg longEdge=2048` runs any chain of commands (headless, on a saved library, or against the running app)
   and prints one JSON result per command; `lightcraft-cli render in.dng -o out.jpg --set light.exposure=0.7 --preset …`.
 - **Undo for everything**, including agent actions: a slider drag (or a scripted burst of updates) is one undo step.
+- **Contact sheets (native app / CLI):** select photos, then **File → Contact Sheet PDF…**. Choose A4 or Letter, landscape,
+  rows/columns and filename captions; save a paginated PDF and print it from your PDF viewer. Exports use the
+  current edits, fit each photo without further cropping, and render at 150 dpi in sRGB. The background export
+  supports cancellation and protects originals and XMP sidecars. From the CLI:
+
+  ```sh
+  lightcraft-cli run --import ~/Pictures/shoot library.selectAll export.contactSheet path=Contact.pdf paper=a4 columns=3 rows=4 captions=true
+  ```
+
+  `export.contactSheet` also accepts explicit `ids`, `landscape=true`, and `paper=letter`. It replaces an existing
+  output only after the entire PDF succeeds. Limits: 1,000 photos, 100 pages, 256 MiB; captions are rasterized
+  with the same font coverage as watermarks (CJK requires craft-fonts), with long names shortened in the middle.
+  This is a contact-sheet workflow,
+  not a printer-driver or custom picture-package layout editor.
 - **Every widget is addressable** (`ui.widgets`) and clickable by name, so agents operate the real UI, not a
   side door.
 - The screenshots in this README were produced end to end by the [`docs/showcase/`](docs/showcase/) scripts.
@@ -269,7 +283,8 @@ lightcraft --control 7980 ~/Pictures/trip
 - **GPU-accelerated, CPU-exact.** The whole develop pipeline runs as wgpu compute kernels (Metal / Vulkan / DX12),
   checked against the CPU pipeline to within 1/255. On a 24 MP raw (Apple M4 Pro): a slider update re-renders in
   ~4 ms, a cold 2.5 MP loupe in ~30 ms, and a full-size export in ~0.3 s including a parallel JPEG encode.
-  Without a GPU the same pipeline runs on all CPU cores, redoing only the stages a slider affects.
+  Without a GPU the same pipeline runs on all CPU cores, redoing only the stages a slider affects. Batch exports
+  render several photos side by side, so one's decode and encode overlap another's render.
 - **Instant culling.** Opening a raw shows its embedded camera preview or cached render within ~0.1 s while the
   full render follows (~0.2–0.5 s for 24 MP). The next and previous photos are prepared in the background, so stepping
   through a shoot takes ~50 ms per photo.
@@ -289,10 +304,10 @@ LightCraft is young and moving fast. **Where we honestly stand** (details in the
 - **As a day-to-day Lightroom replacement we're nearer 60–70%.** It's great for JPEG/DNG and most Nikon / Sony /
   older-Canon raws on one machine.
 - **The biggest gaps:**
-  - **camera colour calibration:** Sony, Nikon, Panasonic, Fujifilm and Canon CR3 raws have guarded estimates from their camera JPEGs, with built-in ILCE-7M4, X-H2S and X-T4 profiles; measured calibration is missing, and other raws or rejected fits retain a neutral matrix;
+  - **camera colour calibration:** Sony, Nikon, Panasonic, Fujifilm and Canon CR3 raws have guarded estimates from their camera JPEGs, with built-in ILCE-7CR, ILCE-7M4, X-H2S and X-T4 profiles; measured calibration is missing, and other raws or rejected fits retain a neutral matrix;
   - **compressed Olympus raws and unsupported CR3 variants:** these use embedded JPEG previews when present. Fujifilm lossless/lossy compressed RAF now decodes sensor data; [verification and existing-library reload instructions](docs/raf-compression.md);
   - **AI masks and denoise:** subject and sky selection are classical heuristics;
-  - **HDR, video and the Classic Print / Book / Map modules.**
+  - **on-screen HDR display, video and the Classic Print / Book / Map modules.**
 - **What's next:** see [where we're going](ROADMAP.md#where-were-going).
 
 | Area | Status |
@@ -305,10 +320,11 @@ LightCraft is young and moving fast. **Where we honestly stand** (details in the
 | Profiles (Color, Neutral, Vivid, Landscape, Portrait, Monochrome: our own looks), presets, versions, history, copy/paste/sync settings | ✅ |
 | Camera colour: DNG files use their own matrices | ✅ DNG · 🟡 own Sony/Fujifilm profiles; measured calibration database missing |
 | Native macOS menu bar (generated from the command registry), control channel + every widget addressable, headless UI snapshots | ✅ |
-| RAW: DNG, CR2, CR3 (lossless CRX Bayer and version 0x100/0x200 C-RAW), ARW, NEF (uncompressed + lossless/lossy compressed), Fujifilm RAF (uncompressed + lossless/lossy compressed, Bayer + X-Trans), Panasonic RW2 / Leica RWL / Panasonic RAW (every raw format, DMC-LX1 to DC-S1RM2), Pentax PEF, Olympus ORF (uncompressed); embedded previews for every format incl. CR3 | 🟡 · CR3, compressed ORF decode ⬜ |
+| RAW: DNG, CR2, CR3 (lossless CRX Bayer and version 0x100/0x200 C-RAW), ARW, NEF (uncompressed + lossless/lossy compressed), Fujifilm RAF (uncompressed + lossless/lossy compressed, Bayer + X-Trans), Panasonic RW2 / Leica RWL / Panasonic RAW (every raw format, DMC-LX1 to DC-S1RM2), Pentax PEF, Olympus ORF (uncompressed), Samsung SRW (uncompressed); embedded previews for every format incl. CR3 | 🟡 · CR3, compressed ORF and compressed SRW decode ⬜ |
 | Detail: sharpening, luminance + colour noise reduction | ✅ · AI Denoise, Super Resolution ⬜ |
 | Remove / Heal / Clone spots (auto source), Visualize Spots, Red Eye and Pet Eye (auto pupil detection, catchlight) | ✅ · content-aware fill, spot pin editing 🚧 |
-| Export: JPEG / PNG / TIFF / WebP / AVIF / DNG / original, sizing, file-size limit, output sharpening, naming templates, batch, metadata policy, text or image watermark | ✅ · HDR export ⬜ |
+| Export: JPEG / PNG / TIFF / WebP / AVIF / DNG / original, sizing, file-size limit, output sharpening, naming templates, batch, metadata policy, text or image watermark | ✅ |
+| HDR: HDR editing with a headroom limit, SDR rendition, Visualize HDR; export as ISO 21496-1 gain map JPEG, PQ AVIF or 32-bit float TIFF | ✅ · HDR display ⬜ |
 | Library persistence (crash-safe op log + snapshots, background compaction, failed saves reported), disk thumbnail cache | ✅ |
 | Import: Add in place / Copy / Move, rename and folder templates, devices, duplicate detection, watched folders; Local folder browsing | ✅ |
 | MCP server (headless or live app, persistent libraries), CLI, control channel | ✅ |
@@ -316,7 +332,7 @@ LightCraft is young and moving fast. **Where we honestly stand** (details in the
 | Optics (distortion, vignetting, auto + manual CA, defringe, lens corrections embedded in DNG files and Panasonic / Leica RW2 / RWL distortion data), Geometry (transforms, Constrain Crop), Upright (Auto/Level/Vertical/Full/Guided) | ✅ · camera lens profiles (our own) ⬜ |
 | Photo Merge: HDR (auto-align, deghost), Panorama (spherical/cylindrical/perspective, boundary warp, auto crop), HDR Panorama → DNG | ✅ |
 | GPU pipeline (wgpu compute, CPU-exact within 1/255), CPU fallback on device limits / errors | ✅ · WebGPU in the browser 🚧 |
-| AI: segmentation masks, AI denoise, super resolution, faces; HDR editing; video | ⬜ (see [roadmap](ROADMAP.md#where-were-going)) |
+| AI: segmentation masks, AI denoise, super resolution, faces; video | ⬜ (see [roadmap](ROADMAP.md#where-were-going)) |
 | Web build (same UI in the browser via WASM): persistent library in OPFS/IndexedDB, Web Worker rendering, export downloads | ✅ · WebGPU, Safari/Firefox testing 🚧 |
 
 <sub>✅ works today · 🚧 in progress · ⬜ not started</sub>
@@ -354,7 +370,7 @@ CRAFT_FONTS_DIR=../craft-fonts cargo run --release -p lightcraft
 Without it LightCraft builds and runs the same, but Chinese and Japanese text have no glyphs. Fonts are never committed to this
 repo; see [craftrules `standards/fonts.md`](https://github.com/storytold/craftrules/blob/main/standards/fonts.md).
 
-**Interface language:** **Edit → Language** (English, 简体中文, 繁體中文（台灣）, 日本語, Português (Brasil), Deutsch) or **Settings → General →
+**Interface language:** **Edit → Language** (English, 简体中文, 繁體中文（台灣）, 日本語, Português (Brasil), Español, Deutsch, Русский, Français) or **Settings → General →
 Language**; the choice applies immediately and persists. See [docs/localization.md](docs/localization.md).
 
 **Logs:** the desktop app writes its log to standard error and to `logs/lightcraft.log` in its settings folder
@@ -444,7 +460,9 @@ Questions, ideas or a bug you'd like to talk through first? Bring them to [Disco
 | arm64 (Snapdragon and other ARM PCs) | `lightcraft-<ver>-windows-arm64.msi` | `lightcraft-<ver>-windows-arm64-portable.zip` |
 | x86 (32-bit) | `lightcraft-<ver>-windows-x86.msi` | `lightcraft-<ver>-windows-x86-portable.zip` |
 
-Installers and executables are code-signed.
+Installers and executables are code-signed. The installer asks where to install (`C:\Program Files\LightCraft` by
+default; upgrades stay in the folder you chose) and ends on a page confirming LightCraft was installed, with an
+option to start it. For unattended installs: `msiexec /i lightcraft-<ver>-windows-x64.msi /qn INSTALLFOLDER="D:\Apps\LightCraft\"`.
 
 ### macOS
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 4a6b101a..dad5a432 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -23,13 +23,13 @@ duplicate Local entries #22, black GPU exports on an Intel iGPU #78).
 | Dimension | Estimate | What's true today | Biggest gaps |
 |---|---:|---|---|
 | **Feature checklist** | 79.7% | P0 core and P1 nearly complete: import (Add / Copy / Move, templates, devices), library, grid/loupe/compare/survey, every Edit slider, curves, colour grading, masking tools, crop/Upright, heal/clone, presets/profiles, versions/history, sync, export, menus, shortcuts | P0: full-resolution zoom detail; P1: lens-profile database, content-aware fill (patch synthesis), video playback/trim |
-| **RAW coverage** (formats people shoot) | ~55% | DNG (all kinds), CR2, CR3 lossless Bayer and version 0x100/0x200 C-RAW (M50/R100/R8 pixel-exact corpus), ARW, NEF (uncompressed + Huffman lossless/lossy), RAF (uncompressed, lossless/lossy compressed Bayer and X-Trans), uncompressed ORF, RW2 / RWL / Panasonic RAW (every raw format, checked on 178 files from 118 Panasonic and Leica bodies), PEF; every container's embedded preview (incl. CR3) | **CR3** (every Canon since ~2018), compressed ORF, Nikon lossy-after-split, Canon sRAW, HEIC/AVIF. NEFs labelled compressed but stored uncompressed (Z 6 packed 14-bit, D850 12-bit uncompressed). Per-model verification is thin (~55 corpus files vs >1,000 models) |
-| **Colour & image quality** | ~55–65% | Pipeline is complete and fast; GPU path CPU-exact within 1/255 | **No measured camera calibration database**: ARW, NEF, RW2, RAF, CR3, CR2 and PEF have guarded camera-JPEG colour estimates, with bundled ILCE-7M4, X-H2S and X-T4 profiles (docs/camera-preview-colour.md); other non-DNG raws and rejected estimates use a neutral matrix. Colour fidelity remains incomplete. No lens-profile database. No measured fidelity against Lightroom (tone, highlights, texture/clarity, NR, sharpening are tuned by eye) |
+| **RAW coverage** (formats people shoot) | ~55% | DNG (all kinds), CR2, CR3 lossless Bayer and version 0x100/0x200 C-RAW (M50/R100/R8 pixel-exact corpus), ARW, NEF (uncompressed + Huffman lossless/lossy), RAF (uncompressed, lossless/lossy compressed Bayer and X-Trans), uncompressed ORF, uncompressed Samsung SRW (NX5 to NX1100, EX1, WB2000), RW2 / RWL / Panasonic RAW (every raw format, checked on 178 files from 118 Panasonic and Leica bodies), PEF; every container's embedded preview (incl. CR3) | **CR3** (every Canon since ~2018), compressed ORF, compressed Samsung SRW (NX1, NX30, NX300, NX500, NX2000, NX3000, NX3300, NX mini), Nikon lossy-after-split, Canon sRAW, HEIC/AVIF. NEFs labelled compressed but stored uncompressed (Z 6 packed 14-bit, D850 12-bit uncompressed). Nikon High Efficiency NEF (HE / HE★: Z 8, Z 9, Z 6III, Z f; JPEG XS-based, preview only, #193). Per-model verification is thin (~55 corpus files vs >1,000 models) |
+| **Colour & image quality** | ~55–65% | Pipeline is complete and fast; GPU path CPU-exact within 1/255 | **No measured camera calibration database**: ARW, NEF, RW2, RAF, CR3, CR2 and PEF have guarded camera-JPEG colour estimates, with bundled ILCE-7CR, ILCE-7M4, X-H2S and X-T4 profiles (docs/camera-preview-colour.md); other non-DNG raws and rejected estimates use a neutral matrix. Colour fidelity remains incomplete. No lens-profile database. No measured fidelity against Lightroom (tone, highlights, texture/clarity, NR, sharpening are tuned by eye) |
 | **AI & computational** | ~15–20% | Assisted culling (focus, bursts), auto tone, HDR/panorama merge; subject/sky/background masks as classical heuristics, or the photo's own segmentation mattes when it ships them (DNG semantic masks, e.g. iPhone ProRAW's sky matte); non-destructive Bayer RAW denoise with opt-in weights on pure-Rust CPU/GPU; **faces (MVP, [docs/faces.md](docs/faces.md))**: a pure-Rust detector (a 232 KB opt-in download), opt-in recognition models (one-click download or add a file; they run on the shared pure-Rust CPU interpreter; pinned SFace/AuraFace embeddings agree with an independent reference runtime on 40 public crops; one-thread medians 34–36 / 233–252 ms (AuraFace remains expensive)), a background scan that finds and embeds faces, name suggestions, a person's page with look-alike faces to confirm, an Unnamed faces section (look-alikes together, select a group and name it at once) | Real segmentation masks (subject, sky, people, objects, landscape, depth), denoise model policy / linear RGB / quality verification, super resolution, lens blur, generative remove, natural-language search; for faces: clusters with separators between groups, small faces in large photos (the detector looks at 640 px), thresholds calibrated on live faces, writing face regions back to XMP. **Blocked on a model strategy** (licensable weights or our own training; pure-Rust inference is feasible) |
 | **Workflow & library** | ~85% (single machine) | Robust catalog (journal + snapshots, background compaction, crash-tested), 85k-photo libraries stay responsive, Local browsing with automatic cleanup, XMP interop, keywords, smart albums, Move import | Opening an 85k library takes 1.7–4.7 s; no cloud sync (out of scope), no tablet companion (#74, roadmap), shared albums, publish services, tethering |
-| **Classic modules** | ~30% | Geotagging from GPX track logs, soft proofing (partial), slideshow (basic) | **Map view, Book, Print, Slideshow module, Web, publish services**: ~40 tracker rows ⬜ |
-| **HDR & video** | 0% | | HDR edit/display/export; video play/trim/edit/export |
-| **Platform & robustness** | ~70% | macOS native; Windows/Linux builds; web via WASM; no-panic lints workspace-wide, `unsafe` confined to `crates/sysmem`; failed saves are reported; GPU errors fall back to CPU | Windows installer UI unverified on Windows (PR #79); GPU path proven only on Apple + user reports; English, Simplified/Traditional Chinese, Japanese, Brazilian Portuguese and German UI (see docs/localization.md); remaining technical errors; Traditional Chinese uses the Simplified Chinese font until craft-fonts has a TC face; accessibility partial; headless UI tests time out under machine load |
+| **Classic modules** | ~30% | Geotagging from GPX track logs, soft proofing (partial), slideshow (basic), paginated contact-sheet PDF export (A4/Letter, layout/captions, current edits, 150 dpi sRGB) | **Map view, Book, full Print module, Slideshow module, Web, publish services**: contact sheets work, custom print packages and printer colour management remain missing |
+| **HDR & video** | ~25% | HDR editing (headroom limit, SDR rendition, Visualize HDR); gain map JPEG, PQ AVIF and float TIFF export | On-screen HDR display, HLG, HDR settings from crs XMP; video play/trim/edit/export |
+| **Platform & robustness** | ~70% | macOS native; Windows/Linux builds; web via WASM; no-panic lints workspace-wide, `unsafe` confined to `crates/sysmem`; failed saves are reported; GPU errors fall back to CPU | Windows installer UI unverified on Windows (PR #79); GPU path proven only on Apple + user reports; English, Simplified/Traditional Chinese, Japanese, Brazilian Portuguese, Spanish, German, Russian and Ukrainian UI (see docs/localization.md); remaining technical errors; Traditional Chinese uses the Simplified Chinese font until craft-fonts has a TC face; accessibility partial; headless UI tests time out under machine load |
 
 ### By kind of user
 
@@ -47,9 +47,9 @@ duplicate Local entries #22, black GPU exports on an Intel iGPU #78).
 Priorities, in order. Each points at tracker rows in [`docs/parity.md`](docs/parity.md) → *Top gaps*.
 
 1. **Camera colour calibration of our own** (LR-PROF-CAMERACOLOR, P0): fit each camera to its own embedded JPEG, use
-   matrices the files carry themselves, then chart shots. Sony ARW, Nikon NEF, Panasonic RW2, Fujifilm RAF, Canon CR3/CR2
-   and Pentax PEF have the file-local fit (matrix + tone curve from their own JPEG; CR2 and PEF since issue #310, not yet
-   checked on the corpus); then ORF, then validate fidelity.
+   matrices the files carry themselves, then chart shots. Sony ARW, Nikon NEF, Panasonic RW2, Fujifilm RAF, Canon CR3/CR2,
+   Pentax PEF, Samsung SRW and Olympus ORF have the file-local fit (matrix + tone curve from their own JPEG; CR2 and PEF
+   since issue #310, not yet checked on the corpus); then validate fidelity.
 2. **Raw formats, clean-room** (LR-IMP-FORMATS, P0): Remaining **unverified CR3 CRX** variants, compressed ORF, NEF
    lossy-after-split, sRAW. Decided 2026-10-05: write our own decoders from prose descriptions (never decoder source,
    no LGPL dependency); compressed NEF (#86) is the template.
@@ -62,13 +62,18 @@ Priorities, in order. Each points at tracker rows in [`docs/parity.md`](docs/par
    segmentation masks and denoise. Bayer denoise inference is implemented in pure Rust with an opt-in GPL model; release policy and independently licensed weights remain open. Unblocks M12 and Enhance. Face detection and recognition run on our own checked Rust engine. Object / Describe masks now
    run Meta's SAM 3 in pure Rust (optional, user-consented download under the non-OSI SAM License; CDN mirrors still
    to be set up, docs/ai-masks.md); Subject / Sky / People, Raw Details and Super Resolution are still open.
-7. **Then:** HDR (Q), the Classic output modules (Print first, then Map view, Book, Slideshow), video (R), localisation
+7. **Then:** HDR (Q), the Classic output modules (expand contact-sheet PDF export into full Print, then Map view, Book, Slideshow), video (R), localisation
    and accessibility.
 
 Already closed in the week of 2026-10-03: compressed NEF (#10), Move import (#29), per-library smart-preview folder,
 Local roots / cleanup, grid and catalog performance at 85k photos (#35, #37), failed-save reporting, GPU export
 hardening (#78), copyright metadata (#51), GPX geotagging (#60), import tag help and folder templates (#31, #32).
 
+Library folders now have records of their own in the catalog (`Catalog.folder_records`, keyed by folder path; colour
+labels first). Photos still store full paths, so moving a whole disk or folder relinks each photo. If that becomes a
+problem (an "Update Folder Location" for a renamed or replaced drive, journal growth on large moves), the next step is
+the Classic model: photos point to a folder id (root + relative path), and the records keyed by path become those rows.
+
 Image navigation now supports native pinch zoom and two-finger pan in Detail, Compare and Reference views.
 The whole-image preview still has a configurable size cap (2,560 px default), so 100% on larger photos does not
 yet guarantee original-pixel detail; visible-region rendering remains a gap (LR-VIEW-ZOOM).
@@ -89,13 +94,13 @@ yet guarantee original-pixel detail; visible-region rendering remains a gap (LR-
 | M7 | Detail | sharpening + masking preview, luminance/colour NR, Denoise, Raw Details, Super Resolution | 6–10 | 🚧 (sharpening, luminance/colour NR ✅; AI Denoise 🟡 (Bayer, optional weights; policy/fidelity open); Raw Details, Super Resolution ⬜) |
 | M8 | Heal / Remove | content-aware remove (PatchMatch), heal, clone, brush spots, visualize spots, red/pet eye | 6–10 | 🚧 (heal, clone, auto source, visualize spots, red/pet eye ✅; PatchMatch remove ⬜) |
 | M9 | Presets, profiles, versions, sync | preset browser + amount, create/import presets, profile browser, versions, history, copy/paste/sync settings | 5–8 | ✅ |
-| M10 | Export & share | export dialog (JPEG/PNG/TIFF/DNG/AVIF/JXL/original), sizing, sharpening, metadata, watermark, naming, batch jobs, XMP sidecars, HDR export | 6–10 | 🚧 (all formats incl. DNG/original, sizing, presets, background jobs ✅; JXL encode, HDR export ⬜) |
+| M10 | Export & share | export dialog (JPEG/PNG/TIFF/DNG/AVIF/JXL/original), sizing, sharpening, metadata, watermark, naming, batch jobs, XMP sidecars, HDR export | 6–10 | 🚧 (all formats incl. DNG/original, sizing, presets, background jobs, HDR gain map JPEG / PQ AVIF ✅; JXL encode ⬜) |
 | M11 | RAW II | CR3, RAF (X-Trans), ORF, RW2, PEF, SRW, 3FR, IIQ + long tail; camera calibration DB; HEIC/AVIF/JXL import | 20–35 | 🚧 (CR3 lossless CRX and C-RAW, RAF uncompressed and lossless/lossy compressed, RW2 (every raw format), PEF, ORF uncompressed ✅; **camera colour calibration** 🚧 (guarded ARW, NEF, RW2 and RAF preview fitting; measured database still missing), CR3, compressed ORF ⬜) |
 | M12 | AI & smart features | subject/sky/background/people/object masks, semantic search, faces/People (permissively licensed models, pure-Rust inference) | 20–40 | ⬜ |
 | M13 | Merge | HDR merge (deghost), panorama (projections, boundary warp, fill edges), HDR panorama | 10–15 | ✅ |
 | M14 | Video | import/playback/trim via FilmCraft crates, global edits + presets on video, video export | 6–10 | ⬜ |
 | M15 | Classic modules | Map, Book, Slideshow, Print, Web; smart collections, stacks, virtual copies, publish services, tethering | 25–40 | 🚧 (smart albums, stacks, virtual copies, compare/survey ✅; Map/Book/Slideshow/Print/Web ⬜) |
-| M16 | 1.0 polish | preferences, shortcut editor, accessibility, localization, packaging (dmg/msi/AppImage/web), hardening | 10–20 | 🚧 (settings, keyboard shortcuts sheet, packaging basics ✅; English/Chinese (Simplified, Traditional)/Japanese/Brazilian Portuguese/German localisation 🟡; accessibility and further locales ⬜) |
+| M16 | 1.0 polish | preferences, shortcut editor, accessibility, localization, packaging (dmg/msi/AppImage/web), hardening | 10–20 | 🚧 (settings, keyboard shortcuts sheet, packaging basics ✅; English/Chinese (Simplified, Traditional)/Japanese/Brazilian Portuguese/Spanish/German/Russian/Ukrainian localisation 🟡; accessibility and further locales ⬜) |
 
 ## Parity estimate (feature count updated 2026-10-08; effort estimate from 2026-10-02)
 
@@ -164,7 +169,8 @@ The milestone estimates in the table above were made before work started and are
   published alongside GPL code); decoder source is never read. Still open: freedom-to-operate review for local
   Laplacian filters, PatchMatch and HEVC (HEIC).
 - **Look parity** with Adobe's default rendering is tuned by eye today; the planned fidelity suite (LR-BEHAV-RENDER-FIDELITY)
-  turns it into measured comparisons against local-only Lightroom references.
+  turns it into measured comparisons against local-only Lightroom references. Retuning changes existing edits, so it
+  ships as a new process version (`docs/process-versions.md`): photos keep their look until they are updated.
 
 ## Raw format coverage and known gaps
 
@@ -175,20 +181,16 @@ CR3 lossless Bayer and version 0x100/0x200 C-RAW sensor decoding is verified pix
 
 Decoded (CC0 corpus from raw.pixls.us, `cargo xtask corpus --download`, `crates/raw/tests/corpus.rs`): DNG (uncompressed,
 LJ92, lossy JPEG / Smart Previews, Deflate, float, linear, DNG 1.7 JPEG XL tiles: lossless ones bit-exact on synthetic files,
-lossy ones decode but no real file has verified them), CR2, ARW (uncompressed, ARW2, LJ92; as-shot white balance and black level of pre-2017 bodies from the enciphered
-maker-note `Tag2010` and the encrypted `SR2SubIFD`, both recovered by black-box analysis, `crates/raw/src/vendor/arw.rs`), NEF/NRW uncompressed and Huffman-compressed (lossless, lossy type 1/2, 12/14-bit), RAF uncompressed and lossless/lossy compressed (Bayer and
+lossy ones unclipped in the declared linear primaries, checked on one real file), CR2, ARW (uncompressed, ARW2, LJ92; as-shot white balance and black level of pre-2017 bodies from the encrypted
+`SR2SubIFD`, decrypted with a keystream recovered by black-box analysis, `crates/raw/src/vendor/sr2.rs`, `crates/raw/src/vendor/arw.rs`), NEF/NRW uncompressed and Huffman-compressed (lossless, lossy type 1/2, 12/14-bit), RAF uncompressed and lossless/lossy compressed (Bayer and
 X-Trans, 14/16-bit real-file verification), RW2 / Leica RWL / Panasonic RAW in every raw format (compressed formats 4 and 6, the prefix-coded strips of format 8,
 packed formats 2, 5 and 7, the 16-bit words of the 2005–2007 bodies; all recovered by black-box analysis of 178 CC0 files from
 118 bodies, `crates/raw/src/vendor/rw2.rs`), PEF (uncompressed and Huffman), ORF uncompressed (16-bit and 12-bit packed). Supported containers yield their embedded JPEG preview when present (including CR3). The engine uses it for RAW variants it cannot decode yet; HEVC-only CR3 previews are not decoded.
 
 Not decoded yet — preview only (no permissively licensed description; black-box analysis incomplete):
-- **Nikon "lossy after split" NEF** (non-zero split row in maker note `0x0096`, e.g. some D3400/D5000/D5200/D5500/D5600
-  files): rows above the split decode with the regular lossy table; from the split row on a different code is used
-  that our black-box analysis has not recovered yet (none of the four regular tables fits, also not with byte
-  alignment or reset predictors at the split row). The other Nikon Huffman variants are decoded (`crates/raw/src/vendor/nefc.rs` documents the analysis).
 - **Olympus compressed ORF**, **Canon CR3 unverified CRX variants** (M11.1), **Canon sRAW/mRAW**.
 
-**Camera colour matrices:** ARW, NEF, RW2, RAF, CR3, CR2 and PEF files can use guarded, separate chromaticity and tone estimates from their own embedded JPEG (see `docs/camera-preview-colour.md`); this is a per-file camera-look estimate with relative WB, not measured calibration or absolute-Kelvin WB. Other non-DNG raws and rejected fits use the documented neutral fallback (camera RGB ≈ linear sRGB, flagged
+**Camera colour matrices:** ARW, NEF, RW2, RAF, CR3, CR2, PEF, Samsung SRW and Olympus ORF files can use guarded, separate chromaticity and tone estimates from their own embedded JPEG (see `docs/camera-preview-colour.md`); this is a per-file camera-look estimate with relative WB, not measured calibration or absolute-Kelvin WB. Other non-DNG raws and rejected fits use the documented neutral fallback (camera RGB ≈ linear sRGB, flagged
 `matrix_is_fallback`) with the file's as-shot white-balance multipliers. Clean sources to evaluate next: manufacturer
 matrices stored in the files themselves (Olympus ImageProcessing `ColorMatrix`, Pentax equivalents; Panasonic RW2 files carry none) and our
 own chart-based calibration (M11.4). Adobe matrices are never used.
@@ -220,13 +222,16 @@ database is read-only; LightCraft owns subsequent edits. See `docs/lightroom-cat
   16-bit words), black levels, in-camera aspect crops and mapped-out defects established on 178 CC0 files from 118
   bodies; RW2 gets the file-local camera look (accepted on 140 of 174 files with a preview).
 - 2026-10-08: independent Rust CR3 lossless and version 0x100/0x200 C-RAW decoding, six exact full-sensor regressions on M50/R100/R8; any CR3 decode error falls back to the embedded JPEG; guarded CR3 camera-JPEG colour fitting with independent framing validation (`docs/cr3.md`). Unverified CRX variants and broader model verification remain.
+- 2026-10-09: Sony ILCE-7CR camera colour: bundled profile from 125 photos. On 26 withheld photos mean ΔE vs the camera JPEG 4.07 → 3.29; all 131 photos accepted, where 8 fell back to the neutral matrix without it. Measured calibration remains open.
 
 ## Chinese and Japanese interfaces, and text watermarks
 
 English, Simplified Chinese, Traditional Chinese (Taiwan) and Japanese interface languages are persisted in UI state, and the
 language table (`crates/ui-egui/src/i18n.rs`) drives the menus, settings and fonts, so another
 language is a table entry plus two catalogs (docs/localization.md). Core menus and panels are
-translated; untranslated text retains English. CJK glyphs (Chinese: Noto Sans CJK SC; Japanese UI:
+translated; untranslated text retains English. Ukrainian covers all existing catalog keys, command/control/rule labels
+and format messages, with count-neutral labels and numeric dates; technical errors from lower layers remain English.
+CJK glyphs (Chinese: Noto Sans CJK SC; Japanese UI:
 BIZ UDPGothic; watermarks: BIZ UDMincho) come from storytold/craft-fonts, embedded by builds made
 with the optional `CRAFT_FONTS_DIR` input (all releases), so no system fonts are needed. Text watermarks now accept
 `vertical: true` in export JSON/presets and expose an orientation selector. Japanese
diff --git a/apps/lightcraft-cli/src/main.rs b/apps/lightcraft-cli/src/main.rs
index f8ddf550..592a534a 100644
--- a/apps/lightcraft-cli/src/main.rs
+++ b/apps/lightcraft-cli/src/main.rs
@@ -342,7 +342,7 @@ fn mcp(args: &[String]) -> Result<(), String> {
     eprintln!("lightcraft-cli mcp: serving MCP on stdio ({})", backend.describe());
     let mut server = Server::new(backend).with_command_tools(!compact);
     let stdin = std::io::stdin();
-    server.serve(BufReader::new(stdin.lock()), std::io::stdout().lock()).map_err(|e| e.to_string())
+    server.serve(BufReader::new(stdin), std::io::stdout()).map_err(|e| e.to_string())
 }
 
 fn merge(args: &[String]) -> Result<(), String> {
@@ -391,7 +391,7 @@ fn merge(args: &[String]) -> Result<(), String> {
         }
         i += 1;
     }
-    let mut s = Session::new().with_fs().with_default_denoise_models();
+    let mut s = Session::new().with_fs().with_default_denoise_models().with_system_clock();
     let paths = expand_paths(&files);
     let r = s.execute("library.import", &json!({"paths": paths})).map_err(|e| e.to_string())?;
     let mut ids: Vec<u64> = r["imported"].as_array().map(|a| a.iter().filter_map(Value::as_u64).collect()).unwrap_or_default();
@@ -652,7 +652,7 @@ fn render(args: &[String]) -> Result<(), String> {
     }
     let input = input.ok_or("render: missing input file")?;
     let output = output.ok_or("render: missing -o OUTPUT")?;
-    let mut s = Session::new().with_fs().with_default_denoise_models();
+    let mut s = Session::new().with_fs().with_default_denoise_models().with_system_clock();
     let abs = expand_paths(std::slice::from_ref(&input));
     let r = s.execute("library.import", &json!({"paths": abs})).map_err(|e| e.to_string())?;
     let id = r["imported"][0].as_u64().ok_or_else(|| format!("{input}: not a readable photo"))?;
@@ -732,12 +732,12 @@ fn snapshot(args: &[String]) -> Result<(), String> {
     let t0 = Instant::now();
     let mut session = match &library {
         Some(dir) => {
-            let mut s = Session::new().with_fs().with_default_denoise_models().with_default_face_models();
+            let mut s = Session::new().with_fs().with_default_denoise_models().with_system_clock().with_default_face_models();
             s.open_library(dir, false).map_err(|e| library_error(dir, e))?;
             s
         }
-        None if files.is_empty() => Session::with_demo().with_fs().with_default_denoise_models().with_default_face_models(),
-        None => Session::new().with_fs().with_default_denoise_models().with_default_face_models(),
+        None if files.is_empty() => Session::with_demo().with_fs().with_default_denoise_models().with_system_clock().with_default_face_models(),
+        None => Session::new().with_fs().with_default_denoise_models().with_system_clock().with_default_face_models(),
     };
     // Apply compute policy before imports or the first scripted query can discover an adapter.
     session.execute("app.gpu", &json!({"enabled": false})).map_err(|e| e.to_string())?;
diff --git a/apps/lightcraft-cli/tests/cli.rs b/apps/lightcraft-cli/tests/cli.rs
index 2009e818..ecda1102 100644
--- a/apps/lightcraft-cli/tests/cli.rs
+++ b/apps/lightcraft-cli/tests/cli.rs
@@ -7,6 +7,46 @@ use serde_json::{Value, json};
 
 const BIN: &str = env!("CARGO_BIN_EXE_lightcraft-cli");
 
+#[test]
+fn contact_sheet_exports_pdf_and_protects_originals() {
+    let input = tmp("contact-sheet-input.png");
+    gradient_png(&input);
+    let out = tmp("contact-sheet.pdf");
+    let (ok, lines, err) = run_cli(
+        &[
+            "--import",
+            input.to_str().unwrap(),
+            "export.contactSheet",
+            &format!("path={}", out.display()),
+            "paper=letter",
+            "landscape=true",
+            "columns=2",
+            "rows=3",
+        ],
+        None,
+    );
+    assert!(ok, "{err}: {lines:?}");
+    assert_eq!(lines[0]["result"]["pages"], 1);
+    assert_eq!(lines[0]["result"]["photos"], 1);
+    let bytes = std::fs::read(&out).unwrap();
+    assert!(bytes.starts_with(b"%PDF-1.4"));
+    assert!(String::from_utf8_lossy(&bytes).contains("/MediaBox [0 0 792.00 612.00]"));
+    let before = std::fs::read(&input).unwrap();
+    for target in [input.clone(), input.with_extension("xmp")] {
+        if target != input {
+            std::fs::write(&target, b"existing sidecar").unwrap();
+        }
+        let (ok, _, _) = run_cli(&["--import", input.to_str().unwrap(), "export.contactSheet", &format!("path={}", target.display())], None);
+        assert!(!ok, "overwrote protected file");
+    }
+    assert_eq!(std::fs::read(&input).unwrap(), before);
+    assert_eq!(std::fs::read(input.with_extension("xmp")).unwrap(), b"existing sidecar");
+    let prior = std::fs::read(&out).unwrap();
+    let (ok, _, _) = run_cli(&["--import", input.to_str().unwrap(), "export.contactSheet", &format!("path={}", out.display()), "columns=0"], None);
+    assert!(!ok);
+    assert_eq!(std::fs::read(&out).unwrap(), prior, "failed export changed prior output");
+}
+
 fn tmp(name: &str) -> std::path::PathBuf {
     let d = std::env::temp_dir().join(format!("lightcraft-cli-test-{}", std::process::id()));
     std::fs::create_dir_all(&d).unwrap();
@@ -236,11 +276,8 @@ fn snapshot_script_failure_exits_non_zero() {
 #[test]
 fn snapshot_ui_zoom_keeps_requested_pixel_dimensions() {
     let script = tmp("snap-ui-zoom.jsonl");
-    std::fs::write(
-        &script,
-        format!("{}\n{}\n", json!({"method": "ui.key", "params": {"key": "Plus", "cmd": true}}), json!({"method": "ui.inspect"})),
-    )
-    .unwrap();
+    std::fs::write(&script, format!("{}\n{}\n", json!({"method": "ui.zoomFactor", "params": {"factor": 1.1}}), json!({"method": "ui.inspect"})))
+        .unwrap();
     for (size, scale, expected) in [("400x240", "1", (400, 240)), ("345x200", "0.9", (311, 180))] {
         let out = tmp(&format!("snap-ui-zoom-{scale}.png"));
         let o = Command::new(BIN)
diff --git a/apps/lightcraft-web/index.html b/apps/lightcraft-web/index.html
index bc0ad203..b088ad18 100644
--- a/apps/lightcraft-web/index.html
+++ b/apps/lightcraft-web/index.html
@@ -24,13 +24,21 @@
   <script type="module">
     import init, { start, command } from "./lightcraft_web.js";
     (async () => {
+      // The Chinese font is a separate file: embedding it would exceed the host's WASM size limit.
+      // Font-free development builds can still run, with the same missing-glyph warning as before.
+      const chineseFont = fetch("./lightcraft_zh_hans.otf")
+        .then(async response => response.ok ? new Uint8Array(await response.arrayBuffer()) : new Uint8Array())
+        .catch(() => new Uint8Array());
       // Compile once; the render workers (worker.js) instantiate the same compiled module.
-      const module = await WebAssembly.compileStreaming(fetch("./lightcraft_web_bg.wasm"));
+      const [module, font] = await Promise.all([
+        WebAssembly.compileStreaming(fetch("./lightcraft_web_bg.wasm")),
+        chineseFont,
+      ]);
       globalThis.lightcraftModule = module;
       await init({ module_or_path: module });
       // automation: `await lightcraft.command("library.info", "{}")` → JSON text
       globalThis.lightcraft = { command };
-      start();
+      start(font);
     })().catch((e) => {
       console.error(e);
       const el = document.getElementById("lightcraft_loading");
diff --git a/apps/lightcraft-web/src/backup.rs b/apps/lightcraft-web/src/backup.rs
index 5161e69f..00ec12a4 100644
--- a/apps/lightcraft-web/src/backup.rs
+++ b/apps/lightcraft-web/src/backup.rs
@@ -11,8 +11,9 @@
 //!
 //! Restoring never deletes anything: the library files go to a new library folder in browser
 //! storage, originals that aren't stored yet are added (they're named by content, so existing
-//! ones are identical), and only then does a small pointer file ([`ACTIVE_LIBRARY`]) switch to
-//! the restored library. The library that was there before stays in storage.
+//! ones are identical; a restored one must match its content hash, see [`verify_original`]),
+//! and only then does a small pointer file ([`ACTIVE_LIBRARY`]) switch to the restored library.
+//! The library that was there before stays in storage.
 //!
 //! No zip64: a backup holds at most [`MAX_BYTES`] and 65 535 entries.
 
@@ -241,6 +242,16 @@ pub fn verify(entry: &ZipEntry, data: &[u8]) -> Result<(), String> {
     Ok(())
 }
 
+/// Check that an original's bytes are the photo its storage key names: originals are stored
+/// under their content hash, and a restore that kept bytes under another photo's hash would
+/// give that photo's catalog record a different image (the zip checksum can't tell).
+pub fn verify_original(entry: &ZipEntry, hash: &str, data: &[u8]) -> Result<(), String> {
+    if crate::store::content_hash(data) != hash {
+        return Err(format!("{}: the file doesn't match its content hash (damaged or altered backup)", entry.name));
+    }
+    Ok(())
+}
+
 /// A name for the restored library's folder.
 pub fn restored_dir_name(now_ms: f64) -> String {
     format!("library-restored-{}", now_ms.max(0.0) as u64)
@@ -283,6 +294,27 @@ mod tests {
         assert!(find_central(b"not a zip at all, just some text").is_err());
     }
 
+    #[test]
+    fn originals_must_match_their_content_hash() {
+        let red: &[u8] = b"red corner photo";
+        let blue: &[u8] = b"blue corner photo";
+        let hash = crate::store::content_hash(red);
+        let name = original_entry(&hash, "IMG 1.png");
+        let key = restore_key(&name, "d").unwrap();
+        let key_hash = key.strip_prefix("originals/").unwrap();
+        assert_eq!(key_hash, hash);
+        // the entry's own bytes pass; other bytes under the same name (valid zip CRC) don't
+        let zip = build(&[(name.as_str(), blue)]);
+        let tail = &zip[zip.len() - tail_len(zip.len() as u64) as usize..];
+        let (off, size) = find_central(tail).unwrap();
+        let entries = parse_central(&zip[off as usize..(off + size) as usize]).unwrap();
+        let entry = &entries[0];
+        verify(entry, blue).unwrap();
+        let err = verify_original(entry, key_hash, blue).unwrap_err();
+        assert!(err.contains(&name), "{err}");
+        verify_original(entry, key_hash, red).unwrap();
+    }
+
     #[test]
     fn restore_keys_are_safe() {
         assert_eq!(restore_key("library/catalog.snap", "library-restored-1").as_deref(), Some("library-restored-1/catalog.snap"));
diff --git a/apps/lightcraft-web/src/safety.rs b/apps/lightcraft-web/src/safety.rs
index c0dac59c..137b5250 100644
--- a/apps/lightcraft-web/src/safety.rs
+++ b/apps/lightcraft-web/src/safety.rs
@@ -14,7 +14,7 @@ use wasm_bindgen_futures::JsFuture;
 use crate::backend::Backend;
 use crate::backup::{
     ACTIVE_LIBRARY, README, ZipWriter, data_offset, find_central, original_entry, parse_central, restore_key, restored_dir_name, tail_len,
-    valid_hash, verify,
+    valid_hash, verify, verify_original,
 };
 use crate::files::{Files, LIBRARY_FILES};
 use crate::store::storage_key;
@@ -93,25 +93,41 @@ pub fn install_panic_hook() {
 const TAB_LOCK: &str = "lightcraft-library";
 
 /// Hold the library lock for as long as this page lives (Web Locks API). `Some(true)`: ours;
-/// `Some(false)`: another tab of this site has it; `None`: the browser can't tell (no Web Locks).
+/// `Some(false)`: another tab of this site has it; `None`: the browser can't tell (no Web Locks, or
+/// it refused the request).
 pub async fn acquire_tab_lock() -> Option<bool> {
     let nav = Reflect::get(&js_sys::global(), &"navigator".into()).ok()?;
     let locks = Reflect::get(&nav, &"locks".into()).ok().filter(|l| !l.is_undefined() && !l.is_null())?;
     let request: js_sys::Function = Reflect::get(&locks, &"request".into()).ok()?.dyn_into().ok()?;
     let opts = js_sys::Object::new();
     Reflect::set(&opts, &"ifAvailable".into(), &true.into()).ok()?;
-    let granted = js_sys::Promise::new(&mut |resolve, _reject| {
+    let granted = js_sys::Promise::new(&mut |resolve, reject| {
         let cb = Closure::once_into_js(move |lock: JsValue| -> JsValue {
             let ours = !lock.is_null() && !lock.is_undefined();
             let _ = resolve.call1(&JsValue::NULL, &ours.into());
             // keep the lock until the page goes away: a promise that never settles
             if ours { js_sys::Promise::new(&mut |_, _| {}).into() } else { JsValue::NULL }
         });
-        if let Err(e) = request.call3(&locks, &TAB_LOCK.into(), &opts, &cb) {
-            log::warn!("Web Locks request failed: {e:?}");
+        // a refused request never calls `cb`: settle with its error instead of waiting forever
+        match request.call3(&locks, &TAB_LOCK.into(), &opts, &cb) {
+            Ok(pending) => {
+                let catch = Reflect::get(&pending, &"catch".into()).ok().and_then(|c| c.dyn_into::<js_sys::Function>().ok());
+                if let Some(catch) = catch {
+                    let _ = catch.call1(&pending, &reject);
+                }
+            }
+            Err(e) => {
+                let _ = reject.call1(&JsValue::NULL, &e);
+            }
         }
     });
-    JsFuture::from(granted).await.ok().map(|v| v.is_truthy())
+    match JsFuture::from(granted).await {
+        Ok(v) => Some(v.is_truthy()),
+        Err(e) => {
+            log::warn!("Web Locks request failed, starting without the one-tab guard: {e:?}");
+            None
+        }
+    }
 }
 
 /// Offer a blob as a download named `name`.
@@ -208,6 +224,9 @@ pub async fn restore(file: web_sys::File, backend: Backend) -> Result<String, St
         let start = data_offset(e, &local)?;
         let data = read_range(&file, start, start + e.size).await?;
         verify(e, &data)?;
+        if let Some(hash) = key.strip_prefix("originals/") {
+            verify_original(e, hash, &data)?;
+        }
         backend.write(&key, &data).await.map_err(|err| format!("storing {}: {err}", e.name))?;
         written += 1;
     }
diff --git a/apps/lightcraft-web/src/web.rs b/apps/lightcraft-web/src/web.rs
index f78ac861..592d05cd 100644
--- a/apps/lightcraft-web/src/web.rs
+++ b/apps/lightcraft-web/src/web.rs
@@ -169,6 +169,7 @@ fn services(originals: Originals, backend: Option<Backend>, files: Files, frozen
     let restore_backend = backend.clone();
     Services {
         picker: None,
+        pick_display_profile: None,
         backup_library: Some(Box::new(move |session: &mut Session| {
             let Some(b) = backup_backend.clone() else { return Err("nothing is stored in this browser session (?store=memory)".into()) };
             // the photos' own names for the originals in the zip
@@ -213,6 +214,8 @@ fn services(originals: Originals, backend: Option<Backend>, files: Files, frozen
         // Face models need a folder to live in; the web has none.
         pick_model_file: None,
         save_preset_file: None,
+        pick_keyword_list: None,
+        save_keyword_list: None,
         pick_curve_preset_files: None,
         save_curve_preset_file: None,
         write: Some(Box::new(download)),
@@ -378,7 +381,7 @@ struct WebApp {
 }
 
 impl WebApp {
-    fn new(cc: &eframe::CreationContext<'_>, boot: Boot) -> Self {
+    fn new(cc: &eframe::CreationContext<'_>, boot: Boot, chinese_font: Vec<u8>) -> Self {
         let Boot { opts, backend, files, index, lib_dir } = boot;
         let originals = Originals::default();
         let t = perf_now();
@@ -423,7 +426,8 @@ impl WebApp {
         // previews are large (≤ 2560 px, f32): keep few in a 32-bit address space
         session.media.preview_capacity = 3;
         let frozen = Rc::new(Cell::new(false));
-        let mut app = LightcraftApp::new(session, services(originals.clone(), backend.clone(), files.clone(), frozen.clone(), cc.egui_ctx.clone()));
+        let mut app = LightcraftApp::new(session, services(originals.clone(), backend.clone(), files.clone(), frozen.clone(), cc.egui_ctx.clone()))
+            .with_chinese_font(chinese_font);
         let ui_written = files.get("ui.json").unwrap_or_default();
         if let Ok(ui) = serde_json::from_slice::<UiState>(&ui_written) {
             app.ui = ui;
@@ -656,12 +660,15 @@ impl eframe::App for WebApp {
     }
 }
 
-/// Start the app (called by `index.html` after instantiating the module).
+/// Start the app with the separately fetched Simplified Chinese font (empty in font-free builds).
 #[wasm_bindgen]
-pub fn start() {
+pub fn start(chinese_font: Vec<u8>) {
     eframe::WebLogger::init(log::LevelFilter::Info).ok();
     safety::install_panic_hook();
     log::info!("lightcraft: wasm instantiated at {:.0} ms", perf_now());
+    if chinese_font.is_empty() {
+        log::warn!("lightcraft: no Simplified Chinese font supplied; Chinese-only glyphs will show as boxes");
+    }
     let opts = Options::from_url();
     wasm_bindgen_futures::spawn_local(async move {
         // one tab per library: two would each keep their own copy and overwrite each other's saves
@@ -682,7 +689,7 @@ pub fn start() {
         };
         let boot = boot(opts).await;
         let runner = eframe::WebRunner::new();
-        let r = runner.start(canvas, eframe::WebOptions::default(), Box::new(move |cc| Ok(Box::new(WebApp::new(cc, boot))))).await;
+        let r = runner.start(canvas, eframe::WebOptions::default(), Box::new(move |cc| Ok(Box::new(WebApp::new(cc, boot, chinese_font))))).await;
         match r {
             Ok(()) => {
                 if let Some(el) = window().and_then(|w| w.document()).and_then(|d| d.get_element_by_id("lightcraft_loading")) {
diff --git a/apps/lightcraft-web/src/wire.rs b/apps/lightcraft-web/src/wire.rs
index b08ae150..4796740e 100644
--- a/apps/lightcraft-web/src/wire.rs
+++ b/apps/lightcraft-web/src/wire.rs
@@ -113,6 +113,7 @@ impl WireJob {
             depth: lightcraft_engine::pipeline::OutputDepth::U8,
             proof: None,
             window: self.window.map(|[x, y, w, h]| lightcraft_engine::pipeline::PixelWindow { x, y, w, h }),
+            display: None,
         }
     }
 
diff --git a/apps/lightcraft-web/src/workers.rs b/apps/lightcraft-web/src/workers.rs
index 52a32328..f321bdb9 100644
--- a/apps/lightcraft-web/src/workers.rs
+++ b/apps/lightcraft-web/src/workers.rs
@@ -293,6 +293,7 @@ impl Workers {
                     rendered: Err(msg),
                     loaded: None,
                     quick: None,
+                    display: None,
                 };
                 g.done.push((b.slot, r, 0.0));
             }
@@ -379,6 +380,7 @@ impl Workers {
                 rendered,
                 loaded: None,
                 quick: None,
+                display: None,
             },
             ms,
         ));
@@ -431,6 +433,7 @@ impl RenderOffload for Workers {
                 rendered: Ok(Rendered { image, histogram, deep: None }),
                 loaded: None,
                 quick: None,
+                display: None,
             };
             g.done.push((slot, r, 0.0));
             return None;
diff --git a/apps/lightcraft/src/main.rs b/apps/lightcraft/src/main.rs
index a0394da9..00665e87 100644
--- a/apps/lightcraft/src/main.rs
+++ b/apps/lightcraft/src/main.rs
@@ -52,8 +52,15 @@ struct App(LightcraftApp, PrefsWriter, #[cfg(target_os = "macos")] Option<native
 impl eframe::App for App {
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
         #[cfg(target_os = "macos")]
-        if let Some(m) = self.2.as_mut() {
-            m.update(&mut self.0, ctx);
+        if let Some(m) = self.2.as_mut()
+            && m.update(&mut self.0, ctx)
+            && lightcraft_ui_egui::panels::notices::may_close(&mut self.0)
+        {
+            // Quit from the menu bar: save exactly what closing the window saves (settings and
+            // library, after the unsaved-changes check; otherwise its prompt shows), then end the
+            // process instead of closing the viewport while AppKit is terminating (PR #444).
+            eframe::App::on_exit(self);
+            std::process::exit(0);
         }
         self.0.logic(ctx);
         self.1.tick(&mut self.0, ctx);
@@ -71,16 +78,26 @@ impl eframe::App for App {
         if let Err(e) = self.0.session.close_library() {
             log::error!("saving the library failed: {e}");
         }
+        // last, with everything saved: no render may be inside the GPU driver when the process ends
+        if !self.0.shutdown(EXIT_WAIT) {
+            log::warn!("quit: background work was still running after {EXIT_WAIT:?}");
+        }
     }
 }
 
+/// How long quitting waits for renders that are running (issue #620). A GPU render takes well under
+/// a second; anything slower gives way to quitting.
+const EXIT_WAIT: std::time::Duration = std::time::Duration::from_secs(2);
+
 /// The window's renderer (egui-wgpu): eframe's defaults, with LightCraft's backend choice — DX12
 /// alone on Windows unless `LIGHTCRAFT_GPU_BACKEND` / `WGPU_BACKEND` say otherwise (issue #136:
-/// with Vulkan in the set, wgpu loads the Vulkan driver even when it then picks DX12).
+/// with Vulkan in the set, wgpu loads the Vulkan driver even when it then picks DX12) — and DX12
+/// shaders compiled with FXC, never a stray `dxcompiler.dll` (issue #471).
 fn window_wgpu_options() -> eframe::egui_wgpu::WgpuConfiguration {
     let mut c = eframe::egui_wgpu::WgpuConfiguration::default();
     if let eframe::egui_wgpu::WgpuSetup::CreateNew(n) = &mut c.wgpu_setup {
         n.instance_descriptor.backends = lightcraft_engine::gpu::backend::window_backends();
+        n.instance_descriptor.backend_options = lightcraft_engine::gpu::backend::backend_options();
     }
     c
 }
@@ -124,6 +141,23 @@ fn gpu_crash_notice(what: &str) -> String {
     )
 }
 
+/// Where the system keeps monitor profiles, for the Choose Profile dialog to start in: the user's
+/// own profiles first (Linux: colord / DisplayCAL; macOS: ColorSync), then the system's.
+fn display_profile_dir() -> Option<std::path::PathBuf> {
+    let home = std::env::var_os(if cfg!(windows) { "USERPROFILE" } else { "HOME" }).filter(|h| !h.is_empty()).map(std::path::PathBuf::from);
+    let user = |rel: &str| home.as_ref().map(|h| h.join(rel));
+    let candidates: Vec<Option<std::path::PathBuf>> = if cfg!(target_os = "macos") {
+        vec![user("Library/ColorSync/Profiles"), Some("/Library/ColorSync/Profiles".into())]
+    } else if cfg!(windows) {
+        let root = std::env::var_os("SystemRoot").map(std::path::PathBuf::from).unwrap_or_else(|| "C:\\Windows".into());
+        vec![Some(root.join("System32").join("spool").join("drivers").join("color"))]
+    } else {
+        let data = std::env::var_os("XDG_DATA_HOME").filter(|d| !d.is_empty()).map(std::path::PathBuf::from).or_else(|| user(".local/share"));
+        vec![data.map(|d| d.join("icc")), user(".color/icc"), Some("/usr/share/color/icc".into())]
+    };
+    candidates.into_iter().flatten().find(|d| d.is_dir())
+}
+
 fn config_dir() -> Option<std::path::PathBuf> {
     lightcraft_engine::config::config_dir()
 }
@@ -281,6 +315,39 @@ fn windows_open_url_command(url: &str) -> std::process::Command {
     c
 }
 
+/// Explorer's `/select,<path>` switch (issue #272). Explorer parses its own command line and only
+/// selects the file when the path after the comma is quoted (`/select,"C:\My Photos\a.jpg"`),
+/// spelled with backslashes and free of the verbatim prefix (`\\?\`, `\\?\UNC\`) that
+/// `canonicalize` adds; given anything else it opens Documents. Windows file names can't contain
+/// `"`; a path that does anyway (a hostile catalog) has them dropped, so the raw command line
+/// always holds exactly this one argument.
+fn explorer_select_arg(path: &str) -> String {
+    let path = path.replace('/', "\\").replace('"', "");
+    let path = match path.strip_prefix(r"\\?\UNC\") {
+        Some(unc) => format!(r"\\{unc}"),
+        None => path.strip_prefix(r"\\?\").unwrap_or(path.as_str()).to_string(),
+    };
+    format!("/select,\"{path}\"")
+}
+
+/// `explorer /select,"<path>"`. Rust's own argument quoting wraps the whole switch in quotes
+/// (`"/select,C:\My Photos\a.jpg"`) whenever the path has a space, which Explorer doesn't
+/// recognise, so on Windows the switch goes on the command line exactly as built.
+fn explorer_select_command(path: &str) -> std::process::Command {
+    let mut c = std::process::Command::new("explorer");
+    let arg = explorer_select_arg(path);
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+        c.raw_arg(arg);
+    }
+    #[cfg(not(windows))]
+    {
+        c.arg(arg);
+    }
+    c
+}
+
 /// The platform services; `ctx` repaints when a file dialog closes, and `log_file` is
 /// for Help ▸ Open Log Folder.
 fn services(ctx: egui::Context, log_file: Option<&std::path::Path>) -> Services {
@@ -368,8 +435,7 @@ fn services(ctx: egui::Context, log_file: Option<&std::path::Path>) -> Services
             let status = if cfg!(target_os = "macos") {
                 std::process::Command::new("open").args(["-R", path]).status()
             } else if cfg!(target_os = "windows") {
-                let win_path = path.replace('/', "\\");
-                std::process::Command::new("explorer").arg(format!("/select,{win_path}")).status()
+                explorer_select_command(path).status()
             } else {
                 let dir = std::path::Path::new(path).parent().map(|d| d.to_string_lossy().to_string()).unwrap_or_else(|| ".".into());
                 std::process::Command::new("xdg-open").arg(dir).status()
@@ -423,6 +489,15 @@ fn services(ctx: egui::Context, log_file: Option<&std::path::Path>) -> Services
                 .map(|p| vec![p.to_string_lossy().to_string()])
                 .unwrap_or_default()
         })),
+        pick_display_profile: Some(Box::new(|| {
+            let mut d = rfd::FileDialog::new()
+                .set_title(lightcraft_ui_egui::i18n::tr("Choose Monitor Profile"))
+                .add_filter_nocase(lightcraft_ui_egui::i18n::tr("ICC Profiles"), &["icc", "icm"]);
+            if let Some(dir) = display_profile_dir() {
+                d = d.set_directory(dir);
+            }
+            d.pick_file().map(|p| vec![p.to_string_lossy().to_string()]).unwrap_or_default()
+        })),
         save_preset_file: Some(Box::new(|name: &str| {
             rfd::FileDialog::new()
                 .set_title(lightcraft_ui_egui::i18n::tr("Export Presets"))
@@ -431,6 +506,22 @@ fn services(ctx: egui::Context, log_file: Option<&std::path::Path>) -> Services
                 .save_file()
                 .map(|p| p.to_string_lossy().to_string())
         })),
+        pick_keyword_list: Some(Box::new(|| {
+            rfd::FileDialog::new()
+                .set_title(lightcraft_ui_egui::i18n::tr("Import Keywords"))
+                .add_filter_nocase(lightcraft_ui_egui::i18n::tr("Keyword Lists"), &["txt", "utf8"])
+                .pick_file()
+                .map(|p| vec![p.to_string_lossy().to_string()])
+                .unwrap_or_default()
+        })),
+        save_keyword_list: Some(Box::new(|name: &str| {
+            rfd::FileDialog::new()
+                .set_title(lightcraft_ui_egui::i18n::tr("Export Keywords"))
+                .add_filter_nocase(lightcraft_ui_egui::i18n::tr("Keyword Lists"), &["txt"])
+                .set_file_name(name)
+                .save_file()
+                .map(|p| p.to_string_lossy().to_string())
+        })),
         pick_curve_preset_files: Some(Box::new(|| {
             rfd::FileDialog::new()
                 .set_title(lightcraft_ui_egui::i18n::tr("Import Point Curve Presets"))
@@ -898,6 +989,16 @@ mod tests {
         assert!(!b.is_empty());
     }
 
+    /// Issue #471: the window's DX12 shaders compile with FXC — wgpu's default loaded any
+    /// `dxcompiler.dll` on the search path, and one without `dxil.dll` kept the window from opening.
+    #[test]
+    fn window_compiles_dx12_shaders_with_fxc() {
+        let eframe::egui_wgpu::WgpuSetup::CreateNew(n) = window_wgpu_options().wgpu_setup else { panic!("expected CreateNew") };
+        if std::env::var_os("WGPU_DX12_COMPILER").is_none() {
+            assert!(matches!(n.instance_descriptor.backend_options.dx12.shader_compiler, eframe::wgpu::Dx12Compiler::Fxc));
+        }
+    }
+
     /// Issue #234: Windows opens links with the URL protocol handler (the default browser), not
     /// File Explorer, and passes the whole map link, `?`, `&` and `#` included, as one argument.
     #[test]
@@ -909,6 +1010,23 @@ mod tests {
         assert_eq!(args, ["url.dll,FileProtocolHandler", url]);
     }
 
+    /// Issue #272: Explorer gets the file to select quoted after `/select,`, with backslashes and
+    /// without the verbatim prefix, even when the path has spaces (else it opens Documents).
+    #[test]
+    fn explorer_select_quotes_the_path() {
+        assert_eq!(explorer_select_arg(r"C:\Users\Me\My Photos\IMG 1.jpg"), r#"/select,"C:\Users\Me\My Photos\IMG 1.jpg""#);
+        assert_eq!(explorer_select_arg("D:/Example/Photos/IMG_0001.CR3"), r#"/select,"D:\Example\Photos\IMG_0001.CR3""#);
+        assert_eq!(explorer_select_arg(r"\\server\share\My Photos\a.jpg"), r#"/select,"\\server\share\My Photos\a.jpg""#);
+        assert_eq!(explorer_select_arg(r"\\?\D:\My Photos\a.jpg"), r#"/select,"D:\My Photos\a.jpg""#);
+        assert_eq!(explorer_select_arg(r"\\?\UNC\server\share\a.jpg"), r#"/select,"\\server\share\a.jpg""#);
+        // a `"` can't end the quoted path and add arguments to the raw command line
+        assert_eq!(explorer_select_arg(r#"C:\a" "C:\b.jpg"#), r#"/select,"C:\a C:\b.jpg""#);
+        let c = explorer_select_command(r"C:\My Photos\a.jpg");
+        assert_eq!(c.get_program(), "explorer");
+        let args: Vec<&std::ffi::OsStr> = c.get_args().collect();
+        assert_eq!(args, [r#"/select,"C:\My Photos\a.jpg""#]);
+    }
+
     #[test]
     fn a_control_port_that_is_not_a_number_is_ignored() {
         assert_eq!(control_port_from("--control", Some("7980".into())), Some(7980));
diff --git a/apps/lightcraft/src/native_menu.rs b/apps/lightcraft/src/native_menu.rs
index 647f7e27..256faa1f 100644
--- a/apps/lightcraft/src/native_menu.rs
+++ b/apps/lightcraft/src/native_menu.rs
@@ -355,12 +355,15 @@ impl NativeMenu {
     }
 
     /// Per frame: run chosen items, then sync labels / enabled / checked and the text-focus
-    /// accelerators with the app state.
-    pub fn update(&mut self, app: &mut LightcraftApp, ctx: &egui::Context) {
+    /// accelerators with the app state. Returns whether Quit was chosen: the caller saves
+    /// everything and exits the process itself (closing the viewport while AppKit terminates the
+    /// app can crash in winit's teardown, PR #444).
+    pub fn update(&mut self, app: &mut LightcraftApp, ctx: &egui::Context) -> bool {
         lightcraft_ui_egui::i18n::set_language(app.ui.language);
+        let mut quit = false;
         while let Ok(key) = self.rx.try_recv() {
             if key == QUIT {
-                ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+                quit = true;
                 continue;
             }
             if key == "app.about" || key == SETTINGS {
@@ -375,7 +378,7 @@ impl NativeMenu {
         let bar = menu_bar(app);
         if structure_of(&bar) != self.structure {
             self.rebuild(app);
-            return;
+            return quit;
         }
         fn walk(nodes: &[MenuNode], items: &mut HashMap<String, Item>) {
             for n in nodes {
@@ -429,6 +432,7 @@ impl NativeMenu {
             }
             self.publish_shortcuts(app);
         }
+        quit
     }
 }
 
diff --git a/assets/ATTRIBUTION.md b/assets/ATTRIBUTION.md
index 202eb27e..0fc883bd 100644
--- a/assets/ATTRIBUTION.md
+++ b/assets/ATTRIBUTION.md
@@ -12,7 +12,9 @@ covers a whole directory), or if a licence file referenced in the Licence column
 | `assets/app-icon/` (`lightcraft.svg` and the PNG/ICNS/ICO/SVG files derived from it) | LightCraft app icon (lynx) | LightCraft project owner (drawn in ArtCraft) | original work (vectorised from the owner's drawing; see `assets/app-icon/README.md`) | MIT OR Apache-2.0 (`assets/app-icon/LICENSE.txt`) | 2026-10-02 | vectorised to SVG; rendered to PNG/ICNS/ICO by `packaging/icons.sh` |
 | `assets/camera-profiles/*.json` | Camera colour profiles (matrix + hue/saturation/value table), built into LightCraft | ILCE-7M4: Harald Hoyer | original work: fitted by `lightcraft-cli calibrate` to the contributor's own raw photos and their in-camera JPEGs (597 ILCE-7M4 photos, 2026); aggregate colour statistics only, no image content; no Adobe or third-party profile data | MIT OR Apache-2.0 | 2026-10-07 | none |
 | `packaging/macos/dmg/` (`background.svg`, the `background.tiff` rendered from it by `generate.py`, and the `dmg-layout.DS_Store` layout file) | LightCraft macOS DMG window background | @XusBadia | original work for this repository, derived from the LightCraft app icon (`assets/app-icon/lightcraft.svg`, referenced via `<image>`, not copied); text is outlined Inter / JetBrains Mono glyph paths | MIT OR Apache-2.0 | 2026-10-08 | none (original); used for the Finder window of the macOS DMG, `packaging/macos/dmg/generate.py` renders it to `background.tiff` |
+| `assets/camera-profiles/ILCE-7CR.json` | Sony ILCE-7CR camera colour profile (matrix + hue/saturation/value table), built into LightCraft | LightCraft contributors; source photographs supplied by @AlexChambers | original work: fitted by `lightcraft-cli calibrate` to 125 usable ILCE-7CR ARWs (of 131, September 2025 to September 2026, Standard creative style) and their in-camera JPEGs; aggregate colour statistics only, no image content; no Adobe or third-party profile data | MIT OR Apache-2.0 | 2026-10-09 | none |
 | `assets/camera-profiles/X-H2S.json`, `assets/camera-profiles/X-T4.json` | Fujifilm camera colour profiles (matrix + hue/saturation/value table), built into LightCraft | LightCraft contributors; source photographs supplied by Sebastian Pfluegelmeier | original work: fitted by `lightcraft-cli calibrate` to 201 X-H2S and 545 X-T4 RAFs and their in-camera JPEGs; aggregate colour statistics only, no image content; no Adobe or third-party profile data | MIT OR Apache-2.0 | 2026-10-08 | none |
+| `assets/camera-tone/sony-dro-off.json` | Sony global tone curve with the Dynamic Range Optimizer off (32 knots), built into LightCraft for ARWs shot with DRO on | LightCraft contributors; source photographs by raw.pixls.us contributors | original work: tone curve quantile-matched over the pooled pixel pairs of 12 CC0 raw.pixls.us ARWs (DRO off, Standard creative style; ILCE-3500, -5000, -6600, -7CR, -7M3 ×3, -7S, -9M2, ILCA-77M2, SLT-A57, NEX-F3) and their embedded camera JPEGs; the file lists each source URL and SHA-256 and how the curve was derived (see also `docs/camera-preview-colour.md`); aggregate tone statistics only, no image content; no Adobe or third-party profile data | MIT OR Apache-2.0 (sources CC0) | 2026-10-09 | none |
 | `crates/scenes/` (generated images) | Procedural demo photographs | LightCraft contributors | original work (generated at runtime, no source imagery) | MIT OR Apache-2.0 | 2026-09-30 | n/a |
 | `crates/ui-egui/src/icons.rs` | UI icons drawn as vector paths in code | LightCraft contributors | original work | MIT OR Apache-2.0 | 2026-09-30 | n/a |
 | `docs/images/*-tetons.jpg`, `docs/images/grid-pd.jpg` (screenshots containing it) | "The Tetons and the Snake River" | Ansel Adams (1942), U.S. National Archives | https://commons.wikimedia.org/wiki/File:Adams_The_Tetons_and_the_Snake_River.jpg | Public domain (U.S. federal government work) | 2026-09-30 | developed in LightCraft; shown inside app screenshots |
@@ -21,12 +23,13 @@ covers a whole directory), or if a licence file referenced in the Licence column
 | `docs/images/*-blue-marble.jpg`, `docs/images/grid-pd.jpg` | "The Blue Marble" (AS17-148-22727) | NASA, Apollo 17 crew (1972) | https://commons.wikimedia.org/wiki/File:The_Earth_seen_from_Apollo_17.jpg | Public domain (NASA) | 2026-09-30 | developed in LightCraft; shown inside app screenshots |
 | `docs/images/*.jpg` (UI) | LightCraft application screenshots | LightCraft contributors | original work (captured with `docs/showcase/`) | MIT OR Apache-2.0 | 2026-09-30 | n/a |
 | `docs/brand/` (artcraft-logo and artcraft-mark, SVG and PNG) | ArtCraft wordmark and mark | ArtCraft Team | original work (https://getartcraft.com/) | ArtCraft trademark, see `docs/brand/LICENSE-brand.txt` (not open source) | 2026-10-01 | none |
-| craft-fonts: optional build input, not files in this repository | BIZ UDPGothic (Regular, Bold), BIZ UDMincho Regular, Shippori Mincho Regular | Morisawa Inc. / The BIZ UDGothic and BIZ UDMincho Project Authors; The Shippori Mincho Project Authors (per craft-fonts' attribution) | https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md | SIL Open Font License 1.1 (each font's OFL.txt in craft-fonts; release packages ship it as OFL-<family>.txt) | 2026-10-06 | none; embedded only in builds made with `CRAFT_FONTS_DIR` (all official releases); the web (wasm32) build embeds BIZ UDPGothic Regular only |
+| craft-fonts: optional build input, not files in this repository | BIZ UDPGothic (Regular, Bold), BIZ UDMincho Regular, Shippori Mincho Regular, Noto Sans CJK SC Regular | Morisawa Inc. / The BIZ UDGothic and BIZ UDMincho Project Authors; The Shippori Mincho Project Authors; Google and Adobe (Noto Sans CJK, maintainer-approved exception; see AGENTS.md) (per craft-fonts' attribution) | https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md | SIL Open Font License 1.1 (each font's OFL.txt in craft-fonts; release packages ship it as OFL-<family>.txt) | 2026-10-06 | none; native builds made with `CRAFT_FONTS_DIR` embed the manifest fonts (all official releases); the web build embeds BIZ UDPGothic Regular and ships Noto Sans CJK SC Regular as a separate font file |
+| `crates/ui-egui/locales/uk.json`, `crates/ui-egui/locales/uk-formats.json` | Ukrainian interface catalogs | @dmatviichuk with Codex; PhotoCraft, FilmCraft and VectorCraft translation contributors for reused labels | original translations from English source; 337 initial English-key matches reviewed from [PhotoCraft 69c41f3](https://github.com/storytold/photocraft/blob/69c41f3523e147eb215da8c7b4c29b18b35d1c63/crates/ui-egui/src/i18n/uk.tsv), [FilmCraft 4854c27](https://github.com/storytold/filmcraft/blob/4854c277536fe8118257362304b6a7d82d8e704b/crates/ui-egui/src/i18n/uk.tsv), [VectorCraft 4b44265](https://github.com/storytold/vectorcraft/blob/4b44265965fdd6ffedfd6182a892c1a6c360d344/crates/ui-egui/src/i18n/uk.tsv) | MIT OR Apache-2.0 (`LICENSE-MIT`, `LICENSE-APACHE`, also the source repositories' licences) | 2026-10-09 | adapted to LightCraft photo-development context, completed catalogs, reviewed spelling and placeholders |
 
 Notes
 - Fonts authored or published by Adobe (Source Sans/Serif/Code, Source Han, …) are not used, even though some are
   OFL-licensed: the asset rule excludes anything from Adobe. Source Sans 3 was removed on 2026-09-30 and replaced by Inter.
-- Japanese fonts (BIZ UDPGothic, BIZ UDMincho, Shippori Mincho) are not in this repository. They live in
+- CJK fonts (BIZ UDPGothic, BIZ UDMincho, Shippori Mincho, Noto Sans CJK SC) are not in this repository. They live in
   [storytold/craft-fonts](https://github.com/storytold/craft-fonts), with their licences and attribution in its
   `ATTRIBUTION.md`, and are embedded only in builds made with the optional `CRAFT_FONTS_DIR` build input (all official
   releases). Never commit font files here; add new fonts to craft-fonts (craftrules `standards/fonts.md`).
diff --git a/assets/camera-profiles/ILCE-7CR.json b/assets/camera-profiles/ILCE-7CR.json
new file mode 100644
index 00000000..3534f05c
--- /dev/null
+++ b/assets/camera-profiles/ILCE-7CR.json
@@ -0,0 +1,1819 @@
+{
+  "version": 1,
+  "model": "ILCE-7CR",
+  "files": 125,
+  "samples": 448230,
+  "matrix": [
+    [1.1094755401970307, -0.1814643173262276, 0.07642328704815071],
+    [-0.0353042898479492, 1.1462523170955077, -0.11812642489032932],
+    [-0.08133079077168937, -0.8682697273084319, 2.0120289809143364]
+  ],
+  "hue_sat": {
+    "hue_divisions": 72,
+    "sat_divisions": 5,
+    "val_divisions": 5,
+    "data": [
+      [0.0, 1.0, 1.0],
+      [1.6383686, 1.0720526, 1.0],
+      [-3.1825573, 1.0282102, 1.0],
+      [-3.0505095, 1.0160933, 1.0],
+      [-0.6544773, 1.0011821, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.7573091, 1.0635676, 1.0],
+      [-3.6906753, 1.0049208, 1.0],
+      [-3.9162223, 0.98691005, 1.0],
+      [-1.7661046, 0.9845228, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.3244245, 1.0702444, 1.0],
+      [-3.7783418, 1.0267969, 1.0],
+      [-4.208394, 0.98504055, 1.0],
+      [-3.8247044, 0.95117354, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.7408551, 1.0626208, 1.0],
+      [-4.5483084, 1.0503119, 1.0],
+      [-5.022255, 1.0133994, 1.0],
+      [-4.9868593, 0.9531773, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.1140733, 1.0510494, 1.0],
+      [-4.3416905, 1.0382092, 1.0],
+      [-5.6782136, 1.0137324, 1.0],
+      [-6.408746, 0.95611, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.8071455, 1.0453869, 1.0],
+      [-4.1650367, 1.0307838, 1.0],
+      [-7.1355047, 1.0019747, 1.0],
+      [-8.950974, 0.94559556, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.9337237, 1.0438595, 1.0],
+      [-4.7190723, 1.0019213, 1.0],
+      [-8.449162, 0.98546976, 1.0],
+      [-9.80414, 0.9475938, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.8035413, 1.0596792, 1.0],
+      [-4.483865, 0.99361634, 1.0],
+      [-9.145701, 0.95965594, 1.0],
+      [-12.007559, 0.9046417, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.1054618, 1.0610611, 1.0],
+      [-3.750633, 1.0037059, 1.0],
+      [-8.3648205, 0.9508676, 1.0],
+      [-12.104278, 0.89305633, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.3433983, 1.0385724, 1.0],
+      [-1.8320823, 0.96856654, 1.0],
+      [-6.4716563, 0.89340544, 1.0],
+      [-13.182256, 0.79202217, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.1155825, 1.0546852, 1.0],
+      [0.2504126, 0.95593035, 1.0],
+      [-4.421105, 0.86601037, 1.0],
+      [-11.81684, 0.76859766, 1.0],
+      [0.0, 1.0, 1.0],
+      [5.193353, 1.100501, 1.0],
+      [2.245616, 0.9877438, 1.0],
+      [-1.3484466, 0.89190966, 1.0],
+      [-5.656248, 0.79824746, 1.0],
+      [0.0, 1.0, 1.0],
+      [5.539407, 1.1472836, 1.0],
+      [3.5321336, 1.0246028, 1.0],
+      [1.6943812, 0.92413193, 1.0],
+      [0.06802155, 0.8097732, 1.0],
+      [0.0, 1.0, 1.0],
+      [5.217841, 1.1450701, 1.0],
+      [4.3687263, 1.0359106, 1.0],
+      [3.8731997, 0.92895746, 1.0],
+      [3.6518888, 0.81207585, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.9854875, 1.1393564, 1.0],
+      [4.353656, 1.0462686, 1.0],
+      [4.8320484, 0.9382486, 1.0],
+      [5.2603836, 0.83231425, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.4905012, 1.1162536, 1.0],
+      [4.399138, 1.0209066, 1.0],
+      [5.125341, 0.93585205, 1.0],
+      [5.7167406, 0.8500491, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.456529, 1.0933266, 1.0],
+      [4.4567842, 1.0046545, 1.0],
+      [5.3395023, 0.9265063, 1.0],
+      [6.239501, 0.8413839, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.3244715, 1.0775917, 1.0],
+      [4.413473, 1.0032461, 1.0],
+      [5.2259183, 0.93235445, 1.0],
+      [5.996756, 0.8481907, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.7977114, 1.0930682, 1.0],
+      [3.9809735, 1.0265673, 1.0],
+      [4.826016, 0.964025, 1.0],
+      [5.9678993, 0.8728676, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.3974957, 1.1096336, 1.0],
+      [3.507613, 1.0540297, 1.0],
+      [4.679865, 0.94909227, 1.0],
+      [6.176524, 0.80889976, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.6225548, 1.1412165, 1.0],
+      [3.2221508, 1.0394865, 1.0],
+      [4.731801, 0.89790475, 1.0],
+      [5.0452776, 0.8134008, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.92599183, 1.1604693, 1.0],
+      [3.414574, 1.0124736, 1.0],
+      [3.7358258, 0.9165049, 1.0],
+      [2.2723522, 0.91374624, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.45341417, 1.168921, 1.0],
+      [1.5084614, 1.0431032, 1.0],
+      [0.8854018, 0.9520788, 1.0],
+      [-1.05283, 0.94668686, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.3174335, 1.1757046, 1.0],
+      [0.5896504, 1.061128, 1.0],
+      [-0.31401426, 0.9736818, 1.0],
+      [-1.8383517, 0.95333457, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.1522639, 1.1637881, 1.0],
+      [-1.4493614, 1.0722672, 1.0],
+      [-1.4632736, 1.0168622, 1.0],
+      [-0.29180732, 0.99931026, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.7037742, 1.1205176, 1.0],
+      [-2.8786352, 1.0513667, 1.0],
+      [-1.286718, 1.0099841, 1.0],
+      [-0.06583492, 0.99989015, 1.0],
+      [0.0, 1.0, 1.0],
+      [-4.2293205, 1.1057495, 1.0],
+      [-5.281706, 1.0493338, 1.0],
+      [-2.4175398, 1.0138595, 1.0],
+      [-0.047981504, 0.99992627, 1.0],
+      [0.0, 1.0, 1.0],
+      [-5.8813257, 1.1112839, 1.0],
+      [-7.088055, 1.0551285, 1.0],
+      [-3.9832814, 1.0086114, 1.0],
+      [-0.17585999, 0.9988311, 1.0],
+      [0.0, 1.0, 1.0],
+      [-6.761259, 1.1026558, 1.0],
+      [-8.000364, 1.0663072, 1.0],
+      [-4.1537356, 1.0163689, 1.0],
+      [-0.13010694, 0.99951726, 1.0],
+      [0.0, 1.0, 1.0],
+      [-8.351095, 1.0976008, 1.0],
+      [-8.466059, 1.0682116, 1.0],
+      [-3.5471215, 1.0211279, 1.0],
+      [-0.0509097, 1.0001352, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.057853, 1.1055348, 1.0],
+      [-8.974651, 1.0689155, 1.0],
+      [-3.2166526, 1.0227399, 1.0],
+      [-0.032699484, 1.0002922, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.427814, 1.1105726, 1.0],
+      [-9.507676, 1.0691713, 1.0],
+      [-3.295734, 1.0189606, 1.0],
+      [-0.034528155, 1.0002044, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.442637, 1.1099377, 1.0],
+      [-10.499484, 1.0757492, 1.0],
+      [-4.3815494, 1.0181382, 1.0],
+      [-0.07561345, 1.0000867, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.983269, 1.114439, 1.0],
+      [-10.951814, 1.0815339, 1.0],
+      [-4.2156606, 1.0171853, 1.0],
+      [-0.08563397, 0.99997413, 1.0],
+      [0.0, 1.0, 1.0],
+      [-10.670809, 1.1166714, 1.0],
+      [-11.719119, 1.0770913, 1.0],
+      [-4.6209064, 1.0083113, 1.0],
+      [-0.12722205, 0.9996538, 1.0],
+      [0.0, 1.0, 1.0],
+      [-12.437358, 1.1277313, 1.0],
+      [-12.732603, 1.0851367, 1.0],
+      [-4.236061, 1.0089667, 1.0],
+      [-0.113364056, 0.9994685, 1.0],
+      [0.0, 1.0, 1.0],
+      [-12.538394, 1.1138527, 1.0],
+      [-11.907458, 1.0645828, 1.0],
+      [-4.889425, 0.9901681, 1.0],
+      [-0.30379632, 0.99794984, 1.0],
+      [0.0, 1.0, 1.0],
+      [-12.718707, 1.0802225, 1.0],
+      [-12.242265, 1.0252401, 1.0],
+      [-6.184896, 0.96578616, 1.0],
+      [-0.6155264, 0.99502194, 1.0],
+      [0.0, 1.0, 1.0],
+      [-14.020359, 1.0553012, 1.0],
+      [-13.098407, 1.0011256, 1.0],
+      [-7.327469, 0.9492975, 1.0],
+      [-0.9094673, 0.9916255, 1.0],
+      [0.0, 1.0, 1.0],
+      [-15.101152, 1.0212511, 1.0],
+      [-12.824179, 0.96607465, 1.0],
+      [-10.019363, 0.9155735, 1.0],
+      [-1.7772533, 0.9820373, 1.0],
+      [0.0, 1.0, 1.0],
+      [-14.286782, 0.9806954, 1.0],
+      [-9.569648, 0.94380945, 1.0],
+      [-9.857059, 0.9003953, 1.0],
+      [-2.1718888, 0.9759639, 1.0],
+      [0.0, 1.0, 1.0],
+      [-13.73097, 0.94591624, 1.0],
+      [-11.556911, 0.921234, 1.0],
+      [-12.93851, 0.8641401, 1.0],
+      [-3.652711, 0.9552426, 1.0],
+      [0.0, 1.0, 1.0],
+      [-16.801582, 0.8864382, 1.0],
+      [-11.193753, 0.9149052, 1.0],
+      [-9.738617, 0.8872918, 1.0],
+      [-2.5534081, 0.9664013, 1.0],
+      [0.0, 1.0, 1.0],
+      [-17.101755, 0.84524596, 1.0],
+      [-9.365246, 0.91499794, 1.0],
+      [-4.452413, 0.9442718, 1.0],
+      [-0.7637209, 0.989576, 1.0],
+      [0.0, 1.0, 1.0],
+      [-18.14948, 0.8175313, 1.0],
+      [-11.684059, 0.8936882, 1.0],
+      [-3.2155685, 0.9607375, 1.0],
+      [-0.26556945, 0.9955721, 1.0],
+      [0.0, 1.0, 1.0],
+      [-16.426699, 0.8100732, 1.0],
+      [-9.782718, 0.9018959, 1.0],
+      [-4.339177, 0.96653545, 1.0],
+      [-0.41509473, 0.99594533, 1.0],
+      [0.0, 1.0, 1.0],
+      [-10.315517, 0.84992623, 1.0],
+      [-5.747398, 0.9413663, 1.0],
+      [-3.1746607, 0.982243, 1.0],
+      [-0.5927395, 0.994371, 1.0],
+      [0.0, 1.0, 1.0],
+      [-6.9678645, 0.8809627, 1.0],
+      [-3.7169914, 0.9728603, 1.0],
+      [-0.7432635, 1.0332607, 1.0],
+      [0.729794, 1.0225081, 1.0],
+      [0.0, 1.0, 1.0],
+      [-5.2035117, 0.84641093, 1.0],
+      [-1.5942934, 0.9789916, 1.0],
+      [1.2482002, 1.0807693, 1.0],
+      [1.347859, 1.064622, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.1986942, 0.7543623, 1.0],
+      [0.8410356, 0.938187, 1.0],
+      [2.4551218, 1.095957, 1.0],
+      [2.1389015, 1.0985862, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.88384134, 0.7095005, 1.0],
+      [1.9973824, 0.93200374, 1.0],
+      [2.549452, 1.0998962, 1.0],
+      [2.047063, 1.0879719, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.7609332, 0.6956258, 1.0],
+      [2.31692, 0.9102155, 1.0],
+      [2.647937, 1.0628512, 1.0],
+      [3.2615342, 1.036636, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.2741787, 0.69057876, 1.0],
+      [3.5142605, 0.88028973, 1.0],
+      [4.4796543, 1.0268018, 1.0],
+      [4.20299, 1.024853, 1.0],
+      [0.0, 1.0, 1.0],
+      [5.380194, 0.69558483, 1.0],
+      [5.080697, 0.882952, 1.0],
+      [6.105996, 1.0175306, 1.0],
+      [5.514054, 1.0149113, 1.0],
+      [0.0, 1.0, 1.0],
+      [9.913718, 0.69718885, 1.0],
+      [6.5240126, 0.8923008, 1.0],
+      [8.154414, 1.0078559, 1.0],
+      [6.6946135, 1.0048004, 1.0],
+      [0.0, 1.0, 1.0],
+      [13.040619, 0.6963414, 1.0],
+      [8.325149, 0.912086, 1.0],
+      [9.543625, 1.0013618, 1.0],
+      [6.4392266, 0.99676377, 1.0],
+      [0.0, 1.0, 1.0],
+      [14.4534025, 0.727793, 1.0],
+      [8.82926, 0.949796, 1.0],
+      [6.9925814, 1.0022112, 1.0],
+      [2.9664295, 0.99772435, 1.0],
+      [0.0, 1.0, 1.0],
+      [15.132328, 0.78525466, 1.0],
+      [10.728416, 0.9771031, 1.0],
+      [7.899672, 0.9900357, 1.0],
+      [2.4584854, 0.9965681, 1.0],
+      [0.0, 1.0, 1.0],
+      [16.370947, 0.8516936, 1.0],
+      [14.804218, 1.0220509, 1.0],
+      [7.60627, 1.0105268, 1.0],
+      [0.47612935, 0.9996986, 1.0],
+      [0.0, 1.0, 1.0],
+      [15.766772, 0.93907374, 1.0],
+      [16.010454, 1.051158, 1.0],
+      [7.589318, 1.0160706, 1.0],
+      [0.24546027, 1.000115, 1.0],
+      [0.0, 1.0, 1.0],
+      [14.457747, 0.9682619, 1.0],
+      [13.106996, 1.0823271, 1.0],
+      [5.0127563, 1.0306457, 1.0],
+      [0.11494827, 1.0005567, 1.0],
+      [0.0, 1.0, 1.0],
+      [13.896352, 0.95646006, 1.0],
+      [10.509385, 1.0747057, 1.0],
+      [4.687772, 1.0336343, 1.0],
+      [0.18767904, 1.0010031, 1.0],
+      [0.0, 1.0, 1.0],
+      [12.871006, 0.94392693, 1.0],
+      [8.716992, 1.0580047, 1.0],
+      [4.032118, 1.0331796, 1.0],
+      [0.19235706, 1.0013452, 1.0],
+      [0.0, 1.0, 1.0],
+      [12.761354, 0.94344586, 1.0],
+      [4.8192053, 1.0303724, 1.0],
+      [-0.55819005, 1.0258765, 1.0],
+      [-0.18075792, 1.0020537, 1.0],
+      [0.0, 1.0, 1.0],
+      [11.323022, 0.95529723, 1.0],
+      [3.8540874, 1.0221503, 1.0],
+      [-1.5989528, 1.0256935, 1.0],
+      [-0.31334943, 1.0026582, 1.0],
+      [0.0, 1.0, 1.0],
+      [9.946704, 0.988154, 1.0],
+      [2.8923109, 1.0258386, 1.0],
+      [-1.5042264, 1.0218962, 1.0],
+      [-0.26236275, 1.0021061, 1.0],
+      [0.0, 1.0, 1.0],
+      [9.115504, 0.9980661, 1.0],
+      [1.3947439, 1.0351801, 1.0],
+      [-1.7974052, 1.0161659, 1.0],
+      [-0.24226402, 1.0010152, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.536506, 1.0020467, 1.0],
+      [0.87553304, 1.0329614, 1.0],
+      [0.18591607, 1.0122479, 1.0],
+      [0.054326985, 1.0008035, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.8057537, 1.0455284, 1.0],
+      [1.8502842, 1.0506709, 1.0],
+      [0.7893407, 1.0182511, 1.0],
+      [0.09190431, 1.0011369, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.130396, 1.0462483, 1.0],
+      [0.7220753, 1.0326569, 1.0],
+      [-0.40912512, 1.0052713, 1.0],
+      [0.03908602, 1.0007522, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.2550654, 1.05479, 1.0],
+      [1.3151088, 1.0173345, 1.0],
+      [0.43053803, 1.0046135, 1.0],
+      [0.23496991, 1.0016526, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.200835, 1.041949, 1.0],
+      [-0.12719084, 0.97952026, 1.0],
+      [0.40004775, 0.9858662, 1.0],
+      [0.089090385, 1.0008289, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.1867458, 1.063474, 1.0],
+      [-3.518081, 1.0572506, 1.0],
+      [-3.6311622, 1.0408844, 1.0],
+      [-1.250096, 1.0127242, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.11487997, 1.055631, 1.0],
+      [-3.8922422, 1.0360129, 1.0],
+      [-4.149058, 0.99983233, 1.0],
+      [-2.9244108, 0.9689904, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.1612215, 1.0692844, 1.0],
+      [-3.87592, 1.0401592, 1.0],
+      [-4.3422823, 0.97830665, 1.0],
+      [-3.9827328, 0.9330193, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.6057762, 1.0657002, 1.0],
+      [-4.05366, 1.0526804, 1.0],
+      [-4.907047, 0.98893243, 1.0],
+      [-4.8015065, 0.93376106, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.9405156, 1.0538071, 1.0],
+      [-3.854631, 1.0372756, 1.0],
+      [-5.677292, 1.008557, 1.0],
+      [-6.4605684, 0.95010316, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.84950966, 1.0556635, 1.0],
+      [-3.8397493, 1.0464863, 1.0],
+      [-6.724636, 0.9974292, 1.0],
+      [-9.358037, 0.9205249, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.36474, 1.0466326, 1.0],
+      [-4.358288, 1.0096835, 1.0],
+      [-8.078475, 0.96894723, 1.0],
+      [-10.280892, 0.91327274, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.1897643, 1.0460767, 1.0],
+      [-4.8276143, 0.9861743, 1.0],
+      [-8.967868, 0.9454565, 1.0],
+      [-11.58099, 0.89431435, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.8428742, 1.0415783, 1.0],
+      [-4.2447996, 0.9901131, 1.0],
+      [-8.640936, 0.9449217, 1.0],
+      [-11.831331, 0.8849682, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.8116823, 1.0284086, 1.0],
+      [-2.5288608, 0.97493637, 1.0],
+      [-6.911547, 0.9111893, 1.0],
+      [-13.192846, 0.79674995, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.2551363, 1.0582069, 1.0],
+      [-0.61379474, 0.9854093, 1.0],
+      [-5.207653, 0.885589, 1.0],
+      [-12.072603, 0.7643964, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.0988145, 1.1001511, 1.0],
+      [1.3202463, 1.014535, 1.0],
+      [-2.0446327, 0.91062075, 1.0],
+      [-6.382716, 0.7884341, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.772627, 1.1340997, 1.0],
+      [2.6516492, 1.0298927, 1.0],
+      [1.0751725, 0.93674093, 1.0],
+      [-0.6240697, 0.80116963, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.6609416, 1.1409346, 1.0],
+      [3.6919625, 1.0409919, 1.0],
+      [3.1592674, 0.94452727, 1.0],
+      [2.8074346, 0.81181794, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.88111, 1.1356293, 1.0],
+      [3.934658, 1.0424132, 1.0],
+      [4.262655, 0.94446814, 1.0],
+      [4.659253, 0.8268726, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.2726362, 1.1170003, 1.0],
+      [3.9152527, 1.0194097, 1.0],
+      [4.7911615, 0.9256793, 1.0],
+      [5.6844645, 0.8277047, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.968466, 1.084938, 1.0],
+      [3.864402, 1.0008085, 1.0],
+      [4.9878488, 0.9206543, 1.0],
+      [6.272722, 0.8304063, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.805873, 1.0721347, 1.0],
+      [3.7892249, 1.0025132, 1.0],
+      [4.7126594, 0.937998, 1.0],
+      [5.7331266, 0.8633941, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.439447, 1.0980592, 1.0],
+      [3.5134554, 1.0268866, 1.0],
+      [4.373185, 0.973018, 1.0],
+      [5.2375226, 0.9141984, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.122798, 1.1300637, 1.0],
+      [3.0972943, 1.0678729, 1.0],
+      [4.0227356, 0.99388194, 1.0],
+      [4.4452977, 0.8434974, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.4539274, 1.1699649, 1.0],
+      [2.7342727, 1.0873699, 1.0],
+      [4.0375504, 0.9513469, 1.0],
+      [2.912934, 0.7801174, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.2035671, 1.2061948, 1.0],
+      [2.204418, 1.0808513, 1.0],
+      [3.2734146, 0.95607066, 1.0],
+      [3.3829432, 0.8604104, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.069349, 1.2016822, 1.0],
+      [0.78204316, 1.0802776, 1.0],
+      [0.8939021, 0.9876918, 1.0],
+      [0.9314171, 0.9479382, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.2317412, 1.2042382, 1.0],
+      [-0.8626396, 1.0817081, 1.0],
+      [-1.1587913, 1.0106043, 1.0],
+      [-0.7471611, 0.9841788, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.6874542, 1.1916536, 1.0],
+      [-2.8666534, 1.0680176, 1.0],
+      [-3.0523398, 1.0200123, 1.0],
+      [-0.8098775, 1.0000143, 1.0],
+      [0.0, 1.0, 1.0],
+      [-4.6867037, 1.1576309, 1.0],
+      [-4.1102524, 1.0329399, 1.0],
+      [-3.0036724, 0.9886833, 1.0],
+      [-0.33008483, 0.99551946, 1.0],
+      [0.0, 1.0, 1.0],
+      [-6.2138457, 1.1177778, 1.0],
+      [-5.5909715, 1.0219685, 1.0],
+      [-3.883835, 0.9935609, 1.0],
+      [-0.19700186, 0.9980648, 1.0],
+      [0.0, 1.0, 1.0],
+      [-7.703151, 1.118376, 1.0],
+      [-7.2529035, 1.0356544, 1.0],
+      [-5.5993958, 1.0061052, 1.0],
+      [-0.36084718, 0.99833083, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.133752, 1.1199366, 1.0],
+      [-9.163867, 1.0599968, 1.0],
+      [-6.685689, 1.0225968, 1.0],
+      [-0.3279509, 0.9992778, 1.0],
+      [0.0, 1.0, 1.0],
+      [-10.304704, 1.1167951, 1.0],
+      [-9.944268, 1.0687343, 1.0],
+      [-6.581675, 1.0340862, 1.0],
+      [-0.1731145, 1.0005047, 1.0],
+      [0.0, 1.0, 1.0],
+      [-11.287525, 1.12426, 1.0],
+      [-10.652732, 1.0709195, 1.0],
+      [-6.425803, 1.0336635, 1.0],
+      [-0.1326214, 1.0005356, 1.0],
+      [0.0, 1.0, 1.0],
+      [-11.926306, 1.1344961, 1.0],
+      [-11.767215, 1.0815933, 1.0],
+      [-6.9073353, 1.033758, 1.0],
+      [-0.15162425, 1.0003935, 1.0],
+      [0.0, 1.0, 1.0],
+      [-12.356211, 1.1320031, 1.0],
+      [-12.448733, 1.087039, 1.0],
+      [-7.868196, 1.0303723, 1.0],
+      [-0.21782555, 1.0001445, 1.0],
+      [0.0, 1.0, 1.0],
+      [-12.909969, 1.1390688, 1.0],
+      [-12.794445, 1.0962518, 1.0],
+      [-7.4221215, 1.0277627, 1.0],
+      [-0.24051952, 0.9994796, 1.0],
+      [0.0, 1.0, 1.0],
+      [-14.318492, 1.1441628, 1.0],
+      [-14.100717, 1.0943929, 1.0],
+      [-8.575853, 1.009897, 1.0],
+      [-0.41431823, 0.9982393, 1.0],
+      [0.0, 1.0, 1.0],
+      [-15.74911, 1.1528009, 1.0],
+      [-15.211963, 1.1008726, 1.0],
+      [-8.026304, 0.99996704, 1.0],
+      [-0.47660625, 0.9950099, 1.0],
+      [0.0, 1.0, 1.0],
+      [-16.241463, 1.1295997, 1.0],
+      [-15.810595, 1.066377, 1.0],
+      [-10.653159, 0.9577683, 1.0],
+      [-1.2817223, 0.9887495, 1.0],
+      [0.0, 1.0, 1.0],
+      [-17.143677, 1.0890604, 1.0],
+      [-17.320019, 1.0180693, 1.0],
+      [-14.736028, 0.90419865, 1.0],
+      [-3.1021247, 0.97202545, 1.0],
+      [0.0, 1.0, 1.0],
+      [-18.748793, 1.0463697, 1.0],
+      [-18.46616, 0.98106045, 1.0],
+      [-18.009438, 0.86111045, 1.0],
+      [-5.893209, 0.94255584, 1.0],
+      [0.0, 1.0, 1.0],
+      [-19.686289, 0.996309, 1.0],
+      [-19.95499, 0.901589, 1.0],
+      [-23.705408, 0.78339463, 1.0],
+      [-13.599181, 0.862805, 1.0],
+      [0.0, 1.0, 1.0],
+      [-19.272419, 0.9451124, 1.0],
+      [-18.105583, 0.8663253, 1.0],
+      [-23.313438, 0.7696128, 1.0],
+      [-14.894453, 0.842119, 1.0],
+      [0.0, 1.0, 1.0],
+      [-18.445044, 0.90566933, 1.0],
+      [-17.009562, 0.85194093, 1.0],
+      [-23.163944, 0.7514455, 1.0],
+      [-18.454296, 0.7895318, 1.0],
+      [0.0, 1.0, 1.0],
+      [-19.975847, 0.8582838, 1.0],
+      [-15.432948, 0.85963035, 1.0],
+      [-21.027409, 0.75946647, 1.0],
+      [-18.194445, 0.78112334, 1.0],
+      [0.0, 1.0, 1.0],
+      [-18.885874, 0.83879834, 1.0],
+      [-14.115562, 0.8839908, 1.0],
+      [-12.019917, 0.8720784, 1.0],
+      [-6.3177505, 0.91974896, 1.0],
+      [0.0, 1.0, 1.0],
+      [-17.701115, 0.8398532, 1.0],
+      [-14.244609, 0.89724517, 1.0],
+      [-9.12698, 0.9179684, 1.0],
+      [-1.9648052, 0.9748977, 1.0],
+      [0.0, 1.0, 1.0],
+      [-16.505676, 0.80830556, 1.0],
+      [-10.482741, 0.91814256, 1.0],
+      [-6.0856237, 0.97157246, 1.0],
+      [-1.7848674, 0.98539186, 1.0],
+      [0.0, 1.0, 1.0],
+      [-11.111074, 0.84318155, 1.0],
+      [-6.120855, 0.96219766, 1.0],
+      [-3.149391, 1.02109, 1.0],
+      [-0.97741336, 1.0116717, 1.0],
+      [0.0, 1.0, 1.0],
+      [-7.5704823, 0.8942756, 1.0],
+      [-3.2543333, 1.0210055, 1.0],
+      [-0.5860294, 1.0834074, 1.0],
+      [0.870136, 1.0914137, 1.0],
+      [0.0, 1.0, 1.0],
+      [-6.0229716, 0.8704741, 1.0],
+      [-1.4675226, 1.0396374, 1.0],
+      [0.57677406, 1.1029227, 1.0],
+      [1.422931, 1.1059595, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.5032904, 0.7701063, 1.0],
+      [0.7988452, 0.982442, 1.0],
+      [2.1533048, 1.102169, 1.0],
+      [2.2210178, 1.1071599, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.029193172, 0.72968274, 1.0],
+      [2.5515428, 0.9443575, 1.0],
+      [2.4624462, 1.1000748, 1.0],
+      [2.2837563, 1.1011144, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.7426748, 0.71043026, 1.0],
+      [3.054676, 0.9081306, 1.0],
+      [2.6141508, 1.0664026, 1.0],
+      [2.980883, 1.0584391, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.6768913, 0.6937622, 1.0],
+      [4.527743, 0.8812177, 1.0],
+      [4.8806653, 1.0332351, 1.0],
+      [4.967902, 1.0312556, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.1945524, 0.68730164, 1.0],
+      [6.950681, 0.8867778, 1.0],
+      [7.3334575, 1.0227884, 1.0],
+      [7.0962567, 1.0217508, 1.0],
+      [0.0, 1.0, 1.0],
+      [11.6981535, 0.68517774, 1.0],
+      [9.424991, 0.89795345, 1.0],
+      [10.109896, 1.0150306, 1.0],
+      [9.631388, 1.0133693, 1.0],
+      [0.0, 1.0, 1.0],
+      [15.01595, 0.69489264, 1.0],
+      [10.674274, 0.93846947, 1.0],
+      [12.570046, 0.999178, 1.0],
+      [11.800817, 0.993752, 1.0],
+      [0.0, 1.0, 1.0],
+      [16.40186, 0.72178566, 1.0],
+      [13.150471, 0.9621032, 1.0],
+      [13.788712, 0.9881621, 1.0],
+      [12.145564, 0.9821678, 1.0],
+      [0.0, 1.0, 1.0],
+      [16.426535, 0.7873739, 1.0],
+      [15.013656, 0.98788464, 1.0],
+      [15.114616, 0.9857073, 1.0],
+      [10.671278, 0.97703195, 1.0],
+      [0.0, 1.0, 1.0],
+      [18.044664, 0.8680412, 1.0],
+      [18.143904, 1.0268604, 1.0],
+      [16.295511, 1.0147856, 1.0],
+      [5.056517, 0.9941207, 1.0],
+      [0.0, 1.0, 1.0],
+      [18.028666, 0.95773226, 1.0],
+      [18.875088, 1.0640182, 1.0],
+      [16.150946, 1.0385625, 1.0],
+      [3.1871507, 1.0035607, 1.0],
+      [0.0, 1.0, 1.0],
+      [16.514034, 1.0013099, 1.0],
+      [17.314789, 1.0905116, 1.0],
+      [14.560985, 1.0545624, 1.0],
+      [1.7983161, 1.0041636, 1.0],
+      [0.0, 1.0, 1.0],
+      [15.797172, 1.0078827, 1.0],
+      [14.955377, 1.0977542, 1.0],
+      [12.220257, 1.0560337, 1.0],
+      [1.3466339, 1.0037528, 1.0],
+      [0.0, 1.0, 1.0],
+      [14.565454, 0.98415726, 1.0],
+      [11.735246, 1.0906302, 1.0],
+      [8.986611, 1.0521289, 1.0],
+      [0.96998435, 1.0029405, 1.0],
+      [0.0, 1.0, 1.0],
+      [13.707696, 0.9740702, 1.0],
+      [9.109479, 1.0700653, 1.0],
+      [6.174766, 1.0449634, 1.0],
+      [0.61549, 1.0034261, 1.0],
+      [0.0, 1.0, 1.0],
+      [13.172035, 0.965594, 1.0],
+      [6.792434, 1.0554295, 1.0],
+      [2.0799077, 1.0371919, 1.0],
+      [-0.03451228, 1.002662, 1.0],
+      [0.0, 1.0, 1.0],
+      [12.510916, 0.9951767, 1.0],
+      [4.6987195, 1.0665245, 1.0],
+      [0.08861357, 1.0415522, 1.0],
+      [-0.20895422, 1.0027298, 1.0],
+      [0.0, 1.0, 1.0],
+      [10.848053, 0.9867255, 1.0],
+      [2.4717958, 1.0654173, 1.0],
+      [-1.2781724, 1.0430613, 1.0],
+      [-0.29540727, 1.0029501, 1.0],
+      [0.0, 1.0, 1.0],
+      [8.924775, 1.0128679, 1.0],
+      [1.6049622, 1.0838153, 1.0],
+      [0.04660962, 1.0468647, 1.0],
+      [0.06334232, 1.0034819, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.795764, 1.0535507, 1.0],
+      [1.7419995, 1.088198, 1.0],
+      [-0.15147558, 1.0503129, 1.0],
+      [-0.0022487787, 1.0045427, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.2572355, 1.0579109, 1.0],
+      [1.0977098, 1.0733509, 1.0],
+      [-1.2772944, 1.044092, 1.0],
+      [-0.13525482, 1.0073868, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.364052, 1.0702623, 1.0],
+      [0.38560438, 1.0597174, 1.0],
+      [-0.880569, 1.0338639, 1.0],
+      [0.45450735, 1.0093911, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.635617, 1.0665764, 1.0],
+      [-1.8541563, 1.0492157, 1.0],
+      [-2.224277, 1.0312802, 1.0],
+      [0.02060782, 1.0094924, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.9177897, 0.931073, 1.0],
+      [-3.830959, 0.9463443, 1.0],
+      [-4.178485, 0.96985245, 1.0],
+      [-2.8674722, 0.9778141, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.63912636, 0.92612, 1.0],
+      [-3.5380905, 0.9278758, 1.0],
+      [-4.304839, 0.9169423, 1.0],
+      [-3.5802007, 0.9137134, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.754941, 0.92468625, 1.0],
+      [-2.9381945, 0.9232937, 1.0],
+      [-3.6206696, 0.90653074, 1.0],
+      [-3.333006, 0.8945919, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.4640048, 0.9297938, 1.0],
+      [-1.9298265, 0.9331787, 1.0],
+      [-3.5713015, 0.9139552, 1.0],
+      [-3.4944124, 0.8915449, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.2694256, 0.93911076, 1.0],
+      [-1.7281839, 0.9344968, 1.0],
+      [-4.068964, 0.9337624, 1.0],
+      [-3.7026005, 0.88743496, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.443677, 0.9488072, 1.0],
+      [-2.1556156, 0.9397697, 1.0],
+      [-5.040308, 0.9141083, 1.0],
+      [-7.3046207, 0.8774791, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.2289524, 0.9390356, 1.0],
+      [-2.256875, 0.87258524, 1.0],
+      [-5.24316, 0.86723936, 1.0],
+      [-8.016062, 0.860503, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.379857, 0.9152337, 1.0],
+      [-3.06269, 0.88222355, 1.0],
+      [-5.274808, 0.8565716, 1.0],
+      [-6.253486, 0.83439857, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.9447069, 0.8909187, 1.0],
+      [-2.1291292, 0.8753727, 1.0],
+      [-4.2053227, 0.8382535, 1.0],
+      [-4.9932523, 0.804721, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.2031088, 0.883391, 1.0],
+      [-0.5427132, 0.8514603, 1.0],
+      [-2.1573637, 0.8162667, 1.0],
+      [-5.739983, 0.78099483, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.0463758, 0.8902918, 1.0],
+      [0.4049588, 0.8463498, 1.0],
+      [-1.3030909, 0.8070003, 1.0],
+      [-5.3864274, 0.73747945, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.5551093, 0.93288326, 1.0],
+      [1.5804863, 0.88684475, 1.0],
+      [-0.0010043167, 0.8088468, 1.0],
+      [-2.0880547, 0.7102155, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.7656722, 0.9366638, 1.0],
+      [2.0004451, 0.89587283, 1.0],
+      [0.78522146, 0.8225704, 1.0],
+      [-0.7193246, 0.7130292, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.447219, 0.95061296, 1.0],
+      [2.4834387, 0.91706544, 1.0],
+      [1.561155, 0.851608, 1.0],
+      [0.53629506, 0.7400539, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.7838557, 0.9778509, 1.0],
+      [2.667703, 0.94507015, 1.0],
+      [2.5998428, 0.87076056, 1.0],
+      [2.1060734, 0.76656604, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.9395797, 0.98501194, 1.0],
+      [2.645288, 0.9442791, 1.0],
+      [3.7864566, 0.86861855, 1.0],
+      [4.5985446, 0.77926284, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.8749794, 0.9834793, 1.0],
+      [2.6313577, 0.9403016, 1.0],
+      [3.6338875, 0.8868182, 1.0],
+      [4.784866, 0.8023069, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.8682514, 0.97530806, 1.0],
+      [2.5901785, 0.9404073, 1.0],
+      [3.0052283, 0.905837, 1.0],
+      [2.0069096, 0.83484143, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.4727961, 1.0080808, 1.0],
+      [2.3305118, 0.9540467, 1.0],
+      [2.282054, 0.91564345, 1.0],
+      [-7.6290994, 0.69604313, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.0637859, 1.0516135, 1.0],
+      [1.7671573, 0.9879856, 1.0],
+      [-5.2584343, 0.73675436, 1.0],
+      [-16.342901, 0.5216483, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.61982626, 1.0828284, 1.0],
+      [1.5899999, 0.95572406, 1.0],
+      [-5.914253, 0.5874747, 1.0],
+      [-8.813023, 0.507078, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.5224679, 1.0920671, 1.0],
+      [2.2305388, 0.914912, 1.0],
+      [8.181367, 0.6633539, 1.0],
+      [11.847236, 0.5297007, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.8650954, 1.0546236, 1.0],
+      [2.5084958, 0.8949213, 1.0],
+      [8.434784, 0.7660728, 1.0],
+      [19.517859, 0.6189292, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.33615965, 0.9680921, 1.0],
+      [1.9523638, 0.8709517, 1.0],
+      [3.7503355, 0.8401423, 1.0],
+      [5.316759, 0.87355274, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.4475873, 0.99367666, 1.0],
+      [0.3394638, 0.9137543, 1.0],
+      [1.7758911, 0.8927394, 1.0],
+      [1.1283293, 0.9674458, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.4284496, 1.0324663, 1.0],
+      [-1.4436898, 0.9559075, 1.0],
+      [-0.31089765, 0.9398312, 1.0],
+      [0.15274782, 0.99124306, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.9135323, 0.9894693, 1.0],
+      [-1.0511459, 0.9277451, 1.0],
+      [0.45192885, 0.9280664, 1.0],
+      [0.32532325, 0.98979396, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.6640732, 0.9995134, 1.0],
+      [-1.4445381, 0.94103074, 1.0],
+      [-0.45791662, 0.9589122, 1.0],
+      [0.080993034, 0.9953546, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.9926722, 1.0097752, 1.0],
+      [-2.3710601, 0.9654012, 1.0],
+      [-0.9738827, 0.97923654, 1.0],
+      [-0.07195478, 0.99595565, 1.0],
+      [0.0, 1.0, 1.0],
+      [-4.377553, 0.9997677, 1.0],
+      [-2.9565587, 0.951771, 1.0],
+      [-1.253855, 0.97048193, 1.0],
+      [-0.08838272, 0.99680644, 1.0],
+      [0.0, 1.0, 1.0],
+      [-4.8839297, 0.9710823, 1.0],
+      [-2.0442789, 0.89748603, 1.0],
+      [-0.6975334, 0.93988526, 1.0],
+      [0.013153156, 0.9972744, 1.0],
+      [0.0, 1.0, 1.0],
+      [-5.2213855, 0.95285964, 1.0],
+      [-2.4940815, 0.8997929, 1.0],
+      [-0.48827216, 0.956785, 1.0],
+      [0.22012724, 0.9936011, 1.0],
+      [0.0, 1.0, 1.0],
+      [-6.361059, 0.9966289, 1.0],
+      [-4.30683, 0.97904444, 1.0],
+      [-0.99236, 0.99435294, 1.0],
+      [0.009188855, 0.99846935, 1.0],
+      [0.0, 1.0, 1.0],
+      [-8.2860985, 1.0472525, 1.0],
+      [-4.832397, 1.016574, 1.0],
+      [-1.5982567, 0.96859825, 1.0],
+      [-0.58968186, 0.9639687, 1.0],
+      [0.0, 1.0, 1.0],
+      [-8.645831, 1.0387725, 1.0],
+      [-4.62883, 0.99550915, 1.0],
+      [-2.1827693, 0.89403373, 1.0],
+      [-0.32529926, 0.9052658, 1.0],
+      [0.0, 1.0, 1.0],
+      [-8.275511, 1.0268661, 1.0],
+      [-6.3909574, 0.9760469, 1.0],
+      [-7.4211764, 0.8973423, 1.0],
+      [-2.6890829, 0.9495063, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.703486, 1.0061108, 1.0],
+      [-7.5075417, 0.95615023, 1.0],
+      [-7.846866, 0.88695526, 1.0],
+      [-3.1512766, 0.9450091, 1.0],
+      [0.0, 1.0, 1.0],
+      [-11.724224, 0.97924507, 1.0],
+      [-7.2378116, 0.9570293, 1.0],
+      [-6.0934024, 0.91340625, 1.0],
+      [-1.4091715, 0.97521883, 1.0],
+      [0.0, 1.0, 1.0],
+      [-15.354833, 0.944077, 1.0],
+      [-11.498621, 0.93437237, 1.0],
+      [-10.131048, 0.8965729, 1.0],
+      [-2.5142438, 0.97270924, 1.0],
+      [0.0, 1.0, 1.0],
+      [-16.9717, 0.904382, 1.0],
+      [-15.424872, 0.87748027, 1.0],
+      [-19.262257, 0.8070707, 1.0],
+      [-8.481445, 0.91010606, 1.0],
+      [0.0, 1.0, 1.0],
+      [-16.93574, 0.86007816, 1.0],
+      [-14.099674, 0.8571838, 1.0],
+      [-18.867304, 0.7990837, 1.0],
+      [-9.067885, 0.89900285, 1.0],
+      [0.0, 1.0, 1.0],
+      [-17.21487, 0.795665, 1.0],
+      [-14.66645, 0.8218075, 1.0],
+      [-20.941486, 0.75604767, 1.0],
+      [-14.4985485, 0.8239577, 1.0],
+      [0.0, 1.0, 1.0],
+      [-19.005753, 0.758779, 1.0],
+      [-16.680302, 0.7971698, 1.0],
+      [-23.688643, 0.7191442, 1.0],
+      [-21.129248, 0.7400342, 1.0],
+      [0.0, 1.0, 1.0],
+      [-18.484707, 0.78127193, 1.0],
+      [-17.147287, 0.8205015, 1.0],
+      [-16.7867, 0.8153531, 1.0],
+      [-6.6663785, 0.8562561, 1.0],
+      [0.0, 1.0, 1.0],
+      [-17.904772, 0.7992509, 1.0],
+      [-16.290035, 0.8404375, 1.0],
+      [-14.898, 0.84211147, 1.0],
+      [-2.2072968, 0.9246411, 1.0],
+      [0.0, 1.0, 1.0],
+      [-17.892328, 0.7252675, 1.0],
+      [-12.422257, 0.84525913, 1.0],
+      [-7.915848, 0.90744674, 1.0],
+      [-2.4332101, 0.9394951, 1.0],
+      [0.0, 1.0, 1.0],
+      [-12.256403, 0.7670256, 1.0],
+      [-7.3728104, 0.89708215, 1.0],
+      [-4.5105395, 0.97277874, 1.0],
+      [-1.5832016, 0.9920798, 1.0],
+      [0.0, 1.0, 1.0],
+      [-8.016388, 0.830646, 1.0],
+      [-4.5538907, 0.95883, 1.0],
+      [-2.5789335, 1.0234452, 1.0],
+      [-1.105107, 1.0530177, 1.0],
+      [0.0, 1.0, 1.0],
+      [-7.20433, 0.7782197, 1.0],
+      [-3.208458, 0.96606797, 1.0],
+      [-1.2935421, 1.0479633, 1.0],
+      [-0.0024548925, 1.0702269, 1.0],
+      [0.0, 1.0, 1.0],
+      [-4.574243, 0.6783128, 1.0],
+      [-0.29323265, 0.85936415, 1.0],
+      [1.1714814, 1.0271277, 1.0],
+      [1.6805246, 1.0721738, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.44121024, 0.69732547, 1.0],
+      [2.5033805, 0.8090156, 1.0],
+      [2.4892168, 1.0115892, 1.0],
+      [2.4337752, 1.0545831, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.7189965, 0.7012635, 1.0],
+      [3.8152018, 0.79624814, 1.0],
+      [4.6650043, 1.0100449, 1.0],
+      [4.9573836, 1.0277257, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.6361694, 0.6836669, 1.0],
+      [5.552024, 0.82980967, 1.0],
+      [7.0284324, 1.0110646, 1.0],
+      [7.0502753, 1.0152555, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.356563, 0.66799754, 1.0],
+      [7.49933, 0.86984295, 1.0],
+      [8.87279, 1.0068405, 1.0],
+      [8.66629, 1.0076414, 1.0],
+      [0.0, 1.0, 1.0],
+      [10.443153, 0.6744798, 1.0],
+      [8.668258, 0.89632285, 1.0],
+      [10.57484, 0.9984911, 1.0],
+      [10.112442, 1.0011668, 1.0],
+      [0.0, 1.0, 1.0],
+      [12.3462305, 0.69375634, 1.0],
+      [8.875547, 0.9268088, 1.0],
+      [11.964839, 0.98318386, 1.0],
+      [11.041635, 0.98537666, 1.0],
+      [0.0, 1.0, 1.0],
+      [13.036472, 0.71343744, 1.0],
+      [11.375755, 0.9281431, 1.0],
+      [13.321662, 0.9727517, 1.0],
+      [11.939063, 0.9759464, 1.0],
+      [0.0, 1.0, 1.0],
+      [12.724641, 0.77864206, 1.0],
+      [12.92866, 0.9616247, 1.0],
+      [13.789892, 0.96263355, 1.0],
+      [10.826783, 0.966194, 1.0],
+      [0.0, 1.0, 1.0],
+      [14.19844, 0.8416513, 1.0],
+      [15.266627, 0.9758373, 1.0],
+      [14.160454, 0.96900314, 1.0],
+      [6.107243, 0.977027, 1.0],
+      [0.0, 1.0, 1.0],
+      [12.747447, 0.88937104, 1.0],
+      [15.23662, 0.99281013, 1.0],
+      [13.870695, 0.9845561, 1.0],
+      [3.245, 0.992735, 1.0],
+      [0.0, 1.0, 1.0],
+      [11.464138, 0.9069218, 1.0],
+      [13.882505, 0.99412805, 1.0],
+      [12.3678875, 0.984619, 1.0],
+      [2.4400496, 0.9936844, 1.0],
+      [0.0, 1.0, 1.0],
+      [10.054893, 0.9309123, 1.0],
+      [11.051042, 0.9889742, 1.0],
+      [9.503872, 0.9689598, 1.0],
+      [2.0153925, 0.98796266, 1.0],
+      [0.0, 1.0, 1.0],
+      [9.463208, 0.9101172, 1.0],
+      [7.3157954, 0.9752043, 1.0],
+      [6.0373473, 0.95434564, 1.0],
+      [1.4550027, 0.9813375, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.941972, 0.91271096, 1.0],
+      [4.060063, 0.9565896, 1.0],
+      [2.8974419, 0.94200397, 1.0],
+      [0.63167155, 0.97762823, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.7601333, 0.8894366, 1.0],
+      [1.375002, 0.936908, 1.0],
+      [-1.5859069, 0.9271758, 1.0],
+      [-0.71164757, 0.9791451, 1.0],
+      [0.0, 1.0, 1.0],
+      [8.1289625, 0.8806327, 1.0],
+      [-1.5395085, 0.93572843, 1.0],
+      [-5.483463, 0.9259951, 1.0],
+      [-1.7303535, 0.97720516, 1.0],
+      [0.0, 1.0, 1.0],
+      [8.060848, 0.89185596, 1.0],
+      [-2.4483445, 0.95255435, 1.0],
+      [-7.1547413, 0.9442576, 1.0],
+      [-2.1877682, 0.98242164, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.4304748, 0.86830884, 1.0],
+      [-1.4413718, 0.9585318, 1.0],
+      [-4.279423, 0.9782264, 1.0],
+      [-0.973853, 0.9942283, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.0025797, 0.86645776, 1.0],
+      [-1.0643132, 0.94587845, 1.0],
+      [-2.816222, 0.9981094, 1.0],
+      [-0.6120733, 0.999216, 1.0],
+      [0.0, 1.0, 1.0],
+      [5.2618656, 0.87934244, 1.0],
+      [-1.9260371, 0.92144936, 1.0],
+      [-3.44394, 0.9980872, 1.0],
+      [-0.8797513, 1.0006056, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.48014, 0.9191667, 1.0],
+      [-2.3073015, 0.9339955, 1.0],
+      [-2.6852305, 0.9934067, 1.0],
+      [-0.5358713, 1.0003943, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.1199076, 0.94316065, 1.0],
+      [-3.2203076, 0.9512757, 1.0],
+      [-3.2261748, 0.98376966, 1.0],
+      [-1.225657, 0.99541444, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.5250582, 0.87108445, 1.0],
+      [-2.2838533, 0.8486961, 1.0],
+      [-3.0364053, 0.91204727, 1.0],
+      [-2.5156116, 0.9678634, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.9791424, 0.90573484, 1.0],
+      [-1.1473076, 0.85067075, 1.0],
+      [-4.143441, 0.83307755, 1.0],
+      [-3.6135044, 0.8626736, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.1917787, 0.8886335, 1.0],
+      [1.4209502, 0.84427315, 1.0],
+      [-1.902567, 0.8220766, 1.0],
+      [-1.2590855, 0.84276557, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.5577917, 0.8582681, 1.0],
+      [4.414367, 0.8102154, 1.0],
+      [1.2046701, 0.8105167, 1.0],
+      [1.181831, 0.82471985, 1.0],
+      [0.0, 1.0, 1.0],
+      [5.644376, 0.800012, 1.0],
+      [4.4705477, 0.738722, 1.0],
+      [4.9720116, 0.78066784, 1.0],
+      [6.1397104, 0.79611427, 1.0],
+      [0.0, 1.0, 1.0],
+      [5.2449017, 0.72134954, 1.0],
+      [3.139061, 0.68135095, 1.0],
+      [3.8384428, 0.7519106, 1.0],
+      [6.912432, 0.7883944, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.7535887, 0.67236185, 1.0],
+      [1.6767513, 0.6455759, 1.0],
+      [1.2658948, 0.7090765, 1.0],
+      [4.059322, 0.7603392, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.5784483, 0.6933753, 1.0],
+      [0.27928707, 0.699313, 1.0],
+      [2.2699614, 0.6997288, 1.0],
+      [6.3981876, 0.672012, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.7372062, 0.6813957, 1.0],
+      [1.5830798, 0.67802733, 1.0],
+      [3.873308, 0.6486227, 1.0],
+      [5.3511515, 0.6483506, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.6191099, 0.6723053, 1.0],
+      [2.7363768, 0.64387995, 1.0],
+      [3.5159998, 0.6142523, 1.0],
+      [2.8553054, 0.64838594, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.7020638, 0.6383956, 1.0],
+      [2.3508477, 0.6238232, 1.0],
+      [2.9867542, 0.61862445, 1.0],
+      [2.3013074, 0.64164305, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.380534, 0.6982154, 1.0],
+      [1.8927245, 0.6699597, 1.0],
+      [2.130032, 0.6536506, 1.0],
+      [1.440734, 0.64402896, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.307678, 0.74071306, 1.0],
+      [2.2724662, 0.70253104, 1.0],
+      [1.6237959, 0.6603189, 1.0],
+      [-0.29978958, 0.64183867, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.4868233, 0.7586426, 1.0],
+      [1.4523857, 0.7366422, 1.0],
+      [-0.15140325, 0.68974066, 1.0],
+      [-1.4498984, 0.65608776, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.5952954, 0.81705433, 1.0],
+      [0.3610198, 0.76384574, 1.0],
+      [-1.1764607, 0.7085227, 1.0],
+      [-2.0014498, 0.66375816, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.009735043, 0.8393661, 1.0],
+      [-0.52455544, 0.74124515, 1.0],
+      [-0.48256284, 0.7240061, 1.0],
+      [-4.231129, 0.6864818, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.5011253, 0.85113287, 1.0],
+      [-1.526793, 0.741856, 1.0],
+      [-3.389466, 0.69727397, 1.0],
+      [-10.565374, 0.63681203, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.5787122, 0.8358186, 1.0],
+      [-1.0496063, 0.7413957, 1.0],
+      [-6.023933, 0.6728621, 1.0],
+      [-16.243042, 0.57179403, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.5238857, 0.81381685, 1.0],
+      [-3.973887, 0.73654264, 1.0],
+      [-13.029781, 0.5978037, 1.0],
+      [-18.08632, 0.5250716, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.3169994, 0.8272504, 1.0],
+      [-8.047612, 0.7040424, 1.0],
+      [-16.19256, 0.52720886, 1.0],
+      [-17.492706, 0.50534374, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.432385, 0.8549761, 1.0],
+      [-4.998627, 0.67764604, 1.0],
+      [-8.85871, 0.51909405, 1.0],
+      [-9.629815, 0.5025227, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.8054225, 0.83563244, 1.0],
+      [2.1752064, 0.66142064, 1.0],
+      [12.088789, 0.54614425, 1.0],
+      [12.621284, 0.51645017, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.066309, 0.7654777, 1.0],
+      [9.837004, 0.6236221, 1.0],
+      [17.423119, 0.5883316, 1.0],
+      [21.496513, 0.5862999, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.741904, 0.7127471, 1.0],
+      [9.628795, 0.64409775, 1.0],
+      [10.995573, 0.6744512, 1.0],
+      [6.354313, 0.84476554, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.6841927, 0.7843752, 1.0],
+      [8.19482, 0.7160338, 1.0],
+      [6.0010133, 0.7742455, 1.0],
+      [0.18970187, 0.94752014, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.842979, 0.8000173, 1.0],
+      [11.690232, 0.739449, 1.0],
+      [5.110884, 0.80710995, 1.0],
+      [-1.2012933, 0.922968, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.3574314, 0.84719974, 1.0],
+      [5.8742213, 0.8123406, 1.0],
+      [2.516008, 0.8360613, 1.0],
+      [-0.37090135, 0.9494042, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.4409087, 0.846134, 1.0],
+      [-0.13644595, 0.8567972, 1.0],
+      [-3.2113655, 0.839664, 1.0],
+      [-1.5690522, 0.91481286, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.6356204, 0.8613304, 1.0],
+      [-1.9126496, 0.8373374, 1.0],
+      [-10.372357, 0.78524256, 1.0],
+      [-6.5644794, 0.844308, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.35381076, 0.93528235, 1.0],
+      [-2.7392008, 0.89980006, 1.0],
+      [-9.026086, 0.7895136, 1.0],
+      [-4.9918127, 0.83979625, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.22767301, 0.91764885, 1.0],
+      [-0.28452978, 0.84251344, 1.0],
+      [-1.9016887, 0.84161645, 1.0],
+      [0.3422665, 0.93315935, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.123091474, 0.89455956, 1.0],
+      [-2.1685836, 0.84581566, 1.0],
+      [1.3732817, 0.84082806, 1.0],
+      [2.6831613, 0.92868334, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.86503315, 0.88304895, 1.0],
+      [-1.5601242, 0.91238695, 1.0],
+      [0.37940353, 0.93464494, 1.0],
+      [1.0456579, 0.96896976, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.7394576, 0.89377844, 1.0],
+      [-2.3233414, 0.9390823, 1.0],
+      [-5.721086, 0.8329246, 1.0],
+      [-3.1057966, 0.82862717, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.6411211, 0.92481196, 1.0],
+      [-2.3975968, 0.85534614, 1.0],
+      [-5.8770084, 0.68478525, 1.0],
+      [-1.5260915, 0.6935012, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.2765417, 0.9208617, 1.0],
+      [-12.06742, 0.81020206, 1.0],
+      [-20.405844, 0.7374704, 1.0],
+      [-12.597571, 0.79101664, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.897616, 0.9211402, 1.0],
+      [-14.421744, 0.7903851, 1.0],
+      [-19.214266, 0.71761405, 1.0],
+      [-13.390762, 0.7809222, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.158559, 0.93960077, 1.0],
+      [-11.273947, 0.7577517, 1.0],
+      [-13.330117, 0.7017324, 1.0],
+      [-5.7236233, 0.8588474, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.592437, 0.9224862, 1.0],
+      [-1.9768095, 0.79358673, 1.0],
+      [-2.52034, 0.80400187, 1.0],
+      [-0.77087885, 0.96653724, 1.0],
+      [0.0, 1.0, 1.0],
+      [-4.4444714, 0.9292429, 1.0],
+      [1.6647115, 0.8260513, 1.0],
+      [1.4503638, 0.8003794, 1.0],
+      [-0.4073486, 0.9618924, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.7638762, 0.8422526, 1.0],
+      [-1.7696239, 0.8175861, 1.0],
+      [-2.5969453, 0.82940525, 1.0],
+      [-1.4243466, 0.9425862, 1.0],
+      [0.0, 1.0, 1.0],
+      [-5.8228145, 0.77634525, 1.0],
+      [-8.170251, 0.7666279, 1.0],
+      [-7.5123396, 0.81542164, 1.0],
+      [-1.8198384, 0.95125085, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.360387, 0.7797565, 1.0],
+      [-11.051248, 0.7752701, 1.0],
+      [-9.444043, 0.77841234, 1.0],
+      [-0.21361573, 0.87572235, 1.0],
+      [0.0, 1.0, 1.0],
+      [-13.2849245, 0.7415836, 1.0],
+      [-13.399887, 0.7924007, 1.0],
+      [4.650317, 0.81708753, 1.0],
+      [18.099548, 0.862965, 1.0],
+      [0.0, 1.0, 1.0],
+      [-14.249046, 0.7239625, 1.0],
+      [-12.644726, 0.787061, 1.0],
+      [1.3048109, 0.795617, 1.0],
+      [9.834041, 0.8405552, 1.0],
+      [0.0, 1.0, 1.0],
+      [-17.444523, 0.5949457, 1.0],
+      [-13.476753, 0.6840091, 1.0],
+      [-12.6381235, 0.6644669, 1.0],
+      [-9.62859, 0.6923138, 1.0],
+      [0.0, 1.0, 1.0],
+      [-14.0186615, 0.6051366, 1.0],
+      [-10.975076, 0.6890023, 1.0],
+      [-10.500401, 0.6949134, 1.0],
+      [-8.894962, 0.72246975, 1.0],
+      [0.0, 1.0, 1.0],
+      [-10.543245, 0.67233354, 1.0],
+      [-8.299539, 0.78261155, 1.0],
+      [-7.1005125, 0.845384, 1.0],
+      [-4.664283, 0.8898768, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.807613, 0.6154132, 1.0],
+      [-7.3155074, 0.76350015, 1.0],
+      [-5.8409595, 0.86448425, 1.0],
+      [-3.3455367, 0.93252707, 1.0],
+      [0.0, 1.0, 1.0],
+      [-7.5137596, 0.5462595, 1.0],
+      [-3.004627, 0.658936, 1.0],
+      [-1.8417222, 0.8381658, 1.0],
+      [-1.8682895, 0.9441728, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.9677281, 0.56995666, 1.0],
+      [0.90389174, 0.6623684, 1.0],
+      [1.5478073, 0.8449315, 1.0],
+      [0.2826305, 0.8891036, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.82919896, 0.63599986, 1.0],
+      [2.8135967, 0.7249443, 1.0],
+      [7.3101892, 0.9042873, 1.0],
+      [7.7040653, 0.9522446, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.789316, 0.6838728, 1.0],
+      [4.7111635, 0.81004953, 1.0],
+      [9.877694, 0.9593944, 1.0],
+      [10.302842, 0.9809844, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.4230366, 0.7425048, 1.0],
+      [3.738975, 0.84671533, 1.0],
+      [10.307028, 0.958077, 1.0],
+      [10.699147, 0.9737339, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.8469787, 0.7797298, 1.0],
+      [4.6221204, 0.8404099, 1.0],
+      [9.099866, 0.9094019, 1.0],
+      [8.047509, 0.95190895, 1.0],
+      [0.0, 1.0, 1.0],
+      [5.217233, 0.7993761, 1.0],
+      [1.3621497, 0.8585704, 1.0],
+      [4.016475, 0.86902857, 1.0],
+      [3.1859565, 0.94888914, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.6767554, 0.8303384, 1.0],
+      [2.1546807, 0.8991955, 1.0],
+      [3.7274258, 0.9081848, 1.0],
+      [1.5931357, 0.9754997, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.6186461, 0.8725928, 1.0],
+      [-0.23522311, 0.9146301, 1.0],
+      [0.9835199, 0.91176814, 1.0],
+      [0.58563864, 0.9759792, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.1956127, 0.8745205, 1.0],
+      [-0.72214097, 0.8934399, 1.0],
+      [0.99975485, 0.9016286, 1.0],
+      [0.34649053, 0.98511404, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.01588, 0.8797899, 1.0],
+      [-0.11028997, 0.90068436, 1.0],
+      [2.4051347, 0.8929491, 1.0],
+      [0.31044072, 0.98858964, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.801372, 0.9000487, 1.0],
+      [3.2723014, 0.94898623, 1.0],
+      [3.251487, 0.95616883, 1.0],
+      [0.26165524, 0.9953507, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.3384478, 0.94916874, 1.0],
+      [-0.76461834, 0.9320178, 1.0],
+      [-1.0340531, 0.937888, 1.0],
+      [-0.2052262, 0.9910225, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.5522646, 0.8218283, 1.0],
+      [-7.093138, 0.7325952, 1.0],
+      [-3.7177348, 0.77458364, 1.0],
+      [-0.5455225, 0.9524443, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.41480815, 0.85181725, 1.0],
+      [-0.36262518, 0.7285184, 1.0],
+      [1.2038608, 0.76166785, 1.0],
+      [0.34981248, 0.9373231, 1.0],
+      [0.0, 1.0, 1.0],
+      [3.0183747, 0.8615714, 1.0],
+      [6.522213, 0.7130658, 1.0],
+      [4.7299647, 0.7329898, 1.0],
+      [0.69027966, 0.9252049, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.8928224, 0.86741346, 1.0],
+      [-0.22437978, 0.85102594, 1.0],
+      [-4.3790607, 0.8801903, 1.0],
+      [-1.6888652, 0.97201353, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.9431077, 0.87125516, 1.0],
+      [-6.9137535, 0.94617844, 1.0],
+      [-11.575183, 0.9801642, 1.0],
+      [-2.7485921, 0.99310756, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.68844545, 0.8476669, 1.0],
+      [-6.3806562, 0.9206668, 1.0],
+      [-11.188042, 0.98616713, 1.0],
+      [-1.8384333, 0.9988374, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.11813285, 0.83367205, 1.0],
+      [-5.729458, 0.87351876, 1.0],
+      [-9.243516, 0.94089884, 1.0],
+      [-1.174662, 0.994138, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.088543095, 0.81548285, 1.0],
+      [-2.1764681, 0.8262967, 1.0],
+      [-2.4391656, 0.9571753, 1.0],
+      [-0.27592131, 0.99790347, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.30223542, 0.8490914, 1.0],
+      [-2.565041, 0.84209675, 1.0],
+      [-0.73276377, 0.9614384, 1.0],
+      [-0.06476155, 0.9990294, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.5150307, 0.87056994, 1.0],
+      [-2.4532168, 0.83294433, 1.0],
+      [-1.4075577, 0.94370353, 1.0],
+      [-0.6351769, 0.9955674, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.843285, 1.0033246, 1.0],
+      [7.4428577, 0.95056987, 1.0],
+      [2.108944, 0.94717664, 1.0],
+      [-0.25893068, 0.99069285, 1.0],
+      [0.0, 1.0, 1.0],
+      [9.999977, 1.0822781, 1.0],
+      [12.696831, 1.0251509, 1.0],
+      [5.93438, 0.93318224, 1.0],
+      [0.086959586, 0.9213895, 1.0],
+      [0.0, 1.0, 1.0],
+      [11.269931, 1.041934, 1.0],
+      [13.652761, 1.0116991, 1.0],
+      [7.9889326, 0.8788855, 1.0],
+      [6.5503616, 0.8362481, 1.0],
+      [0.0, 1.0, 1.0],
+      [9.251398, 0.93022597, 1.0],
+      [9.773671, 0.9091432, 1.0],
+      [11.005983, 0.7908927, 1.0],
+      [14.940665, 0.7742994, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.4155545, 0.85385036, 1.0],
+      [8.46417, 0.829654, 1.0],
+      [12.680234, 0.7829167, 1.0],
+      [16.267979, 0.77082276, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.912974, 0.8363341, 1.0],
+      [7.421986, 0.7468915, 1.0],
+      [13.157313, 0.70293534, 1.0],
+      [15.670254, 0.72895324, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.2732983, 0.83324426, 1.0],
+      [4.6879416, 0.76169664, 1.0],
+      [10.194166, 0.70281017, 1.0],
+      [15.137923, 0.6564709, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.691554, 0.8958847, 1.0],
+      [2.522616, 0.835281, 1.0],
+      [9.138479, 0.64440495, 1.0],
+      [13.552704, 0.5891457, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.0758106, 0.8807258, 1.0],
+      [3.3481083, 0.76597595, 1.0],
+      [9.720517, 0.59901714, 1.0],
+      [11.450588, 0.57016766, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.6788739, 0.8362954, 1.0],
+      [4.2696314, 0.6845474, 1.0],
+      [6.650018, 0.60105395, 1.0],
+      [7.2880855, 0.60911906, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.7132614, 0.8527012, 1.0],
+      [4.419341, 0.72993284, 1.0],
+      [5.6017246, 0.65223414, 1.0],
+      [5.9043407, 0.6311042, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.8517584, 0.93619037, 1.0],
+      [3.993357, 0.8524601, 1.0],
+      [4.7696304, 0.73141557, 1.0],
+      [5.134474, 0.6413797, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.8878054, 0.9270773, 1.0],
+      [3.787974, 0.889603, 1.0],
+      [2.4917884, 0.7853351, 1.0],
+      [-1.3098156, 0.6682702, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.0253179, 0.92877746, 1.0],
+      [4.033826, 0.9008868, 1.0],
+      [2.3986337, 0.83885485, 1.0],
+      [-2.687886, 0.695036, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.32751077, 0.94140244, 1.0],
+      [2.0182226, 0.85748637, 1.0],
+      [-1.1619195, 0.7632388, 1.0],
+      [-5.5223203, 0.6635563, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.050555307, 0.9604787, 1.0],
+      [0.5055935, 0.83031297, 1.0],
+      [-1.6055543, 0.70797473, 1.0],
+      [-8.740934, 0.6385445, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.79567736, 0.96682066, 1.0],
+      [-3.8943377, 0.8166324, 1.0],
+      [-5.3518414, 0.68081903, 1.0],
+      [-8.843345, 0.6458594, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.6558982, 0.9616084, 1.0],
+      [-5.2786994, 0.80397224, 1.0],
+      [-10.992683, 0.63992244, 1.0],
+      [-16.177847, 0.58813363, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.75773, 0.9437587, 1.0],
+      [-6.6879635, 0.7789285, 1.0],
+      [-14.333078, 0.6058587, 1.0],
+      [-18.033953, 0.5445878, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.043338794, 0.9552455, 1.0],
+      [-5.321281, 0.83083135, 1.0],
+      [-16.969313, 0.5537831, 1.0],
+      [-19.017706, 0.51461524, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.0175552, 0.9202445, 1.0],
+      [-2.6896808, 0.7869496, 1.0],
+      [-9.4466, 0.5490753, 1.0],
+      [-10.706868, 0.5131165, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.088289, 0.8988069, 1.0],
+      [-0.30899394, 0.75239635, 1.0],
+      [9.381413, 0.59920007, 1.0],
+      [12.207738, 0.5500292, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.4638748, 0.87054735, 1.0],
+      [5.293201, 0.7064153, 1.0],
+      [13.263786, 0.6700958, 1.0],
+      [17.00946, 0.66093135, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.8831717, 0.8199807, 1.0],
+      [4.7780185, 0.6955879, 1.0],
+      [1.744097, 0.76860195, 1.0],
+      [1.6281474, 0.8714117, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.23940727, 0.86877394, 1.0],
+      [-3.3042376, 0.77865523, 1.0],
+      [-12.2173395, 0.7857939, 1.0],
+      [-8.226082, 0.87283903, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.590711, 0.8670613, 1.0],
+      [6.093016, 0.75086886, 1.0],
+      [-8.317774, 0.7136495, 1.0],
+      [-12.525191, 0.7473165, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.1493275, 0.8251384, 1.0],
+      [1.9776939, 0.76206553, 1.0],
+      [-6.1686516, 0.72631574, 1.0],
+      [-6.670901, 0.8287188, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.16302122, 0.8325588, 1.0],
+      [-2.9226806, 0.84611636, 1.0],
+      [-4.327261, 0.8001389, 1.0],
+      [-1.8962665, 0.88277936, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.857538, 0.87345517, 1.0],
+      [-4.3408766, 0.82445586, 1.0],
+      [-10.225279, 0.7459497, 1.0],
+      [-7.025876, 0.81165254, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.5294373, 0.88929296, 1.0],
+      [-2.200273, 0.8323351, 1.0],
+      [-10.405199, 0.74956995, 1.0],
+      [-6.132038, 0.81040746, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.16174325, 0.96300906, 1.0],
+      [-2.8326685, 0.88233006, 1.0],
+      [-1.4370927, 0.8078291, 1.0],
+      [2.6871767, 0.8748735, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.3610977, 0.96746254, 1.0],
+      [-3.2795222, 0.9109032, 1.0],
+      [-0.09399727, 0.89467824, 1.0],
+      [1.9920977, 0.94535923, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.7663058, 0.9140197, 1.0],
+      [-1.8021601, 0.91958934, 1.0],
+      [0.29760635, 0.93971634, 1.0],
+      [0.9959274, 0.97391975, 1.0],
+      [0.0, 1.0, 1.0],
+      [2.160797, 0.8958013, 1.0],
+      [1.4534999, 0.89726895, 1.0],
+      [0.68010294, 0.89640915, 1.0],
+      [-0.5888536, 0.93606305, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.0493987, 0.968603, 1.0],
+      [0.9824815, 0.89990664, 1.0],
+      [-0.49817523, 0.7474924, 1.0],
+      [-1.0627013, 0.79141307, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.48714, 0.9750619, 1.0],
+      [-2.067653, 0.8603522, 1.0],
+      [-8.571636, 0.7305363, 1.0],
+      [-4.7118134, 0.8108301, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.725708, 0.98409593, 1.0],
+      [-7.151362, 0.8263027, 1.0],
+      [-12.0670395, 0.7186623, 1.0],
+      [-6.794398, 0.8430157, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.816568, 0.9682442, 1.0],
+      [-7.979974, 0.7548534, 1.0],
+      [-12.051381, 0.6975676, 1.0],
+      [-6.639557, 0.8519053, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.947905, 0.92271626, 1.0],
+      [-11.209933, 0.7695706, 1.0],
+      [-13.407172, 0.7412468, 1.0],
+      [-4.071555, 0.91521406, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.0821028, 0.9144603, 1.0],
+      [-4.187682, 0.8065792, 1.0],
+      [-5.4081926, 0.75121087, 1.0],
+      [-2.8812873, 0.896328, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.7102738, 0.89479977, 1.0],
+      [1.0865877, 0.75759023, 1.0],
+      [-2.4494224, 0.68042827, 1.0],
+      [-4.5266833, 0.78840774, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.7601203, 0.91100687, 1.0],
+      [-0.37138972, 0.77027845, 1.0],
+      [-1.2509688, 0.72588146, 1.0],
+      [-1.5607324, 0.8591345, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.8733535, 0.9064345, 1.0],
+      [-3.315706, 0.7831079, 1.0],
+      [1.3590022, 0.72675896, 1.0],
+      [6.3603826, 0.8151842, 1.0],
+      [0.0, 1.0, 1.0],
+      [1.1287688, 0.9338128, 1.0],
+      [1.2533982, 0.73052305, 1.0],
+      [13.717384, 0.74975586, 1.0],
+      [18.239985, 0.8096522, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.185362, 0.8746891, 1.0],
+      [-5.5458236, 0.6902374, 1.0],
+      [2.3753786, 0.7056687, 1.0],
+      [7.2279525, 0.7721612, 1.0],
+      [0.0, 1.0, 1.0],
+      [-5.603719, 0.7863287, 1.0],
+      [-11.014495, 0.64638335, 1.0],
+      [-13.238409, 0.6131685, 1.0],
+      [-11.532672, 0.64018786, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.553351, 0.64817256, 1.0],
+      [-10.655705, 0.5973265, 1.0],
+      [-11.155985, 0.6075254, 1.0],
+      [-8.812423, 0.6737688, 1.0],
+      [0.0, 1.0, 1.0],
+      [-12.175202, 0.59095675, 1.0],
+      [-12.133568, 0.60512704, 1.0],
+      [-9.002674, 0.67072225, 1.0],
+      [-3.0383387, 0.8035592, 1.0],
+      [0.0, 1.0, 1.0],
+      [-12.228456, 0.5612792, 1.0],
+      [-11.996711, 0.59280115, 1.0],
+      [-9.705961, 0.687603, 1.0],
+      [-7.773533, 0.80342376, 1.0],
+      [0.0, 1.0, 1.0],
+      [-8.663709, 0.5645525, 1.0],
+      [-7.764659, 0.6173788, 1.0],
+      [-10.524891, 0.75197405, 1.0],
+      [-11.214434, 0.77335423, 1.0],
+      [0.0, 1.0, 1.0],
+      [-5.396718, 0.67858976, 1.0],
+      [-7.135087, 0.71634585, 1.0],
+      [-2.9309926, 0.74045223, 1.0],
+      [-4.4241138, 0.7625005, 1.0],
+      [0.0, 1.0, 1.0],
+      [-7.4634604, 0.93015254, 1.0],
+      [-11.637723, 0.8254694, 1.0],
+      [1.3877314, 0.75356996, 1.0],
+      [7.4537945, 0.7911049, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.0797722, 0.8257694, 1.0],
+      [-9.952251, 0.7275845, 1.0],
+      [-1.22222, 0.76648885, 1.0],
+      [8.443583, 0.86626667, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.719869, 0.81726277, 1.0],
+      [-8.175672, 0.6951251, 1.0],
+      [-5.122706, 0.7475115, 1.0],
+      [2.8121452, 0.87993133, 1.0],
+      [0.0, 1.0, 1.0],
+      [-0.5990696, 0.8328561, 1.0],
+      [-0.61761487, 0.68436635, 1.0],
+      [-1.5171839, 0.73146296, 1.0],
+      [-1.249486, 0.9136568, 1.0],
+      [0.0, 1.0, 1.0],
+      [-1.1546803, 0.9241708, 1.0],
+      [-4.1920066, 0.75697076, 1.0],
+      [-4.5107627, 0.73179376, 1.0],
+      [-2.238509, 0.89131826, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.956483, 0.96588635, 1.0],
+      [-1.0265821, 0.84155124, 1.0],
+      [-2.66922, 0.8079714, 1.0],
+      [-2.6284955, 0.95289963, 1.0],
+      [0.0, 1.0, 1.0],
+      [-2.347914, 0.93753785, 1.0],
+      [-1.3445268, 0.83233905, 1.0],
+      [-4.9731174, 0.79405123, 1.0],
+      [-4.1485014, 0.9415318, 1.0],
+      [0.0, 1.0, 1.0],
+      [-5.317987, 0.923656, 1.0],
+      [-4.806357, 0.8041632, 1.0],
+      [-4.5212965, 0.7689882, 1.0],
+      [-1.453726, 0.9560485, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.224498, 0.98964065, 1.0],
+      [-10.262257, 0.8849552, 1.0],
+      [-2.7684932, 0.7562575, 1.0],
+      [-0.23699033, 0.9539201, 1.0],
+      [0.0, 1.0, 1.0],
+      [-3.002255, 0.97370094, 1.0],
+      [-2.716253, 0.914175, 1.0],
+      [1.5104983, 0.89325345, 1.0],
+      [0.14295425, 0.99063605, 1.0],
+      [0.0, 1.0, 1.0],
+      [0.36685634, 0.9282719, 1.0],
+      [-8.506473, 0.8523475, 1.0],
+      [-12.094891, 0.90356064, 1.0],
+      [-2.1393285, 0.9895608, 1.0],
+      [0.0, 1.0, 1.0],
+      [-9.882091, 0.7290178, 1.0],
+      [-9.057711, 0.6043994, 1.0],
+      [-4.1615314, 0.62489474, 1.0],
+      [-1.1871183, 0.8577925, 1.0],
+      [0.0, 1.0, 1.0],
+      [-4.1569786, 0.7451061, 1.0],
+      [0.43200502, 0.61813676, 1.0],
+      [5.076925, 0.62860876, 1.0],
+      [2.997295, 0.8324412, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.9129972, 0.81619036, 1.0],
+      [7.9838896, 0.63521093, 1.0],
+      [8.996219, 0.6237475, 1.0],
+      [4.1178374, 0.81866705, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.801817, 0.8912142, 1.0],
+      [8.943227, 0.74254304, 1.0],
+      [5.654569, 0.76142734, 1.0],
+      [0.74153537, 0.9477238, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.679993, 0.9053932, 1.0],
+      [0.72251046, 0.8655048, 1.0],
+      [-8.141989, 0.94272244, 1.0],
+      [-2.3421266, 1.0002514, 1.0],
+      [0.0, 1.0, 1.0],
+      [7.750666, 0.8927274, 1.0],
+      [1.6069077, 0.8618249, 1.0],
+      [-12.324378, 0.9456767, 1.0],
+      [-3.3410037, 0.99778306, 1.0],
+      [0.0, 1.0, 1.0],
+      [4.629134, 0.8679321, 1.0],
+      [-5.62241, 0.8793257, 1.0],
+      [-17.850567, 0.9430222, 1.0],
+      [-4.631688, 0.9899626, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.1155505, 0.7920305, 1.0],
+      [6.8210797, 0.7819359, 1.0],
+      [-3.9575536, 0.92559654, 1.0],
+      [-0.8186751, 0.9944719, 1.0],
+      [0.0, 1.0, 1.0],
+      [6.673559, 0.9143873, 1.0],
+      [8.677403, 0.9072902, 1.0],
+      [3.8159382, 0.9608776, 1.0],
+      [0.21488708, 0.9980647, 1.0],
+      [0.0, 1.0, 1.0],
+      [9.044622, 0.9573329, 1.0],
+      [11.07611, 0.8985059, 1.0],
+      [3.8399148, 0.9358206, 1.0],
+      [0.10755205, 0.997731, 1.0]
+    ],
+    "srgb_value": true
+  }
+}
diff --git a/assets/camera-tone/sony-dro-off.json b/assets/camera-tone/sony-dro-off.json
new file mode 100644
index 00000000..46397044
--- /dev/null
+++ b/assets/camera-tone/sony-dro-off.json
@@ -0,0 +1,52 @@
+{
+  "description": "Sony's global tone curve with the Dynamic Range Optimizer (DRO) off, Standard creative style: knots of scene luminance (white-balanced camera RGB with baseline exposure, through the colour model) to display-linear luminance. The camera look of an ARW shot with DRO on is lowered to it wherever it is darker (crates/engine/src/camera_preview.rs, docs/camera-preview-colour.md, issue #244).",
+  "derivation": "Each source raw was paired with its own embedded camera JPEG at the 96-pixel proxy of the per-photo fit (camera_preview::collect_pairs). The pairs of all 12 files were pooled as one model, as lightcraft-cli calibrate pools a camera profile: a colour matrix and hue/saturation table were fitted to the pool, and the tone curve was quantile-matched (camera_preview::fit_tone) between the pooled scene luminances through that colour model and the JPEG luminances. Knots rounded to 5 decimals. Aggregate statistics only, no image content.",
+  "sources": [
+    { "body": "ILCA-77M2", "url": "https://raw.pixls.us/data/Sony/ILCA-77M2/_DSC0244.ARW", "sha256": "f41ceff680b675460cc1fe258a24d8c8c01c52a300933f3ab6401d9a20b60dcc", "licence": "CC0" },
+    { "body": "ILCE-3500", "url": "https://raw.pixls.us/data/Sony/ILCE-3500/DSC06923.ARW", "sha256": "04c4fe04425c3e6fff7c8af0f811923c35e750300373357bd54342150c5505d8", "licence": "CC0" },
+    { "body": "ILCE-5000", "url": "https://raw.pixls.us/data/Sony/ILCE-5000/_DSC0793.ARW", "sha256": "a919c8535eed68577f1745fb9674ccf333962628ccdec6d48a6f635208467f6c", "licence": "CC0" },
+    { "body": "ILCE-6600", "url": "https://raw.pixls.us/data/Sony/ILCE-6600/_DSC0268.ARW", "sha256": "041d71d70148ca77164f19d061e3582adb34399ea5a4baba32960f2956fb0362", "licence": "CC0" },
+    { "body": "ILCE-7CR", "url": "https://raw.pixls.us/data/Sony/ILCE-7CR/DSC00798.ARW", "sha256": "f5096e8fbccf0842c8a57763cabd2836608f019eb7fd54f7b22260c2f5bc4da5", "licence": "CC0" },
+    { "body": "ILCE-7M3", "url": "https://raw.pixls.us/data/Sony/ILCE-7M3/UNCOMPRESSED_14bit.ARW", "sha256": "ece80551abf64949dbe826985a80f1d9b265401ee4ea6b989e1829549616fdcd", "licence": "CC0" },
+    { "body": "ILCE-7M3", "url": "https://raw.pixls.us/data/Sony/ILCE-7M3/_DSC0009.ARW", "sha256": "250784580ea527442c09004417bb0eead484f2bf3ee8f9121a776ac65bb50d0f", "licence": "CC0" },
+    { "body": "ILCE-7M3", "url": "https://raw.pixls.us/data/Sony/ILCE-7M3/_DSC0010.ARW", "sha256": "3ae2ff75cfa7240d0b4458f662afd28665c5fd1e83d230ac73f5ad69d3df8592", "licence": "CC0" },
+    { "body": "ILCE-7S", "url": "https://raw.pixls.us/data/Sony/ILCE-7S/DSC04125.ARW", "sha256": "7cc338a0abc8fdad32d61006f1f8f412297b93e040c7efba572eb2bd8f8e8be2", "licence": "CC0" },
+    { "body": "ILCE-9M2", "url": "https://raw.pixls.us/data/Sony/ILCE-9M2/SONY_A9II_(ILCE-9M2)_-_compressed_(3:2)_14bit.ARW", "sha256": "161c2a9da2b5f1e50be6117a0b4da0ce249660b5d7de13568d301c4034716b97", "licence": "CC0" },
+    { "body": "NEX-F3", "url": "https://raw.pixls.us/data/Sony/NEX-F3/_DSC4017.ARW", "sha256": "cfdc60d118b5ce2dce10d459dcb98ad63c6db3e609999932ca8964d86daf836b", "licence": "CC0" },
+    { "body": "SLT-A57", "url": "https://raw.pixls.us/data/Sony/SLT-A57/a57-06125.arw", "sha256": "0e9064f369a3947f892c1d7b1971f75d3879f5673134932d5cc7a67bf4263ba4", "licence": "CC0" }
+  ],
+  "knots": [
+    [0.01655, 0.01799],
+    [0.01970, 0.02376],
+    [0.02212, 0.03008],
+    [0.02469, 0.03634],
+    [0.02737, 0.04320],
+    [0.03049, 0.05044],
+    [0.03425, 0.05812],
+    [0.03824, 0.06667],
+    [0.04232, 0.07817],
+    [0.04658, 0.09059],
+    [0.05095, 0.10268],
+    [0.05550, 0.11731],
+    [0.05962, 0.13173],
+    [0.06409, 0.14529],
+    [0.06843, 0.15939],
+    [0.07314, 0.17363],
+    [0.07800, 0.18897],
+    [0.08298, 0.20502],
+    [0.08909, 0.22159],
+    [0.09693, 0.23964],
+    [0.10540, 0.26082],
+    [0.11579, 0.28882],
+    [0.12763, 0.31986],
+    [0.14079, 0.35198],
+    [0.15786, 0.39293],
+    [0.17949, 0.44101],
+    [0.20330, 0.49407],
+    [0.23466, 0.54244],
+    [0.27207, 0.60078],
+    [0.31673, 0.66533],
+    [0.38682, 0.74143],
+    [0.52622, 0.80307]
+  ]
+}
diff --git a/contributors/contributors.json b/contributors/contributors.json
index b41b08eb..eaed75d5 100644
--- a/contributors/contributors.json
+++ b/contributors/contributors.json
@@ -2,23 +2,23 @@
   "schema": 1,
   "repo": "storytold/lightcraft",
   "branch": "main",
-  "head": "2694d7089fbf4ada62c6738a7c62fecdfd5711fb",
-  "head_date": "2026-10-08T00:53:19Z",
-  "commits": 424,
+  "head": "c545cc5e842a74d65f32187d9fdee86ada3099de",
+  "head_date": "2026-10-10T05:40:18Z",
+  "commits": 1033,
   "unattributed_commits": 0,
   "contributors": [
     {
       "login": "echelon",
       "people_entry": true,
       "github_name": null,
-      "prs": 71,
-      "commits": 330,
-      "lines_added": 125623,
-      "lines_deleted": 8643,
+      "prs": 85,
+      "commits": 370,
+      "lines_added": 131038,
+      "lines_deleted": 9013,
       "binary_added": 38,
       "binary_deleted": 8,
       "first_commit": "2026-09-30T14:04:12Z",
-      "last_commit": "2026-10-08T00:32:34Z"
+      "last_commit": "2026-10-10T05:56:02Z"
     },
     {
       "login": "leipsfur",
@@ -50,40 +50,53 @@
       "login": "storybored379",
       "people_entry": false,
       "github_name": null,
-      "prs": 7,
-      "commits": 7,
-      "lines_added": 1194,
-      "lines_deleted": 82,
+      "prs": 8,
+      "commits": 9,
+      "lines_added": 1925,
+      "lines_deleted": 119,
       "binary_added": 0,
       "binary_deleted": 0,
       "first_commit": "2026-10-04T00:28:49Z",
-      "last_commit": "2026-10-06T06:51:43Z"
+      "last_commit": "2026-10-09T06:02:21Z"
     },
     {
       "login": "midasdf",
       "people_entry": false,
       "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 424,
-      "lines_deleted": 25,
+      "prs": 6,
+      "commits": 6,
+      "lines_added": 884,
+      "lines_deleted": 93,
       "binary_added": 1,
       "binary_deleted": 0,
       "first_commit": "2026-10-05T16:07:26Z",
-      "last_commit": "2026-10-05T16:07:26Z"
+      "last_commit": "2026-10-09T18:24:49Z"
     },
     {
       "login": "voshart",
       "people_entry": false,
       "github_name": null,
-      "prs": 3,
-      "commits": 12,
-      "lines_added": 2481,
-      "lines_deleted": 1389,
+      "prs": 8,
+      "commits": 26,
+      "lines_added": 30524,
+      "lines_deleted": 4416,
       "binary_added": 0,
       "binary_deleted": 0,
       "first_commit": "2026-10-05T16:23:27Z",
-      "last_commit": "2026-10-07T16:07:24Z"
+      "last_commit": "2026-10-09T02:31:04Z"
+    },
+    {
+      "login": "akvaithi",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 5,
+      "lines_added": 1799,
+      "lines_deleted": 114,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-05T16:53:56Z",
+      "last_commit": "2026-10-05T19:55:59Z"
     },
     {
       "login": "arata-1972",
@@ -124,6 +137,19 @@
       "first_commit": "2026-10-06T20:21:14Z",
       "last_commit": "2026-10-06T20:21:14Z"
     },
+    {
+      "login": "Exalted5373",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 9,
+      "commits": 15,
+      "lines_added": 4316,
+      "lines_deleted": 309,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-06T21:01:23Z",
+      "last_commit": "2026-10-09T21:58:32Z"
+    },
     {
       "login": "treyreynolds",
       "people_entry": false,
@@ -193,7 +219,7 @@
       "login": "itsmunzir",
       "people_entry": false,
       "github_name": null,
-      "prs": 1,
+      "prs": 2,
       "commits": 1,
       "lines_added": 46,
       "lines_deleted": 30,
@@ -245,40 +271,40 @@
       "login": "radialmonster",
       "people_entry": false,
       "github_name": null,
-      "prs": 3,
-      "commits": 19,
-      "lines_added": 2630,
-      "lines_deleted": 259,
+      "prs": 35,
+      "commits": 64,
+      "lines_added": 8732,
+      "lines_deleted": 822,
       "binary_added": 0,
       "binary_deleted": 0,
       "first_commit": "2026-10-07T12:33:51Z",
-      "last_commit": "2026-10-08T00:46:10Z"
+      "last_commit": "2026-10-10T02:01:36Z"
     },
     {
       "login": "bogusyogi",
       "people_entry": false,
       "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 434,
-      "lines_deleted": 29,
+      "prs": 2,
+      "commits": 17,
+      "lines_added": 5124,
+      "lines_deleted": 603,
       "binary_added": 0,
       "binary_deleted": 0,
       "first_commit": "2026-10-07T17:06:00Z",
-      "last_commit": "2026-10-07T17:06:00Z"
+      "last_commit": "2026-10-08T19:26:28Z"
     },
     {
       "login": "nledford",
       "people_entry": false,
       "github_name": null,
-      "prs": 4,
-      "commits": 8,
-      "lines_added": 525,
-      "lines_deleted": 60,
+      "prs": 19,
+      "commits": 305,
+      "lines_added": 24796,
+      "lines_deleted": 2896,
       "binary_added": 0,
       "binary_deleted": 0,
       "first_commit": "2026-10-07T17:33:38Z",
-      "last_commit": "2026-10-07T22:49:00Z"
+      "last_commit": "2026-10-09T23:05:22Z"
     },
     {
       "login": "MusseJusse",
@@ -336,14 +362,27 @@
       "login": "DWAA1660",
       "people_entry": false,
       "github_name": null,
-      "prs": 1,
-      "commits": 1,
-      "lines_added": 54,
-      "lines_deleted": 12,
+      "prs": 3,
+      "commits": 2,
+      "lines_added": 206,
+      "lines_deleted": 42,
       "binary_added": 0,
       "binary_deleted": 0,
       "first_commit": "2026-10-07T22:08:01Z",
-      "last_commit": "2026-10-07T22:08:01Z"
+      "last_commit": "2026-10-08T17:04:19Z"
+    },
+    {
+      "login": "sebastianpfluegelmeier",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 2,
+      "commits": 4,
+      "lines_added": 23063,
+      "lines_deleted": 17968,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-07T22:14:20Z",
+      "last_commit": "2026-10-08T14:38:56Z"
     },
     {
       "login": "agorevski",
@@ -371,6 +410,487 @@
       "first_commit": "2026-10-08T00:53:19Z",
       "last_commit": "2026-10-08T00:53:19Z"
     },
+    {
+      "login": "Hanmo123",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 4,
+      "commits": 6,
+      "lines_added": 922,
+      "lines_deleted": 84,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T02:16:44Z",
+      "last_commit": "2026-10-09T05:35:02Z"
+    },
+    {
+      "login": "wondarkus",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 8,
+      "lines_added": 2776,
+      "lines_deleted": 1387,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T02:56:08Z",
+      "last_commit": "2026-10-08T04:23:30Z"
+    },
+    {
+      "login": "xak47d",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 58,
+      "lines_deleted": 10,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T04:10:21Z",
+      "last_commit": "2026-10-08T04:10:21Z"
+    },
+    {
+      "login": "marceldenzer",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 2864,
+      "lines_deleted": 261,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T05:27:32Z",
+      "last_commit": "2026-10-08T05:27:32Z"
+    },
+    {
+      "login": "bflatastic",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 25,
+      "commits": 2,
+      "lines_added": 108,
+      "lines_deleted": 24,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T06:30:19Z",
+      "last_commit": "2026-10-08T14:00:00Z"
+    },
+    {
+      "login": "wstock",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 8,
+      "commits": 8,
+      "lines_added": 834,
+      "lines_deleted": 67,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T07:45:39Z",
+      "last_commit": "2026-10-08T11:55:57Z"
+    },
+    {
+      "login": "marek-hubar",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 212,
+      "lines_deleted": 29,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T09:01:44Z",
+      "last_commit": "2026-10-08T09:01:44Z"
+    },
+    {
+      "login": "switch87",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 762,
+      "lines_deleted": 34,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T11:00:29Z",
+      "last_commit": "2026-10-08T11:00:29Z"
+    },
+    {
+      "login": "h-a-n-a-s-h-i",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 0,
+      "commits": 2,
+      "lines_added": 50,
+      "lines_deleted": 50,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T12:12:53Z",
+      "last_commit": "2026-10-08T14:01:45Z"
+    },
+    {
+      "login": "Issuenate",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 107,
+      "lines_deleted": 12,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T12:26:27Z",
+      "last_commit": "2026-10-08T12:28:18Z"
+    },
+    {
+      "login": "XusBadia",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 231,
+      "lines_deleted": 1,
+      "binary_added": 2,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T13:12:32Z",
+      "last_commit": "2026-10-08T13:12:32Z"
+    },
+    {
+      "login": "MarekSpodBiedry",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 6,
+      "commits": 7,
+      "lines_added": 351,
+      "lines_deleted": 36,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T13:44:47Z",
+      "last_commit": "2026-10-09T17:29:39Z"
+    },
+    {
+      "login": "peiyan0",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 3,
+      "commits": 3,
+      "lines_added": 215,
+      "lines_deleted": 80,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T15:36:56Z",
+      "last_commit": "2026-10-09T08:09:23Z"
+    },
+    {
+      "login": "hemna",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 459,
+      "lines_deleted": 5,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T16:45:33Z",
+      "last_commit": "2026-10-08T16:45:33Z"
+    },
+    {
+      "login": "joshuaswarren",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 349,
+      "lines_deleted": 18,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T16:47:59Z",
+      "last_commit": "2026-10-08T16:47:59Z"
+    },
+    {
+      "login": "wrgdbtry",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 2733,
+      "lines_deleted": 63,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T19:22:13Z",
+      "last_commit": "2026-10-08T19:22:13Z"
+    },
+    {
+      "login": "parkerdotexe",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 0,
+      "commits": 1,
+      "lines_added": 712,
+      "lines_deleted": 84,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T19:54:50Z",
+      "last_commit": "2026-10-08T19:54:50Z"
+    },
+    {
+      "login": "ragtux",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 3,
+      "commits": 3,
+      "lines_added": 805,
+      "lines_deleted": 50,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-08T22:50:18Z",
+      "last_commit": "2026-10-08T23:42:19Z"
+    },
+    {
+      "login": "sanyamsingh001",
+      "people_entry": true,
+      "github_name": null,
+      "prs": 4,
+      "commits": 5,
+      "lines_added": 841,
+      "lines_deleted": 31,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T03:19:47Z",
+      "last_commit": "2026-10-10T01:46:07Z"
+    },
+    {
+      "login": "onemannoplan",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 1,
+      "lines_deleted": 2,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T04:53:21Z",
+      "last_commit": "2026-10-09T04:53:21Z"
+    },
+    {
+      "login": "Yijie-Si",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 0,
+      "commits": 1,
+      "lines_added": 267,
+      "lines_deleted": 43,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T06:48:00Z",
+      "last_commit": "2026-10-09T06:48:00Z"
+    },
+    {
+      "login": "HarrisXiu",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 6,
+      "commits": 6,
+      "lines_added": 1247,
+      "lines_deleted": 80,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T09:34:51Z",
+      "last_commit": "2026-10-10T05:46:24Z"
+    },
+    {
+      "login": "rock-meister",
+      "people_entry": true,
+      "github_name": "rock-meister",
+      "prs": 4,
+      "commits": 5,
+      "lines_added": 291,
+      "lines_deleted": 46,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T10:15:52Z",
+      "last_commit": "2026-10-09T15:00:07Z"
+    },
+    {
+      "login": "QuirkyTurtle94",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 5,
+      "commits": 5,
+      "lines_added": 475,
+      "lines_deleted": 77,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T11:08:11Z",
+      "last_commit": "2026-10-09T14:32:04Z"
+    },
+    {
+      "login": "AER00",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 207,
+      "lines_deleted": 21,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T12:48:11Z",
+      "last_commit": "2026-10-09T13:57:38Z"
+    },
+    {
+      "login": "AlexChambers",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 11,
+      "commits": 16,
+      "lines_added": 7202,
+      "lines_deleted": 954,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T13:59:07Z",
+      "last_commit": "2026-10-10T05:40:18Z"
+    },
+    {
+      "login": "bitshiftza",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 2,
+      "commits": 2,
+      "lines_added": 342,
+      "lines_deleted": 97,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T15:03:06Z",
+      "last_commit": "2026-10-09T18:14:49Z"
+    },
+    {
+      "login": "vbasky",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 622,
+      "lines_deleted": 10,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T17:43:31Z",
+      "last_commit": "2026-10-09T17:43:31Z"
+    },
+    {
+      "login": "kelanna",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 1169,
+      "lines_deleted": 24,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T17:51:06Z",
+      "last_commit": "2026-10-09T17:51:06Z"
+    },
+    {
+      "login": "dmatviichuk",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 2292,
+      "lines_deleted": 44,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T18:02:42Z",
+      "last_commit": "2026-10-09T18:02:42Z"
+    },
+    {
+      "login": "GarrettGR",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 5,
+      "lines_deleted": 5,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-09T19:37:15Z",
+      "last_commit": "2026-10-09T19:37:15Z"
+    },
+    {
+      "login": "dylanmtaylor",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 38,
+      "lines_deleted": 44,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-10T00:04:24Z",
+      "last_commit": "2026-10-10T00:04:24Z"
+    },
+    {
+      "login": "sawizzle",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 2,
+      "lines_added": 23,
+      "lines_deleted": 3,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-10T00:06:24Z",
+      "last_commit": "2026-10-10T04:50:51Z"
+    },
+    {
+      "login": "KitsuneSemCalda",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 1,
+      "lines_added": 11,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": "2026-10-10T01:50:45Z",
+      "last_commit": "2026-10-10T01:50:45Z"
+    },
+    {
+      "login": "BuonBreda",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 0,
+      "lines_added": 0,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": null,
+      "last_commit": null
+    },
+    {
+      "login": "cookingwithsimon",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 0,
+      "lines_added": 0,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": null,
+      "last_commit": null
+    },
+    {
+      "login": "enzoflayac",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 0,
+      "lines_added": 0,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": null,
+      "last_commit": null
+    },
     {
       "login": "GuintherKovalski",
       "people_entry": false,
@@ -384,6 +904,45 @@
       "first_commit": null,
       "last_commit": null
     },
+    {
+      "login": "henu043",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 0,
+      "lines_added": 0,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": null,
+      "last_commit": null
+    },
+    {
+      "login": "pikkemaat",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 0,
+      "lines_added": 0,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": null,
+      "last_commit": null
+    },
+    {
+      "login": "stano-bustor",
+      "people_entry": false,
+      "github_name": null,
+      "prs": 1,
+      "commits": 0,
+      "lines_added": 0,
+      "lines_deleted": 0,
+      "binary_added": 0,
+      "binary_deleted": 0,
+      "first_commit": null,
+      "last_commit": null
+    },
     {
       "login": "XRTce",
       "people_entry": false,
@@ -404,36 +963,45 @@
       "company": "Anthropic",
       "model": "Claude Opus",
       "version": "5.5",
-      "commits": 364,
-      "lines_added": 131810,
-      "lines_deleted": 9367
+      "commits": 747,
+      "lines_added": 178263,
+      "lines_deleted": 14199
     },
     {
       "id": "anthropic/claude-sonnet/5.5",
       "company": "Anthropic",
       "model": "Claude Sonnet",
       "version": "5.5",
-      "commits": 31,
-      "lines_added": 3941,
-      "lines_deleted": 1543
-    },
-    {
-      "id": "openai/codex",
-      "company": "OpenAI",
-      "model": "Codex",
-      "version": "",
-      "commits": 14,
-      "lines_added": 8341,
-      "lines_deleted": 995
+      "commits": 116,
+      "lines_added": 15071,
+      "lines_deleted": 2624
     },
     {
       "id": "anthropic/claude",
       "company": "Anthropic",
       "model": "Claude",
       "version": "",
-      "commits": 2,
-      "lines_added": 1304,
-      "lines_deleted": 192
+      "commits": 66,
+      "lines_added": 8450,
+      "lines_deleted": 956
+    },
+    {
+      "id": "openai/codex",
+      "company": "OpenAI",
+      "model": "Codex",
+      "version": "",
+      "commits": 38,
+      "lines_added": 17120,
+      "lines_deleted": 1703
+    },
+    {
+      "id": "anthropic/claude-fable/5.1",
+      "company": "Anthropic",
+      "model": "Claude Fable",
+      "version": "5.1",
+      "commits": 9,
+      "lines_added": 1548,
+      "lines_deleted": 112
     },
     {
       "id": "anthropic/claude-sonnet/5",
@@ -453,6 +1021,15 @@
       "lines_added": 1633,
       "lines_deleted": 3
     },
+    {
+      "id": "deepseek/deepseek-flash/v4",
+      "company": "DeepSeek",
+      "model": "DeepSeek Flash",
+      "version": "V4",
+      "commits": 1,
+      "lines_added": 1439,
+      "lines_deleted": 6
+    },
     {
       "id": "deepseek/deepseek/v3.2",
       "company": "DeepSeek",
@@ -461,6 +1038,33 @@
       "commits": 1,
       "lines_added": 1895,
       "lines_deleted": 294
+    },
+    {
+      "id": "openai/gpt-6-luna",
+      "company": "OpenAI",
+      "model": "GPT-6 Luna",
+      "version": "",
+      "commits": 1,
+      "lines_added": 68,
+      "lines_deleted": 19
+    },
+    {
+      "id": "openai/gpt/6",
+      "company": "OpenAI",
+      "model": "GPT",
+      "version": "6",
+      "commits": 1,
+      "lines_added": 2864,
+      "lines_deleted": 261
+    },
+    {
+      "id": "opencode/opencode",
+      "company": "opencode",
+      "model": "opencode",
+      "version": "",
+      "commits": 1,
+      "lines_added": 459,
+      "lines_deleted": 5
     }
   ]
 }
diff --git a/contributors/people.toml b/contributors/people.toml
index fbda1f24..79f20c72 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -22,5 +22,8 @@ real_name = "Brandon Thomas"
 display_name = "Brandon Thomas"
 sync_github_name = false
 
+[people.rock-meister]
+sync_github_name = true
+
 [people.sanyamsingh001]
 display_name = "sanyamsingh001"
diff --git a/crates/catalog/Cargo.toml b/crates/catalog/Cargo.toml
index c70c2831..604fb039 100644
--- a/crates/catalog/Cargo.toml
+++ b/crates/catalog/Cargo.toml
@@ -19,4 +19,5 @@ log = { workspace = true }
 web-time = { workspace = true }
 
 [dev-dependencies]
+lightcraft-geom = { workspace = true }
 proptest = { workspace = true }
diff --git a/crates/catalog/src/dates.rs b/crates/catalog/src/dates.rs
index 06d5c2c0..d180d013 100644
--- a/crates/catalog/src/dates.rs
+++ b/crates/catalog/src/dates.rs
@@ -40,11 +40,17 @@ pub fn weekday(iso: &str) -> Option<&'static str> {
 }
 
 /// Shift an ISO time by `secs`, keeping anything after the seconds (fractions, zone) as it was.
-/// A date without a time gets one. `None` if it doesn't parse.
+/// A date without a time gets one. `None` if it doesn't parse, or if the result leaves years
+/// 0000–9999 (an ISO date here has four year digits, so it couldn't be read back); `secs` may be
+/// anything, it never overflows.
 pub fn shift_iso(iso: &str, secs: i64) -> Option<String> {
-    let t = iso_seconds(iso)?;
+    let t = iso_seconds(iso)?.checked_add(secs)?;
+    let (first, last) = (iso_seconds("0000-01-01T00:00:00")?, iso_seconds("9999-12-31T23:59:59")?);
+    if !(first..=last).contains(&t) {
+        return None;
+    }
     let tail = iso.trim().get(19..).unwrap_or("");
-    Some(format!("{}{tail}", civil(t + secs)))
+    Some(format!("{}{tail}", civil(t)))
 }
 
 /// Normalize user input to `YYYY-MM-DDTHH:MM:SS` (accepts a space instead of `T`, missing
@@ -155,7 +161,7 @@ impl Catalog {
         let date_of = |id: &PhotoId| -> String {
             let Some(p) = self.photo(*id) else { return String::new() };
             let d = match key {
-                SortKey::CaptureDate => Some(p.date()),
+                SortKey::CaptureDate => p.captured.as_deref(),
                 SortKey::ImportDate => Some(p.imported.as_str()),
                 SortKey::EditDate => p.edited.as_deref(),
                 _ => None,
@@ -204,6 +210,14 @@ mod tests {
         assert_eq!(shift_iso("2026-12-31T23:30:00", 3600).as_deref(), Some("2027-01-01T00:30:00"));
         assert_eq!(shift_iso("2026-03-01T00:00:00.25+02:00", -1).as_deref(), Some("2026-02-28T23:59:59.25+02:00"));
         assert_eq!(shift_iso("nope", 5), None);
+        // hostile shifts never overflow, and a result outside years 0000–9999 (which no ISO date
+        // here can read back) is refused rather than stored
+        for secs in [i64::MAX, i64::MIN, i64::MAX / 2, -(i64::MAX / 2)] {
+            assert_eq!(shift_iso("2026-01-01T00:00:00", secs), None, "{secs}");
+        }
+        assert_eq!(shift_iso("9999-12-31T23:59:59", 1), None);
+        assert_eq!(shift_iso("0000-01-01T00:00:00", -1), None);
+        assert_eq!(shift_iso("9999-12-31T23:59:58", 1).as_deref(), Some("9999-12-31T23:59:59"));
         assert_eq!(normalize_iso("2026-04-01 10:05").as_deref(), Some("2026-04-01T10:05:00"));
         assert_eq!(normalize_iso("2026-02-30"), None);
     }
@@ -222,7 +236,7 @@ mod tests {
         }
         let shape = |r: &[DateRun]| r.iter().map(|r| (r.key.clone(), r.start, r.count)).collect::<Vec<_>>();
         let day = c.date_runs(&ids, SortKey::CaptureDate, GroupBy::Day);
-        // the undated photo falls back to its import date
+        // the undated photo is grouped under Unknown Date
         assert_eq!(
             shape(&day),
             vec![
@@ -230,16 +244,20 @@ mod tests {
                 ("2026-09-29".into(), 2, 1),
                 ("2026-08-01".into(), 3, 1),
                 ("2025-12-31".into(), 4, 1),
-                ("2026-10-01".into(), 5, 1)
+                (String::new(), 5, 1)
             ]
         );
         assert_eq!(day[0].label, "Wednesday, 30 September 2026");
+        assert_eq!(day[4].label, "Unknown Date");
         assert_eq!(c.date_runs(&ids, SortKey::CaptureDate, GroupBy::Auto), day);
         assert_eq!(
-            shape(&c.date_runs(&ids[..5], SortKey::CaptureDate, GroupBy::Month)),
-            vec![("2026-09".into(), 0, 3), ("2026-08".into(), 3, 1), ("2025-12".into(), 4, 1)]
+            shape(&c.date_runs(&ids, SortKey::CaptureDate, GroupBy::Month)),
+            vec![("2026-09".into(), 0, 3), ("2026-08".into(), 3, 1), ("2025-12".into(), 4, 1), (String::new(), 5, 1)]
+        );
+        assert_eq!(
+            shape(&c.date_runs(&ids, SortKey::CaptureDate, GroupBy::Year)),
+            vec![("2026".into(), 0, 4), ("2025".into(), 4, 1), (String::new(), 5, 1)]
         );
-        assert_eq!(shape(&c.date_runs(&ids[..5], SortKey::CaptureDate, GroupBy::Year)), vec![("2026".into(), 0, 4), ("2025".into(), 4, 1)]);
         assert!(c.date_runs(&ids, SortKey::FileName, GroupBy::Day).is_empty());
         assert!(c.date_runs(&ids, SortKey::CaptureDate, GroupBy::None).is_empty());
         // edit date: unedited photos have no date
diff --git a/crates/catalog/src/folders.rs b/crates/catalog/src/folders.rs
index 61a8f8c4..aab3b867 100644
--- a/crates/catalog/src/folders.rs
+++ b/crates/catalog/src/folders.rs
@@ -23,15 +23,21 @@
 //! (`/Volumes/Macintosh HD/Users/me` and `/Users/me`, `/media/me/usb` and `/run/media/me/usb`) is
 //! two rows. Each row is still consistent: choosing it shows exactly the photos it counts.
 //!
+//! A folder is otherwise only where photos are, but the library can also keep a
+//! [`FolderRecord`] about it (its colour label), stored under the folder's identity
+//! ([`crate::query::folder_key`]). A record follows its folder when the folder is renamed or moved
+//! here ([`Catalog::folder_records_follow`]); one about a folder that no longer holds a photo is
+//! kept (undo can bring the photos back) and shows again when the folder does.
+//!
 //! This is the library's own view of its photos; browsing any folder on disk without importing
 //! is Local's job (see [`crate::local`]).
 
 use std::collections::{BTreeMap, HashMap};
 
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 
-use crate::query::{folder_key, folder_within, split_path};
-use crate::{Catalog, Source};
+use crate::query::{folder_key, folder_rest, folder_within, key_within, split_path};
+use crate::{Catalog, ColorLabel, Op, Source};
 
 /// Folder levels kept per photo. No real path comes near it; a deeper one is counted at its
 /// ancestor this many levels down, which bounds the tree's depth (and so every walk of it)
@@ -58,9 +64,35 @@ pub struct FolderNode {
     /// so for the startup disk and for folders that hold other disks (`/Volumes`, `/mnt`…): their
     /// path covers those disks' photos too, so choosing them is not offered.
     pub selectable: bool,
+    /// The folder's colour label (see [`FolderRecord`]).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub label: Option<ColorLabel>,
     pub children: Vec<FolderNode>,
 }
 
+/// What the library keeps about one of its folders beyond the photos in it. A record with
+/// nothing in it is not kept.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct FolderRecord {
+    /// A colour label, as a photo has one.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub label: Option<ColorLabel>,
+}
+
+impl FolderRecord {
+    /// Whether the record says nothing (and so is not kept).
+    pub fn is_empty(&self) -> bool {
+        self.label.is_none()
+    }
+}
+
+/// The identity a folder's record is kept under: its [`folder_key`]; `None` for a path that
+/// names no folder (empty, relative, `.`).
+pub(crate) fn record_key(path: &str) -> Option<String> {
+    let key = folder_key(path);
+    (split_path(path, true).absolute && !key.is_empty()).then_some(key)
+}
+
 /// A folder while the tree is being built (children by identity key).
 struct Level {
     name: String,
@@ -151,6 +183,53 @@ pub fn folder_label(path: &str) -> String {
 }
 
 impl Catalog {
+    /// What the library keeps about folder `path`, however it is spelled.
+    pub fn folder_record(&self, path: &str) -> Option<&FolderRecord> {
+        record_key(path).and_then(|k| self.folder_records.get(&k))
+    }
+
+    /// The colour label of folder `path`, however it is spelled.
+    pub fn folder_color_label(&self, path: &str) -> Option<ColorLabel> {
+        self.folder_record(path).and_then(|r| r.label)
+    }
+
+    /// The op that gives folder `path` colour label `label` (`None`: takes it off), keeping the
+    /// rest of its record. Applying it checks the path.
+    pub fn folder_label_op(&self, path: &str, label: Option<ColorLabel>) -> Op {
+        let mut record = self.folder_record(path).cloned().unwrap_or_default();
+        record.label = label;
+        Op::SetFolderRecord { folder: path.to_string(), record: Some(record) }
+    }
+
+    /// The ops that carry the records of folder `from` and the folders inside it over to `to`
+    /// (the same place below it), for a folder renamed or moved on disk: commit them with the
+    /// photos' relinks so undo puts both back. Records already at or below `to` are left from a
+    /// folder that is no longer there and are dropped (undo restores them). Empty when there is
+    /// nothing to carry or drop.
+    pub fn folder_records_follow(&self, from: &str, to: &str) -> Vec<Op> {
+        let (Some(root), Some(dest)) = (record_key(from), record_key(to)) else { return Vec::new() };
+        if root == dest {
+            return Vec::new();
+        }
+        let moved: Vec<(String, FolderRecord)> = self
+            .folder_records
+            .iter()
+            .filter(|(k, _)| key_within(k, &root))
+            .filter_map(|(k, r)| {
+                let rest = folder_rest(k, &root)?;
+                let base = dest.trim_end_matches('/');
+                let path = if rest.is_empty() { dest.clone() } else { format!("{base}/{}", rest.join("/")) };
+                Some((folder_key(&path), r.clone()))
+            })
+            .collect();
+        // what was known at the old place goes, and so does what is left at the new one (also
+        // when the moved folder carries nothing: the folder now there is not the one it was about)
+        let stale = self.folder_records.keys().filter(|k| key_within(k, &root) || key_within(k, &dest));
+        let mut ops: Vec<Op> = stale.map(|k| Op::SetFolderRecord { folder: k.clone(), record: None }).collect();
+        ops.extend(moved.into_iter().map(|(k, r)| Op::SetFolderRecord { folder: k, record: Some(r) }));
+        ops
+    }
+
     /// The library's volumes with their folders and photo counts: volumes by name
     /// (case-insensitive), each folder with its subfolders the same way.
     pub fn folder_tree(&self) -> Vec<FolderNode> {
@@ -196,7 +275,7 @@ impl Catalog {
                 l.own += n;
             }
         }
-        let mut tree: Vec<FolderNode> = roots.iter().filter_map(|k| build(k, &levels)).collect();
+        let mut tree: Vec<FolderNode> = roots.iter().filter_map(|k| build(k, &levels, &self.folder_records)).collect();
         sort(&mut tree);
         // a folder that holds another disk's mount covers that disk's photos too
         let mounts: Vec<String> = tree.iter().filter(|v| v.path != "/").map(|v| v.path.clone()).collect();
@@ -206,12 +285,21 @@ impl Catalog {
 }
 
 /// The node for `key` with everything below it (at most [`MAX_DEPTH`] deep).
-fn build(key: &str, levels: &HashMap<String, Level>) -> Option<FolderNode> {
+fn build(key: &str, levels: &HashMap<String, Level>, records: &BTreeMap<String, FolderRecord>) -> Option<FolderNode> {
     let l = levels.get(key)?;
-    let mut children: Vec<FolderNode> = l.children.iter().filter_map(|k| build(k, levels)).collect();
+    let mut children: Vec<FolderNode> = l.children.iter().filter_map(|k| build(k, levels, records)).collect();
     sort(&mut children);
     let count = l.own + children.iter().map(|c| c.count).sum::<usize>();
-    Some(FolderNode { name: l.name.clone(), path: l.path.clone(), count, own: l.own, volume: l.volume, selectable: true, children })
+    Some(FolderNode {
+        name: l.name.clone(),
+        path: l.path.clone(),
+        count,
+        own: l.own,
+        volume: l.volume,
+        selectable: true,
+        label: records.get(key).and_then(|r| r.label),
+        children,
+    })
 }
 
 fn mark_selectable(nodes: &mut [FolderNode], mounts: &[String]) {
diff --git a/crates/catalog/src/journal.rs b/crates/catalog/src/journal.rs
index 5973975d..f52d08db 100644
--- a/crates/catalog/src/journal.rs
+++ b/crates/catalog/src/journal.rs
@@ -46,6 +46,9 @@
 //! | 1 | up to v0.2.0 | |
 //! | 2 | after v0.2.0 | `Op::SetBrowsed`, `Catalog.browsed`, `Photo.local_baseline` |
 //! | 3 | albums by hand | `Op::SetAlbumOrder`, `Album.order` |
+//! | 4 | Reload reads lens data | `Op::SetEmbeddedLens` |
+//! | 5 | the keyword list | `Op::SetKeyword`, `Catalog.keyword_list` |
+//! | 6 | folder labels | `Op::SetFolderRecord`, `Catalog.folder_records` |
 //!
 //! Rules:
 //! - **Bump [`VERSION`]** (and add a row above) in the change that adds an [`Op`] variant or a
@@ -70,7 +73,7 @@ pub const LOG: &str = "catalog.log";
 const FORMAT: &str = "lightcraft-catalog";
 /// The catalog format this build writes (and the newest it reads). See the module docs →
 /// *Format versions*; bump it whenever an [`Op`] variant or a serialized field is added.
-pub const VERSION: u32 = 3;
+pub const VERSION: u32 = 6;
 
 /// When [`Journal::wants_snapshot`] says it's time to compact the log.
 #[derive(Clone, Copy, Debug)]
diff --git a/crates/catalog/src/keywords.rs b/crates/catalog/src/keywords.rs
index dde02015..92a53195 100644
--- a/crates/catalog/src/keywords.rs
+++ b/crates/catalog/src/keywords.rs
@@ -5,8 +5,14 @@
 //! changes — so they are a single undo step and replay from the op log like any other edit.
 //! Keyword names compare case-insensitively; renaming a keyword renames its children too
 //! (`travel|italy` → `trips|italy`).
+//!
+//! The **keyword list** holds keywords on their own ([`Op::SetKeyword`]): created before any
+//! photo has them, or given attributes ([`KeywordInfo`]: synonyms, export options, person). The
+//! tree is the keyword list together with the keywords photos carry.
 
-use serde::Serialize;
+use std::collections::BTreeMap;
+
+use serde::{Deserialize, Serialize};
 
 use crate::{Catalog, CatalogError, Meta, Op, Result};
 
@@ -18,16 +24,135 @@ pub fn clean(k: &str) -> String {
     k.split(SEP).map(str::trim).filter(|s| !s.is_empty()).collect::<Vec<_>>().join("|")
 }
 
+/// The same name, whatever the case of any of its letters (not only ASCII ones).
+pub fn same(a: &str, b: &str) -> bool {
+    a == b || a.to_lowercase() == b.to_lowercase()
+}
+
 /// `k` is `parent` or one of its descendants (`parent|…`), ignoring case.
 pub fn is_under(k: &str, parent: &str) -> bool {
     let (k, p) = (k.to_lowercase(), parent.to_lowercase());
     k == p || k.strip_prefix(&p).is_some_and(|rest| rest.starts_with(SEP))
 }
 
-/// Replace the `from` prefix of `k` (which [`is_under`] `from`) with `to`.
-fn reparent(k: &str, from: &str, to: &str) -> String {
-    let rest = &k[from.len().min(k.len())..];
-    if to.is_empty() { rest.trim_start_matches(SEP).to_string() } else { format!("{to}{rest}") }
+/// Replace the `from` prefix of `k` (which [`is_under`] `from`) with `to`. By levels, not bytes:
+/// `from` may be written in another case, which can change a letter's length (ẞ / ß).
+pub fn reparent(k: &str, from: &str, to: &str) -> String {
+    let skip = from.split(SEP).filter(|s| !s.trim().is_empty()).count();
+    let rest: Vec<&str> = k.split(SEP).filter(|s| !s.trim().is_empty()).skip(skip).collect();
+    std::iter::once(to).filter(|t| !t.is_empty()).chain(rest).collect::<Vec<_>>().join("|")
+}
+
+/// A file's keywords as a photo carries them: the paths of `lr:hierarchicalSubject`, then the
+/// names of `dc:subject` that aren't levels of those paths (Lightroom Classic writes each keyword's
+/// name, its parents' and synonyms flat besides its path). Each once, cleaned.
+pub fn from_file(flat: &[String], hierarchical: &[String]) -> Vec<String> {
+    let mut out: Vec<String> = hierarchical.iter().map(|k| clean(k)).collect();
+    out.extend(flat.iter().map(|k| clean(k)).filter(|k| !hierarchical.iter().any(|h| h.split(SEP).any(|level| same(level.trim(), k)))));
+    dedupe(&mut out);
+    out
+}
+
+/// The deepest a keyword list file may nest keywords: a file is input, so its nesting is bounded.
+pub const MAX_LEVELS: usize = 64;
+
+/// A keyword list as written by [`Catalog::keyword_list_text`]: the file's text, the keywords in
+/// it (paths), and what the format can't hold and so is left out (a keyword, with those inside it,
+/// as its path; a synonym as `path {synonym}`).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct KeywordListFile {
+    pub text: String,
+    pub written: Vec<String>,
+    pub unwritable: Vec<String>,
+}
+
+/// Read a keyword list file (Lightroom Classic's format): a keyword a line, those inside it
+/// indented one tab more, a synonym in braces on a line of its own under its keyword, a keyword
+/// left out of export in square brackets. Gives each keyword's path and attributes, in the order of
+/// the file; a keyword twice is one. A line it can't read is an error that says which.
+pub fn parse_keyword_list(text: &str) -> Result<Vec<(String, KeywordInfo)>> {
+    let bad = |n: usize, why: &str| CatalogError::Invalid(format!("line {n}: {why}"));
+    let text = text.strip_prefix('\u{feff}').unwrap_or(text);
+    // Windows, Unix and classic Mac line ends alike
+    let text = text.replace("\r\n", "\n").replace('\r', "\n");
+    let mut out: Vec<(String, KeywordInfo)> = Vec::new();
+    // where each keyword is in `out`, by lower-case path (a search of `out` per line was quadratic)
+    let mut index: std::collections::HashMap<String, usize> = std::collections::HashMap::new();
+    // the keyword at each level above the line: its path and where it is in `out`
+    let mut above: Vec<(String, usize)> = Vec::new();
+    for (i, line) in text.split('\n').enumerate() {
+        let n = i + 1;
+        if line.trim().is_empty() {
+            continue;
+        }
+        let depth = line.chars().take_while(|c| *c == '\t').count();
+        let rest = line.trim_start_matches('\t');
+        // levels are tabs: spaces would flatten the hierarchy without a word
+        if rest.starts_with(' ') {
+            return Err(bad(n, "keywords are indented with tabs, one per level, not spaces"));
+        }
+        if rest.chars().any(char::is_control) {
+            return Err(bad(n, "a control character in a keyword"));
+        }
+        let body = rest.trim();
+        if let Some(synonym) = body.strip_prefix('{').and_then(|b| b.strip_suffix('}')) {
+            let Some(at) = depth.checked_sub(1).and_then(|d| above.get(d)).map(|(_, at)| *at) else {
+                return Err(bad(n, "a synonym (in braces) goes one tab under its keyword"));
+            };
+            let synonym = synonym.trim();
+            if synonym.contains(SEP) {
+                return Err(bad(n, "“|” separates a keyword's levels: a synonym can't hold one"));
+            }
+            if let Some((_, info)) = out.get_mut(at)
+                && !synonym.is_empty()
+                && !info.synonyms.iter().any(|s| same(s, synonym))
+            {
+                info.synonyms.push(synonym.to_string());
+            }
+            continue;
+        }
+        if depth > above.len() {
+            return Err(bad(n, "indented more than one tab below the keyword above it"));
+        }
+        if depth >= MAX_LEVELS {
+            return Err(bad(n, &format!("keywords nest {MAX_LEVELS} levels deep at most")));
+        }
+        let (name, left_out) = match body.strip_prefix('[').and_then(|b| b.strip_suffix(']')) {
+            Some(name) => (name.trim(), true),
+            None => (body, false),
+        };
+        if name.is_empty() {
+            return Err(bad(n, "a keyword needs a name"));
+        }
+        if name.contains(SEP) {
+            return Err(bad(n, "“|” separates a keyword's levels: a name can't hold one"));
+        }
+        above.truncate(depth);
+        let path = match above.last() {
+            Some((parent, _)) => format!("{parent}{SEP}{name}"),
+            None => name.to_string(),
+        };
+        let at = match index.get(&path.to_lowercase()) {
+            Some(at) => *at,
+            None => {
+                out.push((path.clone(), KeywordInfo::default()));
+                index.insert(path.to_lowercase(), out.len() - 1);
+                out.len() - 1
+            }
+        };
+        if left_out && let Some((_, info)) = out.get_mut(at) {
+            info.include_on_export = false;
+        }
+        // as first spelled: the keywords inside a repeat take that spelling
+        let spelled = out.get(at).map_or(path, |(p, _)| p.clone());
+        above.push((spelled, at));
+    }
+    Ok(out)
+}
+
+/// The keyword of `from` that `k` is under, the closest one when several are (`a|b` before `a`).
+pub fn closest<'a>(k: &str, from: &'a [String]) -> Option<&'a String> {
+    from.iter().filter(|f| is_under(k, f)).max_by_key(|f| f.split(SEP).count())
 }
 
 /// Keep the first of case-insensitively equal keywords.
@@ -36,6 +161,66 @@ fn dedupe(v: &mut Vec<String>) {
     v.retain(|k| !k.is_empty() && seen.insert(k.to_lowercase()));
 }
 
+/// What the keyword list knows about a keyword besides the photos that carry it: Lightroom
+/// Classic's keyword tag options. A keyword is listed when it was created on its own or given
+/// attributes; one that only photos carry has the defaults.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct KeywordInfo {
+    /// Other words for it, exported with it (when `export_synonyms`).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub synonyms: Vec<String>,
+    /// Written into exported files at all.
+    #[serde(default = "yes")]
+    pub include_on_export: bool,
+    /// The keywords containing it are exported with it (`travel|italy` also gives `travel`).
+    #[serde(default = "yes")]
+    pub export_containing: bool,
+    #[serde(default = "yes")]
+    pub export_synonyms: bool,
+    /// The keyword names a person.
+    #[serde(default)]
+    pub person: bool,
+    /// New keywords go inside this one (Put New Keywords Inside This Keyword): one keyword at
+    /// most, see [`Catalog::default_keyword_parent`].
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub new_keywords_inside: bool,
+}
+
+fn yes() -> bool {
+    true
+}
+
+impl Default for KeywordInfo {
+    fn default() -> Self {
+        KeywordInfo {
+            synonyms: Vec::new(),
+            include_on_export: true,
+            export_containing: true,
+            export_synonyms: true,
+            person: false,
+            new_keywords_inside: false,
+        }
+    }
+}
+
+/// A keyword in the library's keyword list: its path as written and its attributes.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ListedKeyword {
+    pub path: String,
+    pub info: KeywordInfo,
+}
+
+/// A photo's keywords as an exported file carries them.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct ExportKeywords {
+    /// Names, flat (`dc:subject`): each keyword's own, the keywords containing it and synonyms, as
+    /// their options say.
+    pub flat: Vec<String>,
+    /// Full paths (`lr:hierarchicalSubject`).
+    pub hierarchical: Vec<String>,
+}
+
 /// One node of the keyword tree.
 #[derive(Clone, Debug, PartialEq, Serialize)]
 pub struct KeywordNode {
@@ -63,9 +248,12 @@ impl Catalog {
         }
         let mut levels: HashMap<String, Level> = HashMap::new();
         let mut this_photo: HashSet<String> = HashSet::new();
-        for p in self.photos().filter(|p| p.in_library()) {
+        // the keyword list first (no photos counted): a listed keyword is there without photos
+        let listed: Vec<String> = self.listed_keywords().map(|k| k.path.clone()).collect();
+        let photos = self.photos().filter(|p| p.in_library()).map(|p| (true, p.meta.keywords.as_slice()));
+        for (counts, keywords) in std::iter::once((false, listed.as_slice())).chain(photos) {
             this_photo.clear();
-            for k in &p.meta.keywords {
+            for k in keywords {
                 let mut path = String::new();
                 let mut lower = String::new();
                 let mut parent: Option<String> = None;
@@ -82,7 +270,7 @@ impl Catalog {
                         count: 0,
                         parent: parent.clone(),
                     });
-                    if this_photo.insert(lower.clone()) {
+                    if counts && this_photo.insert(lower.clone()) {
                         l.count += 1;
                     }
                     parent = Some(lower.clone());
@@ -118,52 +306,434 @@ impl Catalog {
             .collect()
     }
 
-    /// Rename `from` (and the keywords below it) to `to` on every photo — one batch. Renaming onto
-    /// an existing keyword merges the two.
+    /// `SetKeyword` ops turning the keyword list into what `f` makes of it (lower-case path →
+    /// listing): what it no longer has is taken off first, then what is new or changed is set.
+    fn list_ops(&self, f: impl FnOnce(&mut BTreeMap<String, ListedKeyword>)) -> Vec<Op> {
+        let before = &self.keyword_list;
+        let mut after = before.clone();
+        f(&mut after);
+        let gone = before.iter().filter(|(k, _)| !after.contains_key(*k)).map(|(_, l)| Op::SetKeyword { path: l.path.clone(), info: None });
+        let set = after
+            .iter()
+            .filter(|(k, l)| before.get(*k) != Some(*l))
+            .map(|(_, l)| Op::SetKeyword { path: l.path.clone(), info: Some(l.info.clone()) });
+        gone.chain(set).collect()
+    }
+
+    /// The keyword list once the keywords under each of `from` move to `to`: a listing landing on
+    /// one already there merges into it (that one's attributes stay, the synonyms gather).
+    fn list_move_ops(&self, from: &[String], to: &str) -> Vec<Op> {
+        self.list_ops(|list| {
+            // every moving listing leaves first, then each lands: one landing where another is
+            // about to leave isn't merged into it
+            let moving: Vec<String> = list.iter().filter(|(_, l)| closest(&l.path, from).is_some()).map(|(k, _)| k.clone()).collect();
+            let left: Vec<ListedKeyword> = moving.iter().filter_map(|key| list.remove(key)).collect();
+            for l in left {
+                let Some(f) = closest(&l.path, from) else { continue };
+                let path = reparent(&l.path, f, to);
+                match list.get_mut(&path.to_lowercase()) {
+                    Some(there) => {
+                        there.info.new_keywords_inside |= l.info.new_keywords_inside;
+                        for s in l.info.synonyms {
+                            if !there.info.synonyms.iter().any(|x| same(x, &s)) {
+                                there.info.synonyms.push(s);
+                            }
+                        }
+                    }
+                    None => {
+                        list.insert(path.to_lowercase(), ListedKeyword { path, info: l.info });
+                    }
+                }
+            }
+        })
+    }
+
+    /// Rename `from` (and the keywords below it) to `to` on every photo and in the keyword list —
+    /// one batch. Renaming onto an existing keyword merges the two.
     pub fn rename_keyword_ops(&self, from: &str, to: &str) -> Result<Op> {
         let (from, to) = (clean(from), clean(to));
         if from.is_empty() || to.is_empty() {
             return Err(CatalogError::Invalid("keyword names can't be empty".into()));
         }
-        if is_under(&to, &from) && !to.eq_ignore_ascii_case(&from) {
+        if is_under(&to, &from) && !same(&to, &from) {
             return Err(CatalogError::Invalid("can't move a keyword below itself".into()));
         }
-        let ops = self.keyword_ops(|kws| kws.iter().map(|k| if is_under(k, &from) { reparent(k, &from, &to) } else { k.clone() }).collect());
+        let mut ops = self.keyword_ops(|kws| kws.iter().map(|k| if is_under(k, &from) { reparent(k, &from, &to) } else { k.clone() }).collect());
+        ops.extend(self.list_move_ops(std::slice::from_ref(&from), &to));
         Ok(Op::Batch { ops })
     }
 
-    /// Remove `keyword` and the keywords below it from every photo.
+    /// Remove `keyword` and the keywords below it from every photo and from the keyword list.
     pub fn delete_keyword_ops(&self, keyword: &str) -> Result<Op> {
         let k = clean(keyword);
         if k.is_empty() {
             return Err(CatalogError::Invalid("empty keyword".into()));
         }
-        Ok(Op::Batch { ops: self.keyword_ops(|kws| kws.iter().filter(|x| !is_under(x, &k)).cloned().collect()) })
+        let mut ops = self.keyword_ops(|kws| kws.iter().filter(|x| !is_under(x, &k)).cloned().collect());
+        ops.extend(self.list_ops(|list| list.retain(|_, l| !is_under(&l.path, &k))));
+        Ok(Op::Batch { ops })
     }
 
     /// Merge several keywords (with their children) into `into`.
     pub fn merge_keywords_ops(&self, from: &[String], into: &str) -> Result<Op> {
         let into = clean(into);
-        let from: Vec<String> = from.iter().map(|f| clean(f)).filter(|f| !f.is_empty() && !f.eq_ignore_ascii_case(&into)).collect();
+        let from: Vec<String> = from.iter().map(|f| clean(f)).filter(|f| !f.is_empty() && !same(f, &into)).collect();
         if into.is_empty() || from.is_empty() {
             return Err(CatalogError::Invalid("merge needs keywords and a target".into()));
         }
         if from.iter().any(|f| is_under(&into, f)) {
             return Err(CatalogError::Invalid("can't merge a keyword into one below it".into()));
         }
-        let ops = self.keyword_ops(|kws| {
-            kws.iter().map(|k| from.iter().find(|f| is_under(k, f)).map(|f| reparent(k, f, &into)).unwrap_or_else(|| k.clone())).collect()
-        });
+        let mut ops =
+            self.keyword_ops(|kws| kws.iter().map(|k| closest(k, &from).map(|f| reparent(k, f, &into)).unwrap_or_else(|| k.clone())).collect());
+        ops.extend(self.list_move_ops(&from, &into));
         Ok(Op::Batch { ops })
     }
 
+    /// What exported files carry for a photo with these keywords (Lightroom Classic's keyword tag
+    /// options, [`KeywordInfo`]): a keyword left out of export goes nowhere; otherwise its name
+    /// and full path, the keywords containing it that are exported themselves (unless "export
+    /// containing keywords" is off) and synonyms (unless "export synonyms" is off). Each name once,
+    /// whatever its case.
+    pub fn export_keywords(&self, keywords: &[String]) -> ExportKeywords {
+        let defaults = KeywordInfo::default();
+        let info = |path: &str| self.keyword_info(path).unwrap_or(&defaults);
+        let mut out = ExportKeywords::default();
+        let push = |v: &mut Vec<String>, s: &str| {
+            if !s.is_empty() && !v.iter().any(|x| same(x, s)) {
+                v.push(s.to_string());
+            }
+        };
+        for k in keywords {
+            let path = clean(k);
+            let me = info(&path);
+            if path.is_empty() || !me.include_on_export {
+                continue;
+            }
+            let levels: Vec<&str> = path.split(SEP).collect();
+            let mut names = |at: usize, i: &KeywordInfo| {
+                if let Some(name) = levels.get(at) {
+                    push(&mut out.flat, name);
+                }
+                if i.export_synonyms {
+                    for s in &i.synonyms {
+                        push(&mut out.flat, s.trim());
+                    }
+                }
+            };
+            names(levels.len().saturating_sub(1), me);
+            if me.export_containing {
+                for at in (0..levels.len().saturating_sub(1)).rev() {
+                    let parent = levels.get(..=at).map(|l| l.join("|")).unwrap_or_default();
+                    let pi = info(&parent);
+                    if pi.include_on_export {
+                        names(at, pi);
+                    }
+                }
+            }
+            push(&mut out.hierarchical, &path);
+        }
+        out
+    }
+
+    /// The keyword list as a file (Lightroom Classic's format, [`parse_keyword_list`]): every
+    /// keyword of the tree, those inside one indented a tab more, synonyms in braces under their
+    /// keyword, a keyword left out of export in square brackets; by name. What the format can't hold
+    /// is left out and named, so the file always reads back.
+    pub fn keyword_list_text(&self) -> KeywordListFile {
+        // a name the list would read as something else, or not at all
+        fn unwritable(name: &str) -> bool {
+            name.trim().is_empty()
+                || name != name.trim()
+                || name.chars().any(char::is_control)
+                // a byte-order mark: on the first line the reader takes it for the file's own
+                || name.starts_with('\u{feff}')
+                || (name.starts_with('[') && name.ends_with(']'))
+                || (name.starts_with('{') && name.ends_with('}'))
+        }
+        fn write(c: &Catalog, nodes: &[KeywordNode], depth: usize, file: &mut KeywordListFile) {
+            let tabs = "\t".repeat(depth);
+            for n in nodes {
+                // the keywords inside go with it: under its parent they'd be other keywords
+                if depth >= MAX_LEVELS || unwritable(&n.name) {
+                    file.unwritable.push(n.path.clone());
+                    continue;
+                }
+                let info = c.keyword_info(&n.path).cloned().unwrap_or_default();
+                if info.include_on_export {
+                    file.text.push_str(&format!("{tabs}{}\n", n.name));
+                } else {
+                    file.text.push_str(&format!("{tabs}[{}]\n", n.name));
+                }
+                file.written.push(n.path.clone());
+                // the reader trims synonyms and takes one per spelling: an empty one, or another's
+                // in a different case, is no loss; a line break or a “|” is
+                let mut synonyms: Vec<&str> = Vec::new();
+                for s in info.synonyms.iter().map(|s| s.trim()) {
+                    if s.is_empty() || synonyms.iter().any(|x| same(x, s)) {
+                        continue;
+                    }
+                    if s.chars().any(char::is_control) || s.contains(SEP) {
+                        file.unwritable.push(format!("{} {{{s}}}", n.path));
+                    } else {
+                        synonyms.push(s);
+                        file.text.push_str(&format!("{tabs}\t{{{s}}}\n"));
+                    }
+                }
+                write(c, &n.children, depth + 1, file);
+            }
+        }
+        let mut file = KeywordListFile::default();
+        write(self, &self.keyword_tree(), 0, &mut file);
+        file
+    }
+
+    /// Import a keyword list (read with [`parse_keyword_list`]) — one batch: the keywords the
+    /// library doesn't have are added with the list's attributes, in the library's spelling of the
+    /// levels it has; those it has keep their attributes and gain the list's synonyms. Also says how
+    /// many keywords were added and how many gained synonyms.
+    pub fn import_keywords_ops(&self, entries: &[(String, KeywordInfo)]) -> (Op, usize, usize) {
+        // every keyword the library has, by lower-case path, as it spells it: learnt once from the
+        // tree (looking each line up among all the photos' keywords took minutes for big lists)
+        let mut known: std::collections::HashMap<String, String> = std::collections::HashMap::new();
+        fn learn(nodes: &[KeywordNode], known: &mut std::collections::HashMap<String, String>) {
+            for n in nodes {
+                known.insert(n.path.to_lowercase(), n.path.clone());
+                learn(&n.children, known);
+            }
+        }
+        learn(&self.keyword_tree(), &mut known);
+        // a path in the library's spelling of each level it has
+        let spell = |path: &str, known: &std::collections::HashMap<String, String>| -> String {
+            let levels: Vec<&str> = path.split(SEP).collect();
+            let mut out = String::new();
+            for (i, level) in levels.iter().enumerate() {
+                if !out.is_empty() {
+                    out.push(SEP);
+                }
+                let prefix = levels.get(..=i).map(|l| l.join("|").to_lowercase()).unwrap_or_default();
+                match known.get(&prefix).and_then(|p| p.rsplit(SEP).next()) {
+                    Some(name) => out.push_str(name),
+                    None => out.push_str(level),
+                }
+            }
+            out
+        };
+        let (mut added, mut updated) = (0, 0);
+        let ops = self.list_ops(|list| {
+            for (path, info) in entries {
+                let path = spell(&clean(path), &known);
+                let key = path.to_lowercase();
+                if path.is_empty() {
+                    continue;
+                }
+                if !known.contains_key(&key) {
+                    list.insert(key.clone(), ListedKeyword { path: path.clone(), info: KeywordInfo { new_keywords_inside: false, ..info.clone() } });
+                    // it and its parents are the library's now: what follows spells them so
+                    let levels: Vec<&str> = path.split(SEP).collect();
+                    for i in 0..levels.len() {
+                        let prefix = levels.get(..=i).map(|l| l.join("|")).unwrap_or_default();
+                        known.entry(prefix.to_lowercase()).or_insert(prefix);
+                    }
+                    added += 1;
+                    continue;
+                }
+                // one the library has: the list's synonyms join its own (listed only if it gains some)
+                let mut info_now = list.get(&key).map(|l| l.info.clone()).unwrap_or_default();
+                let before = info_now.synonyms.len();
+                for s in &info.synonyms {
+                    if !info_now.synonyms.iter().any(|x| same(x, s)) {
+                        info_now.synonyms.push(s.clone());
+                    }
+                }
+                if info_now.synonyms.len() > before {
+                    let path = list.get(&key).map_or(path, |l| l.path.clone());
+                    list.insert(key, ListedKeyword { path, info: info_now });
+                    updated += 1;
+                }
+            }
+        });
+        (Op::Batch { ops }, added, updated)
+    }
+
+    /// The keyword is in the tree: listed or on a library photo (not one in Recently Deleted or
+    /// only browsed), itself or one below it.
+    pub fn has_keyword(&self, path: &str) -> bool {
+        self.keyword_path(path).is_some()
+    }
+
+    /// Where a keyword typed for a photo goes: inside the default parent when it is a new name (Put
+    /// New Keywords Inside This Keyword); a keyword the library has, or a path typed whole, as
+    /// typed (cleaned).
+    pub fn typed_keyword(&self, typed: &str) -> String {
+        let k = clean(typed);
+        match self.default_keyword_parent() {
+            Some(parent) if !k.is_empty() && !k.contains(SEP) && !self.has_keyword(&k) => format!("{parent}{SEP}{k}"),
+            _ => k,
+        }
+    }
+
+    /// `path` with each level the library has spelled as the library spells it (`TRAVEL|Rome` next
+    /// to `travel|italy` is `travel|Rome`).
+    fn spelled(&self, path: &str) -> String {
+        let levels: Vec<&str> = path.split(SEP).collect();
+        let mut out = String::new();
+        for (i, level) in levels.iter().enumerate() {
+            let prefix = levels.get(..=i).map(|l| l.join("|")).unwrap_or_default();
+            let name = self.keyword_path(&prefix).and_then(|p| p.rsplit(SEP).next().map(str::to_string)).unwrap_or_else(|| level.to_string());
+            if !out.is_empty() {
+                out.push(SEP);
+            }
+            out.push_str(&name);
+        }
+        out
+    }
+
+    /// The keyword new keywords go inside (Put New Keywords Inside This Keyword), if any.
+    pub fn default_keyword_parent(&self) -> Option<String> {
+        self.keyword_list.values().find(|l| l.info.new_keywords_inside).map(|l| l.path.clone())
+    }
+
+    /// Make `keyword` the one new keywords go inside (`None`: none) — one batch. It is listed if it
+    /// wasn't, keeping the attributes it has.
+    pub fn set_default_parent_ops(&self, keyword: Option<&str>) -> Result<Op> {
+        let path = match keyword {
+            Some(k) => Some(self.keyword_path(k).ok_or_else(|| CatalogError::Invalid(format!("no keyword “{}”", clean(k))))?),
+            None => None,
+        };
+        Ok(Op::Batch {
+            ops: self.list_ops(|list| {
+                for l in list.values_mut() {
+                    l.info.new_keywords_inside = false;
+                }
+                if let Some(path) = path {
+                    let l = list.entry(path.to_lowercase()).or_insert_with(|| ListedKeyword { path, info: KeywordInfo::default() });
+                    l.info.new_keywords_inside = true;
+                }
+            }),
+        })
+    }
+
+    /// The keyword as written in the library (whatever the case of `path`): its listing, or the
+    /// levels a photo's keyword spells it with. `None` when there is no such keyword.
+    pub fn keyword_path(&self, path: &str) -> Option<String> {
+        let k = clean(path);
+        if k.is_empty() {
+            return None;
+        }
+        if let Some(l) = self.keyword_list.get(&k.to_lowercase()) {
+            return Some(l.path.clone());
+        }
+        // the levels of a listed keyword below it, or of a photo's
+        let levels = k.split(SEP).count();
+        let listed = self.keyword_list.values().map(|l| &l.path);
+        listed
+            .chain(self.photos().filter(|p| p.in_library()).flat_map(|p| p.meta.keywords.iter()))
+            .find(|x| is_under(x, &k))
+            .map(|x| x.split(SEP).map(str::trim).filter(|s| !s.is_empty()).take(levels).collect::<Vec<_>>().join("|"))
+    }
+
+    /// Create a keyword with these attributes, and give it to `photos` — one batch. A keyword that
+    /// exists already is refused.
+    pub fn create_keyword_ops(&self, path: &str, info: KeywordInfo, photos: &[crate::PhotoId]) -> Result<Op> {
+        let path = clean(path);
+        if path.is_empty() {
+            return Err(CatalogError::Invalid("keyword names can't be empty".into()));
+        }
+        if self.has_keyword(&path) {
+            return Err(CatalogError::KeywordExists(path));
+        }
+        let path = self.spelled(&path);
+        let mut ops = vec![Op::SetKeyword { path: path.clone(), info: Some(info) }];
+        for id in photos {
+            let p = self.photo(*id).ok_or(CatalogError::NoPhoto(*id))?;
+            let mut meta = p.meta.clone();
+            meta.keywords.push(path.clone());
+            dedupe(&mut meta.keywords);
+            ops.push(Op::SetMeta { id: *id, meta: Box::new(meta) });
+        }
+        Ok(Op::Batch { ops })
+    }
+
+    /// Move `keyword` (with the keywords below it) inside `parent`, or to the top level (`None`).
+    /// It keeps its name. Onto a keyword that is there already the two merge, which only happens
+    /// with `merge`; otherwise [`CatalogError::KeywordExists`].
+    pub fn move_keyword_ops(&self, keyword: &str, parent: Option<&str>, merge: bool) -> Result<Op> {
+        let Some(from) = self.keyword_path(keyword) else {
+            return Err(CatalogError::Invalid(format!("no keyword “{}”", clean(keyword))));
+        };
+        let leaf = from.rsplit(SEP).next().unwrap_or(&from);
+        let to = match parent.map(clean).filter(|p| !p.is_empty()) {
+            Some(p) if is_under(&p, &from) => return Err(CatalogError::Invalid("can't move a keyword inside itself".into())),
+            Some(p) => format!("{}{SEP}{leaf}", self.keyword_path(&p).unwrap_or(p)),
+            None => leaf.to_string(),
+        };
+        if same(&to, &from) {
+            return Ok(Op::Batch { ops: vec![] });
+        }
+        if !merge && self.has_keyword(&to) {
+            return Err(CatalogError::KeywordExists(to));
+        }
+        self.rename_keyword_ops(&from, &to)
+    }
+
+    /// Rename `keyword`'s last level to `name` (it stays where it is) and set its attributes — one
+    /// batch. A name that is taken is refused ([`CatalogError::KeywordExists`]): merging is its own
+    /// action.
+    pub fn edit_keyword_ops(&self, keyword: &str, name: &str, info: KeywordInfo) -> Result<Op> {
+        let Some(from) = self.keyword_path(keyword) else {
+            return Err(CatalogError::Invalid(format!("no keyword “{}”", clean(keyword))));
+        };
+        let name = name.trim();
+        if name.is_empty() || name.contains(SEP) {
+            return Err(CatalogError::Invalid("a keyword's name is one level, without “|”".into()));
+        }
+        let to = match from.rsplit_once(SEP) {
+            Some((parent, _)) => format!("{parent}{SEP}{name}"),
+            None => name.to_string(),
+        };
+        let mut ops = Vec::new();
+        if to != from {
+            if !same(&to, &from) && self.has_keyword(&to) {
+                return Err(CatalogError::KeywordExists(to));
+            }
+            if let Op::Batch { ops: renamed } = self.rename_keyword_ops(&from, &to)? {
+                ops = renamed;
+            }
+        }
+        // set the attributes only when they change something: an unlisted keyword with the default
+        // ones stays unlisted
+        let now = self.keyword_info(&from).cloned();
+        let changed = match &now {
+            Some(now) => *now != info || to != from,
+            None => info != KeywordInfo::default(),
+        };
+        if changed {
+            ops.push(Op::SetKeyword { path: to, info: Some(info) });
+        }
+        Ok(Op::Batch { ops })
+    }
+
+    /// Take off the keyword list the keywords no library photo has, nor any keyword below them — one
+    /// batch.
+    pub fn purge_unused_keywords_ops(&self) -> Op {
+        let used: Vec<&String> = self.photos().filter(|p| p.in_library()).flat_map(|p| p.meta.keywords.iter()).collect();
+        Op::Batch { ops: self.list_ops(|list| list.retain(|_, l| used.iter().any(|k| is_under(k, &l.path)))) }
+    }
+
     /// Keyword suggestions for a photo that has `current` keywords: with a typed `prefix`, the
     /// library's keywords containing it (those starting with it first); otherwise keywords that
     /// appear together with `current` on other photos, then the most used ones. Most frequent
     /// first, at most `n`, never one of `current`.
     pub fn keyword_suggestions(&self, current: &[String], prefix: &str, n: usize) -> Vec<String> {
-        let all = self.keywords();
-        let has = |k: &str| current.iter().any(|c| c.eq_ignore_ascii_case(k));
+        // the photos' keywords with their counts, and those only the list has (none)
+        let mut all = self.keywords();
+        for l in self.keyword_list.values() {
+            if !all.iter().any(|(k, _)| same(k, &l.path)) {
+                all.push((l.path.clone(), 0));
+            }
+        }
+        let has = |k: &str| current.iter().any(|c| same(c, k));
         let q = prefix.trim().to_lowercase();
         let mut scored: Vec<(i64, String)> = if !q.is_empty() {
             all.into_iter()
@@ -263,6 +833,600 @@ mod tests {
         assert_eq!(clean(" a | |b "), "a|b");
     }
 
+    fn tree_paths(nodes: &[KeywordNode]) -> Vec<(String, usize)> {
+        let mut out = Vec::new();
+        for n in nodes {
+            out.push((n.path.clone(), n.count));
+            out.extend(tree_paths(&n.children));
+        }
+        out
+    }
+
+    /// A keyword can be listed before any photo has it (Lightroom Classic's Create Keyword Tag):
+    /// it is in the tree with no photos, its parents too, and undo takes it away.
+    #[test]
+    fn a_keyword_listed_with_no_photos_is_in_the_tree() {
+        let (mut c, _) = lib(&[&["travel|France"]]);
+        let undo = c.apply(Op::SetKeyword { path: " travel | Italy ".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        assert_eq!(tree_paths(&c.keyword_tree()), [("travel".to_string(), 1), ("travel|France".to_string(), 1), ("travel|Italy".to_string(), 0)]);
+        assert_eq!(c.keyword_info("TRAVEL|italy"), Some(&KeywordInfo::default()), "found whatever the case");
+        c.apply(undo).unwrap();
+        assert_eq!(tree_paths(&c.keyword_tree()), [("travel".to_string(), 1), ("travel|France".to_string(), 1)]);
+        assert_eq!(c.keyword_info("travel|Italy"), None);
+    }
+
+    /// A listed keyword needs a name, and its attributes start as Lightroom Classic's do: exported,
+    /// with the keywords containing it and its synonyms; not a person.
+    #[test]
+    fn a_listed_keyword_needs_a_name_and_starts_exported() {
+        let mut c = Catalog::new();
+        assert!(c.apply(Op::SetKeyword { path: " | ".into(), info: Some(KeywordInfo::default()) }).is_err());
+        let info = KeywordInfo::default();
+        assert!(info.include_on_export && info.export_containing && info.export_synonyms && !info.person && info.synonyms.is_empty());
+    }
+
+    /// Changing a listed keyword's attributes is undone to the attributes it had, under the name as
+    /// it was written.
+    #[test]
+    fn changing_a_listed_keyword_is_undone_to_what_it_was() {
+        let mut c = Catalog::new();
+        c.apply(Op::SetKeyword { path: "Weddings".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        let person = KeywordInfo { person: true, synonyms: vec!["Marriage".into()], ..KeywordInfo::default() };
+        let undo = c.apply(Op::SetKeyword { path: "weddings".into(), info: Some(person.clone()) }).unwrap();
+        assert_eq!(c.keyword_info("Weddings"), Some(&person));
+        assert_eq!(undo, Op::SetKeyword { path: "Weddings".into(), info: Some(KeywordInfo::default()) });
+        c.apply(undo).unwrap();
+        assert_eq!(c.keyword_info("weddings"), Some(&KeywordInfo::default()));
+    }
+
+    fn listed(c: &Catalog) -> Vec<(String, KeywordInfo)> {
+        let mut v: Vec<(String, KeywordInfo)> = c.listed_keywords().map(|k| (k.path.clone(), k.info.clone())).collect();
+        v.sort_by_key(|(p, _)| p.to_lowercase());
+        v
+    }
+
+    fn with_synonyms(words: &[&str]) -> KeywordInfo {
+        KeywordInfo { synonyms: words.iter().map(|w| w.to_string()).collect(), ..KeywordInfo::default() }
+    }
+
+    /// Renaming (or moving) a keyword takes its attributes and its listed children along, photos
+    /// or not, in the same undo step.
+    #[test]
+    fn renaming_a_keyword_carries_its_listing_along() {
+        let (mut c, ids) = lib(&[&["travel|italy"]]);
+        c.apply(Op::SetKeyword { path: "travel".into(), info: Some(with_synonyms(&["trip"])) }).unwrap();
+        c.apply(Op::SetKeyword { path: "travel|Spain".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        let before = c.to_snapshot();
+        let op = c.rename_keyword_ops("Travel", "Places|Europe").unwrap();
+        let undo = c.apply(op).unwrap();
+        assert_eq!(kws(&c, ids[0]), ["Places|Europe|italy"]);
+        assert_eq!(
+            listed(&c),
+            [("Places|Europe".to_string(), with_synonyms(&["trip"])), ("Places|Europe|Spain".to_string(), KeywordInfo::default())]
+        );
+        c.apply(undo).unwrap();
+        assert_eq!(c.to_snapshot(), before);
+    }
+
+    /// A keyword only the list holds (no photos) can be renamed too.
+    #[test]
+    fn a_keyword_without_photos_can_be_renamed() {
+        let mut c = Catalog::new();
+        c.apply(Op::SetKeyword { path: "weddings".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        let op = c.rename_keyword_ops("weddings", "Events|Weddings").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(listed(&c), [("Events|Weddings".to_string(), KeywordInfo::default())]);
+    }
+
+    /// Merging keeps the target's attributes and adds the merged keyword's synonyms to them; a target
+    /// not listed yet takes the merged keyword's attributes.
+    #[test]
+    fn merging_keeps_the_targets_attributes_and_gathers_synonyms() {
+        let (mut c, _) = lib(&[&["holiday"], &["travel"]]);
+        let person = KeywordInfo { person: true, ..with_synonyms(&["trip"]) };
+        c.apply(Op::SetKeyword { path: "travel".into(), info: Some(person.clone()) }).unwrap();
+        c.apply(Op::SetKeyword {
+            path: "holiday".into(),
+            info: Some(KeywordInfo { include_on_export: false, ..with_synonyms(&["vacation", "Trip"]) }),
+        })
+        .unwrap();
+        let op = c.merge_keywords_ops(&["holiday".into()], "travel").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(listed(&c), [("travel".to_string(), KeywordInfo { person: true, ..with_synonyms(&["trip", "vacation"]) })]);
+        // onto a keyword that isn't listed: it takes the merged one's attributes
+        let mut c = Catalog::new();
+        c.apply(Op::SetKeyword { path: "holiday".into(), info: Some(with_synonyms(&["vacation"])) }).unwrap();
+        let op = c.merge_keywords_ops(&["holiday".into()], "Travel").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(listed(&c), [("Travel".to_string(), with_synonyms(&["vacation"]))]);
+    }
+
+    /// Deleting a keyword takes it, and the keywords below it, off the list as well as off photos.
+    #[test]
+    fn deleting_a_keyword_takes_it_off_the_list() {
+        let (mut c, _) = lib(&[&["travel|italy"], &["beach"]]);
+        for path in ["travel", "travel|spain", "beach"] {
+            c.apply(Op::SetKeyword { path: path.into(), info: Some(KeywordInfo::default()) }).unwrap();
+        }
+        let before = c.to_snapshot();
+        let op = c.delete_keyword_ops("travel").unwrap();
+        let undo = c.apply(op).unwrap();
+        assert_eq!(listed(&c), [("beach".to_string(), KeywordInfo::default())]);
+        assert_eq!(tree_paths(&c.keyword_tree()), [("beach".to_string(), 1)]);
+        c.apply(undo).unwrap();
+        assert_eq!(c.to_snapshot(), before);
+    }
+
+    /// Creating a keyword lists it with its attributes, and can tag photos with it in the same undo
+    /// step. A keyword that exists already (listed, or on a photo) isn't created again.
+    #[test]
+    fn creating_a_keyword_lists_it_and_can_tag_photos() {
+        let (mut c, ids) = lib(&[&["beach"], &[]]);
+        let before = c.to_snapshot();
+        let op = c.create_keyword_ops("Events | Weddings", with_synonyms(&["marriage"]), &[ids[1]]).unwrap();
+        let undo = c.apply(op).unwrap();
+        assert_eq!(listed(&c), [("Events|Weddings".to_string(), with_synonyms(&["marriage"]))]);
+        assert_eq!(kws(&c, ids[1]), ["Events|Weddings"]);
+        c.apply(undo).unwrap();
+        assert_eq!(c.to_snapshot(), before);
+        for exists in ["BEACH", "events|weddings"] {
+            if exists == "events|weddings" {
+                let op = c.create_keyword_ops("Events|Weddings", KeywordInfo::default(), &[]).unwrap();
+                c.apply(op).unwrap();
+            }
+            assert!(c.create_keyword_ops(exists, KeywordInfo::default(), &[]).is_err(), "{exists}");
+        }
+        assert!(c.create_keyword_ops(" | ", KeywordInfo::default(), &[]).is_err());
+    }
+
+    /// Moving a keyword nests it inside another (or takes it to the top level), with its children,
+    /// on photos and in the list. It can't go inside itself or one of its children, and moving it
+    /// where it already is changes nothing.
+    #[test]
+    fn moving_a_keyword_nests_it_inside_another() {
+        let (mut c, ids) = lib(&[&["Italy|Rome"], &["Europe"]]);
+        // typed in any case, the keywords keep the spelling the library has
+        let op = c.move_keyword_ops("italy", Some("EUROPE"), false).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(kws(&c, ids[0]), ["Europe|Italy|Rome"]);
+        let op = c.move_keyword_ops("europe|italy", None, false).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(kws(&c, ids[0]), ["Italy|Rome"], "back at the top level");
+        assert!(c.move_keyword_ops("italy", Some("italy|rome"), false).is_err(), "inside its own child");
+        assert!(c.move_keyword_ops("italy", Some("Italy"), false).is_err(), "inside itself");
+        assert_eq!(c.move_keyword_ops("italy|rome", Some("italy"), false).unwrap(), Op::Batch { ops: vec![] }, "already there");
+        assert!(c.move_keyword_ops("lisbon", Some("europe"), false).is_err(), "no such keyword");
+    }
+
+    /// Moving onto a name that is taken (Europe already has a Rome) merges the two, so the move
+    /// asks first: refused unless merging is allowed.
+    #[test]
+    fn moving_onto_a_taken_name_merges_only_when_allowed() {
+        let (mut c, ids) = lib(&[&["rome"], &["europe|rome"]]);
+        let err = c.move_keyword_ops("rome", Some("europe"), false).unwrap_err();
+        assert!(matches!(err, CatalogError::KeywordExists(ref k) if k == "europe|rome"), "{err:?}");
+        let op = c.move_keyword_ops("rome", Some("europe"), true).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!((kws(&c, ids[0]), kws(&c, ids[1])), (vec!["europe|rome".to_string()], vec!["europe|rome".to_string()]));
+    }
+
+    /// Editing a keyword renames it (its last level: it stays where it is) and sets its attributes,
+    /// in one undo step. A name that is taken is refused: merging is its own action.
+    #[test]
+    fn editing_a_keyword_renames_it_and_sets_its_attributes() {
+        let (mut c, ids) = lib(&[&["travel|italy"], &["travel|spain"]]);
+        let before = c.to_snapshot();
+        let person = KeywordInfo { person: true, ..KeywordInfo::default() };
+        let op = c.edit_keyword_ops("travel|italy", "Italia", person.clone()).unwrap();
+        let undo = c.apply(op).unwrap();
+        assert_eq!(kws(&c, ids[0]), ["travel|Italia"]);
+        assert_eq!(c.keyword_info("travel|italia"), Some(&person));
+        c.apply(undo).unwrap();
+        assert_eq!(c.to_snapshot(), before);
+        // attributes alone
+        let op = c.edit_keyword_ops("travel", "travel", with_synonyms(&["trip"])).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(listed(&c), [("travel".to_string(), with_synonyms(&["trip"]))]);
+        assert!(matches!(c.edit_keyword_ops("travel|italy", "Spain", KeywordInfo::default()), Err(CatalogError::KeywordExists(_))));
+        assert!(c.edit_keyword_ops("travel|italy", "a|b", KeywordInfo::default()).is_err(), "a name, not a path");
+        assert!(c.edit_keyword_ops("travel|italy", "  ", KeywordInfo::default()).is_err());
+    }
+
+    /// Purging takes off the list the keywords no photo has (nor any keyword below them), in one
+    /// undo step; keywords photos carry stay.
+    #[test]
+    fn purging_takes_unused_keywords_off_the_list() {
+        let (mut c, _) = lib(&[&["travel|italy"]]);
+        for path in ["travel", "travel|italy", "travel|spain", "weddings"] {
+            c.apply(Op::SetKeyword { path: path.into(), info: Some(KeywordInfo::default()) }).unwrap();
+        }
+        let op = c.purge_unused_keywords_ops();
+        c.apply(op).unwrap();
+        assert_eq!(listed(&c).iter().map(|(p, _)| p.as_str()).collect::<Vec<_>>(), ["travel", "travel|italy"]);
+        assert_eq!(tree_paths(&c.keyword_tree()), [("travel".to_string(), 1), ("travel|italy".to_string(), 1)]);
+    }
+
+    /// Renaming matches names whatever their case, also where a letter's case changes its length
+    /// (ẞ is three bytes, ß two): the levels below are kept whole, never cut mid-letter.
+    #[test]
+    fn renaming_keeps_the_levels_below_whatever_the_case() {
+        let (mut c, ids) = lib(&[&["straße|nord"], &["ßa|ü"]]);
+        let op = c.rename_keyword_ops("STRAẞE", "Road").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(kws(&c, ids[0]), ["Road|nord"]);
+        let op = c.rename_keyword_ops("ẞA", "Weg").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(kws(&c, ids[1]), ["Weg|ü"]);
+    }
+
+    fn exported(c: &Catalog, keywords: &[&str]) -> (Vec<String>, Vec<String>) {
+        let e = c.export_keywords(&keywords.iter().map(|k| k.to_string()).collect::<Vec<_>>());
+        (e.flat, e.hierarchical)
+    }
+
+    /// By default a keyword is exported as its name together with the keywords containing it (flat,
+    /// `dc:subject`), and as its full path (`lr:hierarchicalSubject`); each name once.
+    #[test]
+    fn a_keyword_exports_its_name_its_parents_and_its_path() {
+        let c = Catalog::new();
+        let (flat, paths) = exported(&c, &["travel|Italy|Rome", "Travel|Spain", "beach"]);
+        assert_eq!(flat, ["Rome", "Italy", "travel", "Spain", "beach"]);
+        assert_eq!(paths, ["travel|Italy|Rome", "Travel|Spain", "beach"]);
+    }
+
+    /// A keyword not included on export is left out, path and all; a parent left out (a keyword that
+    /// only organizes others) isn't exported as a containing keyword, but its children are.
+    #[test]
+    fn keywords_left_out_of_export_stay_out() {
+        let mut c = Catalog::new();
+        let out = KeywordInfo { include_on_export: false, ..KeywordInfo::default() };
+        c.apply(Op::SetKeyword { path: "Places".into(), info: Some(out.clone()) }).unwrap();
+        c.apply(Op::SetKeyword { path: "draft".into(), info: Some(out) }).unwrap();
+        let (flat, paths) = exported(&c, &["Places|Lisbon", "draft"]);
+        assert_eq!(flat, ["Lisbon"]);
+        assert_eq!(paths, ["Places|Lisbon"]);
+    }
+
+    /// Without "export containing keywords" only the keyword's own name goes out flat; synonyms go
+    /// out with it unless "export synonyms" is off.
+    #[test]
+    fn containing_keywords_and_synonyms_follow_their_options() {
+        let mut c = Catalog::new();
+        let alone = KeywordInfo { export_containing: false, ..with_synonyms(&["Lisboa"]) };
+        c.apply(Op::SetKeyword { path: "Places|Lisbon".into(), info: Some(alone) }).unwrap();
+        let quiet = KeywordInfo { export_synonyms: false, ..with_synonyms(&["marriage"]) };
+        c.apply(Op::SetKeyword { path: "Events|Weddings".into(), info: Some(quiet) }).unwrap();
+        let (flat, _) = exported(&c, &["Places|Lisbon", "Events|Weddings"]);
+        assert_eq!(flat, ["Lisbon", "Lisboa", "Weddings", "Events"]);
+    }
+
+    /// Names match whatever the case of any letter, not only ASCII ones: changing only the case of
+    /// "Ärzte" is a rename, not a clash with itself, and moving it where it is changes nothing.
+    #[test]
+    fn names_match_whatever_the_case_of_any_letter() {
+        let (mut c, ids) = lib(&[&["Ärzte|Wien"]]);
+        let op = c.edit_keyword_ops("ärzte", "ÄRZTE", KeywordInfo::default()).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(kws(&c, ids[0]), ["ÄRZTE|Wien"]);
+        assert_eq!(c.move_keyword_ops("ärzte|wien", Some("ärzte"), false).unwrap(), Op::Batch { ops: vec![] });
+        let op = c.rename_keyword_ops("ärzte", "Ärzte").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(kws(&c, ids[0]), ["Ärzte|Wien"]);
+        assert!(c.create_keyword_ops("ärzte", KeywordInfo::default(), &[]).is_err(), "exists");
+    }
+
+    /// A keyword that is only the parent of a listed one ("Events" of "Events|Weddings") is a
+    /// keyword like any other: it is in the tree, so it can be found, moved and renamed.
+    #[test]
+    fn the_parent_of_a_listed_keyword_is_a_keyword() {
+        let mut c = Catalog::new();
+        c.apply(Op::SetKeyword { path: "Events|Weddings".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        assert!(c.has_keyword("events"));
+        assert_eq!(c.keyword_path("EVENTS").as_deref(), Some("Events"));
+        let op = c.edit_keyword_ops("events", "Occasions", KeywordInfo::default()).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(tree_paths(&c.keyword_tree()), [("Occasions".to_string(), 0), ("Occasions|Weddings".to_string(), 0)]);
+    }
+
+    /// Photos in Recently Deleted don't count: a keyword only they have isn't in the tree, so it
+    /// can be created again and is purged as unused, and its spelling there isn't the library's.
+    #[test]
+    fn deleted_photos_dont_hold_keywords() {
+        let (mut c, ids) = lib(&[&["Weddings"], &["travel"]]);
+        c.apply(Op::SetDeleted { id: ids[0], deleted: true }).unwrap();
+        assert!(!c.has_keyword("weddings"));
+        assert!(c.create_keyword_ops("weddings", KeywordInfo::default(), &[]).is_ok());
+        c.apply(Op::SetKeyword { path: "Weddings".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        let op = c.purge_unused_keywords_ops();
+        c.apply(op).unwrap();
+        assert!(listed(&c).is_empty(), "only a deleted photo has it: unused");
+    }
+
+    /// Merging several keywords moves each keyword under them by the closest one, whatever the
+    /// order they are given in, and every listing lands where its keyword does: one landing where
+    /// another is about to leave isn't merged into it.
+    #[test]
+    fn merging_overlapping_keywords_keeps_every_listing() {
+        let (mut c, ids) = lib(&[&["a|b|c"], &["a|c"]]);
+        let person = KeywordInfo { person: true, ..KeywordInfo::default() };
+        c.apply(Op::SetKeyword { path: "a|b|c".into(), info: Some(person.clone()) }).unwrap();
+        c.apply(Op::SetKeyword { path: "a|c".into(), info: Some(with_synonyms(&["sea"])) }).unwrap();
+        let op = c.merge_keywords_ops(&["a|b".into(), "a|c".into()], "a").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!((kws(&c, ids[0]), kws(&c, ids[1])), (vec!["a|c".to_string()], vec!["a".to_string()]));
+        assert_eq!(listed(&c), [("a".to_string(), with_synonyms(&["sea"])), ("a|c".to_string(), person)]);
+        // the order of the keywords merged doesn't matter
+        let merged = |from: [&str; 2]| {
+            let (mut c, ids) = lib(&[&["a|b|c", "a|d"]]);
+            let op = c.merge_keywords_ops(&from.map(String::from), "x").unwrap();
+            c.apply(op).unwrap();
+            kws(&c, ids[0])
+        };
+        assert_eq!(merged(["a", "a|b"]), merged(["a|b", "a"]));
+        assert_eq!(merged(["a", "a|b"]), ["x|c", "x|d"]);
+    }
+
+    /// One keyword at most is where new keywords go (Put New Keywords Inside This Keyword). Making
+    /// another one so is one undo step; the mark moves with its keyword (also into a merge) and
+    /// goes with it.
+    #[test]
+    fn one_keyword_is_where_new_keywords_go() {
+        let (mut c, _) = lib(&[&["Events|Weddings"], &["Travel"]]);
+        let op = c.set_default_parent_ops(Some("events")).unwrap();
+        let undo = c.apply(op).unwrap();
+        assert_eq!(c.default_keyword_parent().as_deref(), Some("Events"));
+        let op = c.set_default_parent_ops(Some("travel")).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(c.default_keyword_parent().as_deref(), Some("Travel"), "only one");
+        assert!(c.set_default_parent_ops(Some("lisbon")).is_err());
+        let op = c.rename_keyword_ops("travel", "Trips").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(c.default_keyword_parent().as_deref(), Some("Trips"));
+        let op = c.merge_keywords_ops(&["trips".into()], "Events").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(c.default_keyword_parent().as_deref(), Some("Events"), "into the merge");
+        let op = c.delete_keyword_ops("events").unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(c.default_keyword_parent(), None);
+        let op = c.set_default_parent_ops(None).unwrap();
+        assert_eq!(op, Op::Batch { ops: vec![] }, "none to clear");
+        c.apply(undo).unwrap();
+        assert_eq!(c.default_keyword_parent(), None, "undo of the first: none was");
+    }
+
+    /// A file's keywords as a photo carries them: the paths of `lr:hierarchicalSubject`, and the
+    /// names of `dc:subject` that aren't levels of those paths (an exported `travel|Italy` comes
+    /// back as one keyword, not three). Without paths, the names as they are.
+    #[test]
+    fn a_files_keywords_keep_their_hierarchy() {
+        let v = |a: &[&str]| a.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        assert_eq!(from_file(&v(&["Rome", "Italy", "travel", "beach"]), &v(&["travel|Italy|Rome"])), ["travel|Italy|Rome", "beach"]);
+        assert_eq!(from_file(&v(&["ROME"]), &v(&["travel|Rome", " travel | rome "])), ["travel|Rome"], "each once, cleaned");
+        assert_eq!(from_file(&v(&["beach", " sea "]), &[]), ["beach", "sea"]);
+        assert_eq!(from_file(&v(&["a|b"]), &[]), ["a|b"], "LightCraft's own sidecars write paths flat");
+    }
+
+    /// A new keyword inside one the library has takes the library's spelling of it: creating
+    /// "TRAVEL|rome" next to "travel|italy" doesn't respell "travel".
+    #[test]
+    fn a_new_keyword_keeps_the_spelling_of_its_parents() {
+        let (mut c, _) = lib(&[&["travel|italy"]]);
+        let op = c.create_keyword_ops("TRAVEL|Rome", KeywordInfo::default(), &[]).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(listed(&c).iter().map(|(p, _)| p.as_str()).collect::<Vec<_>>(), ["travel|Rome"]);
+        assert_eq!(tree_paths(&c.keyword_tree())[0].0, "travel");
+    }
+
+    /// An edit that changes nothing is nothing: no listing, no undo step.
+    #[test]
+    fn an_edit_that_changes_nothing_is_nothing() {
+        let (mut c, _) = lib(&[&["beach"]]);
+        assert_eq!(c.edit_keyword_ops("beach", "beach", KeywordInfo::default()).unwrap(), Op::Batch { ops: vec![] });
+        c.apply(Op::SetKeyword { path: "beach".into(), info: Some(with_synonyms(&["shore"])) }).unwrap();
+        assert_eq!(c.edit_keyword_ops("BEACH", "beach", with_synonyms(&["shore"])).unwrap(), Op::Batch { ops: vec![] });
+        // renamed with the default attributes: the photos change, nothing is listed
+        let (mut c, _) = lib(&[&["beach"]]);
+        let op = c.edit_keyword_ops("beach", "Shore", KeywordInfo::default()).unwrap();
+        c.apply(op).unwrap();
+        assert!(listed(&c).is_empty());
+    }
+
+    /// Typing suggests keywords no photo has yet too (created in the Keyword List).
+    #[test]
+    fn suggestions_include_keywords_without_photos() {
+        let (mut c, _) = lib(&[&["beach"]]);
+        c.apply(Op::SetKeyword { path: "Events|Weddings".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        assert_eq!(c.keyword_suggestions(&[], "wed", 5), ["Events|Weddings"]);
+        assert!(!c.keyword_suggestions(&["events|weddings".into()], "wed", 5).contains(&"Events|Weddings".to_string()), "not one it has");
+    }
+
+    /// A new name typed for a photo goes inside the default parent; a keyword the library has, and
+    /// a path typed whole, don't.
+    #[test]
+    fn typed_new_keywords_go_inside_the_default_parent() {
+        let (mut c, _) = lib(&[&["beach"], &["Events"]]);
+        assert_eq!(c.typed_keyword(" Weddings "), "Weddings", "no default parent");
+        let op = c.set_default_parent_ops(Some("events")).unwrap();
+        c.apply(op).unwrap();
+        assert_eq!(c.typed_keyword("Weddings"), "Events|Weddings");
+        assert_eq!(c.typed_keyword("BEACH"), "BEACH", "the library has it");
+        assert_eq!(c.typed_keyword("Places|Lisbon"), "Places|Lisbon");
+    }
+
+    /// The keyword list as a text file, as Lightroom Classic writes one: a keyword a line, the
+    /// keywords inside it indented one tab more, a synonym in braces on a line of its own under its
+    /// keyword, a keyword left out of export in square brackets; by name.
+    #[test]
+    fn the_keyword_list_is_written_as_tab_indented_text() {
+        let (mut c, _) = lib(&[&["Places|Lisbon", "beach"]]);
+        c.apply(Op::SetKeyword { path: "Places".into(), info: Some(KeywordInfo { include_on_export: false, ..KeywordInfo::default() }) }).unwrap();
+        c.apply(Op::SetKeyword { path: "Places|Lisbon".into(), info: Some(with_synonyms(&["Lisboa"])) }).unwrap();
+        c.apply(Op::SetKeyword { path: "Events|Weddings".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        assert_eq!(c.keyword_list_text().text, "beach\nEvents\n\tWeddings\n[Places]\n\tLisbon\n\t\t{Lisboa}\n");
+    }
+
+    /// Reading a list gives each keyword's path and attributes: what was written comes back, and a
+    /// file from elsewhere (Windows line ends, a byte-order mark, blank lines) reads too.
+    #[test]
+    fn a_keyword_list_reads_back() {
+        let read = parse_keyword_list("\u{feff}beach\r\n\r\nEvents\r\n\tWeddings\r\n\t\t{marriage}\r\n[Places]\r\n\tLisbon\r\n").unwrap();
+        let out = KeywordInfo { include_on_export: false, ..KeywordInfo::default() };
+        assert_eq!(
+            read,
+            [
+                ("beach".to_string(), KeywordInfo::default()),
+                ("Events".to_string(), KeywordInfo::default()),
+                ("Events|Weddings".to_string(), with_synonyms(&["marriage"])),
+                ("Places".to_string(), out),
+                ("Places|Lisbon".to_string(), KeywordInfo::default()),
+            ]
+        );
+    }
+
+    /// Photo Supreme's Formatted Vocabulary File is the same format: plain text with Windows line
+    /// ends and no byte-order mark, a top-level category in square brackets (an organizing keyword,
+    /// left out of export), keywords a tab further in at each level.
+    #[test]
+    fn a_photo_supreme_vocabulary_file_reads() {
+        let file = "[Places]\r\n\tPortugal\r\n\t\tLisbon\r\n\t\t\tAlfama\r\n\t\tPorto\r\n\tSpain\r\n\t\tSeville\r\n";
+        let read = parse_keyword_list(file).unwrap();
+        let paths: Vec<&str> = read.iter().map(|(p, _)| p.as_str()).collect();
+        assert_eq!(
+            paths,
+            ["Places", "Portugal", "Portugal|Lisbon", "Portugal|Lisbon|Alfama", "Portugal|Porto", "Spain", "Spain|Seville"]
+                .map(|p| if p == "Places" { p.to_string() } else { format!("Places|{p}") })
+        );
+        assert!(!read[0].1.include_on_export, "the category organizes: it isn't exported");
+        assert!(read[1..].iter().all(|(_, i)| i.include_on_export));
+    }
+
+    /// A list that can't be read says which line and why, and nothing of it is taken.
+    #[test]
+    fn a_bad_keyword_list_says_which_line() {
+        let err = |text: &str| parse_keyword_list(text).unwrap_err().to_string();
+        assert!(err("Events\n\t\tWeddings\n").contains("line 2"), "two levels down at once");
+        assert!(err("{marriage}\n").contains("line 1"), "a synonym of nothing");
+        assert!(err("Events\nTravel|Lisbon\n").contains("line 2"), "“|” separates levels here");
+        let deep: String = (0..70).map(|i| format!("{}k{i}\n", "\t".repeat(i))).collect();
+        assert!(err(&deep).contains("line 65"), "a file is input: 64 levels at most");
+    }
+
+    /// Files from elsewhere read as they were meant or say why not: classic Mac line ends (a lone
+    /// carriage return) are lines; indenting with spaces, which would flatten the hierarchy, is
+    /// refused at its line; so are control characters in a name and "|" in a synonym.
+    #[test]
+    fn a_keyword_list_from_elsewhere_reads_or_says_why_not() {
+        let paths = |text: &str| parse_keyword_list(text).unwrap().into_iter().map(|(p, _)| p).collect::<Vec<_>>();
+        assert_eq!(paths("Events\r\tWeddings\rPlaces\r"), ["Events", "Events|Weddings", "Places"]);
+        let err = |text: &str| parse_keyword_list(text).unwrap_err().to_string();
+        assert!(err("Events\n    Weddings\n").contains("line 2"), "space indentation");
+        assert!(err("Events\n\t Weddings\n").contains("line 2"), "a space after the tabs");
+        assert!(err("Events\nx\u{0}y\n").contains("line 2"), "a control character");
+        assert!(err("Events\n\t{sea|shore}\n").contains("line 2"), "“|” in a synonym");
+    }
+
+    /// A keyword repeated in another case is one keyword, and the keywords inside either take the
+    /// first spelling.
+    #[test]
+    fn a_repeated_keyword_keeps_its_first_spelling() {
+        let read = parse_keyword_list("Events\n\tWeddings\nevents\n\tBirthdays\n").unwrap();
+        assert_eq!(read.iter().map(|(p, _)| p.as_str()).collect::<Vec<_>>(), ["Events", "Events|Weddings", "Events|Birthdays"]);
+    }
+
+    /// What the list can't hold is left out and named, so the file always reads back: a name the
+    /// format would read as something else (in brackets or braces), one with a line break, a
+    /// synonym with one, a keyword nested deeper than a list goes; and the keywords inside one left
+    /// out go with it.
+    #[test]
+    fn an_exported_keyword_list_always_reads_back() {
+        let deep = (0..=MAX_LEVELS).map(|i| format!("level {i}")).collect::<Vec<_>>().join("|");
+        let (mut c, _) = lib(&[&["Travel|[draft]", "{todo}|Lisbon", "Weddings", "Line\nbreak", deep.as_str()]]);
+        c.apply(Op::SetKeyword { path: "Weddings".into(), info: Some(with_synonyms(&["marriage", "two\nlines"])) }).unwrap();
+        let KeywordListFile { text, unwritable, .. } = c.keyword_list_text();
+        let read = parse_keyword_list(&text).unwrap_or_else(|e| panic!("{e}\n{text}"));
+        assert!(read.iter().any(|(p, _)| p == "Travel"));
+        assert!(read.iter().all(|(p, _)| !p.contains("draft") && !p.contains("todo") && !p.contains("Line")), "{text}");
+        let weddings = read.iter().find(|(p, _)| p == "Weddings").map(|(_, i)| i.synonyms.clone());
+        assert_eq!(weddings, Some(vec!["marriage".to_string()]));
+        let deepest = read.iter().map(|(p, _)| p.split(SEP).count()).max();
+        assert_eq!(deepest, Some(MAX_LEVELS));
+        assert!(unwritable.contains(&"Travel|[draft]".to_string()), "{unwritable:?}");
+        assert!(unwritable.contains(&"{todo}".to_string()), "{unwritable:?}");
+        assert!(unwritable.contains(&"Line\nbreak".to_string()), "{unwritable:?}");
+        assert!(unwritable.contains(&"Weddings {two\nlines}".to_string()), "{unwritable:?}");
+        assert!(unwritable.iter().any(|u| u.ends_with(&format!("level {MAX_LEVELS}"))), "{unwritable:?}");
+    }
+
+    /// The list leaves out only what it must, and names only what's lost: a name starting with a
+    /// byte-order mark would lose it, but a synonym in braces reads back, and a synonym that's empty
+    /// or another's in a different case is no loss. It also says which keywords it wrote.
+    #[test]
+    fn an_exported_keyword_list_names_only_what_it_loses() {
+        let (mut c, _) = lib(&[&["\u{feff}Albums", "{draft", "Weddings"]]);
+        c.apply(Op::SetKeyword { path: "Weddings".into(), info: Some(with_synonyms(&["Marriage", "marriage", " ", "{vows}"])) }).unwrap();
+        let out = c.keyword_list_text();
+        let read = parse_keyword_list(&out.text).unwrap_or_else(|e| panic!("{e}\n{}", out.text));
+        assert_eq!(out.unwritable, ["\u{feff}Albums"]);
+        assert_eq!(out.written, ["Weddings", "{draft"]);
+        assert_eq!(read.iter().map(|(p, _)| p.as_str()).collect::<Vec<_>>(), ["Weddings", "{draft"]);
+        let weddings = read.iter().find(|(p, _)| p == "Weddings").map(|(_, i)| i.synonyms.clone());
+        assert_eq!(weddings, Some(vec!["Marriage".to_string(), "{vows}".to_string()]));
+    }
+
+    /// A big list reads and imports at once, against a big library too: 40,000 keywords used to take
+    /// half a minute to read, and checking 5,000 new ones against 20,000 photos over a minute, with
+    /// the app frozen.
+    #[test]
+    fn a_big_keyword_list_imports_quickly() {
+        let mut text = String::new();
+        for g in 0..400 {
+            text.push_str(&format!("group {g}\n"));
+            for k in 0..99 {
+                text.push_str(&format!("\tkeyword {g}-{k}\n"));
+            }
+        }
+        let t0 = std::time::Instant::now();
+        let read = parse_keyword_list(&text).unwrap();
+        assert_eq!(read.len(), 40_000);
+        let mut c = Catalog::new();
+        let mut ops = Vec::new();
+        for i in 0..20_000u32 {
+            let id = c.alloc_photo_id();
+            let mut p = Photo::new(id, Source::Demo { scene: 1 }, "a.jpg", "JPEG", 3, 2, "2026-01-01");
+            p.meta.keywords = (0..5).map(|k| format!("library {}|tag {}", k, (i + k) % 3000)).collect();
+            ops.push(Op::AddPhoto { photo: Box::new(p) });
+        }
+        c.apply(Op::Batch { ops }).unwrap();
+        let (op, added, _) = c.import_keywords_ops(&read[..5_000]);
+        c.apply(op).unwrap();
+        assert_eq!(added, 5_000);
+        let took = t0.elapsed();
+        assert!(took < std::time::Duration::from_secs(10), "{took:?}");
+    }
+
+    /// Importing a list adds the keywords the library doesn't have, with their attributes, and gives
+    /// those it has the list's synonyms (their own attributes stay), in one undo step.
+    #[test]
+    fn importing_a_keyword_list_adds_what_is_missing() {
+        let (mut c, _) = lib(&[&["Events|Weddings"]]);
+        c.apply(Op::SetKeyword { path: "Events|Weddings".into(), info: Some(KeywordInfo { person: true, ..with_synonyms(&["marriage"]) }) }).unwrap();
+        let before = c.to_snapshot();
+        let read = parse_keyword_list("events\n\tweddings\n\t\t{nuptials}\n\tBirthdays\n[Drafts]\n").unwrap();
+        let (op, added, updated) = c.import_keywords_ops(&read);
+        assert_eq!((added, updated), (2, 1));
+        let undo = c.apply(op).unwrap();
+        assert_eq!(c.keyword_info("Events|Weddings"), Some(&KeywordInfo { person: true, ..with_synonyms(&["marriage", "nuptials"]) }));
+        assert!(c.has_keyword("Events|Birthdays"));
+        assert_eq!(
+            listed(&c).iter().map(|(p, _)| p.as_str()).collect::<Vec<_>>(),
+            ["Drafts", "Events|Birthdays", "Events|Weddings"],
+            "in the library's spelling"
+        );
+        assert!(!c.keyword_info("Drafts").unwrap().include_on_export);
+        c.apply(undo).unwrap();
+        assert_eq!(c.to_snapshot(), before);
+    }
+
     #[test]
     fn suggestions_rank_co_occurrence_and_prefixes() {
         let (c, _) = lib(&[&["dog", "park"], &["dog", "park", "ball"], &["dog", "beach"], &["cat"], &["cat"], &["cat"], &["parade"], &["eagle"]]);
diff --git a/crates/catalog/src/lib.rs b/crates/catalog/src/lib.rs
index 884ec658..ed615084 100644
--- a/crates/catalog/src/lib.rs
+++ b/crates/catalog/src/lib.rs
@@ -30,7 +30,7 @@ use std::collections::BTreeMap;
 use std::sync::Arc;
 
 pub use dates::{DateRun, GroupBy};
-pub use folders::FolderNode;
+pub use folders::{FolderNode, FolderRecord};
 pub use journal::{Journal, LoadReport, PersistStats, SnapshotPolicy, SnapshotTiming};
 pub use keywords::KeywordNode;
 use lightcraft_develop::DevelopSettings;
@@ -52,6 +52,9 @@ pub enum CatalogError {
     NoStack(StackId),
     #[error("invalid: {0}")]
     Invalid(String),
+    /// A keyword of that name is there already: moving or renaming onto it would merge the two.
+    #[error("there is a keyword “{0}” already")]
+    KeywordExists(String),
     #[error("corrupt catalog data: {0}")]
     Corrupt(String),
     #[error("catalog storage: {0}")]
@@ -206,6 +209,11 @@ pub enum Op {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         preview_only: Option<String>,
     },
+    /// The lens data a photo's file carries (what Reload finds when it was read after import).
+    SetEmbeddedLens {
+        id: PhotoId,
+        lens: Option<Box<lightcraft_develop::EmbeddedLens>>,
+    },
     /// The name shown for a colour label (`None` = its colour's name).
     SetLabelName {
         label: ColorLabel,
@@ -217,6 +225,18 @@ pub enum Op {
         folder: String,
         at: Option<String>,
     },
+    /// List a keyword in the library's keyword list with these attributes, or take it off the list
+    /// (`None`; photos that carry it keep it). Format version 4.
+    SetKeyword {
+        path: String,
+        info: Option<keywords::KeywordInfo>,
+    },
+    /// What the library keeps about one of its folders (see [`folders::FolderRecord`]), under
+    /// its identity ([`query::folder_key`]); `None` or an empty record = keep nothing.
+    SetFolderRecord {
+        folder: String,
+        record: Option<FolderRecord>,
+    },
     /// Several ops as one step (undo applies the inverses in reverse).
     Batch {
         ops: Vec<Op>,
@@ -239,6 +259,12 @@ pub struct Catalog {
     /// When each Local folder was last browsed (folder path → ISO 8601), see [`local`].
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     browsed: BTreeMap<String, String>,
+    /// Keywords listed on their own or given attributes, by lower-case path (see [`keywords`]).
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    keyword_list: BTreeMap<String, keywords::ListedKeyword>,
+    /// What the library keeps about its folders (folder identity → record), see [`folders`].
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    folder_records: BTreeMap<String, FolderRecord>,
     /// Increments on every applied op.
     #[serde(skip)]
     pub revision: u64,
@@ -324,12 +350,57 @@ impl Catalog {
     /// no smart album).
     pub fn album_contains(&self, id: AlbumId, p: &Photo) -> bool {
         match self.albums.get(&id) {
-            Some(Album { smart: Some(rules), .. }) => !p.deleted && rules.matches(p, self),
+            // guarded: a smart album testing smart albums can't loop or recurse without end
+            Some(Album { smart: Some(rules), .. }) => !p.deleted && rules::smart_album_holds(id, p.id, || rules.matches(p, self)),
             Some(a) => a.photos.contains(&p.id),
             None => false,
         }
     }
 
+    /// Whether smart album `from` tests `to`, directly or through the smart albums it tests (the
+    /// rules of `from` would then change when those of `to` do). Loops in saved rules end the
+    /// search, they don't repeat it.
+    pub fn album_reaches(&self, from: AlbumId, to: AlbumId) -> bool {
+        let mut seen: std::collections::HashSet<AlbumId> = std::collections::HashSet::new();
+        let mut next = vec![from];
+        while let Some(a) = next.pop() {
+            if !seen.insert(a) {
+                continue;
+            }
+            let tested = self.albums.get(&a).and_then(|al| al.smart.as_deref()).map(Filter::albums_tested).unwrap_or_default();
+            if tested.contains(&to) {
+                return true;
+            }
+            next.extend(tested);
+        }
+        false
+    }
+
+    /// What is wrong with a saved smart album's rules now (`RuleSet::check`, after
+    /// `RuleSet::upgrade`): typically a rule testing an album that has since been deleted. Empty
+    /// for a sound smart album, a plain album or no album.
+    pub fn smart_album_problems(&self, id: AlbumId) -> Vec<rules::Problem> {
+        let Some(filter) = self.albums.get(&id).and_then(|a| a.smart.as_deref()) else { return Vec::new() };
+        let mut out: Vec<rules::Problem> = self.album_filter_problem(filter, Some(id)).into_iter().collect();
+        if let Some(mut rules) = filter.rule_set.clone() {
+            rules.upgrade();
+            out.extend(rules.check_for(self, Some(id)));
+        }
+        out
+    }
+
+    /// A loop through `filter`'s own album field (not its rules): smart album `owner` filtered to
+    /// itself, or to an album that leads back to it.
+    pub fn album_filter_problem(&self, filter: &Filter, owner: Option<AlbumId>) -> Option<rules::Problem> {
+        let (a, owner) = (filter.album?, owner?);
+        (a == owner || self.album_reaches(a, owner)).then(|| rules::Problem {
+            path: Vec::new(),
+            field: Some("album".into()),
+            issue: rules::Issue::AlbumLoop,
+            message: format!("its album filter (album {}) would make this album include itself", a.0),
+        })
+    }
+
     /// The photos of an album: the stored list, or a smart album's current matches (id order).
     pub fn album_photos(&self, id: AlbumId) -> Vec<PhotoId> {
         match self.albums.get(&id) {
@@ -366,6 +437,18 @@ impl Catalog {
     pub fn label_name(&self, l: ColorLabel) -> String {
         self.label_names.get(&l).cloned().unwrap_or_else(|| format!("{l:?}"))
     }
+    /// A listed keyword's attributes (any case), `None` when it isn't listed.
+    pub fn keyword_info(&self, path: &str) -> Option<&keywords::KeywordInfo> {
+        self.keyword_list.get(&keywords::clean(path).to_lowercase()).map(|k| &k.info)
+    }
+    /// How the keyword list spells a listed keyword (any case), `None` when it isn't listed.
+    pub fn listed_path(&self, path: &str) -> Option<&str> {
+        self.keyword_list.get(&keywords::clean(path).to_lowercase()).map(|k| k.path.as_str())
+    }
+    /// The keyword list: keywords listed on their own or given attributes, by path.
+    pub fn listed_keywords(&self) -> impl Iterator<Item = &keywords::ListedKeyword> {
+        self.keyword_list.values()
+    }
     /// The custom name of a colour label, if any.
     pub fn custom_label_name(&self, l: ColorLabel) -> Option<&str> {
         self.label_names.get(&l).map(String::as_str)
@@ -373,7 +456,9 @@ impl Catalog {
     /// The label a name stands for: a custom name first, then a colour's own name (any case).
     pub fn label_from_name(&self, name: &str) -> Option<ColorLabel> {
         let name = name.trim();
-        self.label_names.iter().find(|(_, n)| n.trim().eq_ignore_ascii_case(name)).map(|(l, _)| *l).or_else(|| ColorLabel::parse(name))
+        // any case, accents included (Été / été), as rules compare names
+        let name_lower = name.to_lowercase();
+        self.label_names.iter().find(|(_, n)| n.trim().to_lowercase() == name_lower).map(|(l, _)| *l).or_else(|| ColorLabel::parse(name))
     }
 
     // ---- writes
@@ -596,6 +681,10 @@ impl Catalog {
                     preview_only: std::mem::replace(&mut p.preview_only, preview_only),
                 }
             }
+            Op::SetEmbeddedLens { id, lens } => {
+                let p = self.photo_mut(id)?;
+                Op::SetEmbeddedLens { id, lens: std::mem::replace(&mut p.embedded_lens, lens.map(|l| *l)).map(Box::new) }
+            }
             Op::SetFile { id, file_name, source } => {
                 if file_name.trim().is_empty() {
                     return Err(CatalogError::Invalid("empty file name".into()));
@@ -612,6 +701,21 @@ impl Catalog {
                 };
                 Op::SetLabelName { label, name: old }
             }
+            Op::SetKeyword { path, info } => {
+                let path = keywords::clean(&path);
+                if path.is_empty() {
+                    return Err(CatalogError::Invalid("keyword names can't be empty".into()));
+                }
+                let key = path.to_lowercase();
+                let old = match info {
+                    Some(info) => self.keyword_list.insert(key, keywords::ListedKeyword { path: path.clone(), info }),
+                    None => self.keyword_list.remove(&key),
+                };
+                match old {
+                    Some(old) => Op::SetKeyword { path: old.path, info: Some(old.info) },
+                    None => Op::SetKeyword { path, info: None },
+                }
+            }
             Op::SetBrowsed { folder, at } => {
                 let folder = crate::query::folder_key(&folder);
                 let old = match at {
@@ -620,6 +724,14 @@ impl Catalog {
                 };
                 Op::SetBrowsed { folder, at: old }
             }
+            Op::SetFolderRecord { folder, record } => {
+                let key = folders::record_key(&folder).ok_or_else(|| CatalogError::Invalid(format!("not a folder: {folder}")))?;
+                let old = match record.filter(|r| !r.is_empty()) {
+                    Some(r) => self.folder_records.insert(key.clone(), r),
+                    None => self.folder_records.remove(&key),
+                };
+                Op::SetFolderRecord { folder: key, record: old }
+            }
             Op::Batch { ops } => {
                 let mut inverses = Vec::with_capacity(ops.len());
                 for op in ops {
@@ -721,6 +833,8 @@ mod tests_album_order;
 #[cfg(test)]
 mod tests_background;
 #[cfg(test)]
+mod tests_folder_records;
+#[cfg(test)]
 mod tests_folders;
 #[cfg(test)]
 mod tests_format_version;
diff --git a/crates/catalog/src/local.rs b/crates/catalog/src/local.rs
index 4291f45f..e81d4880 100644
--- a/crates/catalog/src/local.rs
+++ b/crates/catalog/src/local.rs
@@ -283,7 +283,8 @@ impl Op {
             | Op::SetAnalysis { id, .. }
             | Op::SetFile { id, .. }
             | Op::Relink { id, .. }
-            | Op::SetContent { id, .. } => out(*id),
+            | Op::SetContent { id, .. }
+            | Op::SetEmbeddedLens { id, .. } => out(*id),
             Op::AddAlbum { album } => {
                 album.photos.iter().for_each(|p| out(*p));
                 album.cover.into_iter().for_each(&mut *out);
@@ -299,7 +300,9 @@ impl Op {
             | Op::SetAlbumRules { .. }
             | Op::RemoveStack { .. }
             | Op::SetLabelName { .. }
-            | Op::SetBrowsed { .. } => {}
+            | Op::SetKeyword { .. }
+            | Op::SetBrowsed { .. }
+            | Op::SetFolderRecord { .. } => {}
         }
     }
 }
diff --git a/crates/catalog/src/model.rs b/crates/catalog/src/model.rs
index 957f5b68..199edac1 100644
--- a/crates/catalog/src/model.rs
+++ b/crates/catalog/src/model.rs
@@ -152,6 +152,17 @@ impl CopyrightStatus {
     }
 }
 
+/// A shutter speed as cameras write it (`1/250`, `0.5`, `2"`, `30s`) in seconds; `None` for
+/// anything that isn't a positive, finite time.
+pub fn parse_shutter_seconds(s: &str) -> Option<f64> {
+    let s = s.trim().trim_end_matches(['s', '"']).trim();
+    match s.split_once('/') {
+        Some((n, d)) => Some(n.trim().parse::<f64>().ok()? / d.trim().parse::<f64>().ok()?),
+        None => s.parse().ok(),
+    }
+    .filter(|v: &f64| v.is_finite() && *v > 0.0)
+}
+
 /// Descriptive + capture metadata.
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
@@ -296,6 +307,14 @@ pub struct Analysis {
     pub best: bool,
 }
 
+/// Raw formats whose readers have vendor white-balance multipliers but no measured camera
+/// illuminant: their white balance is developed relative to the as-shot look (6500 K / 0 means
+/// as shot), as for rendered photographs. `format` is the file's extension or Lightroom's
+/// `fileFormat` name, in any case. See [`Photo::relative_wb`].
+pub fn relative_wb_format(format: &str) -> bool {
+    ["ARW", "NEF", "NRW", "RW2", "RWL", "RAW", "RAF", "CR3", "CR2", "PEF", "SRW", "ORF"].iter().any(|f| format.eq_ignore_ascii_case(f))
+}
+
 impl Photo {
     pub fn new(id: PhotoId, source: Source, file_name: &str, format: &str, width: u32, height: u32, imported: &str) -> Photo {
         Photo {
@@ -336,24 +355,27 @@ impl Photo {
     pub fn develops_raw(&self) -> bool {
         self.kind == MediaKind::Raw && self.preview_only.is_none()
     }
-    /// The current ARW, NEF, RW2, RAF, CR3, CR2 and PEF readers have vendor WB multipliers but no measured camera
+    /// The current ARW, NEF, RW2, RAF, CR3, CR2, PEF, SRW and ORF readers have vendor WB multipliers but no measured camera
     /// illuminant. Use adjustments relative to the camera's as-shot look, as for rendered
     /// photographs (the engine's `camera_preview::file_local_look` covers the same formats; RWL and
     /// RAW are Leica's and the oldest Panasonic bodies' names for RW2 files).
     pub fn relative_wb(&self) -> bool {
-        self.develops_raw()
-            && ["ARW", "NEF", "NRW", "RW2", "RWL", "RAW", "RAF", "CR3", "CR2", "PEF"].iter().any(|f| self.format.eq_ignore_ascii_case(f))
+        self.develops_raw() && relative_wb_format(&self.format)
     }
     /// The develop settings import gave this photo: [`Photo::camera_defaults`], or the user's
-    /// default preset applied on top of them ([`Photo::import_look`]).
+    /// default preset applied on top of them ([`Photo::import_look`]). Like the camera defaults,
+    /// in the photo's own rendering process.
     pub fn import_defaults(&self) -> DevelopSettings {
         match &self.import_look {
-            Some(l) => (**l).clone(),
+            Some(l) => DevelopSettings { process: self.develop.process, ..(**l).clone() },
             None => self.camera_defaults(),
         }
     }
     /// The built-in defaults for this photo, before any user default preset: raws start from
-    /// their as-shot white balance; embedded lens corrections on when the file has them.
+    /// their as-shot white balance; embedded lens corrections on when the file has them. They
+    /// carry the photo's own rendering process ([`lightcraft_develop::ProcessVersion`]): which
+    /// process a photo renders with is not an edit, so comparisons with its defaults (edited?
+    /// still as imported?) don't change when a newer process exists. A new photo has the latest.
     pub fn camera_defaults(&self) -> DevelopSettings {
         let wb = if self.relative_wb() { Some((6500.0, 0.0)) } else { self.as_shot_wb };
         let mut d = match wb {
@@ -363,8 +385,49 @@ impl Photo {
         if self.embedded_lens.is_some() {
             d.optics.lens_profile = true;
         }
+        d.process = self.develop.process;
         d
     }
+    /// The file name's extension without the dot, as written (`CR2` for `IMG_0042.CR2`); empty
+    /// when the name has none (`README`, a dot file such as `.hidden`).
+    pub fn extension(&self) -> &str {
+        self.file_name.rsplit_once('.').filter(|(stem, _)| !stem.is_empty()).map_or("", |(_, ext)| ext)
+    }
+    /// Width and height in pixels as the photo is shown: turned by its orientation and cut by its
+    /// crop. Straightening and Constrain Crop shrink the crop without changing its shape, so the
+    /// aspect is exact and the edges can read a little larger than an export.
+    pub fn shown_size(&self) -> (f64, f64) {
+        let (w, h) = (self.width as f64, self.height as f64);
+        let (w, h) = if self.develop.orientation.swaps_axes() { (h, w) } else { (w, h) };
+        let r = self.develop.crop.geometry.rect;
+        // a crop read from a file or an agent is hostile: no NaN, nothing outside the frame
+        let part = |len: f64| if len.is_finite() { len.clamp(0.0, 1.0) } else { 1.0 };
+        (w * part(r.width()), h * part(r.height()))
+    }
+    /// Cropped or straightened.
+    pub fn is_cropped(&self) -> bool {
+        !self.develop.crop.geometry.is_identity()
+    }
+    /// How many keywords the photo has: a hierarchical keyword (`travel|italy|rome`) is one, and
+    /// the same keyword in different case or with stray spaces counts once; blank ones don't count.
+    pub fn keyword_count(&self) -> usize {
+        let mut seen: Vec<String> = self.meta.keywords.iter().map(|k| k.trim().to_lowercase()).filter(|k| !k.is_empty()).collect();
+        seen.sort_unstable();
+        seen.dedup();
+        seen.len()
+    }
+    /// The people in the photo: the names on its face regions, trimmed, each once (names that
+    /// differ only in case are one person, as first seen). Pets and unnamed faces are not people.
+    pub fn people(&self) -> Vec<&str> {
+        let mut out: Vec<&str> = Vec::new();
+        for r in self.meta.regions.iter().filter(|r| r.kind == lightcraft_meta::RegionKind::Face) {
+            let Some(name) = r.name.as_deref().map(str::trim).filter(|n| !n.is_empty()) else { continue };
+            if !out.iter().any(|o| o.to_lowercase() == name.to_lowercase()) {
+                out.push(name);
+            }
+        }
+        out
+    }
     /// In the library: not deleted and not only browsed (Local).
     pub fn in_library(&self) -> bool {
         !self.deleted && !self.local
@@ -439,6 +502,32 @@ mod edited_tests {
         assert!(!p.is_edited(), "a full reset is unedited too");
     }
 
+    #[test]
+    fn the_process_a_photo_renders_with_is_not_an_edit() {
+        use lightcraft_develop::ProcessVersion;
+        // a photo on another process than the latest (a V1 photo once a later process is the
+        // latest, or a photo saved by a newer LightCraft)
+        let other = ProcessVersion(ProcessVersion::LATEST.0 + 1);
+        let mut p = Photo::new(PhotoId(1), Source::Demo { scene: 0 }, "a.dng", "DNG", 10, 10, "2026-10-01T00:00:00");
+        p.kind = MediaKind::Raw;
+        p.as_shot_wb = Some((5200.0, 4.0));
+        assert_eq!(p.camera_defaults().process, ProcessVersion::LATEST, "a new photo gets the latest");
+        p.develop = Arc::new(DevelopSettings { process: other, ..p.import_defaults() });
+        assert_eq!((p.camera_defaults().process, p.import_defaults().process), (other, other));
+        assert!(!p.is_edited(), "still as imported");
+        // with a default preset's look as well
+        let mut look = DevelopSettings::for_raw(5200.0, 4.0);
+        look.light.exposure = 0.3;
+        p.import_look = Some(Arc::new(look.clone()));
+        p.develop = Arc::new(DevelopSettings { process: other, ..look });
+        assert_eq!(p.import_defaults().process, other);
+        assert!(!p.is_edited());
+        let mut d = (*p.develop).clone();
+        d.light.exposure = 1.0;
+        p.develop = Arc::new(d);
+        assert!(p.is_edited(), "an edit still is one");
+    }
+
     #[test]
     fn supported_raws_use_relative_white_balance() {
         for (name, format, relative) in [
@@ -450,6 +539,10 @@ mod edited_tests {
             ("a.raw", "RAW", true),
             ("a.raf", "rAf", true),
             ("a.cr3", "cr3", true),
+            ("a.srw", "SRW", true),
+            ("a.cr2", "CR2", true),
+            ("a.pef", "pef", true),
+            ("a.orf", "ORF", true),
             ("a.dng", "DNG", false),
         ] {
             let mut p = Photo::new(PhotoId(1), Source::Demo { scene: 0 }, name, format, 10, 10, "2026-10-01T00:00:00");
diff --git a/crates/catalog/src/query.rs b/crates/catalog/src/query.rs
index 47223d5d..8b694a02 100644
--- a/crates/catalog/src/query.rs
+++ b/crates/catalog/src/query.rs
@@ -141,7 +141,7 @@ fn token_matches(p: &Photo, tok: &str) -> bool {
             "person" | "who" => has_person(p, val),
             "type" | "kind" => format!("{:?}", p.kind).eq_ignore_ascii_case(val),
             "edited" => (val == "true" || val == "yes") == p.is_edited(),
-            "date" => p.date().starts_with(val),
+            "date" => p.captured.as_deref().is_some_and(|c| c.starts_with(val)),
             "copy" | "virtual" => (val == "true" || val == "yes") == p.copy_of.is_some(),
             "name" | "file" => p.file_name.to_lowercase().contains(val),
             _ => false,
@@ -154,12 +154,21 @@ fn token_matches(p: &Photo, tok: &str) -> bool {
 /// Whether `p` has a named face region called `name` (case-insensitive).
 fn has_person(p: &Photo, name: &str) -> bool {
     let name = name.trim().to_lowercase();
-    p.meta.regions.iter().any(|r| r.kind == lightcraft_meta::RegionKind::Face && r.name.as_deref().is_some_and(|n| n.to_lowercase() == name))
+    p.people().iter().any(|n| n.to_lowercase() == name)
 }
 
 impl Filter {
     /// Human-readable summary of the active rules (smart album tooltips, `album.list`).
     pub fn describe(&self) -> String {
+        self.describe_in(None)
+    }
+
+    /// [`Filter::describe`] naming the albums its rules test (`RuleSet::describe_with`).
+    pub fn describe_with(&self, cat: &crate::Catalog) -> String {
+        self.describe_in(Some(cat))
+    }
+
+    fn describe_in(&self, cat: Option<&crate::Catalog>) -> String {
         let mut v: Vec<String> = Vec::new();
         if self.rating > 0 {
             let op = match self.rating_op {
@@ -207,11 +216,18 @@ impl Filter {
             v.push(format!("“{}”", self.text.trim()));
         }
         if let Some(rs) = self.rule_set.as_ref().filter(|r| !r.rules.is_empty()) {
-            v.push(rs.describe());
+            v.push(cat.map_or_else(|| rs.describe(), |c| rs.describe_with(c)));
         }
         if v.is_empty() { "all photos".into() } else { v.join(", ") }
     }
 
+    /// The albums this filter tests: its album field and its rules' Album rules.
+    pub fn albums_tested(&self) -> Vec<crate::AlbumId> {
+        let mut out: Vec<crate::AlbumId> = self.album.into_iter().collect();
+        out.extend(self.rule_set.as_ref().map(crate::RuleSet::albums_tested).unwrap_or_default());
+        out
+    }
+
     /// Whether matches depend on the clock (only "in the last…" rules do).
     pub fn depends_on_now(&self) -> bool {
         self.rule_set.as_ref().is_some_and(crate::RuleSet::depends_on_now)
@@ -284,12 +300,18 @@ impl Filter {
             return false;
         }
         if let Some(from) = &self.date_from
-            && p.date() < from.as_str()
+            && match p.captured.as_deref() {
+                Some(c) => c < from.as_str(),
+                None => true,
+            }
         {
             return false;
         }
         if let Some(to) = &self.date_to
-            && p.date().get(..to.len()).unwrap_or(p.date()) > to.as_str()
+            && match p.captured.as_deref() {
+                Some(c) => c.get(..to.len()).unwrap_or(c) > to.as_str(),
+                None => true,
+            }
         {
             return false;
         }
@@ -299,7 +321,7 @@ impl Filter {
             return false;
         }
         if let Some(d) = &self.date
-            && !p.date().starts_with(d.as_str())
+            && !p.captured.as_deref().is_some_and(|c| c.starts_with(d.as_str()))
         {
             return false;
         }
@@ -344,7 +366,7 @@ impl Catalog {
         let mut v: Vec<&Photo> = self.photos().map(|p| p.as_ref()).filter(|p| filter.matches_in(p, self, root.as_deref())).collect();
         v.sort_by(|a, b| {
             let o = match sort.key {
-                SortKey::CaptureDate => a.date().cmp(b.date()),
+                SortKey::CaptureDate => a.captured.cmp(&b.captured).then_with(|| a.imported.cmp(&b.imported)),
                 SortKey::ImportDate => a.imported.cmp(&b.imported),
                 SortKey::EditDate => a.edited.cmp(&b.edited),
                 SortKey::FileName => a.file_name.to_lowercase().cmp(&b.file_name.to_lowercase()),
@@ -363,7 +385,7 @@ impl Catalog {
         use std::collections::BTreeMap;
         let mut years: BTreeMap<&str, (BTreeMap<&str, usize>, BTreeMap<&str, usize>)> = BTreeMap::new();
         for p in self.photos().filter(|p| p.in_library()) {
-            let d = p.date();
+            let Some(d) = p.captured.as_deref() else { continue };
             if d.len() >= 10 {
                 let (months, days) = years.entry(&d[..4]).or_default();
                 *months.entry(&d[..7]).or_default() += 1;
diff --git a/crates/catalog/src/rules.rs b/crates/catalog/src/rules.rs
index fab8566c..be1fd867 100644
--- a/crates/catalog/src/rules.rs
+++ b/crates/catalog/src/rules.rs
@@ -43,49 +43,494 @@ pub enum Rule {
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Kind {
     Text,
-    /// Keywords: text ops over each keyword (any keyword matches; `isEmpty` = none).
+    /// A list of names (keywords, people): text ops over each name (any name matches; `isEmpty` =
+    /// none).
     Keywords,
     Number,
     Date,
-    /// One of a fixed set (`choices`).
-    Choice(&'static [&'static str]),
+    /// An album or a smart album (not a folder), by id: in it or not.
+    Album,
+    /// One of a fixed set: (id, label). Rules store the id; people see the label.
+    Choice(&'static [(&'static str, &'static str)]),
     Bool,
 }
 
-/// The fields rules can test: (id, label, kind).
+/// The fields rules can test: (id, label, kind), in field-menu order ([`TOP_LEVEL_FIELDS`], then
+/// each of [`FIELD_GROUPS`]).
 pub const FIELDS: &[(&str, &str, Kind)] = &[
     ("rating", "Rating", Kind::Number),
-    ("flag", "Pick Flag", Kind::Choice(&["pick", "reject", "none"])),
-    ("label", "Color Label", Kind::Choice(&["red", "yellow", "green", "blue", "purple", "none"])),
-    ("kind", "File Type", Kind::Choice(&["image", "raw", "video"])),
-    ("edited", "Has Edits", Kind::Bool),
-    ("keywords", "Keywords", Kind::Keywords),
+    ("flag", "Pick Flag", Kind::Choice(&[("pick", "Picked"), ("reject", "Rejected"), ("none", "Unflagged")])),
+    (
+        "label",
+        "Color Label",
+        Kind::Choice(&[("red", "Red"), ("yellow", "Yellow"), ("green", "Green"), ("blue", "Blue"), ("purple", "Purple"), ("none", "No Label")]),
+    ),
     ("text", "Any Searchable Text", Kind::Text),
+    // Source
+    ("album", "Album", Kind::Album),
+    ("virtualCopy", "Virtual Copy", Kind::Bool),
+    ("copyName", "Copy Name", Kind::Text),
+    ("stacked", "In a Stack", Kind::Bool),
+    // File
     ("fileName", "Filename", Kind::Text),
+    ("extension", "File Extension", Kind::Text),
     ("filePath", "File Path", Kind::Text),
+    ("kind", "File Type", Kind::Choice(&[("image", "Image"), ("raw", "Raw"), ("video", "Video")])),
     ("format", "File Format", Kind::Text),
-    ("title", "Title", Kind::Text),
-    ("caption", "Caption", Kind::Text),
-    ("camera", "Camera", Kind::Text),
-    ("lens", "Lens", Kind::Text),
-    ("location", "Location", Kind::Text),
-    ("creator", "Creator", Kind::Text),
-    ("copyright", "Copyright", Kind::Text),
-    ("copyrightStatus", "Copyright Status", Kind::Choice(&["copyrighted", "publicDomain", "unknown"])),
+    ("duration", "Video Duration", Kind::Number),
+    // Date
     ("captureDate", "Capture Date", Kind::Date),
     ("importDate", "Import Date", Kind::Date),
     ("editDate", "Edit Date", Kind::Date),
-    ("iso", "ISO Speed", Kind::Number),
-    ("aperture", "Aperture", Kind::Number),
+    // Keywords & People
+    ("keywords", "Keywords", Kind::Keywords),
+    ("keywordCount", "Keyword Count", Kind::Number),
+    ("person", "People", Kind::Keywords),
+    ("personCount", "People Count", Kind::Number),
+    // Description
+    ("title", "Title", Kind::Text),
+    ("caption", "Caption", Kind::Text),
+    ("altText", "Alt Text", Kind::Text),
+    ("creator", "Creator", Kind::Text),
+    ("copyright", "Copyright", Kind::Text),
+    (
+        "copyrightStatus",
+        "Copyright Status",
+        Kind::Choice(&[("copyrighted", "Copyrighted"), ("publicDomain", "Public Domain"), ("unknown", "Unknown")]),
+    ),
+    // Camera Info
+    ("camera", "Camera", Kind::Text),
+    ("lens", "Lens", Kind::Text),
     ("focalLength", "Focal Length", Kind::Number),
-    ("megapixels", "Megapixels", Kind::Number),
+    ("aperture", "Aperture", Kind::Number),
+    ("shutterSpeed", "Shutter Speed", Kind::Number),
+    ("iso", "ISO Speed", Kind::Number),
+    // Location
+    ("location", "Location", Kind::Text),
+    ("city", "City", Kind::Text),
+    ("state", "State / Province", Kind::Text),
+    ("country", "Country", Kind::Text),
     ("hasGps", "Has GPS", Kind::Bool),
-    ("virtualCopy", "Virtual Copy", Kind::Bool),
-    ("album", "Album", Kind::Number),
+    // Size
+    ("longEdge", "Long Edge", Kind::Number),
+    ("shortEdge", "Short Edge", Kind::Number),
+    ("aspect", "Aspect Ratio", Kind::Choice(&[("landscape", "Landscape (wide)"), ("portrait", "Portrait (tall)"), ("square", "Square")])),
+    ("megapixels", "Megapixels", Kind::Number),
+    // Develop
+    ("edited", "Has Edits", Kind::Bool),
+    ("cropped", "Cropped", Kind::Bool),
+    ("treatment", "Treatment", Kind::Choice(&[("color", "In Color"), ("monochrome", "Black & White")])),
+    // Assisted Culling
     ("sharpness", "Focus (assisted culling)", Kind::Number),
     ("bestOfGroup", "Best of Similar Shots", Kind::Bool),
 ];
 
+/// The fields the field menu shows at its top level, before the groups.
+pub const TOP_LEVEL_FIELDS: &[&str] = &["rating", "flag", "label", "text"];
+
+/// The field menu's submenus: (label, fields), in order. Every field of [`FIELDS`] is either here
+/// once or in [`TOP_LEVEL_FIELDS`].
+pub const FIELD_GROUPS: &[(&str, &[&str])] = &[
+    ("Source", &["album", "virtualCopy", "copyName", "stacked"]),
+    ("File", &["fileName", "extension", "filePath", "kind", "format", "duration"]),
+    ("Date", &["captureDate", "importDate", "editDate"]),
+    ("Keywords & People", &["keywords", "keywordCount", "person", "personCount"]),
+    ("Description", &["title", "caption", "altText", "creator", "copyright", "copyrightStatus"]),
+    ("Camera Info", &["camera", "lens", "focalLength", "aperture", "shutterSpeed", "iso"]),
+    ("Location", &["location", "city", "state", "country", "hasGps"]),
+    ("Size", &["longEdge", "shortEdge", "aspect", "megapixels"]),
+    ("Develop", &["edited", "cropped", "treatment"]),
+    ("Assisted Culling", &["sharpness", "bestOfGroup"]),
+];
+
+/// The field-menu group `field` sits in; `None` for a top-level or unknown field.
+pub fn field_group(field: &str) -> Option<&'static str> {
+    FIELD_GROUPS.iter().find(|g| g.1.contains(&field)).map(|g| g.0)
+}
+
+/// A rule that can't mean anything ([`RuleSet::check`]): where it is, what is wrong in English
+/// (for agents and logs), and the field and kind of issue, so the editor can say it in any language.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Problem {
+    /// Positions from the top rule list down: `[1, 0]` is the first rule of the second rule's group.
+    pub path: Vec<usize>,
+    /// The rule's field; `None` for a group.
+    pub field: Option<String>,
+    pub issue: Issue,
+    pub message: String,
+}
+
+impl std::fmt::Display for Problem {
+    /// `rule 2.1: no rating 0–5 is 9` (counting from 1, as people do).
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let at: Vec<String> = self.path.iter().map(|i| (i.saturating_add(1)).to_string()).collect();
+        // a problem with the filter around the rules (its album field) has no rule to point at
+        if at.is_empty() { write!(f, "{}", self.message) } else { write!(f, "rule {}: {}", at.join("."), self.message) }
+    }
+}
+
+/// What kind of thing is wrong with a rule ([`Problem`]); [`Issue::text`] says it after the
+/// field's name ("Title: needs something to look for").
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Issue {
+    UnknownField,
+    NoSuchOperator,
+    NotYesNo,
+    NeedsNumber,
+    NeedsShutterSpeed,
+    NeedsDate,
+    DatesReversed,
+    NeedsTwoValues,
+    NeedsCount,
+    UnknownUnit,
+    NotAChoice,
+    NeedsTextOrEmpty,
+    NeedsTextOrNotEmpty,
+    /// Keywords and People: their operators say "are empty".
+    NeedsNamesOrEmpty,
+    NeedsNamesOrNotEmpty,
+    NeedsText,
+    NoRatingMatches,
+    ChooseAlbum,
+    NoSuchAlbum,
+    AlbumLoop,
+    FolderAlbum,
+    EmptyGroup,
+}
+
+impl Issue {
+    pub const ALL: [Issue; 22] = [
+        Issue::UnknownField,
+        Issue::NoSuchOperator,
+        Issue::NotYesNo,
+        Issue::NeedsNumber,
+        Issue::NeedsShutterSpeed,
+        Issue::NeedsDate,
+        Issue::DatesReversed,
+        Issue::NeedsTwoValues,
+        Issue::NeedsCount,
+        Issue::UnknownUnit,
+        Issue::NotAChoice,
+        Issue::NeedsTextOrEmpty,
+        Issue::NeedsTextOrNotEmpty,
+        Issue::NeedsNamesOrEmpty,
+        Issue::NeedsNamesOrNotEmpty,
+        Issue::NeedsText,
+        Issue::NoRatingMatches,
+        Issue::ChooseAlbum,
+        Issue::NoSuchAlbum,
+        Issue::AlbumLoop,
+        Issue::FolderAlbum,
+        Issue::EmptyGroup,
+    ];
+
+    /// The issue in a few words, to follow the field's name; a message for translation catalogs.
+    pub fn text(self) -> &'static str {
+        match self {
+            Issue::UnknownField => "isn't a field rules know",
+            Issue::NoSuchOperator => "can't be tested that way",
+            Issue::NotYesNo => "is yes or no",
+            Issue::NeedsNumber => "needs a number",
+            Issue::NeedsShutterSpeed => "needs a time like 1/250 or 2",
+            Issue::NeedsDate => "needs a date like 2026, 2026-08 or 2026-08-14",
+            Issue::DatesReversed => "has the first date after the second",
+            Issue::NeedsTwoValues => "needs two values",
+            Issue::NeedsCount => "needs a number more than 0",
+            Issue::UnknownUnit => "needs hours, days, weeks, months or years",
+            Issue::NotAChoice => "isn't one of the choices",
+            Issue::NeedsTextOrEmpty => "needs something to look for (or use “is empty”)",
+            Issue::NeedsTextOrNotEmpty => "needs something to look for (or use “isn't empty”)",
+            Issue::NeedsNamesOrEmpty => "needs something to look for (or use “are empty”)",
+            Issue::NeedsNamesOrNotEmpty => "needs something to look for (or use “aren't empty”)",
+            Issue::NeedsText => "needs text",
+            Issue::NoRatingMatches => "can't match any rating from 0 to 5",
+            Issue::ChooseAlbum => "needs an album",
+            Issue::NoSuchAlbum => "names an album that no longer exists",
+            Issue::AlbumLoop => "would make this album include itself through other smart albums",
+            Issue::FolderAlbum => "can't test a folder; choose an album in it",
+            Issue::EmptyGroup => "This group is empty: add a rule or remove it.",
+        }
+    }
+}
+
+/// An issue with its English message, or nothing wrong.
+type Found = Option<(Issue, String)>;
+
+/// What is wrong with one rule, if anything ([`RuleSet::check`]).
+fn field_problem(field: &str, op: &str, value: &Value, cat: &Catalog, owner: Option<crate::AlbumId>) -> Found {
+    let Some(kind) = field_kind(field) else { return Some((Issue::UnknownField, format!("unknown field `{field}`"))) };
+    if !ops_for(kind).iter().any(|o| o.0 == op) {
+        return Some((Issue::NoSuchOperator, format!("`{field}` has no operator `{op}`")));
+    }
+    if matches!(op, "isEmpty" | "isNotEmpty") {
+        return None;
+    }
+    match kind {
+        Kind::Bool => bool_value(value).is_none().then(|| (Issue::NotYesNo, format!("`{field}` is yes or no, not {value}"))),
+        Kind::Album => album_problem(value, cat, owner),
+        Kind::Number => {
+            let each = match value {
+                Value::Array(a) if op == "between" && a.len() == 2 => a.iter().find_map(|v| number_problem(field, v)),
+                _ if op == "between" => Some((Issue::NeedsTwoValues, format!("`{field}` between needs two values, not {value}"))),
+                v => number_problem(field, v),
+            };
+            // a rating rule no rating could meet ("is 9", "≥ 7"); "< 6" is fine, if broad
+            each.or_else(|| {
+                let label = ops_for(kind).iter().find(|o| o.0 == op).map_or(op, |o| o.1);
+                (field == "rating" && !(0..=5).any(|r| num_op(op, Some(f64::from(r)), value)))
+                    .then(|| (Issue::NoRatingMatches, format!("no rating 0–5 {label} {value}")))
+            })
+        }
+        Kind::Date => date_problem(field, op, value),
+        Kind::Choice(choices) => choice_problem(field, value, choices, cat),
+        Kind::Text | Kind::Keywords => match value {
+            Value::String(s) if !s.trim().is_empty() => None,
+            Value::String(_) | Value::Null => {
+                // the hint names the operator as the menu does: Keywords and People say "are empty"
+                let not = matches!(op, "isNot" | "notContains");
+                let (issue, instead) = match (kind, not) {
+                    (Kind::Keywords, false) => (Issue::NeedsNamesOrEmpty, "are empty"),
+                    (Kind::Keywords, true) => (Issue::NeedsNamesOrNotEmpty, "aren't empty"),
+                    (_, false) => (Issue::NeedsTextOrEmpty, "is empty"),
+                    (_, true) => (Issue::NeedsTextOrNotEmpty, "isn't empty"),
+                };
+                Some((issue, format!("`{field}` needs something to look for (or use “{instead}”)")))
+            }
+            Value::Number(_) => None,
+            other => Some((Issue::NeedsText, format!("`{field}` needs text, not {other}"))),
+        },
+    }
+}
+
+fn number_problem(field: &str, v: &Value) -> Found {
+    if field == "shutterSpeed" {
+        return shutter_value(v).is_null().then(|| (Issue::NeedsShutterSpeed, format!("`shutterSpeed` needs a time like 1/250 or 2, not {v}")));
+    }
+    number(v).filter(|n| n.is_finite()).is_none().then(|| (Issue::NeedsNumber, format!("`{field}` needs a number, not {v}")))
+}
+
+/// The album an Album rule names: its id as a whole number, written as a number (`3`, `3.0`) or a
+/// numeric string (`"3"`). The check, the matcher and the editor all read it this way.
+pub fn album_rule_id(value: &Value) -> Option<crate::AlbumId> {
+    number(value).filter(|n| n.is_finite() && *n >= 0.0 && n.fract() == 0.0).map(|n| crate::AlbumId(n as u64))
+}
+
+/// An Album rule's value: an album that exists and holds photos (a plain or a smart album, not a
+/// folder of albums), and, for the rules of `owner`, not one that leads back to it (a smart album
+/// testing itself, directly or through others).
+fn album_problem(v: &Value, cat: &Catalog, owner: Option<crate::AlbumId>) -> Found {
+    if v.is_null() {
+        return Some((Issue::ChooseAlbum, "choose an album".into()));
+    }
+    match album_rule_id(v).and_then(|id| cat.album(id)) {
+        None => Some((Issue::NoSuchAlbum, format!("no album {v}"))),
+        Some(a) if owner.is_some_and(|o| a.id == o || cat.album_reaches(a.id, o)) => {
+            Some((Issue::AlbumLoop, format!("album {v} would make this album include itself")))
+        }
+        Some(a) if a.folder => Some((Issue::FolderAlbum, format!("album {v} is a folder; choose an album in it"))),
+        Some(_) => None,
+    }
+}
+
+/// A rule date in its one reading: `2026`, `2026-08`, `2026-08-14`, then optionally `T10`,
+/// `T10:00` or `T10:00:00` (a space works as the `T`), and after whole seconds a fraction and a
+/// time zone as imported capture times carry them (`.250`, `+02:00`, `Z`); a real date and time
+/// (no month 13, no 30 February, no 25 o'clock). Anything else is [`Issue::NeedsDate`]. The check
+/// and the matcher both read dates this way.
+pub fn rule_date(s: &str) -> Result<String, Issue> {
+    const PATTERN: &str = "dddd-dd-ddTdd:dd:dd";
+    let s: String = s.trim().char_indices().map(|(i, c)| if i == 10 && c == ' ' { 'T' } else { c }).collect();
+    let shaped = |t: &str| {
+        matches!(t.len(), 4 | 7 | 10 | 13 | 16 | 19)
+            && t.chars().zip(PATTERN.chars()).all(|(c, p)| if p == 'd' { c.is_ascii_digit() } else { c == p })
+    };
+    // after whole seconds, a fraction and a zone as imports write them (.250, +02:00 or Z)
+    let tail_ok = |rest: &str| {
+        let after_fraction = match rest.strip_prefix('.') {
+            Some(f) => {
+                let digits = f.bytes().take_while(u8::is_ascii_digit).count();
+                if !(1..=9).contains(&digits) {
+                    return false;
+                }
+                f.get(digits..).unwrap_or("")
+            }
+            None => rest,
+        };
+        let zone = after_fraction.as_bytes();
+        match zone {
+            [] | [b'Z' | b'z'] => true,
+            [b'+' | b'-', h1, h2, b':', m1, m2] => [h1, h2, m1, m2].iter().all(|c| c.is_ascii_digit()),
+            _ => false,
+        }
+    };
+    if !shaped(&s) && !(s.get(..19).is_some_and(shaped) && s.get(19..).is_some_and(tail_ok)) {
+        return Err(Issue::NeedsDate);
+    }
+    let part = |a: usize, b: usize| s.get(a..b).and_then(|t| t.parse::<u32>().ok());
+    let time_ok = part(11, 13).is_none_or(|h| h < 24) && part(14, 16).is_none_or(|m| m < 60) && part(17, 19).is_none_or(|x| x < 60);
+    let day = match s.len().min(19) {
+        4 => format!("{s}-01-01"),
+        7 => format!("{s}-01"),
+        _ => s.get(..10).unwrap_or("").to_string(),
+    };
+    if time_ok && crate::dates::normalize_iso(&day).is_some() { Ok(s) } else { Err(Issue::NeedsDate) }
+}
+
+fn date_problem(field: &str, op: &str, value: &Value) -> Found {
+    let date = |v: &Value| match v.as_str().map(rule_date) {
+        Some(Ok(_)) => None,
+        _ => Some((Issue::NeedsDate, format!("`{field}` needs a date like 2026, 2026-08 or 2026-08-14, not {v}"))),
+    };
+    match op {
+        "inLast" | "notInLast" => {
+            let (n, unit) = match value {
+                Value::Object(o) => (o.get("n").and_then(number), o.get("unit").cloned().unwrap_or(Value::Null)),
+                v => (number(v), Value::Null),
+            };
+            if !n.is_some_and(|n| n.is_finite() && n > 0.0) {
+                return Some((Issue::NeedsCount, format!("`{field}` needs a number of hours, days, weeks, months or years more than 0")));
+            }
+            unit_secs(&unit).is_none().then(|| (Issue::UnknownUnit, format!("`{field}`: unknown unit {unit} (hours, days, weeks, months or years)")))
+        }
+        "between" => match value {
+            Value::Array(a) if a.len() == 2 => a.iter().find_map(date).or_else(|| {
+                let bound = |i: usize| a.get(i).and_then(Value::as_str).and_then(|d| rule_date(d).ok()).unwrap_or_default();
+                let (from, to) = (bound(0), bound(1));
+                (from > to && !from.starts_with(&to)).then(|| (Issue::DatesReversed, format!("`{field}`: the first date is after the second")))
+            }),
+            _ => Some((Issue::NeedsTwoValues, format!("`{field}` between needs two dates, not {value}"))),
+        },
+        _ => date(value),
+    }
+}
+
+fn choice_problem(field: &str, value: &Value, choices: &[(&str, &str)], cat: &Catalog) -> Found {
+    let known = value.as_str().is_some_and(|s| {
+        choices.iter().any(|c| c.0.eq_ignore_ascii_case(s.trim()))
+            || match field {
+                "flag" => matches!(s.trim().to_lowercase().as_str(), "picked" | "rejected"),
+                // a colour's name or the custom name given to it
+                "label" => cat.label_from_name(s).is_some(),
+                "copyrightStatus" => crate::CopyrightStatus::parse(s).is_some(),
+                _ => false,
+            }
+    });
+    let ids: Vec<&str> = choices.iter().map(|c| c.0).collect();
+    (!known).then(|| (Issue::NotAChoice, format!("`{field}` is one of {}, not {value}", ids.join(", "))))
+}
+
+thread_local! {
+    /// The smart albums whose rules are being evaluated on this thread, outermost first.
+    static EVALUATING: std::cell::RefCell<Vec<crate::AlbumId>> = const { std::cell::RefCell::new(Vec::new()) };
+}
+
+thread_local! {
+    /// While one outermost question is answered (is this photo in album X?): what each smart album
+    /// it leads to answered for each photo, so an album tested many times along the way (X tests Y
+    /// twice, Y tests Z twice…) is worked out once, not 2^depth times. Cleared when it ends.
+    static ANSWERS: std::cell::RefCell<std::collections::HashMap<(crate::AlbumId, crate::PhotoId), bool>> =
+        std::cell::RefCell::new(std::collections::HashMap::new());
+}
+
+/// Whether `photo` is in smart album `id`, by `matches` (its rules), remembered for the rest of the
+/// outermost question and guarded by [`evaluating`] (a loop or a chain too deep holds nothing).
+pub(crate) fn smart_album_holds(id: crate::AlbumId, photo: crate::PhotoId, matches: impl FnOnce() -> bool) -> bool {
+    if let Some(known) = ANSWERS.with_borrow(|a| a.get(&(id, photo)).copied()) {
+        return known;
+    }
+    // the outermost question forgets the answers when it ends, however it ends
+    struct Forget(bool);
+    impl Drop for Forget {
+        fn drop(&mut self) {
+            if self.0 {
+                ANSWERS.with_borrow_mut(std::collections::HashMap::clear);
+            }
+        }
+    }
+    let _forget = Forget(EVALUATING.with_borrow(Vec::is_empty));
+    let answer = evaluating(id, matches);
+    if let Some(a) = answer {
+        ANSWERS.with_borrow_mut(|known| known.insert((id, photo), a));
+    }
+    answer.unwrap_or(false)
+}
+
+/// How deep smart albums may test smart albums before the innermost counts as holding nothing.
+const MAX_ALBUM_DEPTH: usize = 32;
+
+/// Run `f` as the evaluation of smart album `id`'s rules: `None` (so it holds nothing) when `id`
+/// is already being evaluated (a loop the check would refuse, saved anyway) or the chain is
+/// deeper than [`MAX_ALBUM_DEPTH`]. Loops cost one pass round them, never a stack overflow.
+pub(crate) fn evaluating<T>(id: crate::AlbumId, f: impl FnOnce() -> T) -> Option<T> {
+    let entered = EVALUATING.with_borrow_mut(|stack| {
+        let ok = !stack.contains(&id) && stack.len() < MAX_ALBUM_DEPTH;
+        if ok {
+            stack.push(id);
+        }
+        ok
+    });
+    if !entered {
+        return None;
+    }
+    // leaves the stack as it was, however `f` ends
+    struct Leave;
+    impl Drop for Leave {
+        fn drop(&mut self) {
+            EVALUATING.with_borrow_mut(|stack| {
+                stack.pop();
+            });
+        }
+    }
+    let _leave = Leave;
+    Some(f())
+}
+
+/// How a summary names an Album rule's album: “Name”, or `#9` when there is no such album.
+pub fn album_name(value: &Value, cat: Option<&Catalog>) -> String {
+    let id = album_rule_id(value);
+    match id.and_then(|id| cat.and_then(|c| c.album(id))) {
+        Some(a) => format!("“{}”", a.name),
+        None => id.map_or_else(|| value.to_string(), |id| format!("#{}", id.0)),
+    }
+}
+
+/// What a yes/no rule's value means: `true`, `"yes"`, `1` (or `1.0`) or no value is yes; `false`,
+/// `"no"`, `0` is no (strings in any case); `None` for anything else, which matches nothing.
+pub fn bool_value(value: &Value) -> Option<bool> {
+    match value {
+        Value::Bool(b) => Some(*b),
+        Value::Null => Some(true),
+        Value::Number(n) => match n.as_f64() {
+            Some(1.0) => Some(true),
+            Some(0.0) => Some(false),
+            _ => None,
+        },
+        Value::String(s) => match s.trim().to_lowercase().as_str() {
+            "true" | "yes" | "1" => Some(true),
+            "false" | "no" | "0" => Some(false),
+            _ => None,
+        },
+        _ => None,
+    }
+}
+
+/// The display label of a yes/no value.
+pub fn bool_label(b: bool) -> &'static str {
+    if b { "Yes" } else { "No" }
+}
+
+/// The display label of choice `id` of `field` ("Public Domain" for `publicDomain`); `None` when
+/// `field` isn't a choice field or has no such choice.
+pub fn choice_label(field: &str, id: &str) -> Option<&'static str> {
+    let Some(Kind::Choice(choices)) = field_kind(field) else { return None };
+    choices.iter().find(|c| c.0 == id).map(|c| c.1)
+}
+
+/// The display label of `field`; `None` for an unknown field.
+pub fn field_label(field: &str) -> Option<&'static str> {
+    FIELDS.iter().find(|f| f.0 == field).map(|f| f.1)
+}
+
 /// The operators for a field kind: (id, label).
 pub fn ops_for(kind: Kind) -> &'static [(&'static str, &'static str)] {
     match kind {
@@ -119,7 +564,7 @@ pub fn ops_for(kind: Kind) -> &'static [(&'static str, &'static str)] {
             ("notInLast", "isn't in the last"),
             ("isEmpty", "is unknown"),
         ],
-        Kind::Choice(_) => &[("is", "is"), ("isNot", "isn't")],
+        Kind::Choice(_) | Kind::Album => &[("is", "is"), ("isNot", "isn't")],
         Kind::Bool => &[("is", "is")],
     }
 }
@@ -176,6 +621,18 @@ fn text_op(op: &str, have: &str, want: &str) -> bool {
     }
 }
 
+/// A [`Kind::Keywords`] op over a list of names: any name matches (none for `notContains`); `is`
+/// also matches one level of a hierarchical keyword (`italy` in `travel|italy|rome`).
+fn names_op<S: AsRef<str>>(op: &str, names: &[S], want: &str) -> bool {
+    let names = names.iter().map(AsRef::as_ref);
+    match op {
+        "isEmpty" => names.clone().all(|n| n.trim().is_empty()),
+        "isNotEmpty" => names.clone().any(|n| !n.trim().is_empty()),
+        "notContains" => !names.clone().any(|n| text_op("contains", n, want)),
+        _ => names.clone().any(|n| text_op(op, n, want) || (op == "is" && n.to_lowercase().split('|').any(|part| part.trim() == want))),
+    }
+}
+
 fn number(v: &Value) -> Option<f64> {
     match v {
         Value::Number(n) => n.as_f64(),
@@ -204,21 +661,70 @@ fn num_op(op: &str, have: Option<f64>, value: &Value) -> bool {
     }
 }
 
-/// `value` for in-the-last rules: `{n, unit: days|weeks|months|years}` or a number of days.
+/// `landscape`, `portrait` or `square` (edges within 1 %) for a `w × h` frame; `None` when it has no area.
+fn aspect((w, h): (f64, f64)) -> Option<&'static str> {
+    if !(w > 0.0 && h > 0.0) {
+        return None;
+    }
+    Some(if (w - h).abs() <= 0.01 * w.max(h) {
+        "square"
+    } else if w > h {
+        "landscape"
+    } else {
+        "portrait"
+    })
+}
+
+/// A shutter-speed rule's value in seconds: camera notation (`1/250`) or a number; an operand
+/// that isn't a time becomes `null`, which matches nothing.
+fn shutter_value(value: &Value) -> Value {
+    let secs = |v: &Value| match v {
+        Value::String(s) => crate::parse_shutter_seconds(s).map_or(Value::Null, Value::from),
+        other => number(other).filter(|n| n.is_finite() && *n > 0.0).map_or(Value::Null, Value::from),
+    };
+    match value {
+        Value::Array(a) => Value::Array(a.iter().map(secs).collect()),
+        v => secs(v),
+    }
+}
+
+/// Seconds in one "in the last…" unit: hours, days, weeks, months or years, in any case, singular
+/// or plural; none means days. `None` for anything else, which the check refuses and the matcher
+/// matches nothing with.
+fn unit_secs(unit: &Value) -> Option<f64> {
+    let day = 86_400.0;
+    let name = match unit {
+        Value::Null => return Some(day),
+        Value::String(s) => s.trim().to_lowercase(),
+        _ => return None,
+    };
+    match name.strip_suffix('s').unwrap_or(&name) {
+        "hour" => Some(3600.0),
+        "day" => Some(day),
+        "week" => Some(7.0 * day),
+        "month" => Some(30.4375 * day),
+        "year" => Some(365.25 * day),
+        _ => None,
+    }
+}
+
+/// The longest "in the last…" span: 10,000 years, beyond any capture date ("ever").
+const MAX_LAST_SECS: f64 = 10_000.0 * 365.25 * 86_400.0;
+
+/// `value` for in-the-last rules: `{n, unit: days|weeks|months|years}` or a number of days, in
+/// seconds. `None` for a zero, negative or unreadable `n`; a longer span than [`MAX_LAST_SECS`]
+/// is that (so the arithmetic on it can't overflow).
 fn last_secs(value: &Value) -> Option<i64> {
     let (n, unit) = match value {
-        Value::Object(o) => (o.get("n").and_then(number)?, o.get("unit").and_then(Value::as_str).unwrap_or("days")),
-        v => (number(v)?, "days"),
+        Value::Object(o) => (o.get("n").and_then(number)?, o.get("unit").unwrap_or(&Value::Null)),
+        v => (number(v)?, &Value::Null),
     };
-    let day = 86_400.0;
-    let per = match unit {
-        "hours" => 3600.0,
-        "weeks" => 7.0 * day,
-        "months" => 30.4375 * day,
-        "years" => 365.25 * day,
-        _ => day,
-    };
-    Some((n * per) as i64)
+    let per = unit_secs(unit)?;
+    let secs = n * per;
+    if secs.is_nan() || secs <= 0.0 {
+        return None;
+    }
+    Some(secs.min(MAX_LAST_SECS) as i64)
 }
 
 fn date_op(op: &str, have: Option<&str>, value: &Value) -> bool {
@@ -226,7 +732,8 @@ fn date_op(op: &str, have: Option<&str>, value: &Value) -> bool {
         return have.is_none_or(str::is_empty);
     }
     let Some(h) = have.filter(|h| !h.is_empty()) else { return op == "notInLast" };
-    let s = |v: &Value| v.as_str().map(str::trim).unwrap_or("").to_string();
+    // the rule's date as the check reads it (a space as the "T"); one it can't read as written
+    let s = |v: &Value| v.as_str().map(|d| rule_date(d).unwrap_or_else(|_| d.trim().to_string())).unwrap_or_default();
     match op {
         // a prefix: 2026, 2026-04, 2026-04-12
         "is" => {
@@ -250,7 +757,8 @@ fn date_op(op: &str, have: Option<&str>, value: &Value) -> bool {
         },
         "inLast" | "notInLast" => {
             let Some(secs) = last_secs(value) else { return false };
-            let from = crate::dates::shift_iso(&now(), -secs).unwrap_or_default();
+            // a span reaching before year 0 is "ever": every dated photo is in it
+            let Some(from) = crate::dates::shift_iso(&now(), -secs) else { return op == "inLast" };
             (h >= from.as_str()) == (op == "inLast")
         }
         _ => false,
@@ -266,6 +774,7 @@ impl Rule {
         let m = &p.meta;
         let want = lower(value);
         let text = |have: &str| text_op(op, have, &want);
+        let yes = |have: bool| bool_value(value).is_some_and(|b| have == b);
         match field {
             "rating" => num_op(op, Some(p.rating as f64), value),
             "flag" => {
@@ -279,15 +788,20 @@ impl Rule {
                 (l == want || named) == (op == "is")
             }
             "kind" => (format!("{:?}", p.kind).to_lowercase() == want) == (op == "is"),
-            "edited" => p.is_edited() == value.as_bool().unwrap_or(true),
-            "hasGps" => m.gps.is_some() == value.as_bool().unwrap_or(true),
-            "virtualCopy" => p.copy_of.is_some() == value.as_bool().unwrap_or(true),
-            "keywords" => match op {
-                "isEmpty" => m.keywords.is_empty(),
-                "isNotEmpty" => !m.keywords.is_empty(),
-                "notContains" => !m.keywords.iter().any(|k| text_op("contains", k, &want)),
-                _ => m.keywords.iter().any(|k| text_op(op, k, &want) || (op == "is" && k.to_lowercase().split('|').any(|part| part == want))),
-            },
+            "edited" => yes(p.is_edited()),
+            "hasGps" => yes(m.gps.is_some()),
+            "virtualCopy" => yes(p.copy_of.is_some()),
+            "copyName" => text(p.copy_name.as_deref().unwrap_or("")),
+            "stacked" => yes(cat.stack_of(p.id).is_some()),
+            "cropped" => yes(p.is_cropped()),
+            "treatment" => {
+                let t = if p.develop.treatment == lightcraft_develop::Treatment::Bw { "monochrome" } else { "color" };
+                (t == want) == (op == "is")
+            }
+            "keywords" => names_op(op, &m.keywords, &want),
+            "keywordCount" => num_op(op, Some(p.keyword_count() as f64), value),
+            "person" => names_op(op, &p.people(), &want),
+            "personCount" => num_op(op, Some(p.people().len() as f64), value),
             "text" => {
                 let all = [
                     p.file_name.as_str(),
@@ -297,14 +811,20 @@ impl Rule {
                     &m.lens,
                     &m.location,
                     &m.city,
+                    &m.state,
                     &m.country,
+                    &m.alt_text,
                     &p.format,
                     &m.keywords.join(" "),
+                    &p.people().join(" "),
+                    p.copy_name.as_deref().unwrap_or(""),
                 ]
                 .join(" ");
                 text(&all)
             }
             "fileName" => text(&p.file_name),
+            "extension" => text_op(op, p.extension(), want.trim_start_matches('.')),
+            "duration" => num_op(op, p.duration.filter(|d| d.is_finite()), value),
             "filePath" => {
                 // `/` and `\` both separate, whatever platform the catalog came from; demo photos have no path
                 let path = match &p.source {
@@ -322,6 +842,10 @@ impl Rule {
             "format" => text(&p.format),
             "title" => text(&m.title),
             "caption" => text(&m.caption),
+            "altText" => text(&m.alt_text),
+            "city" => text(&m.city),
+            "state" => text(&m.state),
+            "country" => text(&m.country),
             "camera" => text(&m.camera),
             "lens" => text(&m.lens),
             "location" => text(&[m.location.as_str(), &m.city, &m.state, &m.country].join(" ")),
@@ -334,15 +858,25 @@ impl Rule {
             "captureDate" => date_op(op, p.captured.as_deref(), value),
             "importDate" => date_op(op, Some(&p.imported), value),
             "editDate" => date_op(op, p.edited.as_deref(), value),
+            "shutterSpeed" => num_op(op, crate::parse_shutter_seconds(&m.shutter), &shutter_value(value)),
             "iso" => num_op(op, m.iso.map(|v| v as f64), value),
             "aperture" => num_op(op, m.aperture.map(|v| v as f64), value),
             "focalLength" => num_op(op, m.focal_mm.map(|v| v as f64), value),
-            "megapixels" => num_op(op, Some(p.width as f64 * p.height as f64 / 1e6), value),
+            "longEdge" | "shortEdge" => {
+                let (w, h) = p.shown_size();
+                num_op(op, Some(if field == "longEdge" { w.max(h) } else { w.min(h) }.round()), value)
+            }
+            "aspect" => (aspect(p.shown_size()) == Some(want.as_str())) == (op == "is"),
+            "megapixels" => {
+                let (w, h) = p.shown_size();
+                num_op(op, Some(w * h / 1e6), value)
+            }
             "sharpness" => num_op(op, p.analysis.map(|a| a.sharpness as f64), value),
-            "bestOfGroup" => p.analysis.is_some_and(|a| a.best || a.group.is_none()) == value.as_bool().unwrap_or(true),
+            "bestOfGroup" => yes(p.analysis.is_some_and(|a| a.best || a.group.is_none())),
             "album" => {
-                let id = number(value).map(|v| crate::AlbumId(v as u64));
-                id.is_some_and(|a| cat.album(a).is_some_and(|al| !al.is_smart()) && cat.album_contains(a, p)) == (op == "is")
+                let id = album_rule_id(value);
+                // a smart album's photos are its matches; one being evaluated (a loop) holds none
+                id.is_some_and(|a| cat.album_contains(a, p)) == (op == "is")
             }
             _ => false,
         }
@@ -370,24 +904,78 @@ impl RuleSet {
         })
     }
 
-    /// Unknown fields or operators (for command validation), as readable messages.
-    pub fn problems(&self) -> Vec<String> {
+    /// Bring rules saved by older versions up to date, keeping what they meant: an Album rule with
+    /// an operator from when Album was a number field (≥, between…) always matched as "isn't", and
+    /// now says so. Commands and the editor apply it before checking.
+    pub fn upgrade(&mut self) {
+        for rule in &mut self.rules {
+            match rule {
+                Rule::Group { group } => group.upgrade(),
+                Rule::Field { field, op, .. } if field == "album" && op != "is" && op != "isNot" => *op = "isNot".into(),
+                Rule::Field { .. } => {}
+            }
+        }
+    }
+
+    /// The rules that can't mean anything, in order: an unknown field, an operator the field
+    /// doesn't have, a value that isn't one of the field's (a number, a date, a choice, yes or
+    /// no, an album that exists and isn't a folder…), text with nothing to look for, an empty group. Commands refuse a rule
+    /// set with problems; the editor shows them. `cat` knows the albums and colour-label names.
+    pub fn check(&self, cat: &Catalog) -> Vec<Problem> {
+        self.check_for(cat, None)
+    }
+
+    /// [`RuleSet::check`] for the rules of smart album `owner` (`None`: a new album or a filter),
+    /// which also refuses an Album rule that would make `owner` include itself.
+    pub fn check_for(&self, cat: &Catalog, owner: Option<crate::AlbumId>) -> Vec<Problem> {
         let mut out = Vec::new();
-        for r in &self.rules {
-            match r {
-                Rule::Group { group } => out.extend(group.problems()),
-                Rule::Field { field, op, .. } => match field_kind(field) {
-                    None => out.push(format!("unknown field `{field}`")),
-                    Some(k) if !ops_for(k).iter().any(|o| o.0 == op) => out.push(format!("`{field}` has no operator `{op}`")),
-                    _ => {}
-                },
+        self.check_into(cat, owner, &mut Vec::new(), &mut out);
+        out
+    }
+
+    /// The albums the Album rules test, groups included, in order.
+    pub fn albums_tested(&self) -> Vec<crate::AlbumId> {
+        let mut out = Vec::new();
+        for rule in &self.rules {
+            match rule {
+                Rule::Group { group } => out.extend(group.albums_tested()),
+                Rule::Field { field, value, .. } if field == "album" => out.extend(album_rule_id(value)),
+                Rule::Field { .. } => {}
             }
         }
         out
     }
 
+    fn check_into(&self, cat: &Catalog, owner: Option<crate::AlbumId>, path: &mut Vec<usize>, out: &mut Vec<Problem>) {
+        for (i, rule) in self.rules.iter().enumerate() {
+            path.push(i);
+            match rule {
+                Rule::Group { group } if group.rules.is_empty() => {
+                    out.push(Problem { path: path.clone(), field: None, issue: Issue::EmptyGroup, message: "an empty group".into() })
+                }
+                Rule::Group { group } => group.check_into(cat, owner, path, out),
+                Rule::Field { field, op, value } => {
+                    if let Some((issue, message)) = field_problem(field, op, value, cat, owner) {
+                        out.push(Problem { path: path.clone(), field: Some(field.clone()), issue, message });
+                    }
+                }
+            }
+            path.pop();
+        }
+    }
+
     /// A short readable summary ("rating is ≥ 3 and keywords contains travel").
     pub fn describe(&self) -> String {
+        self.describe_in(None)
+    }
+
+    /// [`RuleSet::describe`] naming the albums Album rules test ("album isn't “Excluded
+    /// Photos”"); one that is gone shows as `#9`.
+    pub fn describe_with(&self, cat: &Catalog) -> String {
+        self.describe_in(Some(cat))
+    }
+
+    fn describe_in(&self, cat: Option<&Catalog>) -> String {
         let join = match self.mode {
             Match::All => " and ",
             Match::Any => " or ",
@@ -397,12 +985,16 @@ impl RuleSet {
             .rules
             .iter()
             .map(|r| match r {
-                Rule::Group { group } => format!("({})", group.describe()),
+                Rule::Group { group } => format!("({})", group.describe_in(cat)),
                 Rule::Field { field, op, value } => {
-                    let label = FIELDS.iter().find(|f| f.0 == field).map_or(field.as_str(), |f| f.1).to_lowercase();
+                    let label = field_label(field).unwrap_or(field).to_lowercase();
                     let op = field_kind(field).and_then(|k| ops_for(k).iter().find(|o| o.0 == op)).map_or(op.as_str(), |o| o.1);
                     let v = match value {
-                        Value::String(s) => s.clone(),
+                        _ if field == "album" && cat.is_some() => album_name(value, cat),
+                        _ if field_kind(field) == Some(Kind::Bool) => {
+                            bool_value(value).map_or_else(|| value.to_string(), |b| bool_label(b).to_lowercase())
+                        }
+                        Value::String(s) => choice_label(field, s).map_or_else(|| s.clone(), str::to_lowercase),
                         Value::Null => String::new(),
                         Value::Object(o) => format!(
                             "{} {}",
@@ -462,14 +1054,14 @@ mod tests {
         yes(json!({"rules": [{"field": "fileName", "op": "startsWith", "value": "img_"}, {"field": "fileName", "op": "endsWith", "value": ".cr2"}]}));
         // file path: the whole string (spaces included), either separator, case-insensitive
         let mut fp = photo(3);
-        fp.source = Source::File { path: "D:\\Photos\\Aliah Ira Polanco-Grylls\\2026\\IMG_0042.CR2".into() };
+        fp.source = Source::File { path: "D:\\Photos\\Lake Como Wedding-Day\\2026\\IMG_0042.CR2".into() };
         let fpm = |v: serde_json::Value| rs(v).matches(&fp, &cat);
-        assert!(fpm(json!({"rules": [{"field": "filePath", "op": "contains", "value": "/Aliah Ira Polanco-Grylls/"}]})));
-        assert!(!fpm(json!({"rules": [{"field": "filePath", "op": "contains", "value": "/Ira Aliah/"}]})));
-        assert!(!fpm(json!({"rules": [{"field": "filePath", "op": "contains", "value": "Polanco Grylls"}]})));
+        assert!(fpm(json!({"rules": [{"field": "filePath", "op": "contains", "value": "/Lake Como Wedding-Day/"}]})));
+        assert!(!fpm(json!({"rules": [{"field": "filePath", "op": "contains", "value": "/Como Lake/"}]})));
+        assert!(!fpm(json!({"rules": [{"field": "filePath", "op": "contains", "value": "Wedding Day"}]})));
         assert!(fpm(json!({"rules": [{"field": "filePath", "op": "notContains", "value": "/Other/"}]})));
         assert!(fpm(json!({"rules": [{"field": "filePath", "op": "startsWith", "value": "d:/photos/"}]})));
-        no(json!({"rules": [{"field": "filePath", "op": "contains", "value": "/Aliah/"}]})); // demo photo has no path
+        no(json!({"rules": [{"field": "filePath", "op": "contains", "value": "/Lake/"}]})); // demo photo has no path
         yes(json!({"rules": [{"field": "filePath", "op": "isEmpty"}]}));
         yes(json!({"rules": [{"field": "camera", "op": "contains", "value": "x2"}, {"field": "title", "op": "isEmpty"}]}));
         yes(json!({"rules": [{"field": "iso", "op": "between", "value": [800, 3200]}, {"field": "aperture", "op": "lte", "value": "f/4"}]}));
@@ -504,7 +1096,8 @@ mod tests {
     #[test]
     fn problems_and_description() {
         let r = rs(json!({"rules": [{"field": "rating", "op": "contains", "value": 1}, {"group": {"rules": [{"field": "nope", "op": "is"}]}}]}));
-        assert_eq!(r.problems(), vec!["`rating` has no operator `contains`".to_string(), "unknown field `nope`".to_string()]);
+        let messages: Vec<String> = r.check(&Catalog::new()).into_iter().map(|p| p.message).collect();
+        assert_eq!(messages, vec!["`rating` has no operator `contains`".to_string(), "unknown field `nope`".to_string()]);
         let r = rs(
             json!({"match": "any", "rules": [{"field": "rating", "op": "gte", "value": 3}, {"field": "captureDate", "op": "inLast", "value": {"n": 2, "unit": "weeks"}}]}),
         );
@@ -514,4 +1107,561 @@ mod tests {
             assert!(!ops_for(*k).is_empty(), "{f}");
         }
     }
+
+    /// Keyword Count: a photo with 2 keywords is in "≥ 2", "≤ 2" and "is 2"; a hierarchical path
+    /// (travel|italy|rome) is one keyword, and the same keyword twice in different case is one.
+    #[test]
+    fn keyword_count_rules() {
+        let cat = Catalog::new();
+        let mut p = photo(1); // travel|italy|rome, food
+        let m = |p: &Photo, op: &str, value: serde_json::Value| {
+            rs(json!({"rules": [{"field": "keywordCount", "op": op, "value": value}]})).matches(p, &cat)
+        };
+        assert!(m(&p, "gte", json!(2)) && m(&p, "lte", json!(2)) && m(&p, "is", json!(2)));
+        assert!(!m(&p, "gte", json!(3)) && !m(&p, "lt", json!(2)) && m(&p, "between", json!([1, 2])));
+        p.meta.keywords.push("Food".into());
+        assert!(m(&p, "is", json!(2)), "Food and food are one keyword");
+        p.meta.keywords.clear();
+        assert!(m(&p, "is", json!(0)) && m(&p, "lte", json!(2)));
+        assert_eq!(field_group("keywordCount"), Some("Keywords & People"));
+    }
+
+    /// People: the names on face regions. "People contains ana" finds Ana Lima; pets and unnamed
+    /// faces are not people; People Count counts each person once.
+    #[test]
+    fn people_rules() {
+        use lightcraft_meta::{Rect, Region, RegionKind};
+        let cat = Catalog::new();
+        let region = |name: Option<&str>, kind: RegionKind| Region {
+            rect: Rect { x0: 0.4, y0: 0.4, x1: 0.6, y1: 0.6 },
+            kind,
+            name: name.map(str::to_string),
+            description: None,
+        };
+        let mut p = photo(1);
+        let m = |p: &Photo, field: &str, op: &str, value: serde_json::Value| {
+            rs(json!({"rules": [{"field": field, "op": op, "value": value}]})).matches(p, &cat)
+        };
+        assert!(m(&p, "person", "isEmpty", json!(null)) && m(&p, "personCount", "is", json!(0)));
+        p.meta.regions = vec![
+            region(Some("Ana Lima"), RegionKind::Face),
+            region(Some(" ana lima "), RegionKind::Face),
+            region(Some("Rex"), RegionKind::Pet),
+            region(None, RegionKind::Face),
+            region(Some("Bo"), RegionKind::Face),
+        ];
+        assert!(m(&p, "person", "contains", json!("ana")));
+        assert!(m(&p, "person", "is", json!("ANA LIMA")));
+        assert!(!m(&p, "person", "is", json!("rex")), "a pet isn't a person");
+        assert!(m(&p, "person", "notContains", json!("rex")));
+        assert!(m(&p, "person", "isNotEmpty", json!(null)));
+        assert!(m(&p, "personCount", "is", json!(2)), "Ana Lima once, Bo; not the pet or the unnamed face");
+        assert_eq!(field_group("person"), Some("Keywords & People"));
+    }
+
+    /// Shutter Speed compares exposure times in seconds, written as the camera shows them: a
+    /// photo at 1/250 is in "≤ 1/60" (faster) and not in "≥ 1/60"; "between 1/1000 and 1/125".
+    #[test]
+    fn shutter_speed_rules() {
+        let cat = Catalog::new();
+        let mut p = photo(1);
+        let m = |p: &Photo, op: &str, value: serde_json::Value| {
+            rs(json!({"rules": [{"field": "shutterSpeed", "op": op, "value": value}]})).matches(p, &cat)
+        };
+        assert!(!m(&p, "gte", json!(0)), "no shutter speed recorded");
+        p.meta.shutter = "1/250".into();
+        assert!(m(&p, "is", json!("1/250")) && m(&p, "lte", json!("1/60")) && !m(&p, "gte", json!("1/60")));
+        assert!(m(&p, "between", json!(["1/1000", "1/125"])) && m(&p, "lt", json!(0.01)));
+        assert!(!m(&p, "is", json!("1/0")) && !m(&p, "is", json!("fast")), "a value that isn't a time matches nothing");
+        p.meta.shutter = "2\"".into();
+        assert!(m(&p, "gte", json!("1")) && m(&p, "is", json!(2)));
+        assert_eq!(field_group("shutterSpeed"), Some("Camera Info"));
+    }
+
+    #[test]
+    fn shutter_seconds_parses_camera_notation() {
+        for (s, want) in [("1/250", Some(0.004)), (" 1/250 s", Some(0.004)), ("0.5", Some(0.5)), ("2\"", Some(2.0)), ("30s", Some(30.0))] {
+            assert_eq!(crate::parse_shutter_seconds(s), want, "{s}");
+        }
+        for s in ["", "1/0", "0", "-1/250", "fast", "inf", "NaN", "1/x"] {
+            assert_eq!(crate::parse_shutter_seconds(s), None, "{s}");
+        }
+    }
+
+    /// File Extension ignores case and a leading dot; Copy Name, Alt Text, City, State /
+    /// Province and Country are text fields of their own (Location still matches all of them).
+    #[test]
+    fn file_source_description_and_location_rules() {
+        let cat = Catalog::new();
+        let mut p = photo(1); // IMG_0042.CR2
+        let m = |p: &Photo, field: &str, op: &str, value: serde_json::Value| {
+            rs(json!({"rules": [{"field": field, "op": op, "value": value}]})).matches(p, &cat)
+        };
+        assert!(m(&p, "extension", "is", json!("cr2")) && m(&p, "extension", "is", json!(".CR2")));
+        assert!(!m(&p, "extension", "is", json!("jpg")));
+        p.file_name = "README".into();
+        assert!(m(&p, "extension", "isEmpty", json!(null)), "no dot, no extension");
+        p.file_name = "archive.tar.gz".into();
+        assert!(m(&p, "extension", "is", json!("gz")));
+        p.file_name = ".hidden".into();
+        assert!(m(&p, "extension", "isEmpty", json!(null)), "a dot file has no extension");
+        assert!(m(&p, "copyName", "isEmpty", json!(null)));
+        p.copy_name = Some("Black and white".into());
+        assert!(m(&p, "copyName", "contains", json!("black")));
+        p.meta.alt_text = "A red kite over a hill".into();
+        assert!(m(&p, "altText", "contains", json!("kite")));
+        p.meta.city = "Porto".into();
+        p.meta.state = "Porto District".into();
+        p.meta.country = "Portugal".into();
+        assert!(m(&p, "city", "is", json!("porto")) && m(&p, "state", "startsWith", json!("porto")) && m(&p, "country", "is", json!("portugal")));
+        assert!(!m(&p, "city", "is", json!("portugal")), "City tests only the city");
+        assert!(m(&p, "location", "contains", json!("portugal")), "Location still covers the country");
+    }
+
+    /// In a Stack, Video Duration (seconds; photos have none), Cropped and Treatment.
+    #[test]
+    fn source_file_and_develop_rules() {
+        use crate::{Op, Stack, StackId};
+        let mut cat = Catalog::new();
+        let a = photo(1);
+        let b = photo(2);
+        let c = photo(3);
+        for p in [&a, &b, &c] {
+            cat.apply(Op::AddPhoto { photo: Box::new(p.clone()) }).unwrap();
+        }
+        cat.apply(Op::AddStack { stack: Stack { id: StackId(1), photos: vec![a.id, b.id], collapsed: false } }).unwrap();
+        let m = |p: &Photo, field: &str, op: &str, value: serde_json::Value| {
+            rs(json!({"rules": [{"field": field, "op": op, "value": value}]})).matches(p, &cat)
+        };
+        assert!(m(&a, "stacked", "is", json!(true)) && m(&b, "stacked", "is", json!(true)));
+        assert!(m(&c, "stacked", "is", json!(false)));
+        let mut v = photo(4);
+        assert!(!m(&v, "duration", "gte", json!(0)), "a photo has no duration");
+        v.duration = Some(95.0);
+        assert!(m(&v, "duration", "gt", json!(60)) && m(&v, "duration", "between", json!([90, 120])));
+        let mut d = photo(5);
+        assert!(m(&d, "cropped", "is", json!(false)) && m(&d, "treatment", "is", json!("color")));
+        let mut s = (*d.develop).clone();
+        s.crop.geometry.rect = lightcraft_geom::Rect::new(0.1, 0.0, 0.9, 1.0);
+        s.treatment = lightcraft_develop::Treatment::Bw;
+        d.develop = std::sync::Arc::new(s);
+        assert!(m(&d, "cropped", "is", json!(true)) && m(&d, "treatment", "is", json!("monochrome")));
+        assert!(m(&d, "treatment", "isNot", json!("color")));
+        let mut s = (*d.develop).clone();
+        s.crop = Default::default();
+        s.crop.geometry.angle = 2.0;
+        d.develop = std::sync::Arc::new(s);
+        assert!(m(&d, "cropped", "is", json!(true)), "straightening counts as a crop");
+    }
+
+    /// Size follows the photo as shown: rotated a quarter turn a landscape frame is a portrait, and
+    /// a crop changes its edges and its megapixels. Long / Short Edge are in pixels.
+    #[test]
+    fn size_rules_follow_orientation_and_crop() {
+        let cat = Catalog::new();
+        let mut p = photo(1); // 6000 × 4000
+        let m = |p: &Photo, field: &str, op: &str, value: serde_json::Value| {
+            rs(json!({"rules": [{"field": field, "op": op, "value": value}]})).matches(p, &cat)
+        };
+        assert!(m(&p, "aspect", "is", json!("landscape")) && m(&p, "longEdge", "is", json!(6000)) && m(&p, "shortEdge", "is", json!(4000)));
+        assert!(m(&p, "megapixels", "is", json!(24)));
+        let mut s = (*p.develop).clone();
+        s.orientation = lightcraft_geom::Orientation::Rotate90;
+        p.develop = std::sync::Arc::new(s.clone());
+        assert!(m(&p, "aspect", "is", json!("portrait")) && m(&p, "longEdge", "is", json!(6000)));
+        // a square crop of the rotated frame: 4000 wide, 4000 of its 6000 tall
+        s.crop.geometry.rect = lightcraft_geom::Rect::new(0.0, 1.0 / 6.0, 1.0, 5.0 / 6.0);
+        p.develop = std::sync::Arc::new(s);
+        assert!(m(&p, "aspect", "is", json!("square")) && m(&p, "longEdge", "is", json!(4000)));
+        assert!(m(&p, "megapixels", "is", json!(16)), "a 4000 × 4000 crop is 16 MP, not the sensor's 24");
+        assert!(m(&p, "megapixels", "lt", json!(20)) && !m(&p, "megapixels", "gte", json!(24)));
+        assert!(m(&p, "aspect", "isNot", json!("portrait")));
+        let empty = Photo::new(PhotoId(9), Source::Demo { scene: 0 }, "x.jpg", "JPEG", 0, 0, "2026-09-20T10:00:00");
+        assert!(
+            !m(&empty, "aspect", "is", json!("landscape")) && !m(&empty, "aspect", "is", json!("square")) && m(&empty, "longEdge", "is", json!(0))
+        );
+        assert!(m(&empty, "megapixels", "is", json!(0)));
+    }
+
+    /// Any Searchable Text also finds the state / province, the alt text, a person on a face and
+    /// a virtual copy's name, as it already finds the city and country.
+    #[test]
+    fn any_searchable_text_covers_new_fields() {
+        let cat = Catalog::new();
+        let mut p = photo(1);
+        let m = |p: &Photo, value: &str| rs(json!({"rules": [{"field": "text", "op": "contains", "value": value}]})).matches(p, &cat);
+        for word in ["oregon", "kite", "ana", "bluish"] {
+            assert!(!m(&p, word), "{word}");
+        }
+        p.meta.state = "Oregon".into();
+        p.meta.alt_text = "A kite".into();
+        p.meta.regions = vec![lightcraft_meta::Region {
+            rect: lightcraft_meta::Rect { x0: 0.4, y0: 0.4, x1: 0.6, y1: 0.6 },
+            kind: lightcraft_meta::RegionKind::Face,
+            name: Some("Ana".into()),
+            description: None,
+        }];
+        p.copy_name = Some("Bluish".into());
+        for word in ["oregon", "kite", "ana", "bluish"] {
+            assert!(m(&p, word), "{word}");
+        }
+    }
+
+    /// Choice values have readable labels: the editor and summaries show "Public Domain" and
+    /// "Black & White", never ids like `publicDomain`; rules still store and accept the ids.
+    #[test]
+    fn choices_have_readable_labels() {
+        assert_eq!(choice_label("copyrightStatus", "publicDomain"), Some("Public Domain"));
+        assert_eq!(choice_label("treatment", "monochrome"), Some("Black & White"));
+        // own labels where a shared word would translate wrongly: "Color" is the colour noun (the
+        // Color panel) and "None" agrees with other nouns in gendered languages
+        assert_eq!(choice_label("treatment", "color"), Some("In Color"));
+        assert_eq!(choice_label("label", "none"), Some("No Label"));
+        assert_eq!(choice_label("flag", "pick"), Some("Picked"));
+        assert_eq!(choice_label("aspect", "landscape"), Some("Landscape (wide)"));
+        assert_eq!(choice_label("flag", "nope"), None);
+        assert_eq!(choice_label("rating", "pick"), None, "not a choice field");
+        for (field, _, kind) in FIELDS {
+            let Kind::Choice(choices) = kind else { continue };
+            for (id, label) in *choices {
+                assert!(!label.is_empty() && label != id, "{field}: {id} has no label of its own");
+                assert!(label.starts_with(|c: char| c.is_uppercase()), "{field}: {label}");
+            }
+        }
+        let r = rs(
+            json!({"rules": [{"field": "copyrightStatus", "op": "is", "value": "publicDomain"}, {"field": "flag", "op": "isNot", "value": "reject"}]}),
+        );
+        assert_eq!(r.describe(), "copyright status is public domain and pick flag isn't rejected");
+        let mut p = photo(1);
+        p.meta.copyright_status = crate::CopyrightStatus::PublicDomain;
+        assert!(r.matches(&p, &Catalog::new()), "ids still match");
+    }
+
+    /// Yes/no fields read "Yes" / "No", and a value means the same to matching and to every
+    /// summary: `false`, `"false"`, `"no"` and `0` are no; `true`, `"yes"`, `1` and a missing value
+    /// are yes. Anything else is reported, not silently taken as yes.
+    #[test]
+    fn yes_no_values() {
+        for v in [json!(true), json!("true"), json!("Yes"), json!(1), json!(1.0), json!(null)] {
+            assert_eq!(bool_value(&v), Some(true), "{v}");
+        }
+        for v in [json!(false), json!("false"), json!(" NO "), json!(0), json!(0.0)] {
+            assert_eq!(bool_value(&v), Some(false), "{v}");
+        }
+        for v in [json!("maybe"), json!(2), json!(0.5), json!(-1), json!([true]), json!({"x": 1})] {
+            assert_eq!(bool_value(&v), None, "{v}");
+        }
+        assert_eq!((bool_label(true), bool_label(false)), ("Yes", "No"));
+        let cat = Catalog::new();
+        let p = photo(1); // unedited
+        assert!(rs(json!({"rules": [{"field": "edited", "op": "is", "value": "false"}]})).matches(&p, &cat), "\"false\" means no");
+        assert!(
+            !rs(json!({"rules": [{"field": "edited", "op": "is", "value": "false"}, {"field": "hasGps", "op": "is", "value": "yes"}]}))
+                .matches(&p, &cat)
+        );
+        assert!(!rs(json!({"rules": [{"field": "edited", "op": "is", "value": "maybe"}]})).matches(&p, &cat), "an unreadable value matches nothing");
+        let r = rs(json!({"rules": [{"field": "edited", "op": "is", "value": true}, {"field": "cropped", "op": "is", "value": "false"}]}));
+        assert_eq!(r.describe(), "has edits is yes and cropped is no");
+        let bad = rs(json!({"rules": [{"field": "edited", "op": "is", "value": "maybe"}]}));
+        let messages: Vec<String> = bad.check(&cat).into_iter().map(|p| p.message).collect();
+        assert_eq!(messages, vec!["`edited` is yes or no, not \"maybe\"".to_string()]);
+    }
+
+    /// "In the last N" never overflows, whatever N an agent or a saved file holds: a zero,
+    /// negative or unreadable N matches nothing (either way round); an N beyond 10,000 years means
+    /// "ever", so every dated photo is in it and none is outside it.
+    #[test]
+    fn in_the_last_survives_hostile_counts() {
+        set_now(Some("2026-09-01T00:00:00".into()));
+        let cat = Catalog::new();
+        let p = photo(1); // captured 2026-08-14
+        let m = |op: &str, n: serde_json::Value, unit: &str| {
+            rs(json!({"rules": [{"field": "captureDate", "op": op, "value": {"n": n, "unit": unit}}]})).matches(&p, &cat)
+        };
+        for n in [json!(0), json!(-5), json!(-1e30), json!(-9.3e18), json!("soon")] {
+            for op in ["inLast", "notInLast"] {
+                assert!(!m(op, n.clone(), "years"), "{op} {n}");
+            }
+        }
+        for n in [json!(1e30), json!(9.3e18), json!(u64::MAX), json!(20_000)] {
+            assert!(m("inLast", n.clone(), "years"), "{n} years is ever");
+            assert!(!m("notInLast", n.clone(), "years"), "{n}");
+        }
+        assert!(m("inLast", json!(1e30), "hours") && m("inLast", json!(30), "days"));
+        set_now(None);
+    }
+
+    /// Every rule's value is checked against its field, so a rule that can't mean anything is
+    /// reported instead of quietly matching nothing (or everything). Each problem says which rule
+    /// it is about: "rule 2", or "rule 2.1" inside a group.
+    #[test]
+    fn values_are_checked_against_their_field() {
+        use crate::{Album, AlbumId, Op};
+        let mut cat = Catalog::new();
+        cat.apply(Op::AddAlbum { album: Album::new(AlbumId(1), "Trip") }).unwrap();
+        let smart = Album { smart: Some(Box::default()), ..Album::new(AlbumId(2), "Best") };
+        cat.apply(Op::AddAlbum { album: smart }).unwrap();
+        cat.apply(Op::SetLabelName { label: crate::ColorLabel::Red, name: Some("Client".into()) }).unwrap();
+        let check = |rule: serde_json::Value| rs(json!({"rules": [rule]})).check(&cat);
+        let ok = |rule: serde_json::Value| assert!(check(rule.clone()).is_empty(), "{rule}: {:?}", check(rule.clone()));
+        let bad = |rule: serde_json::Value, want: &str| {
+            let p = check(rule.clone());
+            assert!(p.iter().any(|p| p.message.contains(want)), "{rule}: wanted {want:?}, got {p:?}");
+        };
+        let r = |field: &str, op: &str, value: serde_json::Value| json!({"field": field, "op": op, "value": value});
+        // numbers
+        ok(r("rating", "gte", json!(3)));
+        ok(r("rating", "gte", json!("4")));
+        ok(r("rating", "between", json!([1, 5])));
+        ok(r("aperture", "lte", json!("f/4")));
+        ok(r("focalLength", "is", json!("50mm")));
+        bad(r("rating", "gte", json!("abc")), "needs a number");
+        bad(r("rating", "gte", json!(7)), "no rating 0–5 is ≥ 7");
+        bad(r("iso", "between", json!([100])), "two");
+        bad(r("iso", "between", json!("100")), "two");
+        ok(r("shutterSpeed", "lte", json!("1/60")));
+        bad(r("shutterSpeed", "lte", json!("fast")), "1/250");
+        // dates
+        for d in ["2026", "2026-08", "2026-08-14", "2026-08-14T10:00:00"] {
+            ok(r("captureDate", "is", json!(d)));
+        }
+        ok(r("captureDate", "between", json!(["2026-01", "2026-12"])));
+        for d in [json!("banana"), json!("2026-13"), json!("2026-02-30"), json!(""), json!(2026)] {
+            bad(r("captureDate", "after", d), "needs a date");
+        }
+        bad(r("captureDate", "between", json!(["2026-12", "2026-01"])), "after the second");
+        bad(r("captureDate", "between", json!(["", "2026"])), "needs a date");
+        ok(r("captureDate", "inLast", json!({"n": 2, "unit": "weeks"})));
+        ok(r("captureDate", "inLast", json!(7)));
+        bad(r("captureDate", "inLast", json!({"n": 0, "unit": "days"})), "more than 0");
+        bad(r("captureDate", "notInLast", json!({"n": 3, "unit": "fortnights"})), "fortnights");
+        ok(r("captureDate", "isEmpty", json!(null)));
+        // choices: the ids, the flag's aliases and a colour label's custom name
+        ok(r("kind", "is", json!("raw")));
+        ok(r("flag", "is", json!("picked")));
+        ok(r("label", "is", json!("client")));
+        bad(r("label", "is", json!("pink")), "pink");
+        bad(r("kind", "isNot", json!("photo")), "photo");
+        // text needs something to look for
+        ok(r("title", "contains", json!("kite")));
+        ok(r("title", "isEmpty", json!(null)));
+        bad(r("title", "contains", json!("  ")), "something to look for");
+        bad(r("keywords", "startsWith", json!("")), "something to look for");
+        // albums: one that exists, plain or smart
+        ok(r("album", "is", json!(1)));
+        bad(r("album", "is", json!(999)), "no album 999");
+        ok(r("album", "is", json!(2)));
+        // groups: an empty one is a mistake; problems inside one say where they are
+        let p = rs(json!({"rules": [r("rating", "gte", json!(3)), {"group": {"match": "any", "rules": []}}]})).check(&cat);
+        assert_eq!(p.iter().map(ToString::to_string).collect::<Vec<_>>(), vec!["rule 2: an empty group".to_string()]);
+        let p = rs(json!({"rules": [r("rating", "gte", json!(3)), {"group": {"rules": [r("iso", "is", json!(100)), r("rating", "is", json!(9))]}}]}))
+            .check(&cat);
+        assert_eq!(p.len(), 1);
+        assert_eq!(p[0].path, vec![1, 1]);
+        assert_eq!(p[0].to_string(), "rule 2.2: no rating 0–5 is 9");
+        // an empty rule list at the top is "all photos" (or none, for any), not a mistake
+        assert!(rs(json!({"rules": []})).check(&cat).is_empty());
+    }
+
+    /// The check and the matcher agree. Units are any case, singular or plural, and missing means
+    /// days; an unknown unit is refused and matches nothing (it used to count as days, so "week" was
+    /// one day). A rating rule is refused only when no rating 0–5 could meet it. A colour label's
+    /// custom name matches in any case, accents included. Empty text hints at the right operator.
+    #[test]
+    fn check_and_matcher_agree() {
+        use crate::Op;
+        set_now(Some("2026-09-01T00:00:00".into()));
+        let mut cat = Catalog::new();
+        cat.apply(Op::SetLabelName { label: crate::ColorLabel::Red, name: Some("Été".into()) }).unwrap();
+        let p = photo(1); // captured 2026-08-14 (18 days before now), red label, rating 4
+        let rule = |field: &str, op: &str, value: serde_json::Value| rs(json!({"rules": [{"field": field, "op": op, "value": value}]}));
+        let valid = |r: &RuleSet| r.check(&cat).is_empty();
+        for unit in [json!("Days"), json!("DAY"), json!("days"), json!(null)] {
+            let r = rule("captureDate", "inLast", json!({"n": 30, "unit": unit}));
+            assert!(valid(&r) && r.matches(&p, &cat), "{unit}");
+        }
+        let r = rule("captureDate", "inLast", json!({"n": 30}));
+        assert!(valid(&r) && r.matches(&p, &cat), "no unit is days");
+        let week = rule("captureDate", "inLast", json!({"n": 1, "unit": "week"}));
+        assert!(valid(&week) && !week.matches(&p, &cat), "a week, not a day: 18 days ago is outside it");
+        assert!(rule("captureDate", "inLast", json!({"n": 3, "unit": "Weeks"})).matches(&p, &cat));
+        let odd = rule("captureDate", "inLast", json!({"n": 30, "unit": "fortnights"}));
+        assert!(!valid(&odd) && !odd.matches(&p, &cat), "an unknown unit is refused and matches nothing");
+        // rating: only a rule no rating could meet
+        for (op, v) in [("lt", json!(6)), ("gt", json!(-1)), ("isNot", json!(9)), ("between", json!([3, 8]))] {
+            assert!(valid(&rule("rating", op, v.clone())), "{op} {v}");
+        }
+        for (op, v) in [("is", json!(9)), ("gte", json!(7)), ("gt", json!(5)), ("lt", json!(0)), ("between", json!([6, 9]))] {
+            assert!(!valid(&rule("rating", op, v.clone())), "{op} {v}");
+        }
+        // a custom label name, any case, accents too
+        let r = rule("label", "is", json!("été"));
+        assert!(valid(&r) && r.matches(&p, &cat));
+        // "isn't" with nothing points at "isn't empty", the others at "is empty"
+        let hint = |op: &str| rule("title", op, json!("")).check(&cat).first().map(|p| p.message.clone()).unwrap_or_default();
+        assert!(hint("isNot").contains("isn't empty"), "{}", hint("isNot"));
+        assert!(hint("contains").contains("“is empty”"), "{}", hint("contains"));
+        set_now(None);
+    }
+
+    /// An album is in it or not: Album offers "is" and "isn't", never "≥" or "between".
+    #[test]
+    fn album_rules_are_is_or_isnt() {
+        assert_eq!(field_kind("album"), Some(Kind::Album));
+        let ops: Vec<&str> = ops_for(Kind::Album).iter().map(|o| o.0).collect();
+        assert_eq!(ops, ["is", "isNot"]);
+        let r = rs(json!({"rules": [{"field": "album", "op": "gte", "value": 1}]}));
+        assert_eq!(r.check(&Catalog::new()).first().map(|p| p.message.as_str()), Some("`album` has no operator `gte`"));
+    }
+
+    /// An Album rule names its album by id, written as a number or a numeric string, the same way
+    /// for the check, the matcher and the editor. A folder holds albums, not photos, so it can't be
+    /// tested.
+    #[test]
+    fn album_rule_ids() {
+        use crate::{Album, AlbumId, Op};
+        assert_eq!(album_rule_id(&json!(3)), Some(AlbumId(3)));
+        assert_eq!(album_rule_id(&json!("3")), Some(AlbumId(3)));
+        assert_eq!(album_rule_id(&json!(3.0)), Some(AlbumId(3)));
+        for v in [json!(1.5), json!(-1), json!("x"), json!(null)] {
+            assert_eq!(album_rule_id(&v), None, "{v}");
+        }
+        let mut cat = Catalog::new();
+        cat.apply(Op::AddAlbum { album: Album { folder: true, ..Album::new(AlbumId(4), "Trips") } }).unwrap();
+        let p = rs(json!({"rules": [{"field": "album", "op": "is", "value": 4}]})).check(&cat);
+        assert!(p.first().is_some_and(|p| p.message.contains("folder")), "{p:?}");
+    }
+
+    /// Album rules saved before Album offered only "is" / "isn't" (≥, between… from when it was a
+    /// number field) always meant "isn't" to the matcher; upgrading says so, so they check again.
+    #[test]
+    fn old_album_operators_upgrade_to_isnt() {
+        let mut r = rs(json!({"rules": [
+            {"field": "album", "op": "gte", "value": 1},
+            {"field": "album", "op": "is", "value": 1},
+            {"field": "rating", "op": "gte", "value": 3},
+            {"group": {"rules": [{"field": "album", "op": "between", "value": [1, 2]}]}}
+        ]}));
+        r.upgrade();
+        let ops = serde_json::to_value(&r).unwrap().to_string();
+        assert!(ops.contains(r#""field":"album","op":"isNot","value":1"#), "{ops}");
+        assert!(ops.contains(r#""field":"album","op":"is","value":1"#), "{ops}");
+        assert!(ops.contains(r#""field":"rating","op":"gte""#), "other fields keep theirs: {ops}");
+        assert!(ops.contains(r#""field":"album","op":"isNot","value":[1,2]"#), "inside groups too: {ops}");
+    }
+
+    /// Besides its English message (for agents), a problem names its field and the kind of issue,
+    /// so the editor can show "Title: needs something to look for" in any language. Every issue
+    /// has its own short text.
+    #[test]
+    fn problems_name_their_field_and_issue() {
+        let cat = Catalog::new();
+        let check = |rules: serde_json::Value| rs(json!({"rules": rules})).check(&cat);
+        let p = check(json!([{"field": "title", "op": "contains", "value": ""}]));
+        assert_eq!((p[0].field.as_deref(), p[0].issue), (Some("title"), Issue::NeedsTextOrEmpty));
+        let p = check(json!([{"field": "title", "op": "isNot", "value": ""}]));
+        assert_eq!(p[0].issue, Issue::NeedsTextOrNotEmpty);
+        // keywords and people say "are empty", and so does their hint
+        let p = check(json!([{"field": "keywords", "op": "contains", "value": ""}, {"field": "person", "op": "notContains", "value": " "}]));
+        assert_eq!((p[0].issue, p[1].issue), (Issue::NeedsNamesOrEmpty, Issue::NeedsNamesOrNotEmpty));
+        assert!(p[0].issue.text().contains("“are empty”") && p[0].message.contains("“are empty”"));
+        let p = check(json!([{"field": "rating", "op": "is", "value": 9}, {"group": {"rules": []}}]));
+        assert_eq!((p[0].field.as_deref(), p[0].issue), (Some("rating"), Issue::NoRatingMatches));
+        assert_eq!((p[1].field.as_deref(), p[1].issue), (None, Issue::EmptyGroup));
+        let p = check(json!([{"field": "captureDate", "op": "between", "value": ["2026-12", "2026-01"]}]));
+        assert_eq!(p[0].issue, Issue::DatesReversed);
+        let p = check(json!([{"field": "album", "op": "is", "value": null}]));
+        assert_eq!(p[0].issue, Issue::ChooseAlbum);
+        let mut texts: Vec<&str> = Issue::ALL.iter().map(|i| i.text()).collect();
+        assert!(texts.iter().all(|t| !t.is_empty()));
+        texts.sort_unstable();
+        texts.dedup();
+        assert_eq!(texts.len(), Issue::ALL.len(), "each issue reads differently");
+    }
+
+    /// A rule date reads one way for the check and the matcher: a space works as the "T"
+    /// ("2026-10-01 10:00" matches a photo taken then). Imported capture times can carry fractions
+    /// of a second and a time zone (EXIF SubSecTime / OffsetTime: "…T10:00:00.250+02:00"), so a
+    /// rule may too, after the seconds; anywhere else they are no date.
+    #[test]
+    fn rule_dates_have_one_reading() {
+        let cat = Catalog::new();
+        let mut p = photo(1);
+        p.captured = Some("2026-10-01T10:00:00".into());
+        let rule = |op: &str, v: serde_json::Value| rs(json!({"rules": [{"field": "captureDate", "op": op, "value": v}]}));
+        for (op, v) in [
+            ("is", json!("2026-10-01 10:00")),
+            ("is", json!(" 2026-10-01T10 ")),
+            ("between", json!(["2026-10-01 09:00", "2026-10-01 11:00"])),
+            ("after", json!("2026-10-01 09:59")),
+        ] {
+            let r = rule(op, v.clone());
+            assert!(r.check(&cat).is_empty() && r.matches(&p, &cat), "{op} {v}");
+        }
+        // a capture time with a fraction and a zone, as imports write it
+        let mut zoned = photo(2);
+        zoned.captured = Some("2026-08-14T10:00:00.250+02:00".into());
+        for v in ["2026-08-14T10:00:00.250", "2026-08-14T10:00:00.250+02:00", "2026-08-14T10:00:00"] {
+            let r = rule("is", json!(v));
+            assert!(r.check(&cat).is_empty() && r.matches(&zoned, &cat), "{v}");
+        }
+        assert!(rule("is", json!("2026-08-14T10:00:00Z")).check(&cat).is_empty());
+        for v in [
+            "2026-8-14",
+            "2026-08-14T1",
+            "2026-08-14X10",
+            "26-08-14",
+            "2026-08-14T25:00",
+            "2026-08-14Z",
+            "2026-08-14 10:00-05:00",
+            "2026-08-14T10:00:00.",
+            "2026-08-14T10:00:00+2",
+        ] {
+            let p = rule("is", json!(v)).check(&cat);
+            assert_eq!(p.first().map(|p| p.issue), Some(Issue::NeedsDate), "{v}");
+        }
+        assert_eq!(rule_date("2026-10-01 10:00"), Ok("2026-10-01T10:00".to_string()));
+        assert_eq!(rule_date("2026"), Ok("2026".to_string()));
+    }
+
+    /// The field menu shows every rule field once: at the top level or in exactly one group,
+    /// and [`FIELDS`] lists them in menu order.
+    #[test]
+    fn every_field_is_in_the_menu_exactly_once() {
+        let menu: Vec<&str> = TOP_LEVEL_FIELDS.iter().chain(FIELD_GROUPS.iter().flat_map(|g| g.1.iter())).copied().collect();
+        let fields: Vec<&str> = FIELDS.iter().map(|f| f.0).collect();
+        assert_eq!(menu, fields, "the menu and FIELDS list the same fields in the same order");
+        for (label, group) in FIELD_GROUPS {
+            assert!(!group.is_empty(), "group {label} is empty");
+        }
+        let mut labels: Vec<&str> = FIELD_GROUPS.iter().map(|g| g.0).collect();
+        labels.dedup();
+        assert_eq!(labels.len(), FIELD_GROUPS.len(), "group labels are unique");
+    }
+
+    /// Related fields sit together: all the file fields, all the camera (EXIF) fields, all the
+    /// dates, all the keyword fields.
+    #[test]
+    fn related_fields_share_a_group() {
+        let same = |fields: &[&str], group: &str| {
+            for f in fields {
+                assert_eq!(field_group(f), Some(group), "{f}");
+            }
+        };
+        same(&["fileName", "extension", "filePath", "kind", "format", "duration"], "File");
+        same(&["album", "virtualCopy", "copyName", "stacked"], "Source");
+        same(&["longEdge", "shortEdge", "aspect", "megapixels"], "Size");
+        same(&["edited", "cropped", "treatment"], "Develop");
+        same(&["camera", "lens", "focalLength", "aperture", "shutterSpeed", "iso"], "Camera Info");
+        same(&["captureDate", "importDate", "editDate"], "Date");
+        same(&["keywords", "keywordCount", "person", "personCount"], "Keywords & People");
+        same(&["title", "caption", "altText", "creator", "copyright", "copyrightStatus"], "Description");
+        same(&["location", "city", "state", "country", "hasGps"], "Location");
+        for f in ["rating", "flag", "label", "text"] {
+            assert_eq!(field_group(f), None, "{f} stays at the top level");
+        }
+        assert_eq!(field_group("nope"), None);
+        assert_eq!(field_label("filePath"), Some("File Path"));
+        assert_eq!(field_label("nope"), None);
+    }
 }
diff --git a/crates/catalog/src/tests.rs b/crates/catalog/src/tests.rs
index 8d34d5ef..20f4b728 100644
--- a/crates/catalog/src/tests.rs
+++ b/crates/catalog/src/tests.rs
@@ -456,3 +456,220 @@ fn random_sort_has_no_date_headers() {
     let ids = many(&mut c, 5);
     assert!(c.date_runs(&ids, SortKey::Random, GroupBy::Day).is_empty());
 }
+
+/// Reload stores the lens data a file carries; the inverse (through the journal's JSON) takes it back.
+#[test]
+fn set_embedded_lens_is_undoable_and_journaled() {
+    let mut c = Catalog::default();
+    let a = c.alloc_photo_id();
+    c.apply(Op::AddPhoto {
+        photo: Box::new(Photo::new(a, Source::File { path: "/x.rw2".into() }, "x.rw2", "RW2", 4000, 3000, "2026-10-06T00:00:00")),
+    })
+    .unwrap();
+    let lens = lightcraft_develop::EmbeddedLens { warp: Some(Default::default()), vignette: None };
+    let op = Op::SetEmbeddedLens { id: a, lens: Some(Box::new(lens)) };
+    let op: Op = serde_json::from_str(&serde_json::to_string(&op).unwrap()).unwrap();
+    let inv = c.apply(op).unwrap();
+    assert_eq!(c.photo(a).unwrap().embedded_lens, Some(lens));
+    let inv: Op = serde_json::from_str(&serde_json::to_string(&inv).unwrap()).unwrap();
+    c.apply(inv).unwrap();
+    assert_eq!(c.photo(a).unwrap().embedded_lens, None);
+}
+
+/// A saved smart album whose rules no longer check (the album a rule tests was deleted) is found,
+/// with its problems; a good one has none; an old album operator is read as it was meant.
+#[test]
+fn smart_album_problems_flag_stale_rules() {
+    let mut c = Catalog::new();
+    c.apply(Op::AddAlbum { album: Album::new(AlbumId(1), "Trip") }).unwrap();
+    let smart = |id: u64, rules: serde_json::Value| {
+        let f: Filter = serde_json::from_value(serde_json::json!({"ruleSet": {"rules": rules}})).unwrap();
+        Album { smart: Some(Box::new(f)), ..Album::new(AlbumId(id), "Smart") }
+    };
+    c.apply(Op::AddAlbum { album: smart(2, serde_json::json!([{"field": "album", "op": "is", "value": 1}])) }).unwrap();
+    c.apply(Op::AddAlbum { album: smart(3, serde_json::json!([{"field": "album", "op": "gte", "value": 1}])) }).unwrap();
+    assert!(c.smart_album_problems(AlbumId(2)).is_empty());
+    assert!(c.smart_album_problems(AlbumId(3)).is_empty(), "an old operator is upgraded, not a problem");
+    assert!(c.smart_album_problems(AlbumId(1)).is_empty(), "a plain album has no rules");
+    c.apply(Op::RemoveAlbum { id: AlbumId(1) }).unwrap();
+    let p = c.smart_album_problems(AlbumId(2));
+    assert_eq!(p.iter().map(ToString::to_string).collect::<Vec<_>>(), vec!["rule 1: no album 1".to_string()]);
+}
+
+/// A smart album can test another smart album: "Keywords contain travel" and "Album isn't Excluded
+/// Photos" (red or rejected) leaves out the excluded photos, and follows that album's rules as they
+/// change.
+#[test]
+fn a_smart_album_can_exclude_another() {
+    let mut c = Catalog::new();
+    let smart = |id: u64, name: &str, rules: serde_json::Value| {
+        let f: Filter = serde_json::from_value(serde_json::json!({"ruleSet": rules})).unwrap();
+        Album { smart: Some(Box::new(f)), ..Album::new(AlbumId(id), name) }
+    };
+    c.apply(Op::AddAlbum {
+        album: smart(
+            1,
+            "Excluded Photos",
+            serde_json::json!({"match": "any", "rules": [
+            {"field": "label", "op": "is", "value": "red"}, {"field": "flag", "op": "is", "value": "reject"}]}),
+        ),
+    })
+    .unwrap();
+    let travel = |c: &mut Catalog, name: &str, label: Option<ColorLabel>, flag: Flag| {
+        let id = c.alloc_photo_id();
+        let mut p = Photo::new(id, Source::Demo { scene: 1 }, name, "JPEG", 6000, 4000, "2026-09-30T10:00:00");
+        p.meta.keywords = vec!["travel".into()];
+        p.label = label;
+        p.flag = flag;
+        c.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+        id
+    };
+    let keep = travel(&mut c, "keep.jpg", None, Flag::Pick);
+    let red = travel(&mut c, "red.jpg", Some(ColorLabel::Red), Flag::None);
+    let rejected = travel(&mut c, "rejected.jpg", None, Flag::Reject);
+    let rules: RuleSet = serde_json::from_value(serde_json::json!({"rules": [
+        {"field": "keywords", "op": "contains", "value": "travel"}, {"field": "album", "op": "isNot", "value": 1}]}))
+    .unwrap();
+    assert!(rules.check(&c).is_empty(), "a smart album can be tested: {:?}", rules.check(&c));
+    let matched = |c: &Catalog| c.photos().filter(|p| rules.matches(p, c)).map(|p| p.id).collect::<Vec<_>>();
+    assert_eq!(matched(&c), vec![keep]);
+    // "is" works the other way round
+    let inside: RuleSet = serde_json::from_value(serde_json::json!({"rules": [{"field": "album", "op": "is", "value": 1}]})).unwrap();
+    assert_eq!(c.photos().filter(|p| inside.matches(p, &c)).count(), 2);
+    let _ = (red, rejected);
+}
+
+/// An album can't include itself, directly or through other smart albums: the check refuses the
+/// loop for the album being edited, and a loop saved anyway (an older version, a hand-edited file)
+/// neither recurses forever nor crashes: inside it, the album being evaluated counts as holding no
+/// photos, and every album in it is reported.
+#[test]
+fn smart_album_loops_are_refused_and_survived() {
+    let mut c = Catalog::new();
+    let refers = |to: u64| -> Filter {
+        serde_json::from_value(serde_json::json!({"ruleSet": {"rules": [{"field": "album", "op": "isNot", "value": to}]}})).unwrap()
+    };
+    let smart = |id: u64, f: Filter| Album { smart: Some(Box::new(f)), ..Album::new(AlbumId(id), "S") };
+    // A → B → C
+    c.apply(Op::AddAlbum { album: smart(3, Filter::default()) }).unwrap();
+    c.apply(Op::AddAlbum { album: smart(2, refers(3)) }).unwrap();
+    c.apply(Op::AddAlbum { album: smart(1, refers(2)) }).unwrap();
+    let rules = |to: u64| refers(to).rule_set.unwrap();
+    assert!(rules(1).check_for(&c, Some(AlbumId(3))).iter().any(|p| p.issue == crate::rules::Issue::AlbumLoop), "C → A closes A → B → C → A");
+    assert!(rules(3).check_for(&c, Some(AlbumId(3))).iter().any(|p| p.issue == crate::rules::Issue::AlbumLoop), "an album testing itself");
+    assert!(rules(1).check_for(&c, None).is_empty(), "a new album can't be in a loop yet");
+    assert!(rules(3).check_for(&c, Some(AlbumId(1))).is_empty(), "A testing C again is no loop");
+    assert!(!c.album_reaches(AlbumId(3), AlbumId(1)) && c.album_reaches(AlbumId(1), AlbumId(3)));
+    // a loop saved anyway: C → A
+    c.apply(Op::SetAlbumRules { id: AlbumId(3), rules: Box::new(refers(1)) }).unwrap();
+    let id = photo(&mut c, "a.jpg", "2026-09-01T10:00:00");
+    let p = c.photo(id).unwrap().clone();
+    for a in [1, 2, 3] {
+        let _ = c.album_contains(AlbumId(a), &p); // returns, no stack overflow
+        assert!(c.smart_album_problems(AlbumId(a)).iter().any(|p| p.issue == crate::rules::Issue::AlbumLoop), "album {a} is reported");
+    }
+}
+
+/// Summaries name the albums Album rules test ("album isn't “Excluded Photos”"), not their ids;
+/// one that is gone shows as its number.
+#[test]
+fn summaries_name_albums() {
+    let mut c = Catalog::new();
+    c.apply(Op::AddAlbum { album: Album::new(AlbumId(4), "Excluded Photos") }).unwrap();
+    let rules: RuleSet = serde_json::from_value(serde_json::json!({"rules": [
+        {"field": "keywords", "op": "contains", "value": "travel"},
+        {"group": {"match": "any", "rules": [{"field": "album", "op": "isNot", "value": 4}, {"field": "album", "op": "is", "value": 9}]}}]}))
+    .unwrap();
+    assert_eq!(rules.describe_with(&c), "keywords contains travel and (album isn't “Excluded Photos” or album is #9)");
+    let f = Filter { rule_set: Some(rules), ..Default::default() };
+    assert!(f.describe_with(&c).contains("album isn't “Excluded Photos”"));
+}
+
+/// A chain of smart albums each testing the one before twice ("all of: album is X(k-1), album is
+/// X(k-1)") costs a pass per album, not 2^depth: each album's answer for a photo is worked out once
+/// per question. 25 albums deep stays instant.
+#[test]
+fn chains_of_smart_albums_stay_linear() {
+    let mut c = Catalog::new();
+    let smart = |id: u64, f: Filter| Album { smart: Some(Box::new(f)), ..Album::new(AlbumId(id), "X") };
+    c.apply(Op::AddAlbum { album: smart(1, Filter::default()) }).unwrap();
+    for k in 2..=26u64 {
+        let f: Filter = serde_json::from_value(serde_json::json!({"ruleSet": {"rules": [
+            {"field": "album", "op": "is", "value": k - 1}, {"field": "album", "op": "is", "value": k - 1}]}}))
+        .unwrap();
+        c.apply(Op::AddAlbum { album: smart(k, f) }).unwrap();
+    }
+    for i in 0..20 {
+        photo(&mut c, &format!("p{i}.jpg"), "2026-09-01T10:00:00");
+    }
+    let start = std::time::Instant::now();
+    assert_eq!(c.album_count(AlbumId(26)), 20);
+    assert!(start.elapsed() < std::time::Duration::from_secs(2), "took {:?}", start.elapsed());
+}
+
+/// A smart album's own album filter (not only its rules) counts in loops: A filtered to "in A" is
+/// reported, and so is A filtered to B while B's rules test A.
+#[test]
+fn an_album_filter_counts_in_loops() {
+    let mut c = Catalog::new();
+    let smart = |id: u64, f: Filter| Album { smart: Some(Box::new(f)), ..Album::new(AlbumId(id), "S") };
+    c.apply(Op::AddAlbum { album: smart(1, Filter { album: Some(AlbumId(1)), ..Default::default() }) }).unwrap();
+    let loops = |c: &Catalog, id: u64| c.smart_album_problems(AlbumId(id)).iter().any(|p| p.issue == crate::rules::Issue::AlbumLoop);
+    assert!(loops(&c, 1), "filtered to itself");
+    let tests_3: Filter = serde_json::from_value(serde_json::json!({"ruleSet": {"rules": [{"field": "album", "op": "is", "value": 3}]}})).unwrap();
+    c.apply(Op::AddAlbum { album: smart(2, Filter { album: Some(AlbumId(3)), ..Default::default() }) }).unwrap();
+    c.apply(Op::AddAlbum {
+        album: smart(3, serde_json::from_value(serde_json::json!({"ruleSet": {"rules": [{"field": "album", "op": "is", "value": 2}]}})).unwrap()),
+    })
+    .unwrap();
+    assert!(c.album_reaches(AlbumId(3), AlbumId(2)) && c.album_reaches(AlbumId(2), AlbumId(3)));
+    assert!(loops(&c, 2) && loops(&c, 3));
+    let _ = tests_3;
+    let shown: Vec<String> = c.smart_album_problems(AlbumId(1)).iter().map(ToString::to_string).collect();
+    assert!(shown.iter().all(|s| !s.starts_with("rule :")), "{shown:?}");
+}
+
+#[test]
+fn undated_photos_group_under_unknown_date_and_sort_together() {
+    let mut c = Catalog::new();
+    let add_photo = |c: &mut Catalog, name: &str, captured: Option<&str>, imported: &str| {
+        let id = c.alloc_photo_id();
+        let mut p = Photo::new(id, Source::Demo { scene: 0 }, name, "JPEG", 100, 100, imported);
+        p.captured = captured.map(str::to_string);
+        c.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+        id
+    };
+    let p_dated1 = add_photo(&mut c, "dated1.jpg", Some("2026-05-10T12:00:00"), "2026-10-01T00:00:00");
+    let p_dated2 = add_photo(&mut c, "dated2.jpg", Some("2026-05-20T12:00:00"), "2026-10-01T00:00:00");
+    let p_undated1 = add_photo(&mut c, "undated1.jpg", None, "2026-10-05T00:00:00");
+    let p_undated2 = add_photo(&mut c, "undated2.jpg", None, "2026-10-02T00:00:00");
+
+    // Descending sort (default, newest first): dated photos first (newest to oldest), undated photos at the end
+    let desc = c.query(&Filter::default(), &Sort { key: SortKey::CaptureDate, ascending: false, ..Default::default() });
+    assert_eq!(desc, vec![p_dated2, p_dated1, p_undated1, p_undated2]);
+
+    // Ascending sort (oldest first): undated photos at the beginning, dated photos from oldest to newest
+    let asc = c.query(&Filter::default(), &Sort { key: SortKey::CaptureDate, ascending: true, ..Default::default() });
+    assert_eq!(asc, vec![p_undated2, p_undated1, p_dated1, p_dated2]);
+
+    // date_runs groups undated photos under Unknown Date
+    let runs = c.date_runs(&desc, SortKey::CaptureDate, GroupBy::Day);
+    assert_eq!(runs.len(), 3);
+    assert_eq!(runs[0].key, "2026-05-20");
+    assert_eq!(runs[1].key, "2026-05-10");
+    assert_eq!(runs[2].key, "");
+    assert_eq!(runs[2].label, "Unknown Date");
+    assert_eq!(runs[2].count, 2);
+
+    // date_groups sidebar tree only counts photos with capture dates
+    let groups = c.date_groups();
+    assert_eq!(groups.len(), 1);
+    assert_eq!(groups[0].year, "2026");
+    assert_eq!(groups[0].count, 2);
+
+    // Filter by capture date prefix does not match undated photos
+    let filter_day = Filter { date: Some("2026-10-05".into()), ..Default::default() };
+    assert_eq!(c.query(&filter_day, &Sort::default()), vec![]);
+    let filter_year = Filter { date: Some("2026".into()), ..Default::default() };
+    assert_eq!(c.query(&filter_year, &Sort { key: SortKey::CaptureDate, ascending: false, ..Default::default() }), vec![p_dated2, p_dated1]);
+}
diff --git a/crates/catalog/src/tests_folder_records.rs b/crates/catalog/src/tests_folder_records.rs
new file mode 100644
index 00000000..3ae19c33
--- /dev/null
+++ b/crates/catalog/src/tests_folder_records.rs
@@ -0,0 +1,199 @@
+//! What the library keeps about its folders: a colour label, like a photo's (see
+//! [`crate::folders::FolderRecord`]).
+//!
+//! Scenarios, in the words of someone organising their library by folder:
+//!
+//! * Given a folder of the library, when I give it a colour label, its row in the folder tree
+//!   shows that label; the folders around it show none.
+//! * However the folder is spelled, it is one folder with one label.
+//! * When I take the label off, the library keeps nothing about the folder.
+//! * Every change is one undo step: undo puts back the label the folder had before.
+//! * A path that names no folder is refused and nothing changes.
+//! * When the folder is renamed or moved, its label and those of the folders inside it go along;
+//!   a folder beside it whose name merely starts the same way keeps its own. Undo brings them
+//!   back, also a label that was left at the destination.
+//! * Labels survive closing and reopening the library.
+
+use crate::*;
+
+fn add(c: &mut Catalog, path: &str) {
+    let id = c.alloc_photo_id();
+    let name = path.rsplit('/').next().unwrap_or(path);
+    let p = Photo::new(id, Source::File { path: path.into() }, name, "JPEG", 60, 40, "2026-01-01T10:00:00");
+    c.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+}
+
+fn library() -> Catalog {
+    let mut c = Catalog::new();
+    for p in ["/pics/trip/a.jpg", "/pics/trip/day1/b.jpg", "/pics/trip2/c.jpg", "/pics/home/d.jpg"] {
+        add(&mut c, p);
+    }
+    c
+}
+
+fn label(c: &mut Catalog, path: &str, l: Option<ColorLabel>) -> Op {
+    let op = c.folder_label_op(path, l);
+    c.apply(op).unwrap()
+}
+
+/// The label of each row of the tree, by path, depth first (rows without one left out).
+fn tree_labels(c: &Catalog) -> Vec<(String, ColorLabel)> {
+    fn walk(n: &FolderNode, out: &mut Vec<(String, ColorLabel)>) {
+        if let Some(l) = n.label {
+            out.push((n.path.clone(), l));
+        }
+        n.children.iter().for_each(|c| walk(c, out));
+    }
+    let mut out = Vec::new();
+    c.folder_tree().iter().for_each(|n| walk(n, &mut out));
+    out
+}
+
+#[test]
+fn a_new_library_knows_nothing_about_its_folders() {
+    let c = library();
+    assert_eq!(c.folder_record("/pics/trip"), None);
+    assert_eq!(c.folder_color_label("/pics/trip"), None);
+    assert!(tree_labels(&c).is_empty());
+}
+
+#[test]
+fn a_labelled_folder_shows_its_label_in_the_tree_and_only_there() {
+    let mut c = library();
+    label(&mut c, "/pics/trip", Some(ColorLabel::Red));
+    assert_eq!(c.folder_color_label("/pics/trip"), Some(ColorLabel::Red));
+    assert_eq!(tree_labels(&c), vec![("/pics/trip".to_string(), ColorLabel::Red)]);
+}
+
+#[test]
+fn however_a_folder_is_spelled_it_has_one_label() {
+    let mut c = library();
+    label(&mut c, "/pics//trip/", Some(ColorLabel::Green));
+    assert_eq!(c.folder_color_label("/pics/./trip"), Some(ColorLabel::Green));
+    label(&mut c, "/pics/home/../trip", Some(ColorLabel::Blue));
+    assert_eq!(c.folder_color_label("/pics/trip"), Some(ColorLabel::Blue));
+    assert_eq!(tree_labels(&c).len(), 1, "one folder, one record");
+}
+
+#[test]
+fn taking_the_label_off_leaves_no_record() {
+    let mut c = library();
+    label(&mut c, "/pics/trip", Some(ColorLabel::Purple));
+    label(&mut c, "/pics/trip", None);
+    assert_eq!(c.folder_record("/pics/trip"), None);
+    assert!(!c.to_snapshot().contains("folder_records"), "nothing empty is saved");
+}
+
+#[test]
+fn an_empty_record_is_no_record() {
+    let mut c = library();
+    c.apply(Op::SetFolderRecord { folder: "/pics/trip".into(), record: Some(FolderRecord::default()) }).unwrap();
+    assert_eq!(c.folder_record("/pics/trip"), None);
+}
+
+#[test]
+fn undo_puts_back_the_label_the_folder_had() {
+    let mut c = library();
+    let undo_first = label(&mut c, "/pics/trip", Some(ColorLabel::Yellow));
+    let undo_second = label(&mut c, "/pics/trip", Some(ColorLabel::Red));
+    c.apply(undo_second).unwrap();
+    assert_eq!(c.folder_color_label("/pics/trip"), Some(ColorLabel::Yellow));
+    c.apply(undo_first).unwrap();
+    assert_eq!(c.folder_record("/pics/trip"), None);
+}
+
+#[test]
+fn a_path_that_names_no_folder_is_refused() {
+    let mut c = library();
+    let before = c.to_snapshot();
+    for bad in ["", "relative/trip", ".", "a/.."] {
+        let op = Op::SetFolderRecord { folder: bad.into(), record: Some(FolderRecord { label: Some(ColorLabel::Red) }) };
+        assert!(c.apply(op).is_err(), "{bad:?} names no folder");
+    }
+    assert_eq!(c.to_snapshot(), before);
+}
+
+#[test]
+fn a_moved_folder_takes_its_labels_and_its_subfolders_labels_along() {
+    let mut c = library();
+    label(&mut c, "/pics/trip", Some(ColorLabel::Red));
+    label(&mut c, "/pics/trip/day1", Some(ColorLabel::Green));
+    label(&mut c, "/pics/trip2", Some(ColorLabel::Blue));
+    let ops = c.folder_records_follow("/pics/trip", "/archive/2026/trip");
+    c.apply(Op::Batch { ops }).unwrap();
+    assert_eq!(c.folder_record("/pics/trip"), None);
+    assert_eq!(c.folder_color_label("/archive/2026/trip"), Some(ColorLabel::Red));
+    assert_eq!(c.folder_color_label("/archive/2026/trip/day1"), Some(ColorLabel::Green));
+    assert_eq!(c.folder_color_label("/pics/trip2"), Some(ColorLabel::Blue), "a neighbour that only starts the same stays");
+}
+
+#[test]
+fn undoing_a_move_brings_back_every_label_also_one_left_at_the_destination() {
+    let mut c = library();
+    label(&mut c, "/pics/trip", Some(ColorLabel::Red));
+    // a folder that once was at the destination left its labels behind
+    label(&mut c, "/pics/holiday", Some(ColorLabel::Purple));
+    label(&mut c, "/pics/holiday/day9", Some(ColorLabel::Yellow));
+    let before = c.to_snapshot();
+    let ops = c.folder_records_follow("/pics/trip", "/pics/holiday");
+    let undo = c.apply(Op::Batch { ops }).unwrap();
+    assert_eq!(c.folder_color_label("/pics/holiday"), Some(ColorLabel::Red), "the moved folder's label wins");
+    assert_eq!(c.folder_record("/pics/holiday/day9"), None, "what was known about the old folder goes");
+    c.apply(undo).unwrap();
+    assert_eq!(c.to_snapshot(), before);
+}
+
+#[test]
+fn a_folder_without_labels_moves_without_ops() {
+    let c = library();
+    assert!(c.folder_records_follow("/pics/trip", "/elsewhere/trip").is_empty());
+}
+
+#[test]
+fn an_unlabelled_folder_moved_onto_a_stale_label_does_not_inherit_it() {
+    let mut c = library();
+    // a folder that was at the destination once (its photos are gone) left its label behind
+    label(&mut c, "/pics/holiday", Some(ColorLabel::Purple));
+    let ops = c.folder_records_follow("/pics/trip", "/pics/holiday");
+    let undo = c.apply(Op::Batch { ops }).unwrap();
+    assert_eq!(c.folder_record("/pics/holiday"), None, "the folder now there is another one");
+    c.apply(undo).unwrap();
+    assert_eq!(c.folder_color_label("/pics/holiday"), Some(ColorLabel::Purple));
+}
+
+#[test]
+fn labels_survive_the_journal_without_a_snapshot() {
+    let m = MemStore::new();
+    let (mut j, mut c, _) = Journal::open(Box::new(m.clone())).unwrap();
+    {
+        let p = "/pics/trip/a.jpg";
+        let id = c.alloc_photo_id();
+        let op = Op::AddPhoto { photo: Box::new(Photo::new(id, Source::File { path: p.into() }, "a.jpg", "JPEG", 6, 4, "2026-01-01")) };
+        c.apply(op.clone()).unwrap();
+        j.append(std::slice::from_ref(&op)).unwrap();
+    }
+    let op = c.folder_label_op("/pics/trip", Some(ColorLabel::Yellow));
+    c.apply(op.clone()).unwrap();
+    j.append(std::slice::from_ref(&op)).unwrap();
+    drop(j);
+    let (_, reopened, r) = Journal::open(Box::new(m)).unwrap();
+    assert!(r.replayed >= 2, "{r:?}");
+    assert_eq!(reopened.folder_color_label("/pics/trip"), Some(ColorLabel::Yellow));
+}
+
+#[test]
+fn labels_survive_closing_and_reopening_the_library() {
+    let mut c = library();
+    label(&mut c, "/pics/home", Some(ColorLabel::Green));
+    let reopened = Catalog::from_snapshot(&c.to_snapshot()).unwrap();
+    assert_eq!(reopened.folder_color_label("/pics/home"), Some(ColorLabel::Green));
+}
+
+#[test]
+fn a_library_saved_before_folder_records_opens_without_any() {
+    let c = library();
+    let old = c.to_snapshot();
+    assert!(!old.contains("folder_records"));
+    let reopened = Catalog::from_snapshot(&old).unwrap();
+    assert_eq!(reopened.folder_record("/pics/trip"), None);
+}
diff --git a/crates/catalog/src/tests_format_version.rs b/crates/catalog/src/tests_format_version.rs
index cb80ce67..ed2bfe7d 100644
--- a/crates/catalog/src/tests_format_version.rs
+++ b/crates/catalog/src/tests_format_version.rs
@@ -47,7 +47,7 @@ fn v1_library_loads_and_is_upgraded() {
     assert_eq!((r.replayed, r.upgraded_from), (1, None));
 }
 
-/// A library saved before albums could be ordered by hand opens as it was and is rewritten as v3.
+/// A library saved before albums could be ordered by hand opens as it was and is rewritten in the current format.
 #[test]
 fn v2_library_loads_and_is_upgraded() {
     let (base, log, full) = legacy_parts();
@@ -57,7 +57,21 @@ fn v2_library_loads_and_is_upgraded() {
     let (_, c, r) = Journal::open(Box::new(m.clone())).unwrap();
     assert_eq!(c.to_snapshot(), full.to_snapshot());
     assert_eq!((r.replayed, r.upgraded_from), (1, Some(2)));
-    assert_eq!(snapshot_version(&m), 3);
+    assert_eq!(snapshot_version(&m), u64::from(VERSION));
+}
+
+/// A library saved before keywords could be listed on their own opens as it was and is rewritten
+/// in the current format.
+#[test]
+fn v3_library_loads_and_is_upgraded() {
+    let (base, log, full) = legacy_parts();
+    let m = MemStore::new();
+    m.set(SNAPSHOT, format!("{{\"format\":\"lightcraft-catalog\",\"version\":3,\"seq\":2,\"catalog\":{}}}\n", base.to_snapshot()).into_bytes());
+    m.set(LOG, log.into_bytes());
+    let (_, c, r) = Journal::open(Box::new(m.clone())).unwrap();
+    assert_eq!(c.to_snapshot(), full.to_snapshot());
+    assert_eq!((r.replayed, r.upgraded_from), (1, Some(3)));
+    assert_eq!(snapshot_version(&m), u64::from(VERSION));
 }
 
 #[test]
@@ -193,8 +207,11 @@ fn op_variants_are_versioned() {
             | Op::Batch { .. } => 1,
             Op::SetBrowsed { .. } => 2,
             Op::SetAlbumOrder { .. } => 3,
+            Op::SetEmbeddedLens { .. } => 4,
+            Op::SetKeyword { .. } => 5,
+            Op::SetFolderRecord { .. } => 6,
         }
     }
-    let newest = since(&Op::SetAlbumOrder { id: AlbumId(0), order: None });
+    let newest = since(&Op::SetFolderRecord { folder: "/".into(), record: None });
     assert_eq!(newest, VERSION, "the newest op's version must be the current format version");
 }
diff --git a/crates/catalog/src/tests_journal.rs b/crates/catalog/src/tests_journal.rs
index 0594b6d8..8570bd07 100644
--- a/crates/catalog/src/tests_journal.rs
+++ b/crates/catalog/src/tests_journal.rs
@@ -78,6 +78,15 @@ fn op_for(c: &mut Catalog, kind: u8, a: u8, b: u8) -> Op {
         13 => Op::Batch { ops: c.remove_from_stacks_ops(&[pid]) },
         14 => c.set_top_ops(pid).unwrap_or(Op::Batch { ops: vec![] }),
         9 if b.is_multiple_of(5) => Op::SetLabelName { label: ColorLabel::ALL[a as usize % 5], name: (a % 3 != 1).then(|| format!("Label {b}")) },
+        9 if b % 7 == 5 => Op::SetKeyword {
+            path: format!("travel|place {}", b % 4),
+            info: (!b.is_multiple_of(3)).then(|| crate::keywords::KeywordInfo {
+                person: a.is_multiple_of(2),
+                synonyms: vec![format!("trip {a}")],
+                ..Default::default()
+            }),
+        },
+        9 if b % 11 == 4 => c.folder_label_op(&format!("/p/f{}", a % 4), ColorLabel::ALL.get(usize::from(b % 6)).copied()),
         9 if b % 7 == 3 => Op::SetAlbumOrder { id: aid, order: (!b.is_multiple_of(3)).then_some(u32::from(b % 5)) },
         9 if b.is_multiple_of(2) => {
             Op::SetFile { id: pid, file_name: format!("Renamed_{b}.jpg"), source: Source::File { path: format!("/p/Renamed_{b}.jpg") } }
@@ -326,3 +335,44 @@ fn failed_streamed_write_keeps_the_old_file() {
     assert_eq!(std::fs::read(dir.join(SNAPSHOT)).unwrap(), b"new");
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// A damaged rendering process in a saved photo (snapshot or log) reads as V1 and costs nothing
+/// else: the photo and its edits load (`docs/process-versions.md`).
+#[test]
+fn a_damaged_process_value_loads_as_v1_with_the_edits() {
+    use lightcraft_develop::ProcessVersion;
+    let mut c = Catalog::new();
+    let id = c.alloc_photo_id();
+    let mut p = Photo::new(id, Source::Demo { scene: 1 }, "a.jpg", "JPEG", 10, 10, "2026-10-09T00:00:00");
+    p.develop = Arc::new(DevelopSettings {
+        process: ProcessVersion(7),
+        light: lightcraft_develop::Light { exposure: 0.5, ..Default::default() },
+        ..Default::default()
+    });
+    c.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+    let snapshot = c.to_snapshot();
+    assert!(snapshot.contains(r#""process":7"#));
+    let snapshot = format!(
+        "{{\"format\":\"lightcraft-catalog\",\"version\":{},\"seq\":0,\"catalog\":{}}}\n",
+        crate::journal::VERSION,
+        snapshot.replace(r#""process":7"#, r#""process":-1"#)
+    );
+    let m = MemStore::new();
+    m.set(SNAPSHOT, snapshot.into_bytes());
+    let (_, loaded, _) = open(&m);
+    let d = &loaded.photo(id).unwrap().develop;
+    assert_eq!((d.process, d.light.exposure), (ProcessVersion::V1, 0.5));
+    // and in a (CRC-valid) log record
+    let edit = DevelopSettings {
+        process: ProcessVersion(7),
+        light: lightcraft_develop::Light { exposure: 0.8, ..Default::default() },
+        ..Default::default()
+    };
+    let op = Op::SetDevelop { id, settings: Arc::new(edit), label: "Edit".into(), edited: None };
+    let body = serde_json::to_string(&op).unwrap().replace(r#""process":7"#, r#""process":"seven""#);
+    assert!(body.contains("seven"));
+    m.set(LOG, format!("{{\"seq\":1,\"crc\":{},\"op\":{body}}}\n", crc32fast::hash(body.as_bytes())).into_bytes());
+    let (_, loaded, _) = open(&m);
+    let d = &loaded.photo(id).unwrap().develop;
+    assert_eq!((d.process, d.light.exposure), (ProcessVersion::V1, 0.8));
+}
diff --git a/crates/codecs/Cargo.toml b/crates/codecs/Cargo.toml
index 18d00ac3..4c93a89a 100644
--- a/crates/codecs/Cargo.toml
+++ b/crates/codecs/Cargo.toml
@@ -30,6 +30,8 @@ jxl-oxide = { workspace = true, optional = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 ravif = { workspace = true, optional = true }
+rav1e = { workspace = true, optional = true }
+avif-serialize = { workspace = true, optional = true }
 
 [features]
 default = ["parallel", "jxl", "avif"]
@@ -40,7 +42,9 @@ jxl = ["dep:jxl-oxide"]
 # PhotoCraft); `cargo xtask ci` clippies and tests it (`--features heif`), releases don't ship it yet.
 heif = ["dep:lightcraft-heif"]
 ## AVIF encoding via ravif/rav1e (pure Rust, BSD). Native targets only; a no-op on wasm32.
-avif = ["dep:ravif"]
+avif = ["dep:ravif", "dep:rav1e", "dep:avif-serialize"]
 
 [dev-dependencies]
 proptest = { workspace = true }
+# Lossless synthetic HEIC files for the `heif` feature's tests.
+lightcraft-heif = { workspace = true, features = ["testdata"] }
diff --git a/crates/codecs/README.md b/crates/codecs/README.md
index 18743ad0..e1998c49 100644
--- a/crates/codecs/README.md
+++ b/crates/codecs/README.md
@@ -23,6 +23,12 @@ encode_png(&EncodeImage::new(w, h, 4, Samples::U16(&px)), &meta)?;
 encode_tiff(&EncodeImage::new(w, h, 3, Samples::F32(&px)), TiffCompression::Deflate, &meta)?;
 encode_webp_lossless(&img, &meta)?;
 encode_avif(&img, 70, 6, &meta)?;                        // native + feature `avif`
+
+// HDR gain map JPEG (ISO 21496-1): SDR + HDR renditions → base + gain map, and back
+let (map, gm) = gainmap::compute(&sdr_linear, &hdr_linear, w, h, luma, &GainMapOptions::default())?;
+gainmap::encode_jpeg(&EncodeImage::new(w, h, 3, Samples::U8(&base8)), &map, &gm, 90, ChromaSubsampling::S444, &meta)?;
+let found = gainmap::read_jpeg(&bytes);                  // ours, cameras', Lightroom's
+gainmap::apply(&mut base_linear, w, h, &found.gain, &found.meta, 1.0)?;
 ```
 
 Thumbnail fallback decoding limits the source to 64 million pixels by default.
@@ -46,8 +52,9 @@ CRW, MRW, X3F) are detected so the engine can route them to `lightcraft-raw`; `d
 | GIF / BMP | yes (first GIF frame) | — | via `image` |
 | PSD / PSB | merged composite: 8/16/32-bit gray, RGB, CMYK, indexed, duotone (as gray); raw/RLE | — | ICC (1039), EXIF (1058), XMP (1060); ZIP-compressed composite, Lab and 1-bit unsupported |
 | JPEG XL | yes (jxl-oxide, feature `jxl`, default on) | — | enum colour → rendered straight to linear Rec.2020; ICC → our ICC path; orientation applied by the decoder (reported as 1) |
-| AVIF | **no** | yes (ravif/rav1e, native only, feature `avif`) | 8-bit sRGB, EXIF; no ICC in the muxer |
-| HEIC/HEIF | **no** (sniff only) | — | see gaps |
+| AVIF | **no** | yes (ravif/rav1e, native only, feature `avif`) | 8/10-bit sRGB, EXIF; no ICC in the muxer. HDR: `encode_avif_pq` writes 10-bit BT.2020 PQ (SDR white at 203 cd/m², CICP `nclx` + `clli`) |
+| HEIC/HEIF | yes with feature `heif` (lightcraft-heif: heic-rs + libheif-matching colour; 4:2:0/mono, 8–10-bit, grids, irot/imir/clap, ICC/nclx/VUI, EXIF/XMP, thumbnail item) | — | 4:2:2/4:4:4 (Canon/Sony HIF) unsupported |
+| Gain map JPEG (HDR) | gain map found and decoded (`gainmap::read_jpeg`): ISO 21496-1 metadata, else Adobe `hdrgm` XMP | yes (`gainmap::encode_jpeg`) | CIPA DC-007 MPF index (gain map typed `0x050000`), ISO 21496-1 APP2 on both images, `hdrgm` + Container XMP for Android/Chrome, Apple `HDRGainMap`/`HDRToneMap` XMP; gain maps are never used as thumbnails |
 
 ## Colour
 
@@ -100,9 +107,11 @@ Run `cargo test --release -p lightcraft-codecs --test bench -- --ignored --nocap
 
 ## Gaps / limitations
 
-- **AVIF and HEIC decode**: no permissively licensed, pure-Rust AV1/HEVC decoder exists today
-  (dav1d/libheif are C; rav1d-safe and imazen's heic are AGPL). Files are sniffed and rejected with
-  `Error::Unsupported`; a raw-style embedded-preview path could be added for HEIC thumbnails.
+- **AVIF decode**: no permissively licensed, pure-Rust AV1 decoder exists today (dav1d is C;
+  rav1d-safe is AGPL). Files are sniffed and rejected with `Error::Unsupported`.
+- **HEIC** needs the `heif` feature (off by default: HEVC patents are the distributor's call);
+  without it, `Error::Unsupported` says the build has no HEIC support. 4:2:2 and 4:4:4 HEIF
+  (Canon/Sony HIF) is refused: heic-rs 0.1.1 loses sync on those bitstreams.
 - JPEG: arithmetic coding unsupported (as in both decoders); extended XMP (> 64 KiB) neither read
   nor written; EXIF > 64 KiB not written. The encoder uses standard Huffman tables (interleaved
   baseline) for maximum compatibility.
diff --git a/crates/codecs/src/display.rs b/crates/codecs/src/display.rs
new file mode 100644
index 00000000..e26e6ab6
--- /dev/null
+++ b/crates/codecs/src/display.rs
@@ -0,0 +1,442 @@
+//! Monitor (display) ICC profiles: showing photos correctly on wide-gamut and calibrated displays.
+//!
+//! The loupe renders straight into the display's own primaries: the develop pipeline targets the
+//! display's linear RGB ([`DisplayProfile::to_rec2020`]) and encodes it with the sRGB curve, as it
+//! does for every 8-bit output. That "proxy" encoding then goes to the display's real device
+//! values with [`DisplayProfile::correct`]: its tone curves for a matrix/TRC profile (a per-channel
+//! table), or its LUTs for a LUT-based profile (a CMS transform). Images made for sRGB (thumbnails,
+//! cached previews, embedded camera JPEGs) go through [`DisplayProfile::from_srgb`] instead.
+//!
+//! All conversions are relative colorimetric: the display's white is the image's white.
+
+use std::sync::Arc;
+
+use crate::icc;
+use crate::space::Trc;
+use lightcraft_color::{D50, D65, Mat3, REC2020, bradford};
+use lightcraft_raster::Rgba8;
+use moxcms::{ColorProfile, DataColorSpace, Layout, RenderingIntent, Transform8BitExecutor, TransformOptions, Xyzd};
+
+/// Largest profile file accepted (monitor profiles are a few KB; LUT profiles up to a few MB).
+pub const MAX_PROFILE_BYTES: usize = 32 << 20;
+
+/// How a display profile describes the display.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DisplayKind {
+    /// Primaries + tone curves (exact).
+    MatrixTrc,
+    /// LUT-based (A2B/B2A tables): applied through the CMS; the primaries the pipeline targets are
+    /// the profile's matrix tags when it has them, else measured through its tables.
+    Lut,
+}
+
+impl DisplayKind {
+    pub fn label(self) -> &'static str {
+        match self {
+            DisplayKind::MatrixTrc => "matrix",
+            DisplayKind::Lut => "lut",
+        }
+    }
+}
+
+/// The proxy → device step of a display.
+enum Correction {
+    /// The proxy encoding is the display's (sRGB-curve matrix profile): nothing to do.
+    None,
+    /// Per-channel tables (matrix/TRC profile: same primaries, other curves).
+    Curves(Box<[[u8; 256]; 3]>),
+    /// A full CMS transform (LUT-based profile).
+    Cms(Arc<Transform8BitExecutor>),
+}
+
+/// A parsed display profile with its transforms (built once, applied to every preview).
+pub struct DisplayProfile {
+    /// The profile's own description (or "Display profile").
+    pub description: String,
+    /// Identifies the profile (hash of its bytes): part of render keys.
+    pub id: u64,
+    pub kind: DisplayKind,
+    /// Linear display RGB → linear Rec.2020 (D65; display white → (1, 1, 1)).
+    pub to_rec2020: Mat3,
+    correction: Correction,
+    from_srgb: Arc<Transform8BitExecutor>,
+    to_srgb: Arc<Transform8BitExecutor>,
+}
+
+impl std::fmt::Debug for DisplayProfile {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DisplayProfile")
+            .field("description", &self.description)
+            .field("id", &self.id)
+            .field("kind", &self.kind)
+            .field("to_rec2020", &self.to_rec2020)
+            .finish_non_exhaustive()
+    }
+}
+
+fn opts() -> TransformOptions {
+    TransformOptions { rendering_intent: RenderingIntent::RelativeColorimetric, ..TransformOptions::default() }
+}
+
+fn xyzd(v: [f64; 3]) -> Xyzd {
+    Xyzd { x: v[0], y: v[1], z: v[2] }
+}
+
+/// Linear Rec.2020 → XYZ relative to D50 (the ICC PCS), Bradford-adapted.
+fn rec2020_to_xyz_d50() -> Mat3 {
+    bradford(D65, D50).mul(&REC2020.to_xyz())
+}
+
+/// Scale `m`'s columns so that (1, 1, 1) maps to (1, 1, 1): the display's white is the image's.
+fn white_balanced(m: Mat3) -> Option<Mat3> {
+    let s = m.inverse()?.apply([1.0; 3]);
+    s.iter().all(|v| v.is_finite() && *v > 0.0).then(|| m.mul(&Mat3::diag(s[0], s[1], s[2])))
+}
+
+fn hash(bytes: &[u8]) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut h = std::collections::hash_map::DefaultHasher::new();
+    bytes.hash(&mut h);
+    h.finish() | 1
+}
+
+/// Runs a moxcms call that may panic on a hostile profile.
+fn guarded<T>(f: impl FnOnce() -> Option<T>) -> Option<T> {
+    std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)).ok().flatten()
+}
+
+impl DisplayProfile {
+    /// Parse a display profile (an RGB ICC profile, matrix/TRC or LUT-based) and build its
+    /// transforms. Errors say what is wrong with the file; nothing here panics.
+    pub fn from_icc(bytes: &[u8]) -> Result<DisplayProfile, String> {
+        if bytes.len() > MAX_PROFILE_BYTES {
+            return Err(format!("the profile is too large ({} MB)", bytes.len() >> 20));
+        }
+        let p = guarded(|| ColorProfile::new_from_slice(bytes).ok()).ok_or("not a valid ICC profile")?;
+        if p.color_space != DataColorSpace::Rgb {
+            return Err("not an RGB profile (a display profile describes an RGB device)".into());
+        }
+        if !matches!(p.pcs, DataColorSpace::Xyz | DataColorSpace::Lab) {
+            return Err("unsupported profile connection space".into());
+        }
+        let info = icc::parse(bytes).ok_or("not a valid ICC profile")?;
+        let description = info
+            .description
+            .as_deref()
+            .map(|d| d.trim_start_matches('\u{feff}').trim())
+            .filter(|d| !d.is_empty())
+            .unwrap_or("Display profile")
+            .to_string();
+        let has_lut = p.lut_a_to_b_colorimetric.is_some()
+            || p.lut_a_to_b_perceptual.is_some()
+            || p.lut_b_to_a_colorimetric.is_some()
+            || p.lut_b_to_a_perceptual.is_some();
+        let srgb = ColorProfile::new_srgb();
+
+        // the primaries the pipeline renders into
+        let (kind, to_xyz_d50, curves) = match &info.kind {
+            icc::IccKind::MatrixTrc { to_xyz_d50, trc } if !has_lut => (DisplayKind::MatrixTrc, *to_xyz_d50, Some(trc.clone())),
+            icc::IccKind::MatrixTrc { to_xyz_d50, .. } => (DisplayKind::Lut, *to_xyz_d50, None),
+            _ => (DisplayKind::Lut, measured_to_xyz_d50(&p)?, None),
+        };
+        let to_rec2020 =
+            rec2020_to_xyz_d50().inverse().map(|m| m.mul(&to_xyz_d50)).and_then(white_balanced).ok_or("the profile's primaries are degenerate")?;
+        if to_rec2020.0.iter().flatten().any(|v| !v.is_finite()) {
+            return Err("the profile's primaries are degenerate".into());
+        }
+
+        // the proxy: the display's primaries (as the pipeline targets them), sRGB curve
+        let proxy_xyz = rec2020_to_xyz_d50().mul(&to_rec2020).0;
+        let mut proxy = ColorProfile::new_srgb();
+        proxy.cicp = None;
+        proxy.red_colorant = xyzd([proxy_xyz[0][0], proxy_xyz[1][0], proxy_xyz[2][0]]);
+        proxy.green_colorant = xyzd([proxy_xyz[0][1], proxy_xyz[1][1], proxy_xyz[2][1]]);
+        proxy.blue_colorant = xyzd([proxy_xyz[0][2], proxy_xyz[1][2], proxy_xyz[2][2]]);
+
+        let transform = |src: &ColorProfile, dst: &ColorProfile| guarded(|| src.create_transform_8bit(Layout::Rgba, dst, Layout::Rgba, opts()).ok());
+        let correction = match curves {
+            Some(trc) if trc.iter().all(|t| t.approx_eq(&Trc::Srgb, 2e-4)) => Correction::None,
+            Some(trc) => Correction::Curves(Box::new(curve_tables(&trc))),
+            None => Correction::Cms(transform(&proxy, &p).ok_or("the profile's tables can't be applied")?),
+        };
+        let from_srgb = transform(&srgb, &p).ok_or("can't convert sRGB to this profile")?;
+        let to_srgb = transform(&proxy, &srgb).ok_or("can't convert this profile to sRGB")?;
+        Ok(DisplayProfile { description, id: hash(bytes), kind, to_rec2020, correction, from_srgb, to_srgb })
+    }
+
+    /// Does [`correct`](Self::correct) change anything (the display's curves aren't sRGB's)?
+    pub fn needs_correction(&self) -> bool {
+        !matches!(self.correction, Correction::None)
+    }
+
+    /// A render in the display's primaries with the sRGB curve (the pipeline's display target) →
+    /// the display's device values, in place.
+    pub fn correct(&self, img: &mut Rgba8) -> Result<(), String> {
+        match &self.correction {
+            Correction::None => Ok(()),
+            Correction::Curves(t) => {
+                let map = |p: &mut [u8; 4]| *p = [t[0][p[0] as usize], t[1][p[1] as usize], t[2][p[2] as usize], p[3]];
+                #[cfg(feature = "parallel")]
+                {
+                    use rayon::prelude::*;
+                    img.data.par_chunks_mut(1 << 14).for_each(|c| c.iter_mut().for_each(map));
+                }
+                #[cfg(not(feature = "parallel"))]
+                img.data.iter_mut().for_each(map);
+                Ok(())
+            }
+            Correction::Cms(x) => apply(x, img),
+        }
+    }
+
+    /// An sRGB image → the display's device values, in place.
+    pub fn from_srgb(&self, img: &mut Rgba8) -> Result<(), String> {
+        apply(&self.from_srgb, img)
+    }
+
+    /// A render in the display's primaries with the sRGB curve → sRGB (colours outside sRGB are
+    /// clipped): for histograms and cached previews, which stay sRGB.
+    pub fn to_srgb(&self, img: &Rgba8) -> Result<Rgba8, String> {
+        let mut out = img.clone();
+        apply(&self.to_srgb, &mut out)?;
+        Ok(out)
+    }
+}
+
+/// Device RGB → PCS (XYZ D50) of the pure primaries, measured through the profile's tables
+/// (LUT-only profiles have no colorant tags).
+fn measured_to_xyz_d50(p: &ColorProfile) -> Result<Mat3, String> {
+    let lin = icc::linear_rec2020_profile();
+    let x = guarded(|| p.create_transform_f32(Layout::Rgb, &lin, Layout::Rgb, opts()).ok()).ok_or("the profile's tables can't be applied")?;
+    let src = [1.0f32, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0];
+    let mut dst = [0f32; 9];
+    guarded(|| x.transform(&src, &mut dst).ok()).ok_or("the profile's tables can't be applied")?;
+    let c = |i: usize| [dst[i] as f64, dst[i + 3] as f64, dst[i + 6] as f64];
+    // columns: each primary in linear Rec.2020
+    let m = Mat3([c(0), c(1), c(2)]);
+    if m.0.iter().flatten().any(|v| !v.is_finite()) || m.determinant().abs() < 1e-6 {
+        return Err("the profile's primaries are degenerate".into());
+    }
+    Ok(rec2020_to_xyz_d50().mul(&m))
+}
+
+/// sRGB-encoded 8-bit value → the display curve's code value, per channel.
+fn curve_tables(trc: &[Trc; 3]) -> [[u8; 256]; 3] {
+    let mut t = [[0u8; 256]; 3];
+    for (k, tab) in t.iter_mut().enumerate() {
+        for (i, v) in tab.iter_mut().enumerate() {
+            let lin = lightcraft_color::transfer::srgb_to_linear(i as f32 / 255.0);
+            *v = (from_linear(&trc[k], lin) * 255.0 + 0.5).clamp(0.0, 255.0) as u8;
+        }
+    }
+    t
+}
+
+/// Inverse of [`Trc::to_linear`] on 0..1 (bisection: works for tables and every parametric form).
+fn from_linear(t: &Trc, y: f32) -> f32 {
+    let y = y.clamp(0.0, 1.0);
+    let (mut lo, mut hi) = (0.0f32, 1.0f32);
+    for _ in 0..24 {
+        let mid = 0.5 * (lo + hi);
+        if t.to_linear(mid) < y {
+            lo = mid;
+        } else {
+            hi = mid;
+        }
+    }
+    0.5 * (lo + hi)
+}
+
+fn apply(x: &Arc<Transform8BitExecutor>, img: &mut Rgba8) -> Result<(), String> {
+    const CHUNK: usize = 1 << 14; // pixels
+    let src = img.data.clone();
+    let run = |s: &[[u8; 4]], d: &mut [[u8; 4]]| guarded(|| x.transform(s.as_flattened(), d.as_flattened_mut()).ok()).is_some();
+    #[cfg(feature = "parallel")]
+    let ok = {
+        use rayon::prelude::*;
+        src.par_chunks(CHUNK).zip(img.data.par_chunks_mut(CHUNK)).all(|(s, d)| run(s, d))
+    };
+    #[cfg(not(feature = "parallel"))]
+    let ok = src.chunks(CHUNK).zip(img.data.chunks_mut(CHUNK)).all(|(s, d)| run(s, d));
+    if ok { Ok(()) } else { Err("display profile transform failed".into()) }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::space::NamedSpace;
+    use lightcraft_color::{DISPLAY_P3, SRGB};
+
+    fn img(px: &[[u8; 4]]) -> Rgba8 {
+        Rgba8 { width: px.len(), height: 1, data: px.to_vec() }
+    }
+
+    fn close(a: [u8; 4], b: [u8; 4], tol: i32) -> bool {
+        (0..4).all(|i| (a[i] as i32 - b[i] as i32).abs() <= tol)
+    }
+
+    #[test]
+    fn srgb_display_changes_nothing() {
+        let d = DisplayProfile::from_icc(&icc::write_named(NamedSpace::Srgb)).unwrap();
+        assert_eq!(d.kind, DisplayKind::MatrixTrc);
+        assert!(!d.needs_correction());
+        for (i, row) in d.to_rec2020.0.iter().enumerate() {
+            let want = SRGB.to_space(&REC2020).0[i];
+            for k in 0..3 {
+                assert!((row[k] - want[k]).abs() < 2e-3, "{:?}", d.to_rec2020);
+            }
+        }
+        let px = [[0, 0, 0, 255], [255, 255, 255, 255], [200, 30, 90, 128], [17, 140, 251, 7]];
+        let mut a = img(&px);
+        d.correct(&mut a).unwrap();
+        assert_eq!(a.data, px);
+        let mut b = img(&px);
+        d.from_srgb(&mut b).unwrap();
+        for (x, y) in b.data.iter().zip(&px) {
+            assert!(close(*x, *y, 1), "{x:?} {y:?}");
+        }
+    }
+
+    /// On a Display P3 monitor, sRGB red is shown with less red drive than full; P3 green (out of
+    /// sRGB) is reachable in the display's own primaries.
+    #[test]
+    fn p3_display() {
+        let d = DisplayProfile::from_icc(&icc::write_named(NamedSpace::DisplayP3)).unwrap();
+        assert!(!d.needs_correction(), "P3 uses the sRGB curve");
+        let want = DISPLAY_P3.to_space(&REC2020).0;
+        for i in 0..3 {
+            for k in 0..3 {
+                assert!((d.to_rec2020.0[i][k] - want[i][k]).abs() < 2e-3, "{:?}", d.to_rec2020);
+            }
+        }
+        let mut red = img(&[[255, 0, 0, 255], [128, 128, 128, 255]]);
+        d.from_srgb(&mut red).unwrap();
+        assert!(red.data[0][0] < 245 && red.data[0][1] > 40, "{:?}", red.data[0]);
+        assert!(close(red.data[1], [128, 128, 128, 255], 1), "grey stays grey: {:?}", red.data[1]);
+        // the display's own pure green is outside sRGB: it clips there
+        let srgb = d.to_srgb(&img(&[[0, 255, 0, 255]])).unwrap();
+        assert!(srgb.data[0][0] < 10 && srgb.data[0][1] == 255, "{:?}", srgb.data[0]);
+    }
+
+    /// A gamma 2.2 display (Adobe RGB-like): the proxy's sRGB curve goes to the display's curve.
+    #[test]
+    fn gamma_display_uses_its_curve() {
+        let bytes = icc::write_matrix_trc(&lightcraft_color::ADOBE_RGB, &Trc::Gamma(2.2));
+        let d = DisplayProfile::from_icc(&bytes).unwrap();
+        assert!(d.needs_correction());
+        let mut a = img(&[[0, 0, 0, 255], [255, 255, 255, 255], [10, 128, 240, 9]]);
+        d.correct(&mut a).unwrap();
+        assert_eq!(a.data[0], [0, 0, 0, 255]);
+        assert_eq!(a.data[1], [255, 255, 255, 255]);
+        for (k, v) in [10u8, 128, 240].into_iter().enumerate() {
+            let lin = lightcraft_color::transfer::srgb_to_linear(v as f32 / 255.0);
+            let want = (lin.powf(1.0 / 2.2) * 255.0).round() as i32;
+            assert!((a.data[2][k] as i32 - want).abs() <= 1, "{k}: {} vs {want}", a.data[2][k]);
+        }
+        assert_eq!(a.data[2][3], 9, "alpha kept");
+    }
+
+    #[test]
+    fn rejects_bad_profiles() {
+        assert!(DisplayProfile::from_icc(&[]).is_err());
+        assert!(DisplayProfile::from_icc(&[0u8; 300]).is_err());
+        let mut gray = ColorProfile::new_gray_with_gamma(2.2);
+        gray.cicp = None;
+        assert!(DisplayProfile::from_icc(&gray.encode().unwrap()).is_err());
+        // truncated / corrupted real profiles never panic
+        let good = icc::write_named(NamedSpace::DisplayP3);
+        for n in [10, 128, 140, 200, good.len() - 1] {
+            let _ = DisplayProfile::from_icc(&good[..n]);
+        }
+        for i in (0..good.len()).step_by(7) {
+            let mut b = good.clone();
+            b[i] ^= 0xa5;
+            let _ = DisplayProfile::from_icc(&b);
+        }
+    }
+
+    /// A LUT-based display profile with no colorant or TRC tags (its A2B/B2A tables describe a
+    /// Display P3 panel with a gamma 2.2 response): the primaries are measured through the tables
+    /// and every preview goes through the CMS.
+    fn lut_only_p3_gamma22() -> Vec<u8> {
+        use moxcms::{LutMultidimensionalType, LutWarehouse, Matrix3d, ProfileClass, ToneReprCurve, Vector3d};
+        let m = crate::space::rgb_to_xyz_d50(&DISPLAY_P3).0;
+        let inv = crate::space::rgb_to_xyz_d50(&DISPLAY_P3).inverse().unwrap().0;
+        let curves = |v: Vec<f32>| vec![ToneReprCurve::Parametric(v.clone()), ToneReprCurve::Parametric(v.clone()), ToneReprCurve::Parametric(v)];
+        let ident = || curves(vec![1.0]);
+        // mAB: A → CLUT → M → matrix → B (no CLUT: M curves linearize, the matrix goes to XYZ)
+        let a2b = LutWarehouse::Multidimensional(LutMultidimensionalType {
+            num_input_channels: 3,
+            num_output_channels: 3,
+            grid_points: [0; 16],
+            clut: None,
+            a_curves: vec![],
+            m_curves: curves(vec![2.2]),
+            matrix: Matrix3d { v: m.map(|r| r.map(|v| v * 32768.0 / 65535.0)) },
+            b_curves: ident(),
+            bias: Vector3d::default(),
+        });
+        let b2a = LutWarehouse::Multidimensional(LutMultidimensionalType {
+            num_input_channels: 3,
+            num_output_channels: 3,
+            grid_points: [0; 16],
+            clut: None,
+            a_curves: vec![],
+            m_curves: curves(vec![1.0 / 2.2]),
+            matrix: Matrix3d { v: inv.map(|r| r.map(|v| v * 65535.0 / 32768.0)) },
+            b_curves: ident(),
+            bias: Vector3d::default(),
+        });
+        let mut p = ColorProfile::new_srgb();
+        p.cicp = None;
+        p.profile_class = ProfileClass::DisplayDevice;
+        p.red_colorant = Xyzd::default();
+        p.green_colorant = Xyzd::default();
+        p.blue_colorant = Xyzd::default();
+        p.red_trc = None;
+        p.green_trc = None;
+        p.blue_trc = None;
+        p.lut_a_to_b_colorimetric = Some(a2b.clone());
+        p.lut_a_to_b_perceptual = Some(a2b);
+        p.lut_b_to_a_colorimetric = Some(b2a.clone());
+        p.lut_b_to_a_perceptual = Some(b2a);
+        p.encode().unwrap()
+    }
+
+    #[test]
+    fn lut_profile_goes_through_the_cms() {
+        let bytes = lut_only_p3_gamma22();
+        let parsed = ColorProfile::new_from_slice(&bytes).unwrap();
+        assert!(!parsed.is_matrix_shaper() && parsed.lut_b_to_a_colorimetric.is_some(), "a LUT-only profile");
+        let d = DisplayProfile::from_icc(&bytes).unwrap();
+        assert_eq!(d.kind, DisplayKind::Lut);
+        assert!(d.needs_correction());
+        // the measured primaries are P3's
+        let want = DISPLAY_P3.to_space(&REC2020).0;
+        for i in 0..3 {
+            for k in 0..3 {
+                assert!((d.to_rec2020.0[i][k] - want[i][k]).abs() < 0.02, "{:?} vs {want:?}", d.to_rec2020);
+            }
+        }
+        // the correction is the gamma 2.2 curve; grey stays grey
+        let mut a = img(&[[0, 0, 0, 255], [255, 255, 255, 255], [128, 128, 128, 200]]);
+        d.correct(&mut a).unwrap();
+        assert!(close(a.data[0], [0, 0, 0, 255], 1) && close(a.data[1], [255, 255, 255, 255], 1), "{:?}", a.data);
+        let lin = lightcraft_color::transfer::srgb_to_linear(128.0 / 255.0);
+        let g = (lin.powf(1.0 / 2.2) * 255.0).round() as u8;
+        assert!(close(a.data[2], [g, g, g, 200], 2), "{:?} vs {g}", a.data[2]);
+        // sRGB red → less than full red drive on a P3 panel
+        let mut red = img(&[[255, 0, 0, 255]]);
+        d.from_srgb(&mut red).unwrap();
+        assert!(red.data[0][0] < 245 && red.data[0][1] > 30, "{:?}", red.data[0]);
+    }
+
+    #[test]
+    fn ids_identify_profiles() {
+        let a = DisplayProfile::from_icc(&icc::write_named(NamedSpace::DisplayP3)).unwrap();
+        let b = DisplayProfile::from_icc(&icc::write_named(NamedSpace::AdobeRgb)).unwrap();
+        let a2 = DisplayProfile::from_icc(&icc::write_named(NamedSpace::DisplayP3)).unwrap();
+        assert_ne!(a.id, b.id);
+        assert_eq!(a.id, a2.id);
+    }
+}
diff --git a/crates/codecs/src/encode.rs b/crates/codecs/src/encode.rs
index 59622073..c002abd9 100644
--- a/crates/codecs/src/encode.rs
+++ b/crates/codecs/src/encode.rs
@@ -79,6 +79,46 @@ pub enum ChromaSubsampling {
 
 const XMP_NS: &[u8] = b"http://ns.adobe.com/xap/1.0/\0";
 
+/// The APP segments [`encode_jpeg`] writes for `meta` (marker byte, payload): JFIF density, EXIF,
+/// XMP and the ICC profile in chunks, in that order.
+pub(crate) fn jpeg_app_segments(meta: &EncodeMeta) -> Result<Vec<(u8, Vec<u8>)>> {
+    let mut segs: Vec<(u8, Vec<u8>)> = Vec::new();
+    let ppi = meta.ppi.filter(|p| *p > 0).map_or([0u8, 0, 1, 0, 1], |p| {
+        let [hi, lo] = p.to_be_bytes();
+        [1, hi, lo, hi, lo]
+    });
+    segs.push((0xE0, [&b"JFIF\0\x01\x02"[..], &ppi, &[0, 0]].concat()));
+    if let Some(exif) = meta.exif {
+        if exif.len() > 65_527 {
+            return Err(Error::Encode("EXIF larger than one APP1 segment (64 KiB)".into()));
+        }
+        segs.push((0xE1, [&b"Exif\0\0"[..], exif].concat()));
+    }
+    if let Some(xmp) = meta.xmp {
+        segs.push((0xE1, xmp_segment(xmp)?));
+    }
+    if let Some(icc) = meta.icc {
+        // ICC.1 Annex B.4: "ICC_PROFILE\0", 1-based chunk number, chunk count
+        let chunks: Vec<&[u8]> = icc.chunks(65_519).collect();
+        if chunks.len() > 255 {
+            return Err(Error::Encode("ICC profile too large for JPEG".into()));
+        }
+        for (i, c) in chunks.iter().enumerate() {
+            segs.push((0xE2, [&b"ICC_PROFILE\0"[..], &[i as u8 + 1, chunks.len() as u8], c].concat()));
+        }
+    }
+    Ok(segs)
+}
+
+/// An APP1 XMP payload (namespace + packet), refusing packets larger than one segment.
+pub(crate) fn xmp_segment(xmp: &str) -> Result<Vec<u8>> {
+    let seg = [XMP_NS, xmp.as_bytes()].concat();
+    if seg.len() > 65_533 {
+        return Err(Error::Encode("XMP larger than one APP1 segment (extended XMP not supported)".into()));
+    }
+    Ok(seg)
+}
+
 /// Encode baseline JPEG (8-bit; alpha is dropped). `quality` 1..=100.
 pub fn encode_jpeg(img: &EncodeImage, quality: u8, subsampling: ChromaSubsampling, meta: &EncodeMeta) -> Result<Vec<u8>> {
     img.validate()?;
@@ -97,35 +137,7 @@ pub fn encode_jpeg(img: &EncodeImage, quality: u8, subsampling: ChromaSubsamplin
     };
     if subsampling != ChromaSubsampling::S422 {
         // Parallel encoder (restart-interval bands on all cores).
-        let mut segs: Vec<(u8, Vec<u8>)> = Vec::new();
-        let ppi = meta.ppi.filter(|p| *p > 0).map_or([0u8, 0, 1, 0, 1], |p| {
-            let [hi, lo] = p.to_be_bytes();
-            [1, hi, lo, hi, lo]
-        });
-        segs.push((0xE0, [&b"JFIF\0\x01\x02"[..], &ppi, &[0, 0]].concat()));
-        if let Some(exif) = meta.exif {
-            if exif.len() > 65_527 {
-                return Err(Error::Encode("EXIF larger than one APP1 segment (64 KiB)".into()));
-            }
-            segs.push((0xE1, [&b"Exif\0\0"[..], exif].concat()));
-        }
-        if let Some(xmp) = meta.xmp {
-            let seg = [XMP_NS, xmp.as_bytes()].concat();
-            if seg.len() > 65_533 {
-                return Err(Error::Encode("XMP larger than one APP1 segment (extended XMP not supported)".into()));
-            }
-            segs.push((0xE1, seg));
-        }
-        if let Some(icc) = meta.icc {
-            // ICC.1 Annex B.4: "ICC_PROFILE\0", 1-based chunk number, chunk count
-            let chunks: Vec<&[u8]> = icc.chunks(65_519).collect();
-            if chunks.len() > 255 {
-                return Err(Error::Encode("ICC profile too large for JPEG".into()));
-            }
-            for (i, c) in chunks.iter().enumerate() {
-                segs.push((0xE2, [&b"ICC_PROFILE\0"[..], &[i as u8 + 1, chunks.len() as u8], c].concat()));
-            }
-        }
+        let segs = jpeg_app_segments(meta)?;
         let ch = if img.channels == 2 { 1 } else { img.channels as usize };
         // `data` is already gray for 2-channel input (see above)
         return Ok(crate::jpeg_par::encode(&data, img.width as usize, img.height as usize, ch, quality, subsampling, &segs));
@@ -351,6 +363,141 @@ pub fn encode_avif(img: &EncodeImage, quality: u8, speed: u8, meta: &EncodeMeta)
     }
 }
 
+/// Absolute luminance of SDR white in an HDR file (ITU-R BT.2408 reference white), cd/m².
+pub const HDR_REFERENCE_WHITE_NITS: f32 = 203.0;
+
+/// SMPTE ST 2084 (PQ) inverse EOTF: luminance in cd/m² → signal 0..1.
+pub fn pq_encode(nits: f32) -> f32 {
+    const M1: f32 = 2610.0 / 16384.0;
+    const M2: f32 = 2523.0 / 4096.0 * 128.0;
+    const C1: f32 = 3424.0 / 4096.0;
+    const C2: f32 = 2413.0 / 4096.0 * 32.0;
+    const C3: f32 = 2392.0 / 4096.0 * 32.0;
+    let y = (nits / 10_000.0).clamp(0.0, 1.0).powf(M1);
+    ((C1 + C2 * y) / (1.0 + C3 * y)).powf(M2)
+}
+
+/// SMPTE ST 2084 (PQ) EOTF: signal 0..1 → luminance in cd/m².
+pub fn pq_decode(e: f32) -> f32 {
+    const M1: f32 = 2610.0 / 16384.0;
+    const M2: f32 = 2523.0 / 4096.0 * 128.0;
+    const C1: f32 = 3424.0 / 4096.0;
+    const C2: f32 = 2413.0 / 4096.0 * 32.0;
+    const C3: f32 = 2392.0 / 4096.0 * 32.0;
+    let p = e.clamp(0.0, 1.0).powf(1.0 / M2);
+    ((p - C1).max(0.0) / (C2 - C3 * p)).powf(1.0 / M1) * 10_000.0
+}
+
+/// Encode an HDR AVIF: `rgb` is linear light in **Rec. 2020** primaries with SDR white at 1.0
+/// (`width × height × 3`). Written as 10-bit 4:4:4 BT.2020 non-constant-luminance YCbCr with the
+/// PQ transfer curve, SDR white at [`HDR_REFERENCE_WHITE_NITS`], and a content light level box.
+/// `quality` 1..=100, `speed` 1..=10. Native targets with the `avif` feature only.
+pub fn encode_avif_pq(width: u32, height: u32, rgb: &[f32], quality: u8, speed: u8, meta: &EncodeMeta) -> Result<Vec<u8>> {
+    let (w, h) = (width as usize, height as usize);
+    let n = w.checked_mul(h).ok_or_else(|| Error::Encode("image too large".into()))?;
+    if n == 0 || n.checked_mul(3).is_none_or(|need| rgb.len() < need) {
+        return Err(Error::Encode("HDR AVIF: sample buffer too short".into()));
+    }
+    #[cfg(all(feature = "avif", not(target_arch = "wasm32")))]
+    {
+        use rav1e::prelude::*;
+        const K: [f32; 3] = [0.2627, 0.6780, 0.0593]; // BT.2020 NCL
+        let mut max_nits = 0f32;
+        let mut sum_nits = 0f64;
+        let planes: Vec<[u16; 3]> = rgb
+            .as_chunks::<3>()
+            .0
+            .iter()
+            .take(n)
+            .map(|c| {
+                let nits = c.map(|v| (if v.is_finite() { v.max(0.0) } else { 0.0 }) * HDR_REFERENCE_WHITE_NITS);
+                let y_nits = K[0] * nits[0] + K[1] * nits[1] + K[2] * nits[2];
+                max_nits = max_nits.max(nits[0].max(nits[1]).max(nits[2]));
+                sum_nits += y_nits as f64;
+                let [r, g, b] = nits.map(pq_encode);
+                let y = K[0] * r + K[1] * g + K[2] * b;
+                let cb = (b - y) / (2.0 * (1.0 - K[2])) + 0.5;
+                let cr = (r - y) / (2.0 * (1.0 - K[0])) + 0.5;
+                [y, cb, cr].map(|v| (v * 1023.0).round().clamp(0.0, 1023.0) as u16)
+            })
+            .collect();
+        let q = quality.clamp(1, 100) as f32 / 100.0;
+        // ravif's quality → quantizer curve, so qualities match the SDR AVIF path
+        let x = if q >= 0.82 {
+            (1.0 - q) * 2.6
+        } else if q > 0.25 {
+            1.0 - 0.125 - q * 0.5
+        } else {
+            1.0 - q
+        };
+        let quantizer = (x * 255.0).round() as usize;
+        let mut ec = EncoderConfig::with_speed_preset(speed.clamp(1, 10));
+        ec.width = w;
+        ec.height = h;
+        ec.time_base = Rational::new(1, 1);
+        ec.bit_depth = 10;
+        ec.chroma_sampling = ChromaSampling::Cs444;
+        ec.pixel_range = PixelRange::Full;
+        ec.color_description = Some(ColorDescription {
+            color_primaries: ColorPrimaries::BT2020,
+            transfer_characteristics: TransferCharacteristics::SMPTE2084,
+            matrix_coefficients: MatrixCoefficients::BT2020NCL,
+        });
+        let cll = (max_nits.ceil().clamp(1.0, 10_000.0) as u16, ((sum_nits / n as f64).ceil().clamp(1.0, 10_000.0)) as u16);
+        ec.content_light = Some(ContentLight { max_content_light_level: cll.0, max_frame_average_light_level: cll.1 });
+        ec.still_picture = true;
+        ec.quantizer = quantizer;
+        ec.min_quantizer = quantizer.min(255) as u8;
+        ec.speed_settings.multiref = false;
+        ec.speed_settings.rdo_lookahead_frames = 1;
+        ec.speed_settings.scene_detection_mode = SceneDetectionSpeed::None;
+        let e = |e: &dyn std::fmt::Display| Error::Encode(format!("AV1: {e}"));
+        let mut ctx: Context<u16> = Config::new().with_encoder_config(ec).new_context().map_err(|x| e(&x))?;
+        let mut frame = ctx.new_frame();
+        {
+            let mut it = planes.iter();
+            let mut fp = frame.planes.iter_mut();
+            let (Some(py), Some(pu), Some(pv)) = (fp.next(), fp.next(), fp.next()) else {
+                return Err(Error::Encode("AV1: frame has no planes".into()));
+            };
+            let (mut sy, mut su, mut sv) = (py.mut_slice(Default::default()), pu.mut_slice(Default::default()), pv.mut_slice(Default::default()));
+            for ((ry, ru), rv) in sy.rows_iter_mut().zip(su.rows_iter_mut()).zip(sv.rows_iter_mut()).take(h) {
+                for ((y, u), v) in ry.iter_mut().zip(ru.iter_mut()).zip(rv.iter_mut()).take(w) {
+                    let Some(p) = it.next() else { break };
+                    (*y, *u, *v) = (p[0], p[1], p[2]);
+                }
+            }
+        }
+        ctx.send_frame(frame).map_err(|x| e(&x))?;
+        ctx.flush();
+        let mut av1 = Vec::new();
+        loop {
+            match ctx.receive_packet() {
+                Ok(mut p) if p.frame_type == FrameType::KEY => av1.append(&mut p.data),
+                Ok(_) => {}
+                Err(EncoderStatus::Encoded | EncoderStatus::LimitReached) => break,
+                Err(x) => return Err(e(&x)),
+            }
+        }
+        use avif_serialize::constants as c;
+        let mut a = avif_serialize::Aviffy::new();
+        a.set_matrix_coefficients(c::MatrixCoefficients::Bt2020Ncl)
+            .set_transfer_characteristics(c::TransferCharacteristics::Smpte2084)
+            .set_color_primaries(c::ColorPrimaries::Bt2020)
+            .set_full_color_range(true)
+            .set_content_light_level(cll.0, cll.1);
+        if let Some(exif) = meta.exif {
+            a.set_exif(exif.to_vec());
+        }
+        Ok(a.to_vec(&av1, None, width, height, 10))
+    }
+    #[cfg(not(all(feature = "avif", not(target_arch = "wasm32"))))]
+    {
+        let _ = (quality, speed, meta);
+        Err(Error::Encode("AVIF encoding is not available in this build".into()))
+    }
+}
+
 /// 16-bit RGB(A) → 10-bit BT.601 full-range YCbCr planes (the matrix `ravif` uses for 8-bit input).
 #[cfg(all(feature = "avif", not(target_arch = "wasm32")))]
 fn avif_10bit(enc: &ravif::Encoder, img: &EncodeImage, s: &[u16]) -> Result<Vec<u8>> {
diff --git a/crates/codecs/src/gainmap.rs b/crates/codecs/src/gainmap.rs
new file mode 100644
index 00000000..13c3c0e5
--- /dev/null
+++ b/crates/codecs/src/gainmap.rs
@@ -0,0 +1,834 @@
+//! Gain map HDR images (ISO 21496-1): an SDR base image plus a gain map that a decoder uses to
+//! rebuild the HDR rendition, so the file looks right everywhere and lights up on HDR displays.
+//!
+//! - [`compute`] measures a gain map from an SDR and an HDR rendition of the same picture (linear
+//!   light, same primaries). Measure it against the base *as written* (decoded from its 8-bit
+//!   codes), so quantisation in the base is handed back by the gain map.
+//! - [`apply`] rebuilds the HDR rendition from a base and its gain map.
+//! - [`encode_jpeg`] writes a gain map JPEG: the base with an MPF index (CIPA DC-007), the ISO
+//!   21496-1 marker and Adobe/Google container XMP, followed by the gain map JPEG carrying the ISO
+//!   21496-1 metadata, the Adobe `hdrgm` XMP (Android, Chrome) and Apple's description of the same
+//!   map (what survives an iMessage send).
+//! - [`read_jpeg`] finds and decodes the gain map of a gain map JPEG (ours, cameras, Lightroom),
+//!   from its ISO 21496-1 metadata or, failing that, its `hdrgm` XMP.
+//!
+//! All gains are log2. A decoder recovers `log2(hdr + offset_hdr) − log2(sdr + offset_sdr)` as
+//! `min + (max − min) · (code / 255)^(1 / gamma)`, scaled by a weight in 0..1 that depends on how
+//! much headroom the display has between `base_headroom` and `alternate_headroom`.
+
+use crate::encode::{EncodeImage, EncodeMeta, Samples, jpeg_app_segments, xmp_segment};
+use crate::{ChromaSubsampling, Error, Format, Result, jpeg, jpeg_par};
+
+/// The ISO 21496-1 namespace that opens its APP2 payloads (NUL terminated).
+pub const ISO_URN: &[u8] = b"urn:iso:std:iso:ts:21496:-1\0";
+
+/// Fixed denominator for the metadata's rationals: one value per setting, byte-identical output.
+const DENOMINATOR: u32 = 1_000_000;
+
+/// Gain map parameters (ISO 21496-1 / Adobe `hdrgm`). Per-channel arrays repeat the first value
+/// when the map is single-channel.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct GainMapMeta {
+    /// Three gain channels (R, G, B) instead of one luminance gain.
+    pub multichannel: bool,
+    /// The gain applies in the base image's colour space.
+    pub use_base_colour_space: bool,
+    /// log2 headroom at which the base is shown as is (0: an SDR base).
+    pub base_headroom: f32,
+    /// log2 headroom at which the gain map applies in full.
+    pub alternate_headroom: f32,
+    pub min: [f32; 3],
+    pub max: [f32; 3],
+    pub gamma: [f32; 3],
+    pub base_offset: [f32; 3],
+    pub alternate_offset: [f32; 3],
+}
+
+impl Default for GainMapMeta {
+    fn default() -> Self {
+        GainMapMeta {
+            multichannel: false,
+            use_base_colour_space: true,
+            base_headroom: 0.0,
+            alternate_headroom: 1.0,
+            min: [0.0; 3],
+            max: [1.0; 3],
+            gamma: [1.0; 3],
+            base_offset: [1.0 / 64.0; 3],
+            alternate_offset: [1.0 / 64.0; 3],
+        }
+    }
+}
+
+impl GainMapMeta {
+    fn channels(&self) -> usize {
+        if self.multichannel { 3 } else { 1 }
+    }
+
+    /// Usable by [`apply`]: finite, positive gammas, max ≥ min, headrooms in order.
+    pub fn is_valid(&self) -> bool {
+        let fin = |a: &[f32; 3]| a.iter().all(|v| v.is_finite());
+        fin(&self.min)
+            && fin(&self.max)
+            && fin(&self.gamma)
+            && fin(&self.base_offset)
+            && fin(&self.alternate_offset)
+            && self.gamma.iter().all(|g| *g > 0.0)
+            && self.min.iter().zip(&self.max).all(|(a, b)| b >= a)
+            && self.base_headroom.is_finite()
+            && self.alternate_headroom.is_finite()
+            && self.alternate_headroom > self.base_headroom
+    }
+
+    /// The ISO 21496-1 APP2 payload of the gain map image, URN included.
+    pub fn to_iso(&self) -> Vec<u8> {
+        let mut p = ISO_URN.to_vec();
+        p.extend_from_slice(&0u16.to_be_bytes()); // minimum_version: readers gate on this
+        p.extend_from_slice(&0u16.to_be_bytes()); // writer_version
+        let mut flags = 0u8;
+        if self.multichannel {
+            flags |= FLAG_MULTICHANNEL;
+        }
+        if self.use_base_colour_space {
+            flags |= FLAG_BASE_COLOUR_SPACE;
+        }
+        p.push(flags);
+        let unsigned = |p: &mut Vec<u8>, v: f32| {
+            let n = (v as f64 * DENOMINATOR as f64).round().clamp(0.0, u32::MAX as f64) as u32;
+            p.extend_from_slice(&n.to_be_bytes());
+            p.extend_from_slice(&DENOMINATOR.to_be_bytes());
+        };
+        let signed = |p: &mut Vec<u8>, v: f32| {
+            let n = (v as f64 * DENOMINATOR as f64).round().clamp(i32::MIN as f64, i32::MAX as f64) as i32;
+            p.extend_from_slice(&n.to_be_bytes());
+            p.extend_from_slice(&DENOMINATOR.to_be_bytes());
+        };
+        unsigned(&mut p, self.base_headroom.max(0.0));
+        unsigned(&mut p, self.alternate_headroom.max(0.0));
+        for c in 0..self.channels() {
+            signed(&mut p, self.min[c]);
+            signed(&mut p, self.max[c]);
+            unsigned(&mut p, self.gamma[c]);
+            signed(&mut p, self.base_offset[c]);
+            signed(&mut p, self.alternate_offset[c]);
+        }
+        p
+    }
+
+    /// Parse an ISO 21496-1 payload (the bytes after [`ISO_URN`]). `None` for the versions-only
+    /// marker a primary image carries, unknown versions, a base that is the HDR rendition, or
+    /// values no decoder could use.
+    pub fn from_iso(p: &[u8]) -> Option<GainMapMeta> {
+        let mut r = Reader { b: p, at: 0 };
+        let min_version = r.u16()?;
+        let _writer_version = r.u16()?;
+        if min_version != 0 {
+            return None;
+        }
+        let flags = r.u8()?;
+        if flags & FLAG_BACKWARD != 0 {
+            return None;
+        }
+        let multichannel = flags & FLAG_MULTICHANNEL != 0;
+        let common = flags & FLAG_COMMON_DENOMINATOR != 0;
+        let common_d = if common { r.u32()? } else { 0 };
+        let unsigned = |r: &mut Reader| -> Option<f32> {
+            let n = r.u32()?;
+            let d = if common { common_d } else { r.u32()? };
+            (d != 0).then(|| (n as f64 / d as f64) as f32)
+        };
+        let signed = |r: &mut Reader| -> Option<f32> {
+            let n = r.u32()? as i32;
+            let d = if common { common_d } else { r.u32()? };
+            (d != 0).then(|| (n as f64 / d as f64) as f32)
+        };
+        let mut m = GainMapMeta {
+            multichannel,
+            use_base_colour_space: flags & FLAG_BASE_COLOUR_SPACE != 0,
+            base_headroom: unsigned(&mut r)?,
+            alternate_headroom: unsigned(&mut r)?,
+            ..GainMapMeta::default()
+        };
+        for c in 0..m.channels() {
+            m.min[c] = signed(&mut r)?;
+            m.max[c] = signed(&mut r)?;
+            m.gamma[c] = unsigned(&mut r)?;
+            m.base_offset[c] = signed(&mut r)?;
+            m.alternate_offset[c] = signed(&mut r)?;
+        }
+        if !multichannel {
+            m.fill_from_first();
+        }
+        m.is_valid().then_some(m)
+    }
+
+    fn fill_from_first(&mut self) {
+        for a in [&mut self.min, &mut self.max, &mut self.gamma, &mut self.base_offset, &mut self.alternate_offset] {
+            a[1] = a[0];
+            a[2] = a[0];
+        }
+    }
+
+    /// The gain parameters from Adobe `hdrgm` XMP (the gain map image's packet), for files
+    /// without ISO 21496-1 metadata (the first Ultra HDR files). Attributes or `rdf:Seq` lists.
+    pub fn from_hdrgm_xmp(xmp: &str) -> Option<GainMapMeta> {
+        if !xmp.contains("hdrgm:") {
+            return None;
+        }
+        let base_rendition_hdr = xmp_values(xmp, "BaseRenditionIsHDR").is_some_and(|v| v.first().is_some_and(|s| s.eq_ignore_ascii_case("true")));
+        if base_rendition_hdr {
+            return None;
+        }
+        let get = |name: &str, default: f32| -> Option<([f32; 3], bool)> {
+            let Some(v) = xmp_values(xmp, name) else { return Some(([default; 3], false)) };
+            let f: Vec<f32> = v.iter().map(|s| s.trim().parse::<f32>().ok()).collect::<Option<_>>()?;
+            match f.as_slice() {
+                [a] => Some(([*a; 3], false)),
+                [a, b, c] => Some(([*a, *b, *c], true)),
+                _ => None,
+            }
+        };
+        let (max, m1) = get("GainMapMax", f32::NAN)?;
+        if max.iter().any(|v| v.is_nan()) {
+            return None; // the one required parameter
+        }
+        let (min, m2) = get("GainMapMin", 0.0)?;
+        let (gamma, m3) = get("Gamma", 1.0)?;
+        let (base_offset, m4) = get("OffsetSDR", 1.0 / 64.0)?;
+        let (alternate_offset, m5) = get("OffsetHDR", 1.0 / 64.0)?;
+        let (cap_min, _) = get("HDRCapacityMin", 0.0)?;
+        let max_gain = max.iter().copied().fold(f32::MIN, f32::max);
+        let (cap_max, _) = get("HDRCapacityMax", max_gain)?;
+        let m = GainMapMeta {
+            multichannel: m1 || m2 || m3 || m4 || m5,
+            use_base_colour_space: true,
+            base_headroom: cap_min[0].max(0.0),
+            alternate_headroom: cap_max[0],
+            min,
+            max,
+            gamma,
+            base_offset,
+            alternate_offset,
+        };
+        m.is_valid().then_some(m)
+    }
+
+    /// The gain map image's XMP: the Adobe `hdrgm` parameters (read by Android and Chrome, which
+    /// ignore the ISO payload) and Apple's description of the same map (what iMessage keeps).
+    pub fn to_gain_map_xmp(&self) -> String {
+        let names = ["GainMapMin", "GainMapMax", "Gamma", "OffsetSDR", "OffsetHDR"];
+        let values = [&self.min, &self.max, &self.gamma, &self.base_offset, &self.alternate_offset];
+        let uniform = |v: &[f32; 3]| !self.multichannel || (v[0] == v[1] && v[1] == v[2]);
+        let mut s = String::from(XMP_OPEN);
+        s.push_str(r#"<rdf:Description rdf:about="" xmlns:hdrgm="http://ns.adobe.com/hdr-gain-map/1.0/" hdrgm:Version="1.0""#);
+        s.push_str(&format!(r#" hdrgm:HDRCapacityMin="{}""#, num(self.base_headroom)));
+        s.push_str(&format!(r#" hdrgm:HDRCapacityMax="{}""#, num(self.alternate_headroom)));
+        s.push_str(r#" hdrgm:BaseRenditionIsHDR="False""#);
+        for (n, v) in names.iter().zip(values) {
+            if uniform(v) {
+                s.push_str(&format!(r#" hdrgm:{n}="{}""#, num(v[0])));
+            }
+        }
+        s.push('>');
+        // per-channel values are an rdf:Seq of three, not a comma list: readers parse each item
+        for (n, v) in names.iter().zip(values) {
+            if !uniform(v) {
+                s.push_str(&format!("<hdrgm:{n}><rdf:Seq>"));
+                for x in v {
+                    s.push_str(&format!("<rdf:li>{}</rdf:li>", num(*x)));
+                }
+                s.push_str(&format!("</rdf:Seq></hdrgm:{n}>"));
+            }
+        }
+        s.push_str("</rdf:Description>");
+        s.push_str(&self.apple_description());
+        s.push_str(XMP_CLOSE);
+        s
+    }
+
+    /// Apple's own description of the map (`apdi`, `HDRGainMap`, `HDRToneMap` namespaces).
+    fn apple_description(&self) -> String {
+        // 'L008' (8-bit luminance) or '444f'; the stored map must really have that many channels
+        let format = if self.multichannel { 0x3434_3466u32 } else { 0x4C30_3038 };
+        let mut s = String::from(
+            r#"<rdf:Description rdf:about="" xmlns:apdi="http://ns.apple.com/pixeldatainfo/1.0/" xmlns:HDRGainMap="http://ns.apple.com/HDRGainMap/1.0/" xmlns:HDRToneMap="http://ns.apple.com/HDRToneMap/1.0/">"#,
+        );
+        s.push_str("<apdi:AuxiliaryImageType>urn:com:apple:photo:2020:aux:hdrgainmap</apdi:AuxiliaryImageType>");
+        s.push_str(&format!("<apdi:NativeFormat>{format}</apdi:NativeFormat><apdi:StoredFormat>{format}</apdi:StoredFormat>"));
+        s.push_str("<HDRGainMap:HDRGainMapVersion>131072</HDRGainMap:HDRGainMapVersion>");
+        // linear, not log2: the headroom multiplier itself
+        s.push_str(&format!("<HDRGainMap:HDRGainMapHeadroom>{}</HDRGainMap:HDRGainMapHeadroom>", num(self.alternate_headroom.exp2())));
+        s.push_str(&format!("<HDRToneMap:AlternateHeadroom>{}</HDRToneMap:AlternateHeadroom>", num(self.alternate_headroom)));
+        s.push_str("<HDRToneMap:ChannelMetadata><rdf:Seq>");
+        for c in 0..self.channels() {
+            s.push_str(&format!(
+                r#"<rdf:li rdf:parseType="Resource"><HDRToneMap:GainMapMin>{}</HDRToneMap:GainMapMin><HDRToneMap:GainMapMax>{}</HDRToneMap:GainMapMax><HDRToneMap:Gamma>{}</HDRToneMap:Gamma><HDRToneMap:BaseOffset>{}</HDRToneMap:BaseOffset><HDRToneMap:AlternateOffset>{}</HDRToneMap:AlternateOffset></rdf:li>"#,
+                num(self.min[c]),
+                num(self.max[c]),
+                num(self.gamma[c]),
+                num(self.base_offset[c]),
+                num(self.alternate_offset[c])
+            ));
+        }
+        s.push_str("</rdf:Seq></HDRToneMap:ChannelMetadata>");
+        s.push_str(&format!("<HDRToneMap:BaseHeadroom>{}</HDRToneMap:BaseHeadroom>", num(self.base_headroom)));
+        s.push_str("<HDRToneMap:BaseColorIsWorkingColor>True</HDRToneMap:BaseColorIsWorkingColor><HDRToneMap:Version>1</HDRToneMap:Version>");
+        s.push_str("</rdf:Description>");
+        s
+    }
+}
+
+const FLAG_MULTICHANNEL: u8 = 0x80;
+const FLAG_BASE_COLOUR_SPACE: u8 = 0x40;
+const FLAG_COMMON_DENOMINATOR: u8 = 0x08;
+const FLAG_BACKWARD: u8 = 0x04;
+
+const XMP_OPEN: &str = "<?xpacket begin=\"\u{feff}\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?><x:xmpmeta xmlns:x=\"adobe:ns:meta/\"><rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\">";
+const XMP_CLOSE: &str = "</rdf:RDF></x:xmpmeta><?xpacket end=\"w\"?>";
+
+/// A short decimal (up to 6 significant digits, no exponent for ordinary values).
+fn num(v: f32) -> String {
+    if !v.is_finite() {
+        return "0".into();
+    }
+    let s = format!("{:.6}", v);
+    let s = s.trim_end_matches('0').trim_end_matches('.');
+    if s == "-0" || s.is_empty() { "0".into() } else { s.to_string() }
+}
+
+/// The values of `hdrgm:<name>`: an attribute (`name="v"`) or an element holding an `rdf:Seq`.
+fn xmp_values(xmp: &str, name: &str) -> Option<Vec<String>> {
+    let attr = format!("hdrgm:{name}=");
+    if let Some(i) = xmp.find(&attr) {
+        let rest = xmp.get(i + attr.len()..)?;
+        let q = rest.chars().next()?;
+        if q == '"' || q == '\'' {
+            let body = rest.get(1..)?;
+            let end = body.find(q)?;
+            return Some(vec![body.get(..end)?.to_string()]);
+        }
+    }
+    let open = format!("<hdrgm:{name}>");
+    let close = format!("</hdrgm:{name}>");
+    let i = xmp.find(&open)?;
+    let body = xmp.get(i + open.len()..)?;
+    let body = body.get(..body.find(&close)?)?;
+    let mut out = Vec::new();
+    let mut rest = body;
+    while let Some(a) = rest.find("<rdf:li>") {
+        let after = rest.get(a + 8..)?;
+        let b = after.find("</rdf:li>")?;
+        out.push(after.get(..b)?.to_string());
+        rest = after.get(b..)?;
+        if out.len() > 3 {
+            return None;
+        }
+    }
+    if out.is_empty() {
+        // a plain element value
+        out.push(body.trim().to_string());
+    }
+    Some(out)
+}
+
+struct Reader<'a> {
+    b: &'a [u8],
+    at: usize,
+}
+
+impl Reader<'_> {
+    fn take<const N: usize>(&mut self) -> Option<[u8; N]> {
+        let s = self.b.get(self.at..self.at.checked_add(N)?)?;
+        self.at += N;
+        s.try_into().ok()
+    }
+    fn u8(&mut self) -> Option<u8> {
+        self.take::<1>().map(|a| a[0])
+    }
+    fn u16(&mut self) -> Option<u16> {
+        self.take().map(u16::from_be_bytes)
+    }
+    fn u32(&mut self) -> Option<u32> {
+        self.take().map(u32::from_be_bytes)
+    }
+}
+
+/// A gain map image: `channels` (1 or 3) interleaved 8-bit codes.
+#[derive(Clone, Debug, PartialEq)]
+pub struct GainImage {
+    pub width: usize,
+    pub height: usize,
+    pub channels: usize,
+    pub data: Vec<u8>,
+}
+
+impl GainImage {
+    /// Bilinear code of channel `c` at gain map coordinates (`x`, `y`) (pixel centres at +0.5).
+    fn sample(&self, x: f32, y: f32, c: usize) -> f32 {
+        let (w, h) = (self.width, self.height);
+        let fx = (x - 0.5).clamp(0.0, (w - 1) as f32);
+        let fy = (y - 0.5).clamp(0.0, (h - 1) as f32);
+        let (x0, y0) = (fx as usize, fy as usize);
+        let (x1, y1) = ((x0 + 1).min(w - 1), (y0 + 1).min(h - 1));
+        let (tx, ty) = (fx - x0 as f32, fy - y0 as f32);
+        let at = |x: usize, y: usize| self.data.get((y * w + x) * self.channels + c).copied().unwrap_or(0) as f32;
+        let a = at(x0, y0) + (at(x1, y0) - at(x0, y0)) * tx;
+        let b = at(x0, y1) + (at(x1, y1) - at(x0, y1)) * tx;
+        a + (b - a) * ty
+    }
+}
+
+/// How [`compute`] builds the map.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct GainMapOptions {
+    /// Downscale factor of the map (1, 2 or 4).
+    pub scale: usize,
+    /// Three gains (R, G, B) instead of one luminance gain. Apple's readers want a single
+    /// channel, so this is off by default.
+    pub multichannel: bool,
+    pub gamma: f32,
+    /// Offsets added to SDR and HDR before the ratio (keep blacks finite and noise quiet).
+    pub offset: f32,
+}
+
+impl Default for GainMapOptions {
+    fn default() -> Self {
+        GainMapOptions { scale: 2, multichannel: false, gamma: 1.0, offset: 1.0 / 64.0 }
+    }
+}
+
+/// Measure the gain map that turns `sdr` into `hdr` (both `width × height` linear RGB in the same
+/// primaries; `luma` = that space's luminance weights).
+pub fn compute(
+    sdr: &[[f32; 3]],
+    hdr: &[[f32; 3]],
+    width: usize,
+    height: usize,
+    luma: [f32; 3],
+    o: &GainMapOptions,
+) -> Result<(GainImage, GainMapMeta)> {
+    let n = width.checked_mul(height).ok_or_else(|| Error::Encode("gain map: image too large".into()))?;
+    if n == 0 || sdr.len() < n || hdr.len() < n {
+        return Err(Error::Encode("gain map: SDR and HDR renditions must match the image size".into()));
+    }
+    if !matches!(o.scale, 1 | 2 | 4) || !(o.gamma > 0.0 && o.gamma.is_finite()) || !(o.offset > 0.0 && o.offset.is_finite()) {
+        return Err(Error::Encode("gain map: scale must be 1, 2 or 4, gamma and offset positive".into()));
+    }
+    let s = o.scale;
+    let (gw, gh) = (width.div_ceil(s), height.div_ceil(s));
+    let ch = if o.multichannel { 3 } else { 1 };
+    let y = |p: &[f32; 3]| luma[0] * p[0] + luma[1] * p[1] + luma[2] * p[2];
+    let ratio = |a: f32, b: f32| ((b.max(0.0) + o.offset) / (a.max(0.0) + o.offset)).log2();
+    // block means of the log gains
+    let mut gains = vec![0f32; gw * gh * ch];
+    let mut lo = [f32::MAX; 3];
+    let mut hi = [f32::MIN; 3];
+    for gy in 0..gh {
+        for gx in 0..gw {
+            let mut acc = [0f32; 3];
+            let mut count = 0f32;
+            for yy in gy * s..((gy + 1) * s).min(height) {
+                for xx in gx * s..((gx + 1) * s).min(width) {
+                    let i = yy * width + xx;
+                    let (Some(a), Some(b)) = (sdr.get(i), hdr.get(i)) else { continue };
+                    if o.multichannel {
+                        for c in 0..3 {
+                            acc[c] += ratio(a[c], b[c]);
+                        }
+                    } else {
+                        acc[0] += ratio(y(a), y(b));
+                    }
+                    count += 1.0;
+                }
+            }
+            for c in 0..ch {
+                let g = if count > 0.0 { acc[c] / count } else { 0.0 };
+                let g = if g.is_finite() { g } else { 0.0 };
+                gains[(gy * gw + gx) * ch + c] = g;
+                lo[c] = lo[c].min(g);
+                hi[c] = hi[c].max(g);
+            }
+        }
+    }
+    let mut m = GainMapMeta {
+        multichannel: o.multichannel,
+        gamma: [o.gamma; 3],
+        base_offset: [o.offset; 3],
+        alternate_offset: [o.offset; 3],
+        ..GainMapMeta::default()
+    };
+    for c in 0..ch {
+        // the range always includes 0 (no change) so an SDR-only area encodes exactly
+        m.min[c] = lo[c].min(0.0);
+        m.max[c] = hi[c].max(m.min[c] + 1e-4);
+    }
+    if !o.multichannel {
+        m.fill_from_first();
+    }
+    m.base_headroom = 0.0;
+    m.alternate_headroom = m.max.iter().copied().fold(0.0f32, f32::max).max(1e-3);
+    let data = gains
+        .iter()
+        .enumerate()
+        .map(|(i, g)| {
+            let c = i % ch;
+            let norm = ((g - m.min[c]) / (m.max[c] - m.min[c])).clamp(0.0, 1.0);
+            (norm.powf(o.gamma) * 255.0).round() as u8
+        })
+        .collect();
+    Ok((GainImage { width: gw, height: gh, channels: ch, data }, m))
+}
+
+/// Rebuild the HDR rendition in place: `base` (`width × height` linear RGB) is replaced by the
+/// rendition at `weight` (0 = the base, 1 = the full alternate rendition; a display with headroom
+/// `H` uses `(H − base_headroom) / (alternate_headroom − base_headroom)`, clamped).
+pub fn apply(base: &mut [[f32; 3]], width: usize, height: usize, gain: &GainImage, m: &GainMapMeta, weight: f32) -> Result<()> {
+    let n = width.checked_mul(height).ok_or_else(|| Error::Encode("gain map: image too large".into()))?;
+    if base.len() < n
+        || gain.width == 0
+        || gain.height == 0
+        || !matches!(gain.channels, 1 | 3)
+        || gain.data.len() < gain.width * gain.height * gain.channels
+    {
+        return Err(Error::Encode("gain map: base and gain map sizes don't match".into()));
+    }
+    if !m.is_valid() {
+        return Err(Error::Encode("gain map: unusable metadata".into()));
+    }
+    let weight = if weight.is_finite() { weight.clamp(0.0, 1.0) } else { 1.0 };
+    let (sx, sy) = (gain.width as f32 / width as f32, gain.height as f32 / height as f32);
+    let inv_gamma = m.gamma.map(|g| 1.0 / g);
+    for (i, p) in base.iter_mut().enumerate().take(n) {
+        let (x, y) = ((i % width) as f32 + 0.5, (i / width) as f32 + 0.5);
+        let (gx, gy) = (x * sx, y * sy);
+        let mut g = [0f32; 3];
+        for (c, gc) in g.iter_mut().enumerate() {
+            let src = if gain.channels == 3 { c } else { 0 };
+            let norm = (gain.sample(gx, gy, src) / 255.0).clamp(0.0, 1.0).powf(inv_gamma[c]);
+            *gc = m.min[c] + (m.max[c] - m.min[c]) * norm;
+        }
+        for c in 0..3 {
+            let v = (p[c] + m.base_offset[c]) * (g[c] * weight).exp2() - m.alternate_offset[c];
+            p[c] = v.max(0.0);
+        }
+    }
+    Ok(())
+}
+
+/// The primary image's container XMP: `hdrgm:Version` (marks the file as a gain map image for
+/// Adobe/Google readers) and the Container directory naming the gain map and its length.
+fn primary_description(gain_len: usize) -> String {
+    format!(
+        concat!(
+            r#"<rdf:Description rdf:about="" xmlns:Container="http://ns.google.com/photos/1.0/container/" xmlns:Item="http://ns.google.com/photos/1.0/container/item/" xmlns:hdrgm="http://ns.adobe.com/hdr-gain-map/1.0/" hdrgm:Version="1.0">"#,
+            r#"<Container:Directory><rdf:Seq>"#,
+            r#"<rdf:li rdf:parseType="Resource"><Container:Item Item:Semantic="Primary" Item:Mime="image/jpeg"/></rdf:li>"#,
+            r#"<rdf:li rdf:parseType="Resource"><Container:Item Item:Semantic="GainMap" Item:Mime="image/jpeg" Item:Length="{}"/></rdf:li>"#,
+            r#"</rdf:Seq></Container:Directory></rdf:Description>"#
+        ),
+        gain_len
+    )
+}
+
+/// `xmp` with `description` added as another `rdf:Description` (a fresh packet when there is
+/// none, or when it has no `rdf:RDF` to add to).
+fn merge_xmp(xmp: Option<&str>, description: &str) -> String {
+    if let Some(x) = xmp
+        && let Some(i) = x.rfind("</rdf:RDF>")
+        && let (Some(a), Some(b)) = (x.get(..i), x.get(i..))
+    {
+        return format!("{a}{description}{b}");
+    }
+    format!("{XMP_OPEN}{description}{XMP_CLOSE}")
+}
+
+/// Offsets within the MPF payload (from "MPF\0"): the endian field, then the index IFD (3 tags).
+const MPF_ENTRIES_FROM_ENDIAN: usize = 8 + 2 + 3 * 12 + 4;
+
+/// The primary image's MPF payload, entry sizes and offset to be patched once the file exists.
+fn mpf_placeholder() -> Vec<u8> {
+    let mut p = b"MPF\0MM".to_vec();
+    p.extend_from_slice(&42u16.to_be_bytes());
+    p.extend_from_slice(&8u32.to_be_bytes()); // first IFD
+    p.extend_from_slice(&3u16.to_be_bytes());
+    let tag = |p: &mut Vec<u8>, tag: u16, ty: u16, count: u32, value: [u8; 4]| {
+        p.extend_from_slice(&tag.to_be_bytes());
+        p.extend_from_slice(&ty.to_be_bytes());
+        p.extend_from_slice(&count.to_be_bytes());
+        p.extend_from_slice(&value);
+    };
+    tag(&mut p, 0xB000, 7, 4, *b"0100"); // MPFVersion
+    tag(&mut p, 0xB001, 4, 1, 2u32.to_be_bytes()); // NumberOfImages
+    tag(&mut p, 0xB002, 7, 32, (MPF_ENTRIES_FROM_ENDIAN as u32).to_be_bytes()); // MPEntry
+    p.extend_from_slice(&0u32.to_be_bytes()); // no next IFD
+    // entry 0: baseline primary (0x030000) flagged as the representative image (bit 29)
+    for attr in [0x2003_0000u32, jpeg::MPF_GAIN_MAP] {
+        p.extend_from_slice(&attr.to_be_bytes());
+        p.extend_from_slice(&[0; 12]); // size, offset, two dependent-image entries
+    }
+    p
+}
+
+/// Encode a gain map JPEG: `base` (8-bit SDR, 3 or 4 channels, colour-managed by `meta.icc`) and
+/// its gain map, both at `quality`. `meta.xmp` is kept, with the gain map container added.
+pub fn encode_jpeg(base: &EncodeImage, gain: &GainImage, m: &GainMapMeta, quality: u8, sub: ChromaSubsampling, meta: &EncodeMeta) -> Result<Vec<u8>> {
+    let Samples::U8(data) = base.samples else {
+        return Err(Error::Encode("gain map JPEG needs an 8-bit base image".into()));
+    };
+    let (w, h) = (base.width as usize, base.height as usize);
+    if !matches!(base.channels, 3 | 4) || data.len() < w * h * base.channels as usize {
+        return Err(Error::Encode("gain map JPEG needs an RGB base image".into()));
+    }
+    if w == 0 || h == 0 || w > u16::MAX as usize || h > u16::MAX as usize {
+        return Err(Error::Encode("JPEG dimensions are limited to 65535".into()));
+    }
+    if !matches!(gain.channels, 1 | 3) || gain.width == 0 || gain.height == 0 || gain.data.len() < gain.width * gain.height * gain.channels {
+        return Err(Error::Encode("gain map image is malformed".into()));
+    }
+    if !m.is_valid() || m.multichannel != (gain.channels == 3) {
+        return Err(Error::Encode("gain map metadata doesn't match the map".into()));
+    }
+    // jpeg_par writes 4:4:4 or 4:2:0
+    let sub = if sub == ChromaSubsampling::S422 { ChromaSubsampling::S420 } else { sub };
+
+    let gain_segs = vec![(0xE1, xmp_segment(&m.to_gain_map_xmp())?), (0xE2, m.to_iso())];
+    let gain_jpeg = jpeg_par::encode(&gain.data, gain.width, gain.height, gain.channels, quality, ChromaSubsampling::S444, &gain_segs);
+
+    let xmp = merge_xmp(meta.xmp, &primary_description(gain_jpeg.len()));
+    let mut segs = jpeg_app_segments(&EncodeMeta { xmp: Some(&xmp), ..*meta })?;
+    let mut iso_marker = ISO_URN.to_vec();
+    iso_marker.extend_from_slice(&[0, 0, 0, 0]); // versions only: "this image has a gain map"
+    segs.push((0xE2, iso_marker));
+    segs.push((0xE2, mpf_placeholder()));
+    let mut primary = jpeg_par::encode(data, w, h, base.channels as usize, quality, sub, &segs);
+
+    // patch the MPF index: sizes, and the gain map's offset from the MPF endian field
+    let markers = jpeg::parse_markers(&primary).ok_or_else(|| Error::Encode("gain map JPEG: primary image unreadable".into()))?;
+    let endian = markers.mpf.as_ref().map(|m| m.0).ok_or_else(|| Error::Encode("gain map JPEG: MPF segment missing".into()))?;
+    let entries = endian + MPF_ENTRIES_FROM_ENDIAN;
+    let (plen, glen) = (primary.len(), gain_jpeg.len());
+    let fields = [(entries + 4, plen), (entries + 8, 0), (entries + 20, glen), (entries + 24, plen - endian)];
+    for (at, v) in fields {
+        let v = u32::try_from(v).map_err(|_| Error::Encode("gain map JPEG larger than 4 GiB".into()))?;
+        let slot = primary.get_mut(at..at + 4).ok_or_else(|| Error::Encode("gain map JPEG: truncated MPF segment".into()))?;
+        slot.copy_from_slice(&v.to_be_bytes());
+    }
+    primary.extend_from_slice(&gain_jpeg);
+    Ok(primary)
+}
+
+/// The gain map of a gain map JPEG.
+#[derive(Clone, Debug, PartialEq)]
+pub struct JpegGainMap {
+    pub gain: GainImage,
+    pub meta: GainMapMeta,
+}
+
+/// Find and decode the gain map of a JPEG (`None` when it has none or it's unusable). The
+/// primary image is decoded as usual ([`crate::decode`]); combine the two with [`apply`].
+pub fn read_jpeg(bytes: &[u8]) -> Option<JpegGainMap> {
+    let m = jpeg::parse_markers(bytes)?;
+    let marked = m.iso_gainmap.is_some() || m.xmp.as_deref().is_some_and(|x| x.contains("hdrgm:Version"));
+    if !marked {
+        return None;
+    }
+    for e in jpeg::mpf_images(&m) {
+        let Some(data) = bytes.get(e.offset..e.offset.saturating_add(e.len)) else { continue };
+        let Some(gm) = jpeg::parse_markers(data) else { continue };
+        let meta = gm.iso_gainmap.as_deref().and_then(GainMapMeta::from_iso).or_else(|| gm.xmp.as_deref().and_then(GainMapMeta::from_hdrgm_xmp));
+        let Some(meta) = meta else { continue };
+        let Ok((w, h, ch, codes)) = jpeg::decode_codes8(data) else { continue };
+        if ch == 3 && !meta.multichannel {
+            // a single-channel map stored as RGB: use its first channel
+            let g: Vec<u8> = codes.as_chunks::<3>().0.iter().map(|c| c[0]).collect();
+            return Some(JpegGainMap { gain: GainImage { width: w, height: h, channels: 1, data: g }, meta });
+        }
+        let mut meta = meta;
+        if ch == 1 && meta.multichannel {
+            meta.multichannel = false;
+            meta.fill_from_first();
+        }
+        return Some(JpegGainMap { gain: GainImage { width: w, height: h, channels: ch, data: codes }, meta });
+    }
+    None
+}
+
+/// Whether `bytes` is a gain map JPEG with a usable gain map (cheap: no pixel decode).
+pub fn is_gain_map_jpeg(bytes: &[u8]) -> bool {
+    crate::sniff(bytes) == Some(Format::Jpeg)
+        && jpeg::parse_markers(bytes).is_some_and(|m| {
+            (m.iso_gainmap.is_some() || m.xmp.as_deref().is_some_and(|x| x.contains("hdrgm:Version")))
+                && jpeg::mpf_images(&m)
+                    .iter()
+                    .any(|e| bytes.get(e.offset..e.offset.saturating_add(e.len)).and_then(jpeg::parse_markers).is_some_and(|g| g.is_gain_map()))
+        })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn meta3() -> GainMapMeta {
+        GainMapMeta {
+            multichannel: true,
+            use_base_colour_space: true,
+            base_headroom: 0.0,
+            alternate_headroom: 2.5,
+            min: [-0.25, -0.5, 0.0],
+            max: [2.5, 2.25, 2.0],
+            gamma: [1.0, 1.25, 0.75],
+            base_offset: [0.015625; 3],
+            alternate_offset: [0.015625, 0.03125, 0.015625],
+        }
+    }
+
+    #[test]
+    fn iso_metadata_round_trips() {
+        for m in [GainMapMeta { alternate_headroom: 3.0, max: [3.0; 3], ..GainMapMeta::default() }, meta3()] {
+            let p = m.to_iso();
+            assert!(p.starts_with(ISO_URN));
+            let back = GainMapMeta::from_iso(&p[ISO_URN.len()..]).unwrap();
+            for (a, b) in [(back.min, m.min), (back.max, m.max), (back.gamma, m.gamma), (back.alternate_offset, m.alternate_offset)] {
+                for c in 0..3 {
+                    assert!((a[c] - b[c]).abs() < 1e-6, "{a:?} {b:?}");
+                }
+            }
+            assert_eq!(back.multichannel, m.multichannel);
+            assert!((back.alternate_headroom - m.alternate_headroom).abs() < 1e-6);
+        }
+    }
+
+    #[test]
+    fn iso_common_denominator_and_rejections() {
+        // common-denominator form, single channel: d = 4, headrooms 0 and 2, min 0, max 2, gamma 1, offsets 0
+        let mut p = vec![0, 0, 0, 0, FLAG_COMMON_DENOMINATOR];
+        for v in [4u32, 0, 8, 0, 8, 4, 0, 0] {
+            p.extend_from_slice(&v.to_be_bytes());
+        }
+        let m = GainMapMeta::from_iso(&p).unwrap();
+        assert_eq!((m.alternate_headroom, m.max[2], m.gamma[1]), (2.0, 2.0, 1.0));
+        // versions only (a primary image's marker), unknown version, truncated, backward
+        assert!(GainMapMeta::from_iso(&[0, 0, 0, 0]).is_none());
+        assert!(GainMapMeta::from_iso(&[0, 1, 0, 0, 0]).is_none());
+        assert!(GainMapMeta::from_iso(&p[..p.len() - 1]).is_none());
+        let mut back = p.clone();
+        back[4] |= FLAG_BACKWARD;
+        assert!(GainMapMeta::from_iso(&back).is_none());
+        // a zero denominator is rejected, not divided by
+        let mut z = p.clone();
+        z[5..9].copy_from_slice(&0u32.to_be_bytes());
+        assert!(GainMapMeta::from_iso(&z).is_none());
+    }
+
+    #[test]
+    fn hdrgm_xmp_round_trips_including_per_channel_sequences() {
+        for m in [GainMapMeta { alternate_headroom: 2.0, max: [2.0; 3], ..GainMapMeta::default() }, meta3()] {
+            let x = m.to_gain_map_xmp();
+            assert!(x.contains("apdi:AuxiliaryImageType"));
+            if m.multichannel {
+                assert!(x.contains("<hdrgm:GainMapMax><rdf:Seq><rdf:li>2.5</rdf:li>"), "{x}");
+            }
+            let back = GainMapMeta::from_hdrgm_xmp(&x).unwrap();
+            assert_eq!(back.multichannel, m.multichannel);
+            for c in 0..3 {
+                assert!((back.max[c] - m.max[c]).abs() < 1e-5 && (back.gamma[c] - m.gamma[c]).abs() < 1e-5);
+            }
+            assert!((back.alternate_headroom - m.alternate_headroom).abs() < 1e-5);
+        }
+        assert!(GainMapMeta::from_hdrgm_xmp("<x hdrgm:Version=\"1.0\"/>").is_none(), "no GainMapMax");
+        assert!(GainMapMeta::from_hdrgm_xmp("hdrgm:GainMapMax=\"nope\"").is_none());
+    }
+
+    fn renditions(w: usize, h: usize) -> (Vec<[f32; 3]>, Vec<[f32; 3]>) {
+        // a ramp: SDR rolls off at 1, HDR keeps going to 6
+        let hdr: Vec<[f32; 3]> = (0..w * h)
+            .map(|i| {
+                let t = (i % w) as f32 / (w - 1) as f32;
+                let v = 0.01 + 6.0 * t * t;
+                [v, v * 0.8, v * 0.6]
+            })
+            .collect();
+        // a luminance tone map (one scale per pixel, as LightCraft's renders do), so a single
+        // luminance gain can rebuild it exactly
+        let sdr = hdr
+            .iter()
+            .map(|p| {
+                let y = 0.2126 * p[0] + 0.7152 * p[1] + 0.0722 * p[2];
+                let k = 1.0 / (1.0 + y * 0.5);
+                p.map(|v| v * k)
+            })
+            .collect();
+        (sdr, hdr)
+    }
+
+    #[test]
+    fn compute_then_apply_recovers_the_hdr_rendition() {
+        let (w, h) = (64, 8);
+        let (sdr, hdr) = renditions(w, h);
+        for multichannel in [false, true] {
+            let o = GainMapOptions { scale: 1, multichannel, ..GainMapOptions::default() };
+            let (g, m) = compute(&sdr, &hdr, w, h, [0.2126, 0.7152, 0.0722], &o).unwrap();
+            assert!(m.is_valid() && m.alternate_headroom > 1.0);
+            let mut out = sdr.clone();
+            apply(&mut out, w, h, &g, &m, 1.0).unwrap();
+            for (a, b) in out.iter().zip(&hdr) {
+                for c in 0..3 {
+                    // 8-bit codes over the gain range: within ~2 % in linear light
+                    assert!((a[c] - b[c]).abs() <= 0.03 * b[c] + 0.01, "{multichannel}: {a:?} vs {b:?}");
+                }
+            }
+            // weight 0 is the base
+            let mut base = sdr.clone();
+            apply(&mut base, w, h, &g, &m, 0.0).unwrap();
+            for (a, b) in base.iter().zip(&sdr) {
+                assert!((a[0] - b[0]).abs() < 1e-5);
+            }
+        }
+    }
+
+    #[test]
+    fn jpeg_round_trip_and_container_structure() {
+        let (w, h) = (96, 64);
+        let (sdr, hdr) = renditions(w, h);
+        let (g, m) = compute(&sdr, &hdr, w, h, [0.2126, 0.7152, 0.0722], &GainMapOptions::default()).unwrap();
+        let base: Vec<u8> =
+            sdr.iter().flat_map(|p| p.map(|v| (lightcraft_color::transfer::linear_to_srgb(v.clamp(0.0, 1.0)) * 255.0).round() as u8)).collect();
+        let user_xmp = r#"<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="" xmlns:dc="http://purl.org/dc/elements/1.1/"/></rdf:RDF></x:xmpmeta>"#;
+        let meta = EncodeMeta { xmp: Some(user_xmp), ..EncodeMeta::default() };
+        let file = encode_jpeg(&EncodeImage::new(w as u32, h as u32, 3, Samples::U8(&base)), &g, &m, 90, ChromaSubsampling::S444, &meta).unwrap();
+        assert!(is_gain_map_jpeg(&file));
+        // the primary decodes as an ordinary JPEG of the right size, and keeps the user's XMP
+        let d = crate::decode(&file, crate::DecodeOptions::default()).unwrap();
+        assert_eq!((d.width, d.height), (w as u32, h as u32));
+        let x = d.xmp.unwrap();
+        assert!(x.contains("xmlns:dc=") && x.contains("hdrgm:Version") && x.contains("Item:Semantic=\"GainMap\""));
+        // the MPF index points at the gain map, typed as one
+        let pm = jpeg::parse_markers(&file).unwrap();
+        let e = jpeg::mpf_images(&pm);
+        assert_eq!(e.len(), 1);
+        assert_eq!(e[0].kind, jpeg::MPF_GAIN_MAP);
+        assert_eq!(e[0].offset + e[0].len, file.len());
+        // and the gain map reads back
+        let r = read_jpeg(&file).unwrap();
+        assert_eq!((r.gain.width, r.gain.height, r.gain.channels), (48, 32, 1));
+        assert!((r.meta.max[0] - m.max[0]).abs() < 1e-5);
+        // the gain map is never a thumbnail
+        if let Some(t) = jpeg::embedded_thumbnail(&file, 32, 16) {
+            assert_ne!(t.source, crate::ThumbnailSource::MpfPreview);
+        }
+    }
+
+    #[test]
+    fn garbage_never_panics() {
+        assert!(read_jpeg(b"").is_none());
+        assert!(read_jpeg(&[0xFF, 0xD8, 0xFF, 0xE2, 0x00, 0x04, 0, 0]).is_none());
+        assert!(!is_gain_map_jpeg(&[0xFF, 0xD8]));
+        let mut b = vec![0xFF, 0xD8, 0xFF, 0xE2, 0, 40];
+        b.extend_from_slice(ISO_URN);
+        b.extend_from_slice(&[0, 0, 0, 0, 0xFF, 1, 2, 3, 4]);
+        assert!(read_jpeg(&b).is_none());
+        let g = GainImage { width: 2, height: 2, channels: 1, data: vec![0; 3] };
+        assert!(apply(&mut [[0.0; 3]; 4], 2, 2, &g, &GainMapMeta::default(), 1.0).is_err());
+        assert!(compute(&[], &[], 0, 0, [0.3, 0.6, 0.1], &GainMapOptions::default()).is_err());
+    }
+}
diff --git a/crates/codecs/src/heif.rs b/crates/codecs/src/heif.rs
index fe91c0af..702a0d27 100644
--- a/crates/codecs/src/heif.rs
+++ b/crates/codecs/src/heif.rs
@@ -1,16 +1,18 @@
 //! HEIF / HEIC (the iPhone and Mac photo format), read-only.
 //!
 //! Decoding lives in the optional `lightcraft-heif` crate (heic-rs, a pure-Rust HEVC
-//! still-picture decoder), enabled by this crate's `heif` feature — off by default because HEVC
-//! is patent-encumbered and whether a build carries an HEVC decoder is the distributor's call
-//! (the same policy as the sibling PhotoCraft). Without the feature, HEIF files are still
-//! detected and opening one is an [`Error::Unsupported`] error, never a panic.
+//! still-picture decoder, plus a libheif-matching colour conversion), enabled by this crate's
+//! `heif` feature — off by default because HEVC is patent-encumbered and whether a build carries
+//! an HEVC decoder is the distributor's call (the same policy as the sibling PhotoCraft). Without
+//! the feature, HEIF files are still detected and opening one is an [`Error::Unsupported`] error
+//! saying so, never a panic.
 //!
 //! HEIF records orientation in the container (`irot`/`imir`, plus a `clap` crop), not in EXIF,
 //! so the decoder applies them and `orientation` is reported as 1: the EXIF Orientation tag only
 //! mirrors what the container says, and applying it as well would turn the photo twice.
-//! The samples come back in the container's own primaries with its ICC profile (if any); like
-//! every decoder here, the colour interpretation happens in [`crate::convert::finish`].
+//! The samples come back as 16-bit RGB in the container's own primaries, with its ICC profile
+//! (iPhones: Display P3) or, without one, its `nclx` / VUI colour description; like every decoder
+//! here, the colour interpretation happens in [`crate::convert::finish`].
 
 #[cfg(feature = "heif")]
 use crate::convert::{Buf, Meta, Model, Raw, finish};
@@ -22,26 +24,32 @@ const F: Format = Format::Heif;
 #[cfg(not(feature = "heif"))]
 pub(crate) const NOT_IN_BUILD: &str = "HEIC/HEIF support isn't included in this build of LightCraft";
 
-/// The reason a HEIF file that no build can open is refused (this crate decodes HEVC stills
-/// only; the wrapper names the exact construct in its own errors).
-#[cfg(feature = "heif")]
-const NOT_DECODED: &str = "the image is not a decodable HEVC still (image sequence, overlay, alpha-less grid or AVIF-coded item)";
-
 #[cfg(not(feature = "heif"))]
 pub(crate) fn decode(_bytes: &[u8], _opts: &DecodeOptions) -> Result<Decoded> {
     Err(Error::Unsupported(F, NOT_IN_BUILD))
 }
 
+#[cfg(not(feature = "heif"))]
+pub(crate) fn header(_bytes: &[u8]) -> Result<(u32, u32, u16)> {
+    Err(Error::Unsupported(F, NOT_IN_BUILD))
+}
+
 #[cfg(feature = "heif")]
 fn err(e: lightcraft_heif::Error) -> Error {
     match e {
-        // This crate's Unsupported takes a fixed reason; the dynamic wording lives in the
-        // lightcraft-heif error itself.
-        lightcraft_heif::Error::Unsupported(_) => Error::Unsupported(F, NOT_DECODED),
+        lightcraft_heif::Error::Unsupported(why) => Error::Unsupported(F, why),
         lightcraft_heif::Error::Limit(m) | lightcraft_heif::Error::Malformed(m) => Error::Malformed(F, m),
     }
 }
 
+/// The displayed size (container transforms applied, so orientation 1), from the container
+/// alone: no picture is decoded.
+#[cfg(feature = "heif")]
+pub(crate) fn header(bytes: &[u8]) -> Result<(u32, u32, u16)> {
+    let info = lightcraft_heif::probe(bytes).map_err(err)?;
+    Ok((info.width, info.height, 1))
+}
+
 #[cfg(feature = "heif")]
 pub(crate) fn decode(bytes: &[u8], opts: &DecodeOptions) -> Result<Decoded> {
     // The container alone: the declared size is checked before any pixel is decoded.
@@ -50,16 +58,22 @@ pub(crate) fn decode(bytes: &[u8], opts: &DecodeOptions) -> Result<Decoded> {
         return Err(Error::TooLarge(info.width as u64, info.height as u64));
     }
     let options = lightcraft_heif::Options { max_pixels: opts.max_pixels, apply_transforms: true };
-    let decoded = lightcraft_heif::decode(bytes, &options).map_err(err)?;
-    // The decoder re-reads the container; trust its output's shape, not the probe's.
-    let buf = if decoded.sixteen_bit {
-        let mut v = Vec::with_capacity(decoded.data.len() / 2);
-        for pair in decoded.data.as_chunks::<2>().0 {
-            v.push(u16::from_ne_bytes(*pair));
+    // A small decode (a thumbnail or a cataloguing probe) uses the file's own thumbnail image when
+    // it is at least as large as asked: iPhones store one of 320 × 240, and decoding it is a
+    // hundredth of the work of the 12 MP photo.
+    let thumb = match opts.max_size {
+        Some((mw, mh)) if mw > 0 && mh > 0 && mw.max(mh) < info.width.max(info.height) => {
+            lightcraft_heif::decode_thumbnail(bytes, mw.max(mh), &options).ok().flatten().filter(|t| {
+                // Only a thumbnail of the same picture: same orientation and aspect within 1 %.
+                let aspect = |w: u32, h: u32| w as f64 / h.max(1) as f64;
+                (aspect(t.width, t.height) / aspect(info.width, info.height) - 1.0).abs() < 0.01
+            })
         }
-        Buf::U16(v)
-    } else {
-        Buf::U8(decoded.data)
+        _ => None,
+    };
+    let mut decoded = match thumb {
+        Some(t) => t,
+        None => lightcraft_heif::decode(bytes, &options).map_err(err)?,
     };
     let raw = Raw {
         width: decoded.width as usize,
@@ -67,11 +81,20 @@ pub(crate) fn decode(bytes: &[u8], opts: &DecodeOptions) -> Result<Decoded> {
         model: Model::Rgb,
         alpha: decoded.has_alpha,
         premultiplied: false,
-        buf,
-        bit_depth: if decoded.sixteen_bit { 16 } else { 8 },
+        buf: Buf::U16(std::mem::take(&mut decoded.data)),
+        bit_depth: decoded.bit_depth,
     };
-    let meta = Meta { icc: decoded.icc, exif: decoded.exif, xmp: decoded.xmp, orientation: Some(1), ..Default::default() };
-    finish(F, raw, meta, (decoded.width, decoded.height), opts)
+    let c = decoded.colour;
+    let meta = Meta {
+        icc: decoded.icc,
+        exif: decoded.exif,
+        xmp: decoded.xmp,
+        orientation: Some(1),
+        // Used when there is no (usable) ICC profile.
+        hint: crate::space::SourceSpace::from_cicp(c.primaries, c.transfer),
+        ..Default::default()
+    };
+    finish(F, raw, meta, (info.width, info.height), opts)
 }
 
 #[cfg(test)]
@@ -96,6 +119,8 @@ mod tests {
     fn without_the_feature_heif_is_a_clear_unsupported_error() {
         let r = crate::decode(HEIC_HEADER, crate::DecodeOptions::default());
         assert!(matches!(&r, Err(crate::Error::Unsupported(Format::Heif, why)) if why.contains("isn't included in this build")), "{r:?}");
+        let h = crate::read_header(HEIC_HEADER);
+        assert!(matches!(&h, Err(crate::Error::Unsupported(Format::Heif, why)) if why.contains("isn't included in this build")), "{h:?}");
     }
 
     /// Found by PhotoCraft's `decode_heif` fuzz target: a malformed box makes heic-rs 0.1.1 slice
@@ -113,6 +138,7 @@ mod tests {
     fn a_heic_rs_panic_is_a_malformed_error() {
         let r = crate::decode(&HEIC_RS_BOX_PANIC, crate::DecodeOptions::default());
         assert!(matches!(&r, Err(crate::Error::Malformed(Format::Heif, _))), "{r:?}");
+        assert!(crate::read_header(&HEIC_RS_BOX_PANIC).is_err());
     }
 
     #[cfg(feature = "heif")]
@@ -120,6 +146,6 @@ mod tests {
     fn an_image_sequence_is_unsupported() {
         // An ftyp with no meta box: a video track, not a still.
         let r = crate::decode(b"\0\0\0\x18ftypmsf1\0\0\0\0msf1hevc", crate::DecodeOptions::default());
-        assert!(matches!(&r, Err(crate::Error::Unsupported(Format::Heif, _))), "{r:?}");
+        assert!(matches!(&r, Err(crate::Error::Unsupported(Format::Heif, why)) if why.contains("sequence")), "{r:?}");
     }
 }
diff --git a/crates/codecs/src/icc.rs b/crates/codecs/src/icc.rs
index ec9e8efe..c3de9edd 100644
--- a/crates/codecs/src/icc.rs
+++ b/crates/codecs/src/icc.rs
@@ -205,7 +205,7 @@ pub fn write_named(n: NamedSpace) -> Vec<u8> {
     write_matrix_trc(&n.rgb_space(), &n.trc())
 }
 
-fn linear_rec2020_profile() -> ColorProfile {
+pub(crate) fn linear_rec2020_profile() -> ColorProfile {
     let mut p = ColorProfile::new_bt2020();
     p.cicp = None;
     let lin = ToneReprCurve::Parametric(vec![1.0]);
diff --git a/crates/codecs/src/jpeg.rs b/crates/codecs/src/jpeg.rs
index 92409af3..e40cf7e7 100644
--- a/crates/codecs/src/jpeg.rs
+++ b/crates/codecs/src/jpeg.rs
@@ -25,6 +25,17 @@ pub(crate) struct Markers {
     pub adobe_transform: Option<u8>,
     /// Offset of the MPF TIFF header within the file and its bytes.
     pub mpf: Option<(usize, Vec<u8>)>,
+    /// The ISO 21496-1 APP2 payload after its URN: 4 bytes (versions only) on a primary image
+    /// that has a gain map, the full metadata on the gain map image itself.
+    pub iso_gainmap: Option<Vec<u8>>,
+}
+
+impl Markers {
+    /// This image is a gain map (ISO 21496-1 metadata or Adobe `hdrgm` gain parameters), not a
+    /// picture: never a preview, never the image to show.
+    pub fn is_gain_map(&self) -> bool {
+        self.iso_gainmap.as_ref().is_some_and(|p| p.len() > 4) || self.xmp.as_deref().is_some_and(|x| x.contains("hdrgm:GainMapMax"))
+    }
 }
 
 pub(crate) fn parse_markers(b: &[u8]) -> Option<Markers> {
@@ -88,6 +99,10 @@ pub(crate) fn parse_markers(b: &[u8]) -> Option<Markers> {
                     icc_chunks.push((seg[12], &seg[14..]));
                 } else if seg.starts_with(b"MPF\0") && m.mpf.is_none() {
                     m.mpf = Some((start + 4, seg[4..].to_vec()));
+                } else if let Some(p) = seg.strip_prefix(crate::gainmap::ISO_URN)
+                    && m.iso_gainmap.is_none()
+                {
+                    m.iso_gainmap = Some(p.to_vec());
                 }
             }
             0xEE if seg.starts_with(b"Adobe") && seg.len() >= 12 => {
@@ -260,8 +275,11 @@ pub(crate) fn embedded_thumbnail(bytes: &[u8], max_edge: u32, min_edge: u32) ->
     if let (Some(ex), Some((o, l))) = (m.exif.as_deref(), summary.thumbnail) {
         candidates.push((&ex[o..o + l], ThumbnailSource::ExifThumbnail));
     }
-    for (o, l) in mpf_images(&m) {
-        if let Some(s) = bytes.get(o..o.saturating_add(l)) {
+    for e in mpf_images(&m) {
+        if e.kind == MPF_GAIN_MAP {
+            continue;
+        }
+        if let Some(s) = bytes.get(e.offset..e.offset.saturating_add(e.len)) {
             candidates.push((s, ThumbnailSource::MpfPreview));
         }
     }
@@ -269,6 +287,10 @@ pub(crate) fn embedded_thumbnail(bytes: &[u8], max_edge: u32, min_edge: u32) ->
     let mut best: Option<(u32, &[u8], ThumbnailSource)> = None;
     for (data, src) in candidates {
         let Some(pm) = parse_markers(data) else { continue };
+        // a gain map (also when its MPF entry doesn't say so) is greyscale gain data, not a preview
+        if pm.is_gain_map() {
+            continue;
+        }
         let long = pm.width.max(pm.height);
         // Previews must have the main image's aspect ratio (within 2%), else they are letterboxed/cropped.
         let aspect_ok = m.width > 0
@@ -290,8 +312,21 @@ pub(crate) fn embedded_thumbnail(bytes: &[u8], max_edge: u32, min_edge: u32) ->
     Some(Thumbnail { image: d.to_srgb8(), orientation, source, source_width: m.width, source_height: m.height })
 }
 
-/// (file offset, length) of MPF-listed images other than the primary.
-fn mpf_images(m: &Markers) -> Vec<(usize, usize)> {
+/// MP type code of a gain map image (CIPA DC-007 entry attribute, low 24 bits).
+pub(crate) const MPF_GAIN_MAP: u32 = 0x05_0000;
+
+/// An MPF-listed image other than the primary.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct MpfEntry {
+    /// File offset and length of the image.
+    pub offset: usize,
+    pub len: usize,
+    /// MP type code (attribute low 24 bits).
+    pub kind: u32,
+}
+
+/// The MPF-listed images other than the primary.
+pub(crate) fn mpf_images(m: &Markers) -> Vec<MpfEntry> {
     let Some((base, data)) = &m.mpf else { return vec![] };
     let Some(t) = exif::Tiff::new(data) else { return vec![] };
     let Some(ifd) = t.first_ifd() else { return vec![] };
@@ -307,14 +342,34 @@ fn mpf_images(m: &Markers) -> Vec<(usize, usize)> {
             let a = [rec[o], rec[o + 1], rec[o + 2], rec[o + 3]];
             if data.starts_with(b"II") { u32::from_le_bytes(a) } else { u32::from_be_bytes(a) }
         };
-        let (size, off) = (rd(4) as usize, rd(8) as usize);
+        let (attr, size, off) = (rd(0), rd(4) as usize, rd(8) as usize);
         if size > 0 && off > 0 {
-            out.push((base + off, size));
+            out.push(MpfEntry { offset: base.saturating_add(off), len: size, kind: attr & 0x00FF_FFFF });
         }
     }
     out
 }
 
+/// Decode to the file's 8-bit samples as stored (no colour management): 1 channel for greyscale
+/// files, else 3 (RGB). For data images such as gain maps, whose values are codes, not colours.
+pub(crate) fn decode_codes8(bytes: &[u8]) -> Result<(usize, usize, usize, Vec<u8>)> {
+    let m = parse_markers(bytes).ok_or_else(|| Error::Malformed(F, "missing SOI".into()))?;
+    if m.components == 0 {
+        return Err(Error::Malformed(F, "no frame header".into()));
+    }
+    check_size(F, m.width as u64, m.height as u64, &DecodeOptions::default())?;
+    if !matches!(m.components, 1 | 3) || m.precision != 8 {
+        return Err(Error::Malformed(F, "expected an 8-bit greyscale or RGB image".into()));
+    }
+    let non_interleaved = matches!(m.sof, 0xC0 | 0xC1) && m.first_scan_components < m.components;
+    let raw = if non_interleaved { decode_jpeg_decoder(bytes, &m, None)? } else { decode_zune(bytes, &m)? };
+    let ch = raw.model.channels();
+    match raw.buf {
+        Buf::U8(v) if v.len() >= raw.width * raw.height * ch => Ok((raw.width, raw.height, ch, v)),
+        _ => Err(Error::Malformed(F, "unexpected sample format".into())),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/codecs/src/lib.rs b/crates/codecs/src/lib.rs
index 169f40c1..65798718 100644
--- a/crates/codecs/src/lib.rs
+++ b/crates/codecs/src/lib.rs
@@ -17,8 +17,10 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 mod convert;
+pub mod display;
 pub mod encode;
 pub mod exif;
+pub mod gainmap;
 mod heif;
 pub mod icc;
 mod jpeg;
@@ -34,7 +36,8 @@ mod tiff_codec;
 mod webp;
 
 pub use encode::{
-    ChromaSubsampling, EncodeImage, EncodeMeta, Samples, TiffCompression, encode_avif, encode_jpeg, encode_png, encode_tiff, encode_webp_lossless,
+    ChromaSubsampling, EncodeImage, EncodeMeta, HDR_REFERENCE_WHITE_NITS, Samples, TiffCompression, encode_avif, encode_avif_pq, encode_jpeg,
+    encode_png, encode_tiff, encode_webp_lossless,
 };
 pub use sniff::{Format, sniff};
 pub use space::{NamedSpace, SourceSpace, SpaceOrigin, Trc};
@@ -171,9 +174,9 @@ pub struct Header {
 }
 
 /// Read the stored dimensions and orientation of any format [`decode`] supports, agreeing with
-/// what a decode reports, without decoding pixels: JPEG, PNG, TIFF, WebP and PSD are read from
-/// their headers (markers, chunks, IFD, resources). GIF, BMP and JPEG XL fall back to a small
-/// decode.
+/// what a decode reports, without decoding pixels: JPEG, PNG, TIFF, WebP, PSD and HEIF are read
+/// from their headers (markers, chunks, IFD, resources, boxes). GIF, BMP and JPEG XL fall back to
+/// a small decode.
 ///
 /// The header readers also refuse what a decode would refuse before reaching the pixels (an
 /// unsupported layout, compression or frame type) and files whose image data is cut short
@@ -196,6 +199,7 @@ pub fn read_header_unguarded(bytes: &[u8], format: Format) -> Result<Header> {
         Format::Tiff => tiff_codec::header(bytes)?,
         Format::WebP => webp::header(bytes)?,
         Format::Psd => psd::header(bytes)?,
+        Format::Heif => heif::header(bytes)?,
         // rare here (or, for JPEG XL, without a header reader yet): a small decode, as before
         _ => {
             let d = decode_unguarded(bytes, format, &DecodeOptions::fit(64, 64))?;
@@ -217,6 +221,8 @@ pub fn decode_jpeg_with_fallback(bytes: &[u8], opts: DecodeOptions, fallback: Na
 #[doc(hidden)]
 pub fn decode_unguarded(bytes: &[u8], format: Format, opts: &DecodeOptions) -> Result<Decoded> {
     let opts = *opts;
+    // The reason a format can't be decoded lives in one place, `Format::not_decodable`.
+    let unsupported = || Err(Error::Unsupported(format, format.not_decodable().unwrap_or("not decodable in this build")));
     match format {
         Format::Jpeg => jpeg::decode(bytes, &opts),
         Format::Png => png_codec::decode(bytes, &opts),
@@ -227,10 +233,9 @@ pub fn decode_unguarded(bytes: &[u8], format: Format, opts: &DecodeOptions) -> R
         #[cfg(feature = "jxl")]
         Format::Jxl => jxl::decode(bytes, &opts),
         #[cfg(not(feature = "jxl"))]
-        Format::Jxl => Err(Error::Unsupported(format, "built without the `jxl` feature")),
+        Format::Jxl => unsupported(),
         Format::Heif => heif::decode(bytes, &opts),
-        Format::Avif => Err(Error::Unsupported(format, "no pure-Rust, permissively licensed AV1 decoder yet")),
-        Format::RawTiffLike | Format::RawOther => Err(Error::Unsupported(format, "camera raw: decode with lightcraft-raw")),
+        Format::Avif | Format::RawTiffLike | Format::RawOther => unsupported(),
     }
 }
 
diff --git a/crates/codecs/src/png_codec.rs b/crates/codecs/src/png_codec.rs
index 600f60b0..098f1cfa 100644
--- a/crates/codecs/src/png_codec.rs
+++ b/crates/codecs/src/png_codec.rs
@@ -127,25 +127,10 @@ pub(crate) fn header(b: &[u8]) -> Result<(u32, u32, u16)> {
 }
 
 fn container_hint(info: &png::Info) -> Option<SourceSpace> {
-    if let Some(c) = &info.coding_independent_code_points {
-        let named = match c.color_primaries {
-            1 => Some(NamedSpace::Srgb),
-            9 => Some(NamedSpace::Rec2020),
-            12 => Some(NamedSpace::DisplayP3),
-            _ => None,
-        };
-        let trc = match c.transfer_function {
-            13 => Some(Trc::Srgb),
-            1 | 6 | 14 | 15 => Some(Trc::Rec709),
-            8 => Some(Trc::Linear),
-            4 => Some(Trc::Gamma(2.2)),
-            _ => None,
-        };
-        if let (Some(n), Some(t)) = (named, trc) {
-            let mut s = SourceSpace::named(n, SpaceOrigin::Container);
-            s.trc = Some([t.clone(), t.clone(), t]);
-            return Some(s);
-        }
+    if let Some(s) =
+        info.coding_independent_code_points.as_ref().and_then(|c| SourceSpace::from_cicp(c.color_primaries.into(), c.transfer_function.into()))
+    {
+        return Some(s);
     }
     if info.srgb.is_some() {
         return Some(SourceSpace::named(NamedSpace::Srgb, SpaceOrigin::Container));
diff --git a/crates/codecs/src/sniff.rs b/crates/codecs/src/sniff.rs
index 50fa3ccf..5bc5c402 100644
--- a/crates/codecs/src/sniff.rs
+++ b/crates/codecs/src/sniff.rs
@@ -64,11 +64,20 @@ impl Format {
 
     /// Whether [`crate::decode`] can decode this format in this build.
     pub fn can_decode(self) -> bool {
+        self.not_decodable().is_none()
+    }
+
+    /// Why [`crate::decode`] can't decode this format in this build (`None`: it can). The
+    /// [`crate::Error::Unsupported`] a decode returns carries the same reason.
+    pub fn not_decodable(self) -> Option<&'static str> {
         match self {
-            Format::Jxl => cfg!(feature = "jxl"),
-            Format::Heif => cfg!(feature = "heif"),
-            Format::Avif | Format::RawTiffLike | Format::RawOther => false,
-            _ => true,
+            #[cfg(not(feature = "jxl"))]
+            Format::Jxl => Some("built without the `jxl` feature"),
+            #[cfg(not(feature = "heif"))]
+            Format::Heif => Some(crate::heif::NOT_IN_BUILD),
+            Format::Avif => Some("no pure-Rust, permissively licensed AV1 decoder yet"),
+            Format::RawTiffLike | Format::RawOther => Some("camera raw: decode with lightcraft-raw"),
+            _ => None,
         }
     }
 
diff --git a/crates/codecs/src/space.rs b/crates/codecs/src/space.rs
index a945fe72..d8ee0d19 100644
--- a/crates/codecs/src/space.rs
+++ b/crates/codecs/src/space.rs
@@ -255,6 +255,27 @@ impl SourceSpace {
         SourceSpace { named: Some(n), to_xyz_d50: n.to_xyz_d50(), trc: Some([t.clone(), t.clone(), t]), origin }
     }
 
+    /// The space named by ITU-T H.273 code points (PNG `cICP`, HEIF `nclx`, HEVC VUI), when
+    /// both the primaries and the transfer are ones this crate models.
+    pub(crate) fn from_cicp(primaries: u16, transfer: u16) -> Option<SourceSpace> {
+        let named = match primaries {
+            1 => NamedSpace::Srgb,
+            9 => NamedSpace::Rec2020,
+            12 => NamedSpace::DisplayP3,
+            _ => return None,
+        };
+        let trc = match transfer {
+            13 => Trc::Srgb,
+            1 | 6 | 14 | 15 => Trc::Rec709,
+            8 => Trc::Linear,
+            4 => Trc::Gamma(2.2),
+            _ => return None,
+        };
+        let mut s = SourceSpace::named(named, SpaceOrigin::Container);
+        s.trc = Some([trc.clone(), trc.clone(), trc]);
+        Some(s)
+    }
+
     /// Linear source RGB → linear `dst` RGB (Bradford from D50 to `dst`'s white).
     pub fn to_space(&self, dst: &RgbSpace) -> Mat3 {
         if let Some(n) = self.named {
diff --git a/crates/codecs/tests/fuzz.rs b/crates/codecs/tests/fuzz.rs
index 15b236b0..bfee84df 100644
--- a/crates/codecs/tests/fuzz.rs
+++ b/crates/codecs/tests/fuzz.rs
@@ -36,6 +36,17 @@ fn try_all(bytes: &[u8]) {
     let _ = read_header(bytes);
     let _ = decode_thumbnail_with(bytes, &ThumbnailOptions { max_pixels: small_opts().max_pixels, ..ThumbnailOptions::new(16) });
     let _ = lightcraft_codecs::icc::parse(bytes);
+    let _ = lightcraft_codecs::gainmap::read_jpeg(bytes);
+    let _ = lightcraft_codecs::gainmap::is_gain_map_jpeg(bytes);
+}
+
+fn gain_map_jpeg(meta: &EncodeMeta) -> Vec<u8> {
+    use lightcraft_codecs::gainmap::{GainMapOptions, compute, encode_jpeg};
+    let hdr: Vec<[f32; 3]> = (0..24 * 16).map(|i| [i as f32 * 0.02; 3]).collect();
+    let sdr: Vec<[f32; 3]> = hdr.iter().map(|p| p.map(|v| v / (1.0 + v))).collect();
+    let (g, m) = compute(&sdr, &hdr, 24, 16, [0.2126, 0.7152, 0.0722], &GainMapOptions::default()).unwrap();
+    let base: Vec<u8> = sdr.iter().flat_map(|p| p.map(|v| (v * 255.0) as u8)).collect();
+    encode_jpeg(&EncodeImage::new(24, 16, 3, Samples::U8(&base)), &g, &m, 80, ChromaSubsampling::S420, meta).unwrap()
 }
 
 #[test]
@@ -91,6 +102,7 @@ fn seeds() -> &'static Vec<Vec<u8>> {
             encode_tiff(&e, TiffCompression::Lzw, &meta).unwrap(),
             encode_tiff(&EncodeImage::new(24, 16, 3, Samples::F32(&f32s)), TiffCompression::Deflate, &meta).unwrap(),
             encode_webp_lossless(&e, &meta).unwrap(),
+            gain_map_jpeg(&meta),
         ]
     })
 }
@@ -106,7 +118,7 @@ proptest! {
     }
 
     #[test]
-    fn mutated_valid_files(which in 0usize..6, flips in proptest::collection::vec((any::<prop::sample::Index>(), any::<u8>()), 1..12), cut in any::<prop::sample::Index>()) {
+    fn mutated_valid_files(which in 0usize..7, flips in proptest::collection::vec((any::<prop::sample::Index>(), any::<u8>()), 1..12), cut in any::<prop::sample::Index>()) {
         let mut b = seeds()[which].clone();
         for (i, v) in flips {
             let i = i.index(b.len());
diff --git a/crates/codecs/tests/heif.rs b/crates/codecs/tests/heif.rs
new file mode 100644
index 00000000..d14f51ac
--- /dev/null
+++ b/crates/codecs/tests/heif.rs
@@ -0,0 +1,98 @@
+//! HEIC/HEIF through the codec API (feature `heif`), on lossless synthetic files from
+//! `lightcraft_heif::testdata`: an iPhone-like grid with a Display P3 profile, rotation, EXIF, a
+//! thumbnail and an HDR gain map; `nclx`-only colour; 10-bit; and hostile input.
+#![cfg(feature = "heif")]
+
+use lightcraft_codecs::*;
+use lightcraft_heif::testdata::{Prop, Spec, build};
+
+fn grey(x: u32, y: u32) -> [u16; 3] {
+    [((x * 7 + y * 13) % 220 + 20) as u16, 128, 128]
+}
+
+/// EXIF whose Orientation (6) only mirrors the container's `irot`: it must not turn the photo again.
+fn exif_orientation_6() -> Vec<u8> {
+    let mut t = b"MM\0\x2a\0\0\0\x08\0\x01".to_vec();
+    t.extend_from_slice(&[0x01, 0x12, 0, 3, 0, 0, 0, 1, 0, 6, 0, 0]);
+    t.extend_from_slice(&[0, 0, 0, 0]);
+    t
+}
+
+/// The thumbnail is flat mid grey so a test can tell it from the photo.
+fn iphone_like() -> Vec<u8> {
+    build(&Spec {
+        props: vec![Prop::Icc(icc::write_named(NamedSpace::DisplayP3)), Prop::Irot(3)],
+        exif: Some(exif_orientation_6()),
+        thumbnail: Some(&|_, _| [126, 128, 128]),
+        ignored_aux: vec!["urn:com:apple:photo:2020:aux:hdrgainmap"],
+        ..Spec::new(96, 64, &grey)
+    })
+}
+
+#[test]
+fn an_iphone_like_heic_decodes_upright_in_display_p3() {
+    let bytes = iphone_like();
+    assert_eq!(sniff(&bytes), Some(Format::Heif));
+    let d = decode(&bytes, DecodeOptions::default()).unwrap();
+    // irot 3 = 90° clockwise, applied by the decoder; the EXIF Orientation is not applied again.
+    assert_eq!((d.width, d.height, d.source_width, d.source_height, d.orientation), (64, 96, 64, 96, 1));
+    assert_eq!(d.space.named, Some(NamedSpace::DisplayP3));
+    assert_eq!(d.space.origin, SpaceOrigin::IccMatrixTrc);
+    assert_eq!((d.bit_depth, d.has_alpha, d.float), (8, false, false));
+    assert!(d.exif.is_some() && d.icc.is_some());
+    // No nclx and no VUI: limited range, BT.601; neutral chroma stays neutral.
+    let srgb = d.to_srgb8();
+    let px = srgb.data[0];
+    assert!(px[0].abs_diff(px[1]) <= 1 && px[1].abs_diff(px[2]) <= 1, "{px:?}");
+
+    let h = read_header(&bytes).unwrap();
+    assert_eq!((h.format, h.width, h.height, h.orientation), (Format::Heif, 64, 96, 1));
+}
+
+#[test]
+fn a_small_decode_uses_the_embedded_thumbnail() {
+    let bytes = iphone_like();
+    // The 48 × 32 thumbnail, turned like the photo, covers a 32-pixel request.
+    let d = decode(&bytes, DecodeOptions::fit(32, 32)).unwrap();
+    assert!(d.width.max(d.height) <= 32 && d.height > d.width, "{}x{}", d.width, d.height);
+    assert_eq!((d.source_width, d.source_height), (64, 96));
+    assert_eq!(d.space.named, Some(NamedSpace::DisplayP3));
+    let flat = d.to_srgb8();
+    assert!(flat.data.iter().all(|p| *p == flat.data[0]), "the flat thumbnail, not the photo");
+    // A thumbnail too small for the request: the photo is decoded and resized.
+    let d = decode(&bytes, DecodeOptions::fit(60, 60)).unwrap();
+    assert_eq!((d.width.max(d.height), d.source_width), (60, 64));
+    let photo = d.to_srgb8();
+    assert!(photo.data.iter().any(|p| *p != photo.data[0]));
+    let t = decode_thumbnail(&bytes, 32).unwrap();
+    assert_eq!((t.source_width, t.source_height), (64, 96));
+}
+
+#[test]
+fn nclx_colour_and_ten_bit() {
+    // Display P3 primaries, sRGB transfer, BT.709 matrix, full range: the nclx alone names the space.
+    let bytes = build(&Spec { bit_depth: 10, props: vec![Prop::Nclx(12, 13, 1, true)], ..Spec::new(64, 32, &|x, _| [(x * 16) as u16, 512, 512]) });
+    let d = decode(&bytes, DecodeOptions::default()).unwrap();
+    assert_eq!(d.space.named, Some(NamedSpace::DisplayP3));
+    assert_eq!(d.space.origin, SpaceOrigin::Container);
+    assert_eq!(d.bit_depth, 10);
+    // Full-range 10-bit neutral steps of 16 code values: linear values rise monotonically.
+    let row: Vec<f32> = (0..64).map(|x| d.image.row(0)[x][1]).collect();
+    assert!(row.windows(2).all(|w| w[1] > w[0]), "{row:?}");
+}
+
+#[test]
+fn hostile_heic_is_an_error_never_a_panic() {
+    let bytes = iphone_like();
+    let full = decode(&bytes, DecodeOptions::default()).unwrap();
+    for cut in (12..bytes.len()).step_by(11) {
+        let b = &bytes[..cut];
+        // Cut inside the photo: an error. Cut in a trailing item (gain map, thumbnail): the photo.
+        if let (Ok(_), Ok(d)) = (read_header(b), decode(b, DecodeOptions::default())) {
+            assert_eq!(d.image.data, full.image.data, "cut at {cut}");
+        }
+        let _ = decode_thumbnail(b, 16);
+    }
+    let r = decode(&bytes, DecodeOptions { max_pixels: 64 * 96 - 1, ..Default::default() });
+    assert!(matches!(r, Err(Error::TooLarge(64, 96))), "{r:?}");
+}
diff --git a/crates/develop/src/controls.rs b/crates/develop/src/controls.rs
index c8a001b7..83b26403 100644
--- a/crates/develop/src/controls.rs
+++ b/crates/develop/src/controls.rs
@@ -140,6 +140,13 @@ controls! {
     "light.shadows" => light.shadows, "Shadows", Light, -100, 100, 0, 1, 0, Centered;
     "light.whites" => light.whites, "Whites", Light, -100, 100, 0, 1, 0, Centered;
     "light.blacks" => light.blacks, "Blacks", Light, -100, 100, 0, 1, 0, Centered;
+    "hdr.maxEv" => hdr.max_ev, "HDR Headroom", Light, 0, 5, 3, 0.1, 1, Plain;
+    "hdr.sdrBrightness" => hdr.sdr_brightness, "SDR Brightness", Light, -100, 100, 0, 1, 0, Centered;
+    "hdr.sdrContrast" => hdr.sdr_contrast, "SDR Contrast", Light, -100, 100, 0, 1, 0, Centered;
+    "hdr.sdrHighlights" => hdr.sdr_highlights, "SDR Highlights", Light, -100, 100, 0, 1, 0, Centered;
+    "hdr.sdrShadows" => hdr.sdr_shadows, "SDR Shadows", Light, -100, 100, 0, 1, 0, Centered;
+    "hdr.sdrWhites" => hdr.sdr_whites, "SDR Whites", Light, -100, 100, 0, 1, 0, Centered;
+    "hdr.sdrClarity" => hdr.sdr_clarity, "SDR Clarity", Light, -100, 100, 0, 1, 0, Centered;
     "curve.highlights" => curve.highlights, "Highlights", Curve, -100, 100, 0, 1, 0, Centered;
     "curve.lights" => curve.lights, "Lights", Curve, -100, 100, 0, 1, 0, Centered;
     "curve.darks" => curve.darks, "Darks", Curve, -100, 100, 0, 1, 0, Centered;
diff --git a/crates/develop/src/lib.rs b/crates/develop/src/lib.rs
index b7c95251..c2edd76c 100644
--- a/crates/develop/src/lib.rs
+++ b/crates/develop/src/lib.rs
@@ -56,11 +56,13 @@ impl DevelopSettings {
         h
     }
 
-    /// True if nothing differs from a fresh default (ignoring white balance "as shot" values).
+    /// True if nothing differs from a fresh default (ignoring white balance "as shot" values, and
+    /// the rendering process: that is not an edit).
     pub fn is_unedited(&self) -> bool {
         let mut a = self.clone();
         let d = DevelopSettings::default();
         a.wb = d.wb;
+        a.process = d.process;
         a == d
     }
 
@@ -130,6 +132,9 @@ impl DevelopSettings {
     }
 }
 
+#[cfg(test)]
+mod tests_process;
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -162,6 +167,27 @@ mod tests {
         assert_ne!(back.hash64(), DevelopSettings::default().hash64());
     }
 
+    #[test]
+    fn default_hdr_is_not_serialized_so_existing_hashes_stay() {
+        let s = DevelopSettings::default();
+        assert!(s.to_json().get("hdr").is_none(), "HDR off must not change the settings JSON or hash64");
+        let mut on = s.clone();
+        on.hdr.enabled = true;
+        assert!(on.to_json().get("hdr").is_some());
+        assert_ne!(on.hash64(), s.hash64());
+        assert_eq!(DevelopSettings::from_json(&on.to_json()).unwrap(), on);
+    }
+
+    #[test]
+    fn hdr_peak_is_finite_for_a_non_finite_headroom() {
+        let mut h = Hdr { enabled: true, max_ev: f64::NAN, ..Hdr::default() };
+        assert_eq!(h.peak(), (Hdr::DEFAULT_MAX_EV as f32).exp2());
+        h.max_ev = f64::INFINITY;
+        assert_eq!(h.peak(), (Hdr::DEFAULT_MAX_EV as f32).exp2());
+        h.max_ev = -3.0;
+        assert_eq!(h.peak(), 1.0);
+    }
+
     #[test]
     fn missing_fields_take_defaults_and_unknown_ignored() {
         let s = DevelopSettings::from_json(&json!({"light": {"exposure": 0.5}, "futureThing": 3})).unwrap();
diff --git a/crates/develop/src/presets.rs b/crates/develop/src/presets.rs
index 64bb116c..8bd15060 100644
--- a/crates/develop/src/presets.rs
+++ b/crates/develop/src/presets.rs
@@ -3,6 +3,10 @@
 //! A preset is a *partial* settings object (JSON) — only the groups it includes. Applying merges it
 //! into the photo's settings; `amount` (0..200 %) interpolates numeric values between the current
 //! settings and the preset's. Copy/paste/sync use the same group selection ([`SettingsGroup`]).
+//!
+//! The rendering process ([`crate::ProcessVersion`]) is in no group: copy, paste, sync and presets
+//! made from a photo never carry it, so the photos they change keep their own. A partial that names
+//! `process` itself (Apply Settings JSON) sets it like any other field.
 
 use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
@@ -98,7 +102,7 @@ impl SettingsGroup {
             SettingsGroup::Profile => &["profile"],
             SettingsGroup::Treatment => &["treatment"],
             SettingsGroup::WhiteBalance => &["wb"],
-            SettingsGroup::Light => &["light"],
+            SettingsGroup::Light => &["light", "hdr"],
             SettingsGroup::ToneCurve => &["curve"],
             SettingsGroup::Color => &["color"],
             SettingsGroup::ColorMixer => &["mixer", "bw_mix", "point_colors"],
@@ -162,7 +166,9 @@ fn scale_patch(base: &Value, patch: &Value, t: f64) -> Value {
             }
             Value::Object(out)
         }
-        (Value::Number(b), Value::Number(p)) => {
+        // Integer fields (the grain seed, ids) are discrete like strings: an interpolated seed would
+        // not deserialize as an integer, and the whole preset would silently not apply.
+        (Value::Number(b), Value::Number(p)) if b.is_f64() || p.is_f64() => {
             let (b, p) = (b.as_f64().unwrap_or(0.0), p.as_f64().unwrap_or(0.0));
             serde_json::Number::from_f64(b + (p - b) * t).map(Value::Number).unwrap_or(Value::Null)
         }
@@ -267,6 +273,25 @@ mod tests {
         assert_eq!(lots.light.exposure, 5.0);
     }
 
+    /// A preset with the Grain group (its seed is an integer) used to do nothing at any amount
+    /// other than 100 %: the interpolated seed failed to deserialize and the preset was dropped.
+    #[test]
+    fn amount_keeps_integer_fields_whole() {
+        let mut a = DevelopSettings::default();
+        a.light.exposure = 1.0;
+        a.grain.amount = 40.0;
+        a.grain.seed = 12345;
+        let p = Preset::from_settings("p", "P", "User", &a, &SettingsGroup::default_copy());
+        assert!(p.settings.pointer("/grain/seed").is_some_and(Value::is_u64), "the default copy groups include the grain seed");
+        let base = DevelopSettings::default();
+        for (amount, seed) in [(0.3, 0), (0.5, 12345), (1.5, 12345), (2.0, 12345)] {
+            let out = p.apply(&base, amount);
+            assert!((out.light.exposure - amount.min(5.0)).abs() < 1e-9, "{amount}: exposure {}", out.light.exposure);
+            assert!((out.grain.amount - (40.0 * amount).min(100.0)).abs() < 1e-9, "{amount}: grain {}", out.grain.amount);
+            assert_eq!(out.grain.seed, seed, "{amount}: seed");
+        }
+    }
+
     #[test]
     fn deep_merge_objects() {
         let mut a = json!({"x": {"a": 1, "b": 2}, "y": [1]});
diff --git a/crates/develop/src/settings.rs b/crates/develop/src/settings.rs
index 5f0db8ab..54577bff 100644
--- a/crates/develop/src/settings.rs
+++ b/crates/develop/src/settings.rs
@@ -1,19 +1,118 @@
 //! The develop settings schema. Every field has a neutral default; serde uses `#[serde(default)]` so
-//! older/newer files load (unknown fields are ignored, missing fields take defaults).
+//! older/newer files load (unknown fields are ignored, missing fields take defaults). The one
+//! exception is `process`: missing (or unreadable), it is V1, the rendering those older files were
+//! made with.
 
 use lightcraft_geom::{CropGeometry, Homography, Orientation, Point};
 use serde::{Deserialize, Serialize};
 
 pub const SCHEMA_VERSION: u32 = 1;
 
+/// The rendering process a photo's settings are interpreted by (what Lightroom calls the process
+/// version). A change that would alter how existing settings render ships as a new process, so a
+/// photo keeps its look until someone updates it (`develop.updateProcess`). See
+/// `docs/process-versions.md`.
+///
+/// Stored as a plain number: one written by a newer LightCraft loads, is kept as it is, and
+/// renders with the newest process this build knows ([`ProcessVersion::process`]). Reading is
+/// lenient: a whole number from 0 to 2^32 - 1 (also written as `2.0`) is that process; anything
+/// else (negative, fractional, too large, text, null, a list…) reads as V1, like a missing field,
+/// so a damaged value never costs the rest of the settings.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize)]
+#[serde(transparent)]
+pub struct ProcessVersion(pub u32);
+
+impl<'de> Deserialize<'de> for ProcessVersion {
+    fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum Wire {
+            Whole(u64),
+            Number(f64),
+            Other(serde::de::IgnoredAny),
+        }
+        Ok(match Wire::deserialize(d)? {
+            Wire::Whole(n) => u32::try_from(n).map_or_else(|_| ProcessVersion::legacy(), ProcessVersion),
+            Wire::Number(x) if x.fract() == 0.0 && (0.0..=f64::from(u32::MAX)).contains(&x) => ProcessVersion(x as u32),
+            Wire::Number(_) | Wire::Other(_) => ProcessVersion::legacy(),
+        })
+    }
+}
+
+impl ProcessVersion {
+    /// The first process: LightCraft's rendering from before process versions existed. Frozen.
+    pub const V1: ProcessVersion = Process::V1.version();
+    /// The process new photos and Reset get.
+    pub const LATEST: ProcessVersion = Process::LATEST.version();
+
+    /// The process of settings saved without one (catalogs, snapshots, XMP sidecars and browser
+    /// libraries written before process versions existed): V1, whatever [`Self::LATEST`] becomes.
+    pub fn legacy() -> ProcessVersion {
+        ProcessVersion::V1
+    }
+
+    /// Saved settings leave the field out for V1, so files and preview-cache keys of settings made
+    /// before process versions existed stay byte for byte what they were.
+    pub fn is_legacy(&self) -> bool {
+        *self == ProcessVersion::legacy()
+    }
+
+    /// The process this build renders with: the newest one it knows that isn't newer than this
+    /// number (a number from a newer LightCraft renders with [`Process::LATEST`]; one below V1,
+    /// which no LightCraft writes, with V1).
+    pub fn process(self) -> Process {
+        Process::ALL.into_iter().rev().find(|p| p.version() <= self).unwrap_or(Process::V1)
+    }
+
+    /// A process this build implements.
+    pub fn is_known(self) -> bool {
+        Process::ALL.iter().any(|p| p.version() == self)
+    }
+
+    /// Older than [`Self::LATEST`]: Update to Current Process applies.
+    pub fn is_outdated(self) -> bool {
+        self < ProcessVersion::LATEST
+    }
+}
+
+/// A rendering process this build implements. Matches on it are exhaustive, so adding a process
+/// makes the compiler point at every stage whose behaviour depends on it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum Process {
+    /// The rendering of LightCraft before process versions existed (2026-10).
+    V1,
+}
+
+impl Process {
+    /// Every process, oldest first.
+    pub const ALL: [Process; 1] = [Process::V1];
+    pub const LATEST: Process = Process::V1;
+
+    pub const fn version(self) -> ProcessVersion {
+        match self {
+            Process::V1 => ProcessVersion(1),
+        }
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
 pub struct DevelopSettings {
+    /// Schema version of this structure (not the rendering process, see `process`).
     pub version: u32,
+    /// The rendering process ([`ProcessVersion`]): the latest for new settings, V1 for settings
+    /// saved without the field (the field-level default: not the struct's `Default`) or with a
+    /// value that isn't a process number.
+    #[serde(default = "ProcessVersion::legacy", skip_serializing_if = "ProcessVersion::is_legacy")]
+    pub process: ProcessVersion,
     pub profile: Profile,
     pub treatment: Treatment,
     pub wb: WhiteBalance,
     pub light: Light,
+    /// HDR editing: highlights above SDR white, and the SDR rendition derived from them. Not written while it is
+    /// the default, so settings without HDR keep their JSON and `hash64` (and every cached preview stays valid).
+    #[serde(skip_serializing_if = "Hdr::is_default")]
+    pub hdr: Hdr,
     pub curve: ToneCurve,
     pub color: ColorAdj,
     pub mixer: Mixer,
@@ -44,10 +143,12 @@ impl Default for DevelopSettings {
     fn default() -> Self {
         Self {
             version: SCHEMA_VERSION,
+            process: ProcessVersion::LATEST,
             profile: Profile::default(),
             treatment: Treatment::Color,
             wb: WhiteBalance::default(),
             light: Light::default(),
+            hdr: Hdr::default(),
             curve: ToneCurve::default(),
             color: ColorAdj::default(),
             mixer: Mixer::default(),
@@ -88,11 +189,16 @@ pub struct Profile {
     pub id: String,
     /// Creative profile amount 0..200 (%).
     pub amount: f64,
+    /// Render the raw's own local tone mapping (DNG `ProfileGainTableMap`, Apple ProRAW), as the
+    /// camera does. Off: rendered as Lightroom Classic does, without it. Omitted when off, so
+    /// settings without it keep their JSON (and hash).
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    pub camera_local_tone: bool,
 }
 
 impl Default for Profile {
     fn default() -> Self {
-        Self { id: "lc.color".into(), amount: 100.0 }
+        Self { id: "lc.color".into(), amount: 100.0, camera_local_tone: false }
     }
 }
 
@@ -926,3 +1032,78 @@ impl Enhance {
         self.denoise_on.unwrap_or(self.denoise > 0.0)
     }
 }
+
+/// HDR editing. When enabled, an HDR render ([`Hdr::peak`]) keeps highlights above SDR white (1.0)
+/// up to `2^max_ev`; every SDR render (previews on SDR displays, 8/16-bit exports and a gain map's
+/// base image) uses the SDR rendition ([`DevelopSettings::sdr_rendition`]): the same edit with the
+/// `sdr_*` offsets applied.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct Hdr {
+    pub enabled: bool,
+    /// Headroom limit: stops above SDR white the HDR render may reach.
+    pub max_ev: f64,
+    /// SDR rendition offsets (−100..100): brightness (±1 EV), then added to the matching sliders.
+    pub sdr_brightness: f64,
+    pub sdr_contrast: f64,
+    pub sdr_highlights: f64,
+    pub sdr_shadows: f64,
+    pub sdr_whites: f64,
+    pub sdr_clarity: f64,
+}
+
+impl Default for Hdr {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            max_ev: Hdr::DEFAULT_MAX_EV,
+            sdr_brightness: 0.0,
+            sdr_contrast: 0.0,
+            sdr_highlights: 0.0,
+            sdr_shadows: 0.0,
+            sdr_whites: 0.0,
+            sdr_clarity: 0.0,
+        }
+    }
+}
+
+impl Hdr {
+    pub const DEFAULT_MAX_EV: f64 = 3.0;
+    pub const MAX_EV_LIMIT: f64 = 5.0;
+
+    /// Whether these are the default HDR settings (HDR off, nothing changed).
+    pub fn is_default(&self) -> bool {
+        *self == Hdr::default()
+    }
+
+    /// Peak linear value of an HDR render relative to SDR white (1.0 when HDR is off). A non-finite headroom
+    /// (a damaged file or argument) falls back to the default, so the peak is always finite and at least 1.
+    pub fn peak(&self) -> f32 {
+        if !self.enabled {
+            return 1.0;
+        }
+        let ev = if self.max_ev.is_finite() { self.max_ev } else { Hdr::DEFAULT_MAX_EV };
+        (ev.clamp(0.0, Hdr::MAX_EV_LIMIT) as f32).exp2()
+    }
+}
+
+impl DevelopSettings {
+    /// The settings an SDR render uses: unchanged when HDR is off; otherwise HDR off and the
+    /// SDR rendition offsets applied to exposure, contrast, highlights, shadows, whites, clarity.
+    pub fn sdr_rendition(&self) -> std::borrow::Cow<'_, DevelopSettings> {
+        if !self.hdr.enabled {
+            return std::borrow::Cow::Borrowed(self);
+        }
+        let h = self.hdr;
+        let mut s = self.clone();
+        s.hdr.enabled = false;
+        let add = |v: f64, d: f64| (v + d).clamp(-100.0, 100.0);
+        s.light.exposure = (s.light.exposure + h.sdr_brightness / 100.0).clamp(-5.0, 5.0);
+        s.light.contrast = add(s.light.contrast, h.sdr_contrast);
+        s.light.highlights = add(s.light.highlights, h.sdr_highlights);
+        s.light.shadows = add(s.light.shadows, h.sdr_shadows);
+        s.light.whites = add(s.light.whites, h.sdr_whites);
+        s.effects.clarity = add(s.effects.clarity, h.sdr_clarity);
+        std::borrow::Cow::Owned(s)
+    }
+}
diff --git a/crates/develop/src/tests_process.rs b/crates/develop/src/tests_process.rs
new file mode 100644
index 00000000..f89ebfa1
--- /dev/null
+++ b/crates/develop/src/tests_process.rs
@@ -0,0 +1,162 @@
+//! Process versions: settings saved before they existed stay on V1, new settings get the latest,
+//! and numbers this build doesn't know load without harm.
+
+use serde_json::{Value, json};
+
+use crate::*;
+
+/// Complete settings as LightCraft wrote them before process versions existed (main at 8f924a9:
+/// `serde_json::to_string` of a raw photo with tone, colour, curve, grading, effects and a radial
+/// mask), one top-level key per line. There is no `process` field.
+const LEGACY: &str = r#"
+{
+  "version": 1,
+  "profile": {"id": "lc.color", "amount": 100.0},
+  "treatment": "color",
+  "wb": {"mode": "asShot", "temp": 5200.0, "tint": 4.0},
+  "light": {"exposure": 0.4, "contrast": 30.0, "highlights": -60.0, "shadows": 40.0, "whites": 15.0, "blacks": -20.0},
+  "curve": {"highlights": -10.0, "lights": 0.0, "darks": 10.0, "shadows": 0.0, "split_shadows": 25.0, "split_mid": 50.0, "split_highlights": 75.0, "master": [{"x": 0.0, "y": 0.05}, {"x": 0.5, "y": 0.55}, {"x": 1.0, "y": 0.95}], "red": [], "green": [], "blue": [], "refine_saturation": 100.0},
+  "color": {"vibrance": 20.0, "saturation": -5.0},
+  "mixer": {"red": {"hue": 0.0, "sat": 0.0, "lum": 0.0}, "orange": {"hue": 0.0, "sat": 0.0, "lum": 15.0}, "yellow": {"hue": 0.0, "sat": 0.0, "lum": 0.0}, "green": {"hue": 0.0, "sat": 0.0, "lum": 0.0}, "aqua": {"hue": 0.0, "sat": 0.0, "lum": 0.0}, "blue": {"hue": 0.0, "sat": -30.0, "lum": 0.0}, "purple": {"hue": 0.0, "sat": 0.0, "lum": 0.0}, "magenta": {"hue": 0.0, "sat": 0.0, "lum": 0.0}},
+  "point_colors": [],
+  "bw_mix": {"red": 0.0, "orange": 0.0, "yellow": 0.0, "green": 0.0, "aqua": 0.0, "blue": 0.0, "purple": 0.0, "magenta": 0.0},
+  "grading": {"shadows": {"hue": 220.0, "sat": 20.0, "lum": -5.0}, "midtones": {"hue": 0.0, "sat": 0.0, "lum": 0.0}, "highlights": {"hue": 40.0, "sat": 15.0, "lum": 5.0}, "global": {"hue": 0.0, "sat": 0.0, "lum": 0.0}, "blending": 50.0, "balance": 0.0},
+  "effects": {"texture": 20.0, "clarity": 25.0, "dehaze": 15.0},
+  "vignette": {"amount": -25.0, "midpoint": 50.0, "roundness": 0.0, "feather": 50.0, "highlights": 0.0, "style": "highlightPriority"},
+  "grain": {"amount": 20.0, "size": 25.0, "roughness": 50.0, "seed": 0},
+  "detail": {"sharpen_amount": 40.0, "sharpen_radius": 1.0, "sharpen_detail": 25.0, "sharpen_masking": 0.0, "nr_luminance": 20.0, "nr_detail": 50.0, "nr_contrast": 0.0, "nr_color": 25.0, "nr_color_detail": 50.0, "nr_color_smoothness": 50.0},
+  "optics": {"remove_ca": false, "lens_profile": false, "profile_distortion": 100.0, "profile_vignetting": 100.0, "defringe_purple_amount": 0.0, "defringe_purple_hue_lo": 30.0, "defringe_purple_hue_hi": 70.0, "defringe_green_amount": 0.0, "defringe_green_hue_lo": 40.0, "defringe_green_hue_hi": 60.0, "distortion": 0.0, "vignetting": 0.0, "vignetting_midpoint": 50.0, "ca_red": 0.0, "ca_blue": 0.0},
+  "geometry": {"upright": "off", "guides": [], "upright_transform": null, "vertical": 0.0, "horizontal": 0.0, "rotate": 0.0, "aspect": 0.0, "scale": 100.0, "offset_x": 0.0, "offset_y": 0.0, "constrain_crop": false},
+  "crop": {"geometry": {"rect": {"x0": 0.0, "y0": 0.0, "x1": 1.0, "y1": 1.0}, "angle": 0.0}, "aspect": null, "flip_h": false, "flip_v": false},
+  "orientation": "Normal",
+  "masks": [{"id": 1, "name": "Mask 1", "visible": true, "invert": false, "components": [{"op": "add", "invert": false, "shape": {"kind": "radial", "center": {"x": 0.4, "y": 0.5}, "rx": 0.3, "ry": 0.2, "angle": 15.0, "feather": 60.0, "invert": false}}], "adjust": {"temp": 10.0, "tint": 0.0, "exposure": 0.5, "contrast": 0.0, "highlights": 0.0, "shadows": 0.0, "whites": 0.0, "blacks": 0.0, "texture": 0.0, "clarity": 30.0, "dehaze": 0.0, "hue": 0.0, "saturation": 0.0, "sharpness": 0.0, "noise": 0.0, "moire": 0.0, "defringe": 0.0, "color_hue": 0.0, "color_sat": 0.0, "amount": 100.0}}],
+  "spots": [],
+  "red_eye": [],
+  "lens_blur": {"enabled": false, "amount": 0.0, "focal_distance": 0.0, "focal_range": 0.0},
+  "enhance": {"denoise": 0.0, "raw_details": false, "super_resolution": false},
+  "calibration": {"shadows_tint": 0.0, "red_hue": 0.0, "red_sat": 0.0, "green_hue": 0.0, "green_sat": 0.0, "blue_hue": 0.0, "blue_sat": 0.0},
+  "disabled_sections": []
+}
+"#;
+
+fn legacy() -> Value {
+    serde_json::from_str(LEGACY).unwrap()
+}
+
+#[test]
+fn settings_saved_before_process_versions_load_as_v1() {
+    let v = legacy();
+    assert!(v.get("process").is_none(), "the fixture predates the field");
+    let s = DevelopSettings::from_json(&v).unwrap();
+    // V1 as a number, not `LATEST`: once a newer process is the latest, this is what keeps every
+    // existing catalog, sidecar and preset on the rendering it was made with
+    assert_eq!(s.process, ProcessVersion(1));
+    assert_eq!(s.process, ProcessVersion::legacy());
+    assert_eq!((s.light.exposure, s.light.highlights, s.masks.len(), s.detail.sharpen_amount), (0.4, -60.0, 1, 40.0));
+    // the smallest legacy file too, and settings nested in other records (history, versions)
+    assert_eq!(DevelopSettings::from_json(&json!({})).unwrap().process, ProcessVersion(1));
+    let nested: Vec<DevelopSettings> = serde_json::from_value(json!([{}, {"light": {"exposure": 1.0}}])).unwrap();
+    assert!(nested.iter().all(|s| s.process == ProcessVersion(1)));
+    // saved again, they gain no field: files and preview-cache keys (`hash64`) stay as they were
+    assert!(s.to_json().get("process").is_none());
+}
+
+#[test]
+fn new_settings_get_the_latest_process() {
+    assert_eq!(DevelopSettings::default().process, ProcessVersion::LATEST);
+    assert_eq!(DevelopSettings::for_raw(5200.0, 4.0).process, ProcessVersion::LATEST);
+    assert_eq!(ProcessVersion::LATEST, Process::LATEST.version());
+    assert_eq!(ProcessVersion::V1, ProcessVersion(1));
+    // the processes are listed oldest first, the latest last, each with its own number
+    let versions: Vec<u32> = Process::ALL.iter().map(|p| p.version().0).collect();
+    assert!(versions.windows(2).all(|w| w[0] < w[1]), "{versions:?}");
+    assert_eq!(Process::ALL.last(), Some(&Process::LATEST));
+    assert!(Process::ALL.iter().all(|p| p.version().process() == *p && p.version().is_known()));
+}
+
+#[test]
+fn v1_is_left_out_when_saving_and_other_processes_are_kept() {
+    let mut s = DevelopSettings::from_json(&legacy()).unwrap();
+    assert!(s.to_json().get("process").is_none());
+    let before = s.hash64();
+    s.process = ProcessVersion(2);
+    let v = s.to_json();
+    assert_eq!(v["process"], json!(2));
+    assert_eq!(DevelopSettings::from_json(&v).unwrap().process, ProcessVersion(2));
+    assert_ne!(s.hash64(), before, "another process is another preview");
+}
+
+#[test]
+fn unknown_process_numbers_load_and_render_with_the_newest_known() {
+    // written by a newer LightCraft: kept as it is, rendered with the latest process this build has
+    let s = DevelopSettings::from_json(&json!({"process": 7, "light": {"exposure": 0.5}})).unwrap();
+    assert_eq!(s.process, ProcessVersion(7));
+    assert_eq!(s.process.process(), Process::LATEST);
+    assert!(!s.process.is_known());
+    assert!(!s.process.is_outdated(), "never downgraded by Update to Current Process");
+    assert_eq!(s.to_json()["process"], json!(7));
+    assert_eq!(s.merged(&json!({"light": {"exposure": 1.0}})).unwrap().process, ProcessVersion(7));
+    // below V1 (no LightCraft writes it): rendered as V1, and updatable
+    let zero = DevelopSettings::from_json(&json!({"process": 0})).unwrap().process;
+    assert_eq!((zero.process(), zero.is_known(), zero.is_outdated()), (Process::V1, false, true));
+    let max = DevelopSettings::from_json(&json!({"process": u32::MAX})).unwrap().process;
+    assert_eq!(max.process(), Process::LATEST);
+    // a whole number written as a float is that number
+    assert_eq!(DevelopSettings::from_json(&json!({"process": 2.0})).unwrap().process, ProcessVersion(2));
+}
+
+#[test]
+fn a_damaged_process_value_reads_as_v1_and_keeps_the_edits() {
+    let too_big = u64::from(u32::MAX) + 1;
+    for bad in [
+        json!(-1),
+        json!(1.5),
+        json!(-0.5),
+        json!(1e300),
+        json!(too_big),
+        json!(u64::MAX),
+        json!("2"),
+        json!(null),
+        json!(true),
+        json!([2]),
+        json!({"v": 2}),
+    ] {
+        let mut v = legacy();
+        v["process"] = bad.clone();
+        let s = DevelopSettings::from_json(&v).unwrap_or_else(|e| panic!("{bad}: {e}"));
+        assert_eq!(s.process, ProcessVersion::V1, "{bad}");
+        assert_eq!((s.light.exposure, s.masks.len(), s.curve.master.len()), (0.4, 1, 3), "{bad}: the rest of the settings load");
+        // nested in other records too (history, versions, the catalog)
+        let nested: Vec<DevelopSettings> = serde_json::from_value(json!([v])).unwrap();
+        assert_eq!(nested[0].process, ProcessVersion::V1);
+    }
+}
+
+#[test]
+fn the_process_is_not_an_edit_nor_part_of_copied_settings() {
+    let mut s = DevelopSettings { process: ProcessVersion(LATEST_PLUS_ONE), ..Default::default() };
+    assert!(s.is_unedited(), "a photo on another process is not edited for that");
+    s.light.exposure = 1.0;
+    assert!(!s.is_unedited());
+    // resetting a section or a slider leaves the process alone
+    s.reset_section(Section::Light);
+    assert_eq!(s.process, ProcessVersion(LATEST_PLUS_ONE));
+    // copy / paste / sync / presets: no group carries the process, so the target keeps its own
+    assert!(SettingsGroup::ALL.iter().all(|g| !g.keys().contains(&"process")));
+    s.light.exposure = 1.0;
+    let copied = extract_groups(&s, &SettingsGroup::ALL);
+    assert!(copied.get("process").is_none());
+    let target = DevelopSettings::from_json(&legacy()).unwrap();
+    let pasted = apply_partial(&target, &copied, 1.0);
+    assert_eq!((pasted.process, pasted.light.exposure), (ProcessVersion(1), 1.0));
+    // (at another amount, without Grain: its integer seed doesn't survive scaling, a separate issue)
+    let groups: Vec<SettingsGroup> = SettingsGroup::ALL.into_iter().filter(|g| *g != SettingsGroup::Grain).collect();
+    let preset = Preset::from_settings("p", "P", "User", &s, &groups);
+    let half = preset.apply(&target, 0.5);
+    assert_eq!((half.process, half.light.exposure), (ProcessVersion(1), 0.7));
+    // a partial that names a process explicitly (Apply Settings JSON) sets it
+    assert_eq!(target.merged(&json!({"process": LATEST_PLUS_ONE})).unwrap().process, ProcessVersion(LATEST_PLUS_ONE));
+}
+
+/// A process other than the latest: a newer LightCraft's number (no older one than V1 exists).
+const LATEST_PLUS_ONE: u32 = ProcessVersion::LATEST.0 + 1;
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 9bd9845f..4036a5c9 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -49,5 +49,7 @@ denoise = ["dep:lightcraft-denoise", "lightcraft-denoise/runtime", "lightcraft-g
 rawnind-model = ["denoise", "lightcraft-denoise/rawnind-model", "lightcraft-denoise-core/rawnind-model"]
 
 [dev-dependencies]
+# Lossless synthetic HEIC files (the import test; decoded when the codecs' `heif` feature is on).
+lightcraft-heif = { workspace = true, features = ["testdata"] }
 libc = { workspace = true }
 lightcraft-tiff = { workspace = true }
diff --git a/crates/engine/build.rs b/crates/engine/build.rs
index 7350c6d8..e097889f 100644
--- a/crates/engine/build.rs
+++ b/crates/engine/build.rs
@@ -13,19 +13,22 @@ fn main() {
     println!("cargo::rerun-if-changed=build.rs");
     println!("cargo::rerun-if-env-changed=CRAFT_FONTS_DIR");
     println!("cargo::rerun-if-env-changed=CRAFT_FONTS_REQUIRED");
+    let required = std::env::var_os("CRAFT_FONTS_REQUIRED").is_some();
     let mut src = String::from("pub static CRAFT_FONTS: &[CraftFont] = &[\n");
     let mut embedded = 0;
     if let Some(dir) = std::env::var_os("CRAFT_FONTS_DIR").map(PathBuf::from).map(resolve) {
-        match craft_fonts(&dir) {
+        match craft_fonts(&dir, required) {
             Ok(entries) => {
                 embedded = entries.lines().count();
                 src.push_str(&entries);
             }
-            Err(e) if std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() => {
+            Err(e) if required => {
                 println!("cargo::error=CRAFT_FONTS_DIR={}: {e}", dir.display());
             }
             Err(e) => println!("cargo::warning=building without craft-fonts: CRAFT_FONTS_DIR={}: {e}", dir.display()),
         }
+    } else if required {
+        println!("cargo::error=CRAFT_FONTS_REQUIRED is set but CRAFT_FONTS_DIR is missing");
     }
     src.push_str("];\n");
     // Without them the app still runs and every language still selectable, so Chinese and Japanese
@@ -58,17 +61,21 @@ fn resolve(dir: PathBuf) -> PathBuf {
 }
 
 /// One `CraftFont { .. }` initialiser per manifest line.
-fn craft_fonts(dir: &Path) -> Result<String, String> {
+fn craft_fonts(dir: &Path, required: bool) -> Result<String, String> {
     let manifest = dir.join("fonts/manifest.txt");
     println!("cargo::rerun-if-changed={}", manifest.display());
     let text = std::fs::read_to_string(&manifest).map_err(|e| format!("{}: {e}", manifest.display()))?;
     let wasm = std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32");
     let mut out = String::new();
+    let mut has_japanese_ui = false;
+    let mut has_chinese_ui = false;
     for line in text.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')) {
         let f: Vec<&str> = line.split(" | ").map(str::trim).collect();
         let [family, style, file, scripts, ..] = f.as_slice() else {
             return Err(format!("malformed manifest line: {line}"));
         };
+        has_japanese_ui |= (*family, *style) == ("BIZ UDPGothic", "Regular");
+        has_chinese_ui |= (*family, *style) == ("Noto Sans CJK SC", "Regular") && scripts.split(',').any(|script| script.trim() == "Hans");
         if wasm && (*family, *style) != ("BIZ UDPGothic", "Regular") {
             continue;
         }
@@ -82,5 +89,11 @@ fn craft_fonts(dir: &Path) -> Result<String, String> {
             path.display().to_string(),
         );
     }
+    if required && !has_japanese_ui {
+        return Err("required Japanese UI face BIZ UDPGothic Regular is missing from fonts/manifest.txt".into());
+    }
+    if required && !wasm && !has_chinese_ui {
+        return Err("required Simplified Chinese UI face Noto Sans CJK SC Regular (Hans) is missing from fonts/manifest.txt".into());
+    }
     Ok(out)
 }
diff --git a/crates/engine/examples/render_bench.rs b/crates/engine/examples/render_bench.rs
index 55dc2b11..6a473a2d 100644
--- a/crates/engine/examples/render_bench.rs
+++ b/crates/engine/examples/render_bench.rs
@@ -247,18 +247,20 @@ fn main() {
         }
     }
     if run("batch") && args.len() > 1 {
-        // full-size JPEG export of all the files given (decode + render + encode)
-        use lightcraft_engine::export::export_photo;
+        // full-size JPEG export of all the files given (decode + render + encode), as the Export
+        // dialog runs it: several photos side by side (`export_parallelism`), files discarded
+        use lightcraft_engine::export::{Destination, export_batch};
         let mut session = lightcraft_engine::Session::new().with_fs();
         let r = session.execute("library.import", &serde_json::json!({"paths": args})).expect("import");
         let ids: Vec<_> = r["imported"].as_array().expect("ids").iter().filter_map(|v| v.as_u64()).map(lightcraft_engine::catalog::PhotoId).collect();
-        let items: Vec<_> = ids.iter().enumerate().map(|(i, id)| (*id, i + 1)).collect();
         let o = ExportOptions::default();
-        row(&format!("batch export of {} files (decode+render+JPEG):", items.len()), &mut |g| {
+        let lanes = lightcraft_engine::export::export_parallelism(ids.len());
+        row(&format!("batch export of {} files, {lanes} at a time (decode+render+JPEG):", ids.len()), &mut |g| {
             lightcraft_engine::gpu::set_enabled(g);
-            for &(id, seq) in &items {
-                drop(export_photo(&mut session, id, &o, seq).expect("export"));
-                session.media.forget(id); // as in a batch: every original is decoded once
+            let files = export_batch(&mut session, &ids, &o, &Destination::default(), &mut |_, _| Ok(()), &|_| false).expect("export");
+            assert_eq!(files.len(), ids.len());
+            for &id in &ids {
+                session.media.forget(id); // every original is decoded once per run
             }
         });
         lightcraft_engine::gpu::set_enabled(true);
diff --git a/crates/engine/src/camera_preview.rs b/crates/engine/src/camera_preview.rs
index 55ea2d80..fd7c58f8 100644
--- a/crates/engine/src/camera_preview.rs
+++ b/crates/engine/src/camera_preview.rs
@@ -1,5 +1,5 @@
 //! Estimate the starting look of a raw without a camera colour matrix (Sony ARW, Nikon NEF, Panasonic
-//! RW2, Fujifilm RAF, Canon CR3) from its own JPEG. Colour and luminance are fitted separately; the JPEG supplies correspondences only,
+//! RW2, Fujifilm RAF, Canon CR2/CR3, Pentax PEF, Samsung SRW, Olympus ORF) from its own JPEG. Colour and luminance are fitted separately; the JPEG supplies correspondences only,
 //! never output pixels or a replacement for RAW editing.
 //! A global matrix can't follow the camera's hue-dependent rendering (the best matrix rendered a
 //! lime shirt olive that the camera kept lime): a hue/saturation table fitted to the residuals
@@ -8,7 +8,7 @@ use lightcraft_color::{D50, D65, Mat3, PROPHOTO, REC2020, bradford, luminance_20
 use lightcraft_pipeline::tone::{CameraTone, ToneMap};
 use lightcraft_raster::{
     Rgb32f,
-    resample::{Filter, fit},
+    resample::{Filter, fit, resize},
 };
 use lightcraft_raw::{RawFormat, RawImage, color::CameraTransform, profile::HsvTable};
 
@@ -33,7 +33,16 @@ pub(crate) const PROFILE_PROXY: usize = 192;
 pub(crate) fn file_local_look(format: RawFormat) -> bool {
     matches!(
         format,
-        RawFormat::Arw | RawFormat::Nef | RawFormat::Nrw | RawFormat::Rw2 | RawFormat::Raf | RawFormat::Cr3 | RawFormat::Cr2 | RawFormat::Pef
+        RawFormat::Arw
+            | RawFormat::Nef
+            | RawFormat::Nrw
+            | RawFormat::Rw2
+            | RawFormat::Raf
+            | RawFormat::Cr3
+            | RawFormat::Cr2
+            | RawFormat::Pef
+            | RawFormat::Srw
+            | RawFormat::Orf
     )
 }
 
@@ -41,15 +50,19 @@ pub(crate) fn fit_preview(raw: &RawImage, bytes: &[u8], transform: &CameraTransf
     if !transform.matrix_is_fallback || !file_local_look(raw.format) {
         return None;
     }
-    let (sensor, reference) = proxies(raw, bytes, transform, PROXY)?;
+    let (sensor, reference, clipped) = proxies(raw, bytes, transform, PROXY)?;
     // A camera profile pooled from many photos knows colours this photo shows too little of;
-    // try its colour first and fit tone/chroma per photo (DRO and picture styles vary).
+    // try its colour first and fit tone/chroma per photo (picture styles vary).
     let profile = raw.metadata.model.as_deref().and_then(crate::camera_profiles::get);
     let colour = profile.as_ref().and_then(|p| Some((p.matrix().mul(&transform.matrix.inverse()?), p.hue_sat.clone())));
-    let look = fit_pairs_with(&sensor, &reference, colour)?;
+    let look = fit_look(&sensor, &reference, &clipped, colour)?;
+    // Sony's Dynamic Range Optimizer (on by default) brightens the camera JPEG's darker regions,
+    // not the raw: keep the colour fitted to the JPEG, take the tone curve without DRO.
+    let dro = lightcraft_raw::embedded_preview_dynamic_range_optimized(bytes) == Some(true);
+    let look = if dro { with_dro_off_tone(look) } else { look };
     if lightcraft_pipeline::profiling() {
         eprintln!(
-            "[profile] {:?} camera look: {:?}, {:?}, hue/sat table {}, camera profile available {}",
+            "[profile] {:?} camera look: {:?}, {:?}, hue/sat table {}, camera profile available {}, DRO tone replaced {dro}",
             raw.format,
             look.matrix.0,
             look.tone,
@@ -60,9 +73,129 @@ pub(crate) fn fit_preview(raw: &RawImage, bytes: &[u8], transform: &CameraTransf
     Some(look)
 }
 
+/// Sensor level (normalised, white = 1) at or above which a raw channel counts as clipped, as in
+/// the render's highlight reconstruction.
+const SENSOR_CLIP: f32 = 0.99;
+
+/// The photo's look, refitted without the proxy pixels whose sensor values are clipped.
+///
+/// A clipped raw pixel no longer records the scene's colour: with one channel held at the clip
+/// level while the others keep rising, a white overcast sky comes out magenta or blue through the
+/// camera matrix, while the camera JPEG shows it white. As correspondences such pixels teach the
+/// colour matrix to pull colours toward grey, and the chroma curve to remove colour at their
+/// display luminance (on a Z 6II forest under a clipped sky the curve cut colourfulness above
+/// display luminance 0.4 to 13–19%, and every one of its samples there was clipped). The render
+/// rebuilds clipped highlights separately (`lightcraft_raw::highlight`), so the look is fitted on
+/// what the sensor measured.
+///
+/// The search on all pixels decides, as before, whether the photo gets a look and which attempt
+/// of [`search_ordered`] gives it; only that attempt is refitted without the clipped pixels, and
+/// when the refit misses the acceptance gates the look on all pixels is kept. So no photo loses
+/// its look and none switches attempt (a refit that just clears the gate on all pixels must not
+/// replace a look fitted away from edges). A photo that had no look gets one when the search
+/// without the clipped pixels finds it, and otherwise the [`fit_partial`] look when that is clearly
+/// closer to the camera JPEG than the neutral fallback.
+fn fit_look(sensor: &Rgb32f, reference: &Rgb32f, clipped: &[bool], colour: Option<(Mat3, Option<HsvTable>)>) -> Option<CameraLook> {
+    let unclipped = without_clipped(sensor, clipped);
+    let Some((look, attempt)) = search_ordered(sensor, reference, colour.clone(), TONE_FITS) else {
+        return unclipped
+            .as_ref()
+            .and_then(|u| search_ordered(u, reference, colour, TONE_FITS))
+            .map(|(look, _)| look)
+            .or_else(|| fit_partial(unclipped.as_ref().unwrap_or(sensor), reference));
+    };
+    let Some(unclipped) = unclipped else { return Some(look) };
+    let refit = fit_attempt(&unclipped, reference, &colour, attempt);
+    if refit.is_none() && lightcraft_pipeline::profiling() {
+        eprintln!("[profile] camera look: no fit without the clipped pixels on the accepted attempt, keeping the fit on all pixels");
+    }
+    Some(refit.unwrap_or(look))
+}
+
+/// `sensor` with its clipped pixels set to NaN (left out of every training pair), or `None` when
+/// none is clipped.
+fn without_clipped(sensor: &Rgb32f, clipped: &[bool]) -> Option<Rgb32f> {
+    if clipped.len() != sensor.data.len() || !clipped.iter().any(|c| *c) {
+        return None;
+    }
+    let mut out = sensor.clone();
+    for (p, c) in out.data.iter_mut().zip(clipped) {
+        if *c {
+            *p = [f32::NAN; 3];
+        }
+    }
+    if lightcraft_pipeline::profiling() {
+        eprintln!(
+            "[profile] camera look: {} of {} proxy pixels have a clipped sensor channel",
+            clipped.iter().filter(|c| **c).count(),
+            clipped.len()
+        );
+    }
+    Some(out)
+}
+
+/// 1 where any channel of a camera-RGB pixel is at or above [`SENSOR_CLIP`], else 0.
+fn clip_mask(camera: &Rgb32f) -> Rgb32f {
+    let mut mask = camera.clone();
+    mask.map_in_place(|p| if p.iter().any(|v| *v >= SENSOR_CLIP) { [1.0; 3] } else { [0.0; 3] });
+    mask
+}
+
+/// Sony's global tone curve with the Dynamic Range Optimizer off (Standard creative style), pooled
+/// from 12 CC0 raw.pixls.us ARWs of 10 interchangeable-lens bodies and their camera JPEGs; the file
+/// lists them and how the curve was derived (`assets/ATTRIBUTION.md`). Pooled the same way from 55
+/// private ILCE-7CR photos with DRO off, the curve differs by at most 1.2 L* between scene luminance
+/// 0.01 and 0.5. Issue #244, `docs/camera-preview-colour.md`.
+const SONY_DRO_OFF_TONE: &str = include_str!("../../../assets/camera-tone/sony-dro-off.json");
+
+/// [`SONY_DRO_OFF_TONE`]'s curve (`None` only if the built-in file were invalid; a test checks it).
+fn sony_dro_off_tone() -> Option<CameraTone> {
+    #[derive(serde::Deserialize)]
+    struct File {
+        knots: [[f32; 2]; 32],
+    }
+    static TONE: std::sync::OnceLock<Option<CameraTone>> = std::sync::OnceLock::new();
+    *TONE.get_or_init(|| serde_json::from_str::<File>(SONY_DRO_OFF_TONE).ok().and_then(|f| CameraTone::new(f.knots)))
+}
+
+/// `look`, fitted to a camera JPEG brightened by Sony's Dynamic Range Optimizer, with its tone
+/// curve lowered to Sony's without DRO ([`SONY_DRO_OFF_TONE`]) wherever that is darker. DRO only
+/// brightens, so the fitted curve bounds the curve without it from above, everywhere: where Sony's
+/// curve is brighter than the photo's own (the 1″ compacts map raw values darker), the photo keeps
+/// its own. Its colour (matrix, hue/saturation table and chroma curve) stays as fitted.
+fn with_dro_off_tone(look: CameraLook) -> CameraLook {
+    let Some(dro_off) = sony_dro_off_tone() else { return look };
+    let own = look.tone.knots();
+    let mut knots = own.map(|[x, y]| [x, y.min(dro_off.apply(x))]);
+    // Past its last knot a curve goes on as a shoulder whose rate comes from its last two knots
+    // (`CameraTone::apply`): lowering the second-last knot more than the last steepens it, and the
+    // extended highlights would end up above the fitted curve. Raise the second-last knot (never
+    // above the fitted curve) until the rate is at most the fitted curve's.
+    let ([a, b], last) = ([own[30], own[31]], knots[31]);
+    let rate = ((b[1] - a[1]) / (b[0] - a[0])).clamp(0.1, 16.0) / (1.0 - b[1]).max(0.01);
+    let floor = last[1] - rate * (1.0 - last[1]).max(0.01) * (b[0] - a[0]);
+    knots[30][1] = knots[30][1].max(floor).min(last[1]);
+    let Some(tone) = CameraTone::new(knots).and_then(|tone| tone.with_chroma(*look.tone.chroma())) else { return look };
+    if !at_most(&tone, &look.tone) {
+        return look;
+    }
+    CameraLook { tone, ..look }
+}
+
+/// Whether curve `a` is nowhere brighter than `b` over the scene luminances the finish stage's tone
+/// table covers ([`ToneMap::camera`]).
+fn at_most(a: &CameraTone, b: &CameraTone) -> bool {
+    use lightcraft_pipeline::tone::{GREY, LUT_MAX_EV, LUT_MIN_EV, LUT_N};
+    (0..LUT_N).all(|i| {
+        let x = GREY * 2f32.powf(LUT_MIN_EV + (LUT_MAX_EV - LUT_MIN_EV) * i as f32 / (LUT_N - 1) as f32);
+        a.apply(x) <= b.apply(x) + 1e-5
+    })
+}
+
 /// Same-size proxies of the sensor (white-balanced, baseline exposure, through `transform`'s
-/// matrix: the generic camera ≈ sRGB model) and of the file's embedded camera JPEG (linear Rec.2020).
-fn proxies(raw: &RawImage, bytes: &[u8], transform: &CameraTransform, size: usize) -> Option<(Rgb32f, Rgb32f)> {
+/// matrix: the generic camera ≈ sRGB model) and of the file's embedded camera JPEG (linear Rec.2020),
+/// and per proxy pixel whether any sensor sample it covers is clipped.
+fn proxies(raw: &RawImage, bytes: &[u8], transform: &CameraTransform, size: usize) -> Option<(Rgb32f, Rgb32f, Vec<bool>)> {
     let edge = (2 * size).max(384) as u32;
     let decoded = crate::files::decode_raw_preview(bytes, lightcraft_codecs::DecodeOptions { max_size: Some((edge, edge)), max_pixels: 64_000_000 })?;
     let mut reference = decoded.to_working();
@@ -87,23 +220,38 @@ fn proxies(raw: &RawImage, bytes: &[u8], transform: &CameraTransform, size: usiz
     // Fixed, bounded proxy: the selected look cannot depend on thumbnail/export resolution.
     let k = (crop.width.max(crop.height).div_ceil(edge as usize).max(2)).div_ceil(2) * 2;
     let mut sensor = sensor_proxy(raw, k, edge as usize)?;
+    let mut clipped = clip_mask(&sensor);
     let gain = 2f32.powf(transform.baseline_exposure as f32);
     let to_working = |p: [f32; 3]| transform.matrix.apply_f32(std::array::from_fn(|i| p[i] * transform.wb[i] * gain));
     if raw.format == RawFormat::Cr3 {
         // Orient the camera JPEG and the sensor identically before collecting pixel correspondences.
         sensor = sensor.into_oriented(raw.orientation);
+        clipped = clipped.into_oriented(raw.orientation);
         reference = reference.into_oriented(raw.orientation);
         sensor.map_in_place(to_working);
         // Canon's JPEG can be cropped differently from the sensor. Estimate only that common
         // framing from edge directions, independently of the subsequent colour fit.
-        sensor = align_cr3_framing(sensor, &reference);
+        (sensor, clipped) = align_cr3_framing(sensor, clipped, &reference);
     }
     let mut sensor = fit(&sensor, size, size, Filter::Box);
-    let reference = fit(&reference, sensor.width, sensor.height, Filter::Box);
+    let reference = reference_at(&reference, &sensor);
+    // A proxy pixel is clipped when any sample it averages is (outside the CR3 framing the mask is
+    // NaN: those pixels are left out of the pairs anyway). Resized to exactly the proxy's size, like
+    // the reference, so the mask pairs pixel for pixel.
+    let clipped: Vec<bool> = resize(&clipped, sensor.width, sensor.height, Filter::Box).data.iter().map(|p| p[0] > 0.0).collect();
     if raw.format != RawFormat::Cr3 {
         sensor.map_in_place(to_working);
     }
-    Some((sensor, reference))
+    Some((sensor, reference, clipped))
+}
+
+/// The camera JPEG at exactly the sensor proxy's size, so the two pair pixel for pixel. Fitting it
+/// into the proxy's box instead keeps its own aspect, which can round a pixel short: an ILCE-7RM4's
+/// 1616×1080 preview, decoded at 384×257, fits a 192×128 proxy as 191×128, and `collect_pairs`
+/// then rejected every file `lightcraft-cli calibrate` was given. `proxies` has already checked
+/// that the aspects agree within 2 %.
+fn reference_at(reference: &Rgb32f, sensor: &Rgb32f) -> Rgb32f {
+    resize(reference, sensor.width, sensor.height, Filter::Box)
 }
 
 #[derive(Clone, Copy, Debug)]
@@ -230,15 +378,19 @@ fn estimate_cr3_framing(sensor: &Rgb32f, reference: &Rgb32f) -> Option<Cr3Framin
     Some(best.1)
 }
 
-fn align_cr3_framing(sensor: Rgb32f, reference: &Rgb32f) -> Rgb32f {
-    let Some(framing) = estimate_cr3_framing(&sensor, reference) else { return sensor };
-    let (w, h) = (sensor.width, sensor.height);
-    let mut aligned = Rgb32f::new(w, h);
-    for (i, pixel) in aligned.data.iter_mut().enumerate() {
-        let (x, y) = framing.source((i % w) as f32 + 0.5, (i / w) as f32 + 0.5, w, h);
-        *pixel = if x >= 0.5 && y >= 0.5 && x <= w as f32 - 0.5 && y <= h as f32 - 0.5 { sensor.sample_bilinear(x, y) } else { [f32::NAN; 3] };
-    }
-    aligned
+/// The sensor proxy and its clip mask (same size), both moved to the camera JPEG's framing.
+fn align_cr3_framing(sensor: Rgb32f, clipped: Rgb32f, reference: &Rgb32f) -> (Rgb32f, Rgb32f) {
+    let Some(framing) = estimate_cr3_framing(&sensor, reference) else { return (sensor, clipped) };
+    let apply = |image: &Rgb32f| {
+        let (w, h) = (image.width, image.height);
+        let mut aligned = Rgb32f::new(w, h);
+        for (i, pixel) in aligned.data.iter_mut().enumerate() {
+            let (x, y) = framing.source((i % w) as f32 + 0.5, (i / w) as f32 + 0.5, w, h);
+            *pixel = if x >= 0.5 && y >= 0.5 && x <= w as f32 - 0.5 && y <= h as f32 - 0.5 { image.sample_bilinear(x, y) } else { [f32::NAN; 3] };
+        }
+        aligned
+    };
+    (apply(&sensor), apply(&clipped))
 }
 
 /// Colour training pairs of one raw for a camera profile: white-balanced camera RGB (with the
@@ -249,8 +401,10 @@ pub(crate) fn profile_pairs(raw: &RawImage, bytes: &[u8]) -> Option<Vec<([f64; 3
         return None;
     }
     let transform = lightcraft_raw::color::camera_transform(raw, lightcraft_raw::color::as_shot_white_xy(raw));
-    let (sensor, reference) = proxies(raw, bytes, &transform, PROFILE_PROXY)?;
+    let (sensor, reference, clipped) = proxies(raw, bytes, &transform, PROFILE_PROXY)?;
     let to_camera = transform.matrix.inverse()?;
+    // clipped sensor pixels don't record the scene's colour (see `fit_look`)
+    let sensor = without_clipped(&sensor, &clipped).unwrap_or(sensor);
     let (pairs, _) = collect_pairs(&sensor, &reference, 0.05, None)?;
     Some(pairs.into_iter().map(|(x, y)| (to_camera.apply(x), y)).collect())
 }
@@ -263,7 +417,7 @@ pub(crate) fn fit_profile(pairs: &[([f64; 3], [f64; 3])]) -> Option<(Mat3, Optio
 }
 
 fn sensor_proxy(raw: &RawImage, k: usize, edge: usize) -> Option<Rgb32f> {
-    Some(match raw.develop_binned(k, 0.99).ok()? {
+    Some(match raw.develop_binned(k, SENSOR_CLIP).ok()? {
         Some(sensor) => sensor,
         None if raw.cpp == 3 && raw.cfa.is_none() => fit(&raw.develop(lightcraft_raw::Method::Bilinear).ok()?, edge, edge, Filter::Box),
         None => return None,
@@ -389,32 +543,75 @@ fn fit_matrix(pairs: &[([f64; 3], [f64; 3])]) -> Option<Mat3> {
 }
 
 /// Neighbourhood luminance ratio above which a pixel counts as an edge for the second attempt
-/// of [`fit_pairs_with`]. Camera JPEGs are often lens-corrected (Sony "Distortion Comp.: Auto",
+/// of [`search_ordered`]. Camera JPEGs are often lens-corrected (Sony "Distortion Comp.: Auto",
 /// compacts and kit zooms): on a 51 mm ILCE-7RM2 shot of a glass façade the JPEG is up to 15 px
 /// of 1440 (about one proxy pixel) off the raw, and the fit failed the gate on the mismatched
 /// window frames alone (held-out RMS 0.111; 0.059 for the same shot with distortion correction
 /// off). Away from edges: 0.049. Issue #232.
 const EDGE_CONTRAST: f32 = 3.0;
 
-/// The photo's look: its own matrix (with and without a hue/saturation table), or the given
-/// colour model (a camera profile's, in the sensor proxy's space), each completed with a tone
-/// and chroma curve fitted to this photo. When the fit on all pixels fails the acceptance gates,
-/// it is tried once more on the pixels away from edges (same gates): there colour pairs stay
-/// valid when the camera JPEG's geometry differs slightly from the raw's.
+/// The look on all pixels (the search of [`search_ordered`] with [`TONE_FITS`]), as before
+/// clipped pixels were left out.
+#[cfg(test)]
 fn fit_pairs_with(sensor: &Rgb32f, reference: &Rgb32f, colour: Option<(Mat3, Option<HsvTable>)>) -> Option<CameraLook> {
-    let has_profile = colour.is_some();
-    // A different picture style can make a camera profile fail the gates. Preserve the
-    // photo's own colour fit before resorting to the neutral fallback.
-    fit_candidate(sensor, reference, colour).or_else(|| has_profile.then(|| fit_candidate(sensor, reference, None)).flatten())
+    fit_pairs_ordered(sensor, reference, colour, TONE_FITS)
 }
 
-/// One candidate colour model, fitted on all pixels and, when that fails the gates, once more on
-/// the pixels away from edges (issue #232).
-fn fit_candidate(sensor: &Rgb32f, reference: &Rgb32f, colour: Option<(Mat3, Option<HsvTable>)>) -> Option<CameraLook> {
-    fit_pairs_on(sensor, reference, colour.clone(), None).or_else(|| fit_pairs_on(sensor, reference, colour, Some(EDGE_CONTRAST)))
+/// The look from [`search_ordered`] without its attempt.
+#[cfg(test)]
+fn fit_pairs_ordered(sensor: &Rgb32f, reference: &Rgb32f, colour: Option<(Mat3, Option<HsvTable>)>, order: &[ToneFit]) -> Option<CameraLook> {
+    search_ordered(sensor, reference, colour, order).map(|(look, _)| look)
 }
 
-fn fit_pairs_on(sensor: &Rgb32f, reference: &Rgb32f, colour: Option<(Mat3, Option<HsvTable>)>, edge_limit: Option<f32>) -> Option<CameraLook> {
+/// The tone fits the search tries, in order: the first whose look passes the acceptance gates is
+/// used. Quantile matching comes first because it cannot produce flat steps; the
+/// conditional-median fit follows because on a few photos (compacts, early Micro Four Thirds) its
+/// slightly lower held-out error is what clears the gates, and a photo must not lose its look to
+/// the change of fit.
+const TONE_FITS: &[ToneFit] = &[ToneFit::Quantile, ToneFit::ConditionalMedian];
+
+/// One attempt of the search: tone fit, the camera profile's colour or the photo's own, all pixels
+/// or only those away from edges.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+struct Attempt {
+    tone: ToneFit,
+    profile: bool,
+    away_from_edges: bool,
+}
+
+/// The photo's look and the attempt that produced it: its own matrix (with and without a
+/// hue/saturation table), or the given colour model (a camera profile's, in the sensor proxy's
+/// space), each completed with a tone and chroma curve fitted to this photo. Per tone fit in
+/// `order`: the camera profile's colour (when there is one), then the photo's own, as a different
+/// picture style can make a camera profile fail the gates; each fitted on all pixels and, when that
+/// fails the gates, once more on the pixels away from edges (same gates): there colour pairs stay
+/// valid when the camera JPEG's geometry differs slightly from the raw's (issue #232). The whole
+/// search runs with one tone fit before the next is tried, so the conditional-median fallback
+/// accepts exactly what the previous releases accepted.
+fn search_ordered(sensor: &Rgb32f, reference: &Rgb32f, colour: Option<(Mat3, Option<HsvTable>)>, order: &[ToneFit]) -> Option<(CameraLook, Attempt)> {
+    let profiles: &[bool] = if colour.is_some() { &[true, false] } else { &[false] };
+    order.iter().find_map(|&tone| {
+        profiles.iter().find_map(|&profile| {
+            [false, true].into_iter().find_map(|away_from_edges| {
+                let attempt = Attempt { tone, profile, away_from_edges };
+                fit_attempt(sensor, reference, &colour, attempt).map(|look| (look, attempt))
+            })
+        })
+    })
+}
+
+fn fit_attempt(sensor: &Rgb32f, reference: &Rgb32f, colour: &Option<(Mat3, Option<HsvTable>)>, attempt: Attempt) -> Option<CameraLook> {
+    let colour = if attempt.profile { colour.clone() } else { None };
+    fit_pairs_on(sensor, reference, colour, attempt.away_from_edges.then_some(EDGE_CONTRAST), attempt.tone)
+}
+
+fn fit_pairs_on(
+    sensor: &Rgb32f,
+    reference: &Rgb32f,
+    colour: Option<(Mat3, Option<HsvTable>)>,
+    edge_limit: Option<f32>,
+    tone_fit: ToneFit,
+) -> Option<CameraLook> {
     // A known colour model needs enough signal for tone fitting, not a scene rich enough to
     // learn a new colour matrix. Still reject monochrome references.
     let (pairs, bright) = collect_pairs(sensor, reference, if colour.is_some() { 0.005 } else { 0.05 }, edge_limit)?;
@@ -437,7 +634,7 @@ fn fit_pairs_on(sensor: &Rgb32f, reference: &Rgb32f, colour: Option<(Mat3, Optio
         };
         let tone_pairs: Vec<_> =
             pairs.iter().enumerate().filter(|(i, _)| i % 3 != 0).map(|(_, (x, y))| (luma(colour(*x).map(|v| v.max(0.0))), luma(*y))).collect();
-        let Some(curve) = fit_tone(tone_pairs) else { continue };
+        let Some(curve) = tone_fit.fit(tone_pairs) else { continue };
         let mut look = CameraLook { matrix, tone: curve, hue_sat: hue_sat.clone() };
         if let Some(tone) = fit_chroma(&bright, &look) {
             look.tone = tone;
@@ -468,10 +665,11 @@ fn fit_pairs_on(sensor: &Rgb32f, reference: &Rgb32f, colour: Option<(Mat3, Optio
         .sum();
     if lightcraft_pipeline::profiling() {
         eprintln!(
-            "[profile] camera look holdout RMS {:.5} -> {:.5} ({samples} channels{})",
+            "[profile] camera look holdout RMS {:.5} -> {:.5} ({samples} channels{}{})",
             (before / samples as f64).sqrt(),
             (after / samples as f64).sqrt(),
-            if edge_limit.is_some() { ", away from edges" } else { "" }
+            if edge_limit.is_some() { ", away from edges" } else { "" },
+            if tone_fit == ToneFit::ConditionalMedian { ", conditional-median tone" } else { "" }
         );
     }
     if samples == 0 || after >= before * MIN_IMPROVEMENT || after / samples as f64 > MAX_HOLDOUT_RMS.powi(2) {
@@ -480,6 +678,106 @@ fn fit_pairs_on(sensor: &Rgb32f, reference: &Rgb32f, colour: Option<(Mat3, Optio
     Some(look)
 }
 
+/// Weight of the photo's own colour matrix in a [`fit_partial`] look; the rest is the identity (the
+/// neutral fallback's generic camera ≈ sRGB colour). On the CC0 archive's proxies, with the
+/// matrix at full weight 2 of the 23 colourful photos without a look came out more than 2° further
+/// from the camera's hues than the neutral fallback, at half weight none (median hue error 9.6° with
+/// the generic colour, which the tone and chroma curves make visible, 5.1° at half weight).
+const PARTIAL_MATRIX_WEIGHT: f64 = 0.5;
+
+/// Smallest rank correlation of scene and camera JPEG luminance over a [`fit_partial`] look's pairs:
+/// the JPEG must show the same picture. A look that only matches the brightness distribution of an
+/// unrelated picture can still beat the dark neutral fallback pixel for pixel. On the CC0 archive's
+/// proxies the accepted full looks have 0.55 or more, lens-corrected compacts without one 0.53–0.77,
+/// three old Coolpix files whose raw decodes wrongly 0.07–0.27.
+const PARTIAL_MIN_RANK_CORRELATION: f64 = 0.5;
+
+/// Spearman rank correlation of the scene's and the JPEG's luminance over `pairs`.
+fn rank_correlation(pairs: &[([f64; 3], [f64; 3])]) -> f64 {
+    let ranks = |values: Vec<f64>| {
+        let mut order: Vec<usize> = (0..values.len()).collect();
+        order.sort_by(|a, b| values[*a].total_cmp(&values[*b]));
+        let mut ranks = vec![0.0; values.len()];
+        for (rank, i) in order.into_iter().enumerate() {
+            ranks[i] = rank as f64;
+        }
+        ranks
+    };
+    let scene = ranks(pairs.iter().map(|(x, _)| luma(*x)).collect());
+    let jpeg = ranks(pairs.iter().map(|(_, y)| luma(*y)).collect());
+    let mean = (pairs.len() as f64 - 1.0) / 2.0;
+    let (covariance, variance) =
+        scene.iter().zip(&jpeg).fold((0.0, 0.0), |(c, v), (a, b)| (c + (a - mean) * (b - mean), v + (a - mean) * (a - mean)));
+    if variance > 0.0 { covariance / variance } else { 0.0 }
+}
+
+/// A partial look for a photo whose full look misses the acceptance gates (lens-corrected JPEGs of
+/// compacts, dull or nearly colourless scenes): the tone curve by quantile matching, which needs
+/// no pixel-exact registration and was the largest part of the neutral fallback's error (rendered
+/// 9–22 L* too dark), the chroma curve (the fallback kept about a third of the camera's
+/// colourfulness), and, when the scene has enough colour to learn one (the full look's condition),
+/// the photo's own colour matrix at [`PARTIAL_MATRIX_WEIGHT`]. No hue/saturation table. Tried on
+/// all pixels and then, like the full look, on the pixels away from edges; used only when it cuts
+/// the held-out squared error to below [`MIN_IMPROVEMENT`] of the neutral fallback's, in linear
+/// and in gamma-encoded display values, and when the JPEG shows the same picture
+/// ([`PARTIAL_MIN_RANK_CORRELATION`]). There is no limit on its own error: it only has to be clearly
+/// closer to the camera JPEG than what the photo would get otherwise.
+fn fit_partial(sensor: &Rgb32f, reference: &Rgb32f) -> Option<CameraLook> {
+    [None, Some(EDGE_CONTRAST)].into_iter().find_map(|edge_limit| fit_partial_on(sensor, reference, edge_limit))
+}
+
+fn fit_partial_on(sensor: &Rgb32f, reference: &Rgb32f, edge_limit: Option<f32>) -> Option<CameraLook> {
+    // as for a known colour model: enough signal for the tone, but no monochrome reference
+    let (pairs, bright) = collect_pairs(sensor, reference, 0.005, edge_limit)?;
+    let related = rank_correlation(&pairs);
+    if related < PARTIAL_MIN_RANK_CORRELATION {
+        if lightcraft_pipeline::profiling() {
+            eprintln!("[profile] camera look partial: luminance rank correlation {related:.3}, not the same picture");
+        }
+        return None;
+    }
+    let spread = |y: &[f64; 3]| y.iter().copied().fold(f64::NEG_INFINITY, f64::max) - y.iter().copied().fold(f64::INFINITY, f64::min);
+    let colourful = pairs.iter().filter(|(_, y)| spread(y) > 0.05).count() >= pairs.len() / 20;
+    let matrix = match colourful.then(|| fit_matrix(&pairs)).flatten() {
+        Some(own) => Mat3(std::array::from_fn(|r| {
+            std::array::from_fn(|c| Mat3::IDENTITY.0[r][c] + PARTIAL_MATRIX_WEIGHT * (own.0[r][c] - Mat3::IDENTITY.0[r][c]))
+        })),
+        None => Mat3::IDENTITY,
+    };
+    let tone_pairs: Vec<_> =
+        pairs.iter().enumerate().filter(|(i, _)| i % 3 != 0).map(|(_, (x, y))| (luma(matrix.apply(*x).map(|v| v.max(0.0))), luma(*y))).collect();
+    let mut look = CameraLook { matrix, tone: fit_tone(tone_pairs)?, hue_sat: None };
+    if let Some(tone) = fit_chroma(&bright, &look) {
+        look.tone = tone;
+    }
+    let (tone, neutral) = (ToneMap::camera(&look.tone, 0.0, 0.0, 0.0), ToneMap::new(0.0, 0.0, 0.0));
+    let encoded = |v: f64| v.max(0.0).powf(1.0 / 2.2);
+    let (mut before, mut after, mut before_encoded, mut after_encoded, mut samples) = (0.0, 0.0, 0.0, 0.0, 0);
+    for (x, target) in pairs.iter().step_by(3) {
+        let (fallback, partial) = (displayed(*x, &neutral), displayed(matrix.apply(*x), &tone));
+        for c in 0..3 {
+            before += (fallback[c] - target[c]).powi(2);
+            after += (partial[c] - target[c]).powi(2);
+            before_encoded += (encoded(fallback[c]) - encoded(target[c])).powi(2);
+            after_encoded += (encoded(partial[c]) - encoded(target[c])).powi(2);
+            samples += 1;
+        }
+    }
+    if lightcraft_pipeline::profiling() {
+        eprintln!(
+            "[profile] camera look partial (tone{}{}) holdout RMS {:.5} -> {:.5} ({samples} channels{})",
+            if look.tone.chroma().iter().any(|k| *k != 1.0) { ", chroma" } else { "" },
+            if matrix != Mat3::IDENTITY { ", damped matrix" } else { "" },
+            (before / samples.max(1) as f64).sqrt(),
+            (after / samples.max(1) as f64).sqrt(),
+            if edge_limit.is_some() { ", away from edges" } else { "" }
+        );
+    }
+    let better =
+        after.is_finite() && after_encoded.is_finite() && after < before * MIN_IMPROVEMENT && after_encoded < before_encoded * MIN_IMPROVEMENT;
+    (samples > 0 && better).then_some(look)
+}
+
 /// Linear Rec.2020 D65 → linear ProPhoto RGB D50, the space DNG hue/saturation tables work in.
 fn to_prophoto() -> Mat3 {
     PROPHOTO.from_xyz().mul(&bradford(D65, D50)).mul(&REC2020.to_xyz())
@@ -681,12 +979,68 @@ fn fit_chroma(pairs: &[([f64; 3], [f64; 3])], look: &CameraLook) -> Option<Camer
     (after.is_finite() && after < before).then_some(fitted)
 }
 
+/// How the per-photo tone curve is fitted ([`fit_pairs_ordered`] tries them in order).
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+enum ToneFit {
+    /// [`fit_tone`]: no flat steps, no pixel-exact registration needed.
+    Quantile,
+    /// [`fit_tone_conditional`]: the earlier fit, kept as the fallback.
+    ConditionalMedian,
+}
+
+impl ToneFit {
+    fn fit(self, pairs: Vec<(f64, f64)>) -> Option<CameraTone> {
+        match self {
+            ToneFit::Quantile => fit_tone(pairs),
+            ToneFit::ConditionalMedian => fit_tone_conditional(pairs),
+        }
+    }
+}
+
+/// The camera's tone curve from scene/JPEG luminance pairs, by quantile matching: knot `i` pairs
+/// the median of the `i`-th 1/32 of the sorted scene luminances with the median of the `i`-th
+/// 1/32 of the sorted JPEG luminances. A tone curve is monotone, so it maps each quantile of the
+/// scene to the same quantile of the JPEG; matching the two distributions needs no pixel-exact
+/// registration and is increasing by construction.
+///
+/// Binning the pairs by scene luminance and taking the JPEG's median per bin instead (followed by
+/// isotonic pooling) fails on real files: camera JPEGs are lens-corrected and sharpened, so on a
+/// 96 px proxy of a busy scene neighbouring pairs disagree by more than the gap between bins.
+/// The conditional medians then zig-zag, pooling turns them into flat steps (13 of 31 segments
+/// on a Z 6II forest, issue #475) that render as posterised patches, and regression toward the
+/// mean flattens both ends of the curve (lifted blacks, dull highlights).
+fn fit_tone(pairs: Vec<(f64, f64)>) -> Option<CameraTone> {
+    if pairs.len() < 128 || !pairs.iter().all(|(x, y)| x.is_finite() && *x > 0.0 && y.is_finite()) {
+        return None;
+    }
+    let mut xs: Vec<f64> = pairs.iter().map(|p| p.0).collect();
+    let mut ys: Vec<f64> = pairs.iter().map(|p| p.1).collect();
+    xs.sort_by(f64::total_cmp);
+    ys.sort_by(f64::total_cmp);
+    let n = xs.len();
+    let mut knots = [[0.0; 2]; 32];
+    for (i, knot) in knots.iter_mut().enumerate() {
+        let (a, b) = (i * n / 32, (i + 1) * n / 32);
+        let mid = a + (b - a) / 2;
+        *knot = [*xs.get(mid)? as f32, *ys.get(mid)? as f32];
+    }
+    if knots[31][0] < knots[0][0] * 1.5 {
+        return None;
+    }
+    CameraTone::new(knots)
+}
+
 fn median(values: &mut [f64]) -> Option<f64> {
     values.sort_by(f64::total_cmp);
     values.get(values.len() / 2).copied()
 }
 
-fn fit_tone(mut pairs: Vec<(f64, f64)>) -> Option<CameraTone> {
+/// The earlier tone fit, kept as the fallback of [`ToneFit`]: the JPEG's median per equal-population
+/// bin of scene luminance, then pooled-adjacent-violators isotonic regression. It follows the
+/// per-pixel pairs closely when the two images are registered, which is why it can clear the
+/// acceptance gates where [`fit_tone`] just misses them, but on lens-corrected JPEGs of busy scenes
+/// the pooling leaves flat steps (issue #475).
+fn fit_tone_conditional(mut pairs: Vec<(f64, f64)>) -> Option<CameraTone> {
     if pairs.len() < 128 || !pairs.iter().all(|(x, y)| x.is_finite() && *x > 0.0 && y.is_finite()) {
         return None;
     }
@@ -729,6 +1083,23 @@ fn fit_tone(mut pairs: Vec<(f64, f64)>) -> Option<CameraTone> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn camera_jpeg_matches_the_sensor_proxy_size_exactly() {
+        // An ILCE-7RM4 ARW (9504×6336 crop) embeds a 1616×1080 preview; for the camera-profile proxy
+        // it is decoded at 384×257 (`proxies`: twice the proxy edge) next to a 192×128 sensor proxy.
+        let sensor = fit(&Rgb32f::new(9504, 6336), PROFILE_PROXY, PROFILE_PROXY, Filter::Box);
+        assert_eq!((sensor.width, sensor.height), (192, 128));
+        let jpeg = Rgb32f::new(384, 257);
+        // what fitting gave before: a pixel short, so every pair was rejected
+        assert_eq!(fit(&jpeg, sensor.width, sensor.height, Filter::Box).width, 191);
+        let r = reference_at(&jpeg, &sensor);
+        assert_eq!((r.width, r.height), (192, 128));
+        // and at the single-photo proxy size, where fitting happened to land on the same size
+        let sensor = fit(&Rgb32f::new(9504, 6336), PROXY, PROXY, Filter::Box);
+        let r = reference_at(&Rgb32f::new(192, 129), &sensor);
+        assert_eq!((r.width, r.height), (sensor.width, sensor.height));
+    }
+
     #[test]
     fn linear_arw_gets_a_sensor_proxy_without_demosaicing() {
         use lightcraft_raw::{BlackLevel, ColorData, OpcodeLists, Orientation, RawData, RawFormat, Rect};
@@ -1021,7 +1392,18 @@ mod tests {
     #[test]
     fn supported_raws_get_a_file_local_look() {
         // every decoded raw without a colour matrix of its own (issue #310: CR2 rendered flat with the fallback)
-        let local = [RawFormat::Arw, RawFormat::Nef, RawFormat::Nrw, RawFormat::Rw2, RawFormat::Raf, RawFormat::Cr3, RawFormat::Cr2, RawFormat::Pef];
+        let local = [
+            RawFormat::Arw,
+            RawFormat::Nef,
+            RawFormat::Nrw,
+            RawFormat::Rw2,
+            RawFormat::Raf,
+            RawFormat::Cr3,
+            RawFormat::Cr2,
+            RawFormat::Pef,
+            RawFormat::Srw,
+            RawFormat::Orf,
+        ];
         assert!(local.into_iter().all(file_local_look));
         // DNG carries its own colour model
         assert!(!file_local_look(RawFormat::Dng));
@@ -1088,6 +1470,40 @@ mod tests {
         assert_eq!(info.camera_tone.is_some(), look.is_some());
     }
 
+    /// A public ILCE-7CR sample (skipped without the corpus) takes its colour from the bundled ILCE-7CR profile and
+    /// passes the acceptance gates with it: the fitted look keeps the profile's matrix and table, which the photo's
+    /// own fit (the fallback when a profile is rejected) would not.
+    #[test]
+    fn corpus_a7cr_uses_the_bundled_profile() {
+        let path = std::env::var_os("LIGHTCRAFT_CORPUS")
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(|| std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus"))
+            .join("raw/arw-sony-a7cr-lossless-l.arw");
+        let bytes = match std::fs::read(&path) {
+            Ok(bytes) => bytes,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                eprintln!("skip: {} absent", path.display());
+                return;
+            }
+            Err(e) => panic!("{}: {e}", path.display()),
+        };
+        let (_, json) = crate::camera_profiles::BUNDLED.iter().find(|(m, _)| *m == "ILCE-7CR").expect("ILCE-7CR is built in");
+        let bundled: crate::camera_profiles::CameraProfile = serde_json::from_str(json).unwrap();
+        let used = crate::camera_profiles::get("ILCE-7CR").expect("ILCE-7CR profile");
+        assert_eq!(*used, bundled, "a local ILCE-7CR profile overrides the built-in one; remove it to run this test");
+        let raw = lightcraft_raw::decode(&bytes).unwrap();
+        assert_eq!(raw.metadata.model.as_deref(), Some("ILCE-7CR"));
+        let transform = lightcraft_raw::color::camera_transform(&raw, lightcraft_raw::color::as_shot_white_xy(&raw));
+        let look = fit_preview(&raw, &bytes, &transform).expect("fit accepted");
+        let expected = bundled.matrix().mul(&transform.matrix.inverse().unwrap());
+        for (row, want) in look.matrix.0.iter().zip(expected.0) {
+            for (got, want) in row.iter().zip(want) {
+                assert!((got - want).abs() < 1e-12, "the look's matrix is not the profile's: {:?} vs {:?}", look.matrix.0, expected.0);
+            }
+        }
+        assert_eq!(look.hue_sat, bundled.hue_sat, "the look's table is not the profile's");
+    }
+
     /// A public D7500 NEF (skipped without the corpus): its look is fitted to its own JPEG and white
     /// balance is relative to the as-shot look.
     #[test]
@@ -1105,6 +1521,30 @@ mod tests {
         assert!(info.relative_wb && info.as_shot_temp == 6500.0 && info.as_shot_tint == 0.0);
     }
 
+    /// The public ILCE-7CR samples (61 MP; skipped without the corpus): lossless compressed L and M and compressed
+    /// ARW2 all get a look fitted to their own JPEG, not the neutral fallback.
+    #[test]
+    fn corpus_a7cr_codings_get_a_camera_look() {
+        let dir = std::env::var_os("LIGHTCRAFT_CORPUS")
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(|| std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus"))
+            .join("raw");
+        for name in ["arw-sony-a7cr-lossless-l.arw", "arw-sony-a7cr-lossless-m.arw", "arw-sony-a7cr-compressed.arw"] {
+            let bytes = match std::fs::read(dir.join(name)) {
+                Ok(bytes) => bytes,
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                    eprintln!("skip: {name} absent");
+                    continue;
+                }
+                Err(e) => panic!("{name}: {e}"),
+            };
+            let (img, info) = crate::files::load_bytes(&bytes, 400).unwrap();
+            assert_eq!((img.width, img.height), (400, 267), "{name}: framed in the default crop");
+            assert!(info.camera_tone.is_some(), "{name}: no camera look fitted");
+            assert!(info.relative_wb && info.as_shot_temp == 6500.0 && info.as_shot_tint == 0.0, "{name}");
+        }
+    }
+
     /// A public DC-FZ1000 II RW2 shot at 4:3 on its 3:2 sensor (skipped without the corpus): the default crop is 4:3
     /// while the embedded JPEG shows the whole sensor; the look is still fitted, against the matching part of it.
     #[test]
@@ -1140,6 +1580,185 @@ mod tests {
         assert!(info.camera_tone.is_some(), "no camera look fitted");
     }
 
+    /// A look with tone curve `f` at knots `xs` and a colour model and chroma curve to keep.
+    fn dro_test_look(xs: &[f32; 32], f: &dyn Fn(f32) -> f32) -> CameraLook {
+        CameraLook {
+            matrix: Mat3([[1.6, -0.4, -0.2], [-0.2, 1.4, -0.2], [0.0, -0.3, 1.3]]),
+            tone: CameraTone::new(xs.map(|x| [x, f(x)])).unwrap().with_chroma([1.3, 1.2, 1.1, 1.0, 1.0, 0.9, 0.6, 0.3]).unwrap(),
+            hue_sat: Some(HsvTable { hue_divisions: 4, sat_divisions: 2, val_divisions: 1, data: vec![[5.0, 1.1, 1.0]; 8], srgb_value: false }),
+        }
+    }
+
+    /// `fixed` (from `fitted`) is `min(fitted, Sony's DRO-off curve)` at every knot but the
+    /// second-last, which may stay higher (at most the fitted curve) to keep the shoulder past the
+    /// last knot below the fitted one; nowhere brighter than `fitted`, colour unchanged.
+    fn assert_lowered(fitted: &CameraLook, fixed: &CameraLook, what: &str) {
+        let dro_off = sony_dro_off_tone().unwrap();
+        assert_eq!((fixed.matrix, &fixed.hue_sat, fixed.tone.chroma()), (fitted.matrix, &fitted.hue_sat, fitted.tone.chroma()), "{what}");
+        for (i, (k, own)) in fixed.tone.knots().iter().zip(fitted.tone.knots()).enumerate() {
+            let lowered = own[1].min(dro_off.apply(own[0]));
+            assert_eq!(k[0], own[0], "{what}: knot {i}");
+            if i == 30 {
+                assert!(k[1] >= lowered && k[1] <= own[1], "{what}: knot {i} {} not in {lowered}..={}", k[1], own[1]);
+            } else {
+                assert!((k[1] - lowered).abs() < 1e-6, "{what}: knot {i} {} vs {lowered}", k[1]);
+            }
+        }
+        assert!(at_most(&fixed.tone, &fitted.tone), "{what}: brighter than the fitted curve somewhere");
+        // the same check spelled out, from deep shadows to far past the last knot (the shoulder)
+        for i in 0..=2400 {
+            let x = 0.001 * 1.005f32.powi(i);
+            assert!(fixed.tone.apply(x) <= fitted.tone.apply(x) + 1e-5, "{what} at {x}: {} > {}", fixed.tone.apply(x), fitted.tone.apply(x));
+        }
+    }
+
+    /// Issue #244: Sony's Dynamic Range Optimizer lifts the camera JPEG's shadows, not the raw's. A
+    /// look fitted to such a JPEG keeps its colour (matrix, hue/saturation table, chroma curve) and
+    /// its curve is lowered to Sony's without DRO wherever that is darker, never raised.
+    #[test]
+    fn a_dro_look_keeps_its_colour_and_is_lowered_to_the_dro_off_tone() {
+        let dro_off = sony_dro_off_tone().expect("the built-in curve is valid");
+        // the curve itself: black stays black, increasing, mid-grey where cameras put it (L* 50–75)
+        assert_eq!(dro_off.apply(0.0), 0.0);
+        let mut previous = 0.0;
+        for i in 1..200 {
+            let y = dro_off.apply(i as f32 * 0.005);
+            assert!(y > previous && y < 1.0, "{i}: {y}");
+            previous = y;
+        }
+        assert!((0.18..0.48).contains(&dro_off.apply(0.18)), "{}", dro_off.apply(0.18));
+        let xs: [f32; 32] = std::array::from_fn(|i| 0.006 * 1.13f32.powi(i as i32));
+        // a JPEG with lifted shadows: the curve comes down to Sony's, colour and chroma curve stay
+        let lifted = dro_test_look(&xs, &|x| dro_off.apply(x).powf(0.8));
+        let fixed = with_dro_off_tone(lifted.clone());
+        assert_lowered(&lifted, &fixed, "lifted");
+        assert!(fixed.tone.apply(0.02) < 0.85 * lifted.tone.apply(0.02));
+        // a camera that maps raw values darker than Sony's curve keeps its own curve exactly
+        let darker = dro_test_look(&xs, &|x| 0.7 * dro_off.apply(x));
+        assert_eq!(with_dro_off_tone(darker.clone()).tone, darker.tone);
+        // crossing curves: the lower of the two at the knots, still a valid increasing curve
+        let crossing = dro_test_look(&xs, &|x| (dro_off.apply(x) * (0.6 + x)).min(0.95));
+        assert_lowered(&crossing, &with_dro_off_tone(crossing.clone()), "crossing");
+    }
+
+    /// Past its last knot a camera curve continues as a shoulder whose rate comes from its last two
+    /// knots. Lowering the second-last knot more than the last steepened that shoulder: the curve
+    /// fitted to the CC0 NEX-5T sample (raw.pixls.us, DRO Auto) went from 0.740 to 0.843 at scene
+    /// luminance 0.63, brighter than before. The lowered curve must stay at or below the fitted one
+    /// through the shoulder, on that curve and on many others.
+    #[test]
+    fn the_lowered_curve_stays_below_the_fitted_one_past_its_last_knot() {
+        let nex5t: [[f32; 2]; 32] = [
+            [0.014948029, 0.017424058],
+            [0.018395446, 0.023981506],
+            [0.021539066, 0.030581286],
+            [0.024555191, 0.0374646],
+            [0.027602654, 0.044408206],
+            [0.030193308, 0.049894042],
+            [0.03261828, 0.055907387],
+            [0.034544908, 0.06156683],
+            [0.03669959, 0.06814718],
+            [0.039161213, 0.075263545],
+            [0.04173663, 0.0830011],
+            [0.044166446, 0.088166036],
+            [0.04682434, 0.095398724],
+            [0.049544845, 0.1027153],
+            [0.05235826, 0.11173598],
+            [0.05497513, 0.119017586],
+            [0.057503678, 0.12616614],
+            [0.059836045, 0.13521175],
+            [0.062677935, 0.14601946],
+            [0.06599234, 0.15573128],
+            [0.069809504, 0.16883339],
+            [0.0755404, 0.1854325],
+            [0.08250754, 0.20684941],
+            [0.089204684, 0.23466235],
+            [0.09650368, 0.25805998],
+            [0.102161564, 0.27849936],
+            [0.107812546, 0.29706743],
+            [0.11410169, 0.31379074],
+            [0.12000221, 0.33262977],
+            [0.12776275, 0.35407156],
+            [0.1387929, 0.38362882],
+            [0.19492775, 0.43935108],
+        ];
+        let fitted = CameraLook { tone: CameraTone::new(nex5t).unwrap(), ..dro_test_look(&std::array::from_fn(|i| 0.01 + i as f32 * 0.01), &|x| x) };
+        let fixed = with_dro_off_tone(fitted.clone());
+        assert_lowered(&fitted, &fixed, "NEX-5T");
+        assert!((fitted.tone.apply(0.63) - 0.7405).abs() < 1e-3 && fixed.tone.apply(0.63) <= fitted.tone.apply(0.63));
+        assert_ne!(fixed.tone, fitted.tone, "the lifted mid-tones still come down");
+        // curves that end at all kinds of scene luminances, slopes and heights relative to Sony's
+        let dro_off = sony_dro_off_tone().unwrap();
+        let mut seed = 0x9e37_79b9_u32;
+        let mut next = move || {
+            seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+            f32::from((seed >> 16) as u16) / 65536.0
+        };
+        for case in 0..300 {
+            let (start, span) = (0.002 + 0.03 * next(), 1.05 + 0.15 * next());
+            let xs: [f32; 32] = std::array::from_fn(|i| start * span.powi(i as i32));
+            let (lift, gain, top) = (0.5 + 0.6 * next(), 0.6 + 0.8 * next(), next());
+            // brighter or darker than Sony's, with a last knot sometimes lowered less than the one before
+            let f = |x: f32| (gain * dro_off.apply(x).powf(lift) + top * 0.2 * (x / xs[31]).powi(8)).min(0.995);
+            let mut ys = xs.map(f);
+            for i in 1..32 {
+                ys[i] = ys[i].max(ys[i - 1]);
+            }
+            let Some(tone) = CameraTone::new(std::array::from_fn(|i| [xs[i], ys[i]])) else { continue };
+            let fitted = CameraLook { tone, ..dro_test_look(&std::array::from_fn(|i| 0.01 + i as f32 * 0.01), &|x| x) };
+            assert_lowered(&fitted, &with_dro_off_tone(fitted.clone()), &format!("case {case}"));
+        }
+    }
+
+    /// Issue #244 (skipped without the corpus): the public ILCE-7RM2 sample (Standard creative
+    /// style) was shot with DRO Auto, so its curve comes down to Sony's without DRO in the shadows the
+    /// camera lifted; the ILCE-7M4 sample (DRO Auto, Vivid) has deeper shadows than that curve and
+    /// keeps them, only its brighter highlights come down. Both keep the colour fitted to their
+    /// JPEGs. The ILCE-7M3 sample (DRO off) keeps its own fit.
+    #[test]
+    fn corpus_arw_with_dro_is_lowered_to_the_dro_off_tone() {
+        let dir = std::env::var_os("LIGHTCRAFT_CORPUS")
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(|| std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus"))
+            .join("raw");
+        let samples = [
+            ("arw-sony-a7rm2-12bit-uncompressed.arw", true, [0.01, 0.05, 0.1]),
+            ("arw-sony-a7m4-14bit.arw", true, [0.3, 0.4, 0.5]),
+            ("arw-sony-a7m3-compressed.arw", false, [0.0; 3]),
+        ];
+        for (name, dro, lowered) in samples {
+            let path = dir.join(name);
+            let bytes = match std::fs::read(&path) {
+                Ok(bytes) => bytes,
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                    eprintln!("skip: {} absent", path.display());
+                    continue;
+                }
+                Err(e) => panic!("{}: {e}", path.display()),
+            };
+            assert_eq!(lightcraft_raw::embedded_preview_dynamic_range_optimized(&bytes), Some(dro), "{name}");
+            let mut raw = lightcraft_raw::decode(&bytes).unwrap();
+            raw.opcodes.list3.retain(|op| !op.is_lens_correction());
+            let transform = lightcraft_raw::color::camera_transform(&raw, lightcraft_raw::color::as_shot_white_xy(&raw));
+            let look = fit_preview(&raw, &bytes, &transform).expect("a camera look");
+            // the look fitted to the JPEG, as before this change
+            let (sensor, reference, clipped) = proxies(&raw, &bytes, &transform, PROXY).unwrap();
+            let profile = raw.metadata.model.as_deref().and_then(crate::camera_profiles::get);
+            let colour = profile.as_ref().and_then(|p| Some((p.matrix().mul(&transform.matrix.inverse()?), p.hue_sat.clone())));
+            let fitted = fit_look(&sensor, &reference, &clipped, colour).unwrap();
+            if dro {
+                assert_lowered(&fitted, &look, name);
+                for x in lowered {
+                    assert!(look.tone.apply(x) < 0.95 * fitted.tone.apply(x), "{name} at {x}: {} vs {}", look.tone.apply(x), fitted.tone.apply(x));
+                }
+            } else {
+                assert_eq!((look.matrix, &look.hue_sat, look.tone), (fitted.matrix, &fitted.hue_sat, fitted.tone), "{name}");
+            }
+            let (_, info) = crate::files::load_bytes(&bytes, 400).unwrap();
+            assert_eq!(info.camera_tone, Some(look.tone), "{name}");
+        }
+    }
+
     /// Issue #232: an ILCE-7RM2 camera JPEG is lens-corrected ("Distortion Comp.: Auto"), so on a
     /// façade of window frames the raw and its JPEG are a pixel or two apart. The colours agree
     /// everywhere away from the edges, and the look must still be found there.
@@ -1228,4 +1847,297 @@ mod tests {
         reference.data.truncate(8);
         assert!(fit_pairs(&sensor, &reference).is_none());
     }
+
+    /// A busy scene whose JPEG is the camera curve of the scene two proxy pixels to the right (a
+    /// lens-corrected preview): the fitted curve follows the camera's and has no flat steps.
+    #[test]
+    fn tone_fit_has_no_steps_on_a_misregistered_jpeg() {
+        let camera = |x: f64| 0.6 * x.powf(0.55) / (1.0 + 0.2 * x);
+        let (w, h) = (96usize, 64usize);
+        let mut seed = 0x2545_f491_u32;
+        let mut scene = Vec::with_capacity(w * h);
+        for _ in 0..w * h {
+            seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+            scene.push(0.01 * (5.0 * f64::from(seed >> 8) / f64::from(1u32 << 24)).exp());
+        }
+        let pairs: Vec<(f64, f64)> =
+            (0..h).flat_map(|y| (0..w - 2).map(move |x| (y * w + x, y * w + x + 2))).map(|(i, j)| (scene[i], camera(scene[j]))).collect();
+        let curve = fit_tone(pairs).unwrap();
+        let mut sorted = scene.clone();
+        sorted.sort_by(f64::total_cmp);
+        let (lo, hi) = (sorted[sorted.len() / 50], sorted[sorted.len() * 49 / 50]);
+        let mut x = lo;
+        while x < hi {
+            let (a, b) = (curve.apply(x as f32), curve.apply((x * 1.02) as f32));
+            assert!(b > a, "flat step at {x}: {a} -> {b}");
+            assert!((f64::from(a) / camera(x) - 1.0).abs() < 0.05, "at {x}: {a} vs {}", camera(x));
+            x *= 1.02;
+        }
+    }
+
+    /// A synthetic photo whose JPEG is the camera look of the scene scaled per pixel by noise of
+    /// `spread` (a pseudo-random, registration-free stand-in for local tone mapping): the per-bin
+    /// median recovers the curve, while the JPEG's broadened distribution stretches the quantile fit.
+    fn noisy_look(spread: f32) -> (Rgb32f, Rgb32f) {
+        let known = Mat3([[1.8, -0.4, -0.1], [-0.2, 1.5, -0.1], [-0.05, -0.3, 1.7]]);
+        let (w, h) = (96usize, 64usize);
+        let mut sensor = Rgb32f::new(w, h);
+        let mut reference = sensor.clone();
+        let mut seed = 0x9e37_79b9_u32;
+        let mut next = move || {
+            seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+            f32::from((seed >> 16) as u16) / 32768.0 - 1.0
+        };
+        for (src, dst) in sensor.data.iter_mut().zip(&mut reference.data) {
+            let ev = 0.05 + (next() + 1.0) * 0.2;
+            *src = [ev * (0.8 + (next() + 1.0) * 0.1), ev, ev * (0.8 + (next() + 1.0) * 0.1)];
+            let p = known.apply_f32(*src);
+            let y = luminance_2020(p);
+            let scale = (1.0 - (-2.5 * y).exp()) / y * (1.0 + spread * next());
+            *dst = p.map(|v| v * scale);
+        }
+        (sensor, reference)
+    }
+
+    /// A camera rendering with constant colourfulness (no highlight bleaching) of a colourful scene
+    /// under a bright neutral sky, whose sensor pixels are clipped: one channel held at the clip
+    /// level turns the white sky magenta in the raw while the camera JPEG keeps it white. Returns
+    /// the sensor proxy, the JPEG proxy and the clip mask.
+    fn clipped_sky_scene() -> (Rgb32f, Rgb32f, Vec<bool>) {
+        let known = Mat3([[1.8, -0.4, -0.1], [-0.2, 1.5, -0.1], [-0.05, -0.3, 1.7]]);
+        let (w, h) = (96usize, 64usize);
+        let mut sensor = Rgb32f::new(w, h);
+        let mut reference = sensor.clone();
+        let mut clipped = vec![false; w * h];
+        let mut seed = 0x2545_f491_u32;
+        let mut next = move || {
+            seed = seed.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+            f32::from((seed >> 16) as u16) / 65536.0
+        };
+        let camera = |p: [f32; 3]| {
+            let y = luminance_2020(p);
+            let o = 1.0 - (-2.5 * y).exp();
+            p.map(|v| (v * o / y).clamp(0.0, 0.97))
+        };
+        // the sky: a quarter of the frame, white in the scene and in the JPEG
+        let neutral = known.inverse().unwrap().apply_f32([0.32; 3]);
+        for (i, (src, dst)) in sensor.data.iter_mut().zip(&mut reference.data).enumerate() {
+            let scene = if i < w * h / 4 {
+                clipped[i] = true;
+                let sky = neutral.map(|v| v * (0.8 + 0.4 * next()));
+                *dst = camera(known.apply_f32(sky));
+                // the green sample clips, red and blue (after white balance) go on rising
+                *src = [sky[0] * 1.35, sky[1] * 0.85, sky[2] * 1.4];
+                continue;
+            } else {
+                // colourful foliage, leaves, bark and bright flowers from dark to light
+                let ev = 0.02 + next() * 0.4;
+                [ev * (0.6 + next() * 0.8), ev, ev * (0.5 + next() * 0.8)]
+            };
+            *src = scene;
+            *dst = camera(known.apply_f32(scene));
+        }
+        (sensor, reference, clipped)
+    }
+
+    /// Mean colourfulness (distance from neutral of luminance-normalised RGB) of the unclipped
+    /// pixels rendered with `look`, over that of the camera JPEG, per display-luminance band.
+    fn colourfulness_ratio(look: &CameraLook, sensor: &Rgb32f, reference: &Rgb32f, clipped: &[bool], band: std::ops::Range<f64>) -> f64 {
+        let chroma = |p: [f64; 3]| {
+            let y = luma(p);
+            p.iter().map(|v| (v / y - 1.0).powi(2)).sum::<f64>().sqrt()
+        };
+        let tone = ToneMap::camera(&look.tone, 0.0, 0.0, 0.0);
+        let (mut rendered, mut camera) = (0.0, 0.0);
+        for ((x, y), c) in sensor.data.iter().zip(&reference.data).zip(clipped) {
+            let y = y.map(f64::from);
+            if *c || !band.contains(&luma(y)) {
+                continue;
+            }
+            rendered += chroma(displayed(look.matrix.apply(x.map(f64::from)), &tone));
+            camera += chroma(y);
+        }
+        rendered / camera
+    }
+
+    /// Clipped sensor pixels are left out of the look's training pairs: a clipped white sky no longer
+    /// dulls the colour matrix or makes the chroma curve remove colour at the sky's brightness.
+    #[test]
+    fn clipped_sky_does_not_dull_the_look() {
+        let (sensor, reference, clipped) = clipped_sky_scene();
+        let old = fit_pairs(&sensor, &reference).expect("the earlier fit accepts the look");
+        let new = fit_look(&sensor, &reference, &clipped, None).expect("look without the clipped pixels");
+        let (mid, bright) = (0.1..0.35, 0.35..0.75);
+        let old_ratio = (
+            colourfulness_ratio(&old, &sensor, &reference, &clipped, mid.clone()),
+            colourfulness_ratio(&old, &sensor, &reference, &clipped, bright.clone()),
+        );
+        let new_ratio =
+            (colourfulness_ratio(&new, &sensor, &reference, &clipped, mid), colourfulness_ratio(&new, &sensor, &reference, &clipped, bright));
+        // with the clipped sky in the pairs, the bright colours lose much of their colour
+        assert!(old_ratio.1 < 0.8, "earlier fit: colourfulness vs camera {old_ratio:?}, chroma {:?}", old.tone.chroma());
+        // without it, the render keeps the camera's colourfulness at every brightness
+        for r in [new_ratio.0, new_ratio.1] {
+            assert!((0.9..1.1).contains(&r), "colourfulness vs camera {new_ratio:?}, chroma {:?}", new.tone.chroma());
+        }
+        assert!(new.tone.chroma().iter().all(|k| *k > 0.85), "no colour cut: {:?}", new.tone.chroma());
+    }
+
+    /// When the accepted attempt misses the gates without the clipped pixels (here: too few pixels
+    /// left), the look fitted on all pixels is kept unchanged.
+    #[test]
+    fn clipped_fit_falls_back_to_all_pixels() {
+        let (sensor, reference, _) = clipped_sky_scene();
+        let all = fit_pairs(&sensor, &reference).unwrap();
+        // nearly everything clipped: too few pairs remain, the earlier look is used unchanged
+        let mut clipped = vec![true; sensor.data.len()];
+        clipped[..100].iter_mut().for_each(|c| *c = false);
+        let fallback = fit_look(&sensor, &reference, &clipped, None).expect("the fallback keeps the look");
+        assert_eq!((fallback.matrix.0, fallback.tone), (all.matrix.0, all.tone));
+        // nothing clipped: the same look as before, exactly
+        let none = fit_look(&sensor, &reference, &vec![false; sensor.data.len()], None).unwrap();
+        assert_eq!((none.matrix.0, none.tone), (all.matrix.0, all.tone));
+        // without clipped pixels the refit keeps the accepted attempt (here: all pixels, own colour, quantile tone)
+        let (_, attempt) = search_ordered(&sensor, &reference, None, TONE_FITS).unwrap();
+        assert_eq!(attempt, Attempt { tone: ToneFit::Quantile, profile: false, away_from_edges: false });
+        assert!(without_clipped(&sensor, &[true; 3]).is_none(), "a mask of another size is ignored");
+    }
+
+    /// Quantile matching is tried first; the conditional-median fit is the fallback and is used
+    /// only where the quantile look misses the acceptance gates, so no photo loses its look.
+    #[test]
+    fn tone_fit_order_quantile_first_conditional_median_as_fallback() {
+        // Clean data: both fits pass, the default order uses the quantile curve (increasing).
+        let (sensor, reference) = noisy_look(0.0);
+        let default = fit_pairs(&sensor, &reference).expect("clean look");
+        let quantile = fit_pairs_ordered(&sensor, &reference, None, &[ToneFit::Quantile]).expect("quantile passes");
+        assert_eq!(default.tone, quantile.tone);
+        // Noisy data: the quantile fit misses the gates, the conditional median still passes.
+        let (sensor, reference) = noisy_look(0.33);
+        assert!(fit_pairs_ordered(&sensor, &reference, None, &[ToneFit::Quantile]).is_none(), "quantile alone misses the gates");
+        let conditional = fit_pairs_ordered(&sensor, &reference, None, &[ToneFit::ConditionalMedian]).expect("conditional median passes");
+        let default = fit_pairs(&sensor, &reference).expect("the fallback keeps the look");
+        assert_eq!(default.tone, conditional.tone);
+        // The order matters only through the first pass; with the fits swapped the conditional one wins even on clean data.
+        let (sensor, reference) = noisy_look(0.0);
+        let swapped = fit_pairs_ordered(&sensor, &reference, None, &[ToneFit::ConditionalMedian, ToneFit::Quantile]).unwrap();
+        let conditional = fit_pairs_ordered(&sensor, &reference, None, &[ToneFit::ConditionalMedian]).unwrap();
+        assert_eq!(swapped.tone, conditional.tone);
+    }
+
+    /// The camera look of `scene` (the known matrix of these tests, then a bright camera curve).
+    fn bright_camera(p: [f32; 3]) -> [f32; 3] {
+        let known = Mat3([[1.8, -0.4, -0.1], [-0.2, 1.5, -0.1], [-0.05, -0.3, 1.7]]);
+        let q = known.apply_f32(p);
+        let y = luminance_2020(q);
+        if y <= 0.0 { [0.0; 3] } else { q.map(|v| v * (1.0 - (-4.0 * y).exp()) / y) }
+    }
+
+    /// Mean squared error (all channels, display-linear) of `render` against `target` over `scene`.
+    fn mean_error(scene: &Rgb32f, target: impl Fn([f32; 3]) -> [f32; 3], render: impl Fn([f64; 3]) -> [f64; 3]) -> f64 {
+        let error: f64 = scene
+            .data
+            .iter()
+            .map(|x| {
+                let (p, t) = (render(x.map(f64::from)), target(*x));
+                (0..3).map(|c| (p[c] - f64::from(t[c])).powi(2)).sum::<f64>()
+            })
+            .sum();
+        error / (3 * scene.data.len()) as f64
+    }
+
+    /// A colourful scene with fine detail everywhere (foliage) whose camera JPEG is lens-corrected:
+    /// barrel distortion moves the picture by up to about 4 proxy pixels toward the corners, so the
+    /// detail no longer pairs with itself and no global look passes the gates, on all pixels or
+    /// away from edges. The partial look still follows the camera's brightness, colourfulness and
+    /// hues: on the registered scene it is far closer to the camera than the neutral fallback,
+    /// which renders the scene dark and grey.
+    #[test]
+    fn partial_look_when_a_lens_corrected_jpeg_misses_the_gates() {
+        let (w, h) = (96usize, 64usize);
+        let scene = |u: f32, v: f32| -> [f32; 3] {
+            let base = 0.1 * (1.0 + 0.6 * (0.05 * u + 0.04 * v).sin());
+            let detail = 1.0 + 0.8 * (1.7 * u).sin() * (1.3 * v).sin();
+            let y = base * detail;
+            [y * (0.6 + 0.5 * (0.07 * u).sin().abs()), y, y * (0.5 + 0.6 * (0.09 * v + 0.03 * u).cos().abs())]
+        };
+        let (cx, cy) = (w as f32 / 2.0, h as f32 / 2.0);
+        let mut sensor = Rgb32f::new(w, h);
+        let mut reference = sensor.clone();
+        for y in 0..h {
+            for x in 0..w {
+                let (dx, dy) = (x as f32 - cx, y as f32 - cy);
+                let k = 1.0 + 0.08 * (dx * dx + dy * dy) / (cx * cx);
+                sensor.data[y * w + x] = scene(x as f32, y as f32);
+                reference.data[y * w + x] = bright_camera(scene(cx + dx * k, cy + dy * k));
+            }
+        }
+        assert!(fit_pairs(&sensor, &reference).is_none(), "the full look misses the gates");
+        let look = fit_look(&sensor, &reference, &vec![false; w * h], None).expect("a partial look instead of the neutral fallback");
+        assert!(look.hue_sat.is_none());
+        assert_ne!(look.matrix, Mat3::IDENTITY, "a colourful scene gets the damped matrix");
+        // on the registered scene, against what the camera renders
+        let tone = ToneMap::camera(&look.tone, 0.0, 0.0, 0.0);
+        let neutral = ToneMap::new(0.0, 0.0, 0.0);
+        let partial = mean_error(&sensor, bright_camera, |x| displayed(look.matrix.apply(x), &tone));
+        let fallback = mean_error(&sensor, bright_camera, |x| displayed(x, &neutral));
+        assert!(partial < fallback * 0.25, "partial {partial:.5}, neutral fallback {fallback:.5}");
+        assert!(tone.apply(0.05) < tone.apply(0.2) && tone.apply(0.2) < tone.apply(0.8));
+    }
+
+    /// An overcast, nearly colourless scene (under 5% of the pixels coloured, so no colour matrix is
+    /// learnt and the full look is never tried) whose camera renders it two stops brighter than the
+    /// neutral fallback: the partial look is the tone curve (and chroma curve) alone.
+    #[test]
+    fn partial_look_brightens_a_dull_scene_without_learning_colour() {
+        let (w, h) = (96usize, 64usize);
+        let mut sensor = Rgb32f::new(w, h);
+        for (i, p) in sensor.data.iter_mut().enumerate() {
+            let ev = 0.01 + (i % 37) as f32 * 0.004;
+            let tint = if i % 50 == 0 { 1.3 } else { 1.0 + (i % 5) as f32 * 0.004 };
+            *p = [ev * tint, ev, ev * (2.0 - tint)];
+        }
+        let camera = |p: [f32; 3]| {
+            let y = luminance_2020(p);
+            p.map(|v| v * (1.0 - (-12.0 * y).exp()) / y)
+        };
+        let mut reference = sensor.clone();
+        reference.map_in_place(camera);
+        assert!(fit_pairs(&sensor, &reference).is_none(), "too little colour for the full look");
+        let look = fit_look(&sensor, &reference, &vec![false; w * h], None).expect("a partial look");
+        assert_eq!(look.matrix, Mat3::IDENTITY, "no colour matrix from a colourless scene");
+        let tone = ToneMap::camera(&look.tone, 0.0, 0.0, 0.0);
+        let neutral = ToneMap::new(0.0, 0.0, 0.0);
+        let lightness =
+            |tone: &ToneMap| sensor.data.iter().map(|p| f64::from(tone.apply(luminance_2020(*p)))).sum::<f64>() / sensor.data.len() as f64;
+        let target = reference.data.iter().map(|p| f64::from(luminance_2020(*p))).sum::<f64>() / reference.data.len() as f64;
+        assert!((lightness(&tone) / target - 1.0).abs() < 0.05, "{} vs {target}", lightness(&tone));
+        assert!(lightness(&neutral) < target * 0.6, "the neutral fallback is far darker");
+    }
+
+    /// When the neutral fallback already matches the camera JPEG, or the JPEG is unrelated or
+    /// monochrome, the partial look isn't clearly better and the photo keeps the neutral fallback.
+    #[test]
+    fn partial_look_only_when_clearly_better_than_the_neutral_fallback() {
+        let (w, h) = (96usize, 64usize);
+        let mut sensor = Rgb32f::new(w, h);
+        for (i, p) in sensor.data.iter_mut().enumerate() {
+            let ev = 0.02 + (i % 41) as f32 * 0.012;
+            *p = [ev * (0.7 + (i % 11) as f32 * 0.05), ev, ev * (0.7 + (i % 13) as f32 * 0.045)];
+        }
+        let none = vec![false; w * h];
+        // the camera renders exactly as the neutral fallback: nothing to gain
+        let neutral = ToneMap::new(0.0, 0.0, 0.0);
+        let mut reference = sensor.clone();
+        reference.map_in_place(|p| displayed(p.map(f64::from), &neutral).map(|v| v as f32));
+        assert!(fit_partial(&sensor, &reference).is_none(), "no clear gain over the fallback");
+        // an unrelated picture
+        for (i, p) in reference.data.iter_mut().enumerate() {
+            *p = [0.05 + (i % 7) as f32 * 0.07, 0.05 + (i % 19) as f32 * 0.02, 0.05 + (i % 29) as f32 * 0.01];
+        }
+        assert!(fit_look(&sensor, &reference, &none, None).is_none(), "unrelated JPEG");
+        // a black-and-white JPEG of the scene
+        reference.data.iter_mut().zip(&sensor.data).for_each(|(r, s)| *r = [0.8 * luminance_2020(*s).sqrt(); 3]);
+        assert!(fit_look(&sensor, &reference, &none, None).is_none(), "monochrome JPEG");
+    }
 }
diff --git a/crates/engine/src/camera_profiles.rs b/crates/engine/src/camera_profiles.rs
index 80192cf6..6c35c2a4 100644
--- a/crates/engine/src/camera_profiles.rs
+++ b/crates/engine/src/camera_profiles.rs
@@ -25,6 +25,7 @@ const MAX_FILE: u64 = 4 << 20;
 /// Profiles built into LightCraft (`assets/camera-profiles/`, see `assets/ATTRIBUTION.md`):
 /// `(model, JSON)`.
 pub const BUNDLED: &[(&str, &str)] = &[
+    ("ILCE-7CR", include_str!("../../../assets/camera-profiles/ILCE-7CR.json")),
     ("ILCE-7M4", include_str!("../../../assets/camera-profiles/ILCE-7M4.json")),
     ("X-H2S", include_str!("../../../assets/camera-profiles/X-H2S.json")),
     ("X-T4", include_str!("../../../assets/camera-profiles/X-T4.json")),
diff --git a/crates/engine/src/cmd/browse.rs b/crates/engine/src/cmd/browse.rs
index e5074d9e..6406db47 100644
--- a/crates/engine/src/cmd/browse.rs
+++ b/crates/engine/src/cmd/browse.rs
@@ -286,7 +286,7 @@ pub(crate) fn move_folder(s: &mut Session, from: &str, to: &str) -> std::result:
         return Err("the library's own folders can't be moved here".into());
     }
     rename_folder_on_disk(from, to)?;
-    let ops: Vec<Op> = s
+    let mut ops: Vec<Op> = s
         .catalog
         .photos()
         .filter_map(|p| match &p.source {
@@ -301,6 +301,8 @@ pub(crate) fn move_folder(s: &mut Session, from: &str, to: &str) -> std::result:
         })
         .collect();
     let n = ops.len();
+    // what the library knows about the folder (and those inside it) goes along, in the same step
+    ops.extend(s.catalog.folder_records_follow(from, to));
     let name = Path::new(to).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
     let renamed = src.parent() == dst.parent();
     let label = if renamed { format!("Rename Folder to “{name}”") } else { format!("Move Folder “{name}”") };
diff --git a/crates/engine/src/cmd/convert.rs b/crates/engine/src/cmd/convert.rs
index e946d1fa..2b1b368b 100644
--- a/crates/engine/src/cmd/convert.rs
+++ b/crates/engine/src/cmd/convert.rs
@@ -210,6 +210,25 @@ fn fill_missing_meta(id: lightcraft_catalog::PhotoId, ph: &lightcraft_catalog::P
     ops
 }
 
+/// Ops that give a photo the lens data its file carries now (`info`, a fresh probe), or none when
+/// it already has them. A catalog from before the lens data was read at import has none, so such a
+/// photo's correction stayed off. When the photo gains lens data and its develop settings are still
+/// what import gave it, the lens correction is turned on as import would; an edited photo keeps
+/// its settings.
+pub(crate) fn lens_ops(id: lightcraft_catalog::PhotoId, ph: &lightcraft_catalog::Photo, info: &crate::media::ProbeInfo) -> Vec<Op> {
+    if info.embedded_lens == ph.embedded_lens {
+        return Vec::new();
+    }
+    let mut ops = vec![Op::SetEmbeddedLens { id, lens: info.embedded_lens.map(Box::new) }];
+    // (a photo with a default-preset look keeps it: that look is its import state)
+    if ph.embedded_lens.is_none() && info.embedded_lens.is_some() && ph.import_look.is_none() && !ph.is_edited() && !ph.develop.optics.lens_profile {
+        let mut d = (*ph.develop).clone();
+        d.optics.lens_profile = true;
+        ops.push(Op::SetDevelop { id, settings: std::sync::Arc::new(d), label: "Lens Corrections".into(), edited: ph.edited.clone() });
+    }
+    ops
+}
+
 /// Re-read photos whose files changed on disk (an external editor saved them): new size,
 /// dimensions and content hash, cached sources dropped. → {reloaded: [ids]}
 fn reload(s: &mut Session, p: &Value) -> Result<Value> {
@@ -229,21 +248,19 @@ fn reload(s: &mut Session, p: &Value) -> Result<Value> {
         // camera fields the catalog lacks (e.g. a raw imported before its format was read) are filled in;
         // nothing already set is overwritten
         let meta_ops = fill_missing_meta(id, ph, &info);
-        let Some(op) = content_op(id, ph, info.clone()) else {
-            if !meta_ops.is_empty() {
-                ops.extend(meta_ops);
-                reloaded.push(id);
-            }
-            continue;
-        };
-        ops.push(op);
-        ops.extend(meta_ops);
+        let mut mine: Vec<Op> = content_op(id, ph, info.clone()).into_iter().chain(meta_ops).chain(lens_ops(id, ph, &info)).collect();
+        if !mine.is_empty() {
+            ops.append(&mut mine);
+            reloaded.push(id);
+        }
         // virtual copies share the file
         for c in s.catalog.photos().filter(|c| c.copy_of == Some(id)) {
-            ops.extend(content_op(c.id, c, info.clone()));
-            reloaded.push(c.id);
+            let theirs: Vec<Op> = content_op(c.id, c, info.clone()).into_iter().chain(lens_ops(c.id, c, &info)).collect();
+            if !theirs.is_empty() {
+                ops.extend(theirs);
+                reloaded.push(c.id);
+            }
         }
-        reloaded.push(id);
     }
     for id in &reloaded {
         s.media.forget(*id);
@@ -316,7 +333,7 @@ pub fn edit_specs() -> Vec<CommandSpec> {
             "Reload from Disk",
             ["Photo"],
             None,
-            "{ids?} — re-read photos whose files changed on disk (e.g. saved by an external editor), or raws shown from their embedded preview that can be decoded now; camera fields the catalog lacks are filled in → {reloaded}",
+            "{ids?} — re-read photos whose files changed on disk (e.g. saved by an external editor), or raws shown from their embedded preview that can be decoded now; camera fields the catalog lacks are filled in, and so is the lens data the file carries (an untouched photo then gets its lens correction turned on as import would; an edited one keeps its settings) → {reloaded}",
             has_selection,
             reload
         ),
@@ -359,4 +376,102 @@ mod tests {
         ph.captured = Some("2026-10-04T08:16:11".into());
         assert!(fill_missing_meta(PhotoId(1), &ph, &info).is_empty());
     }
+
+    fn lens() -> lightcraft_develop::EmbeddedLens {
+        lightcraft_develop::EmbeddedLens {
+            warp: Some(lightcraft_develop::EmbeddedWarp { planes: [[1.0, -0.1, 0.03, 0.0, 0.0, 0.0]; 3], ..Default::default() }),
+            vignette: None,
+        }
+    }
+    fn old_rw2() -> lightcraft_catalog::Photo {
+        // as an older build catalogued it: no lens data, correction off
+        lightcraft_catalog::Photo::new(
+            lightcraft_catalog::PhotoId(1),
+            Source::File { path: "/x.rw2".into() },
+            "x.rw2",
+            "RW2",
+            4592,
+            3448,
+            "2026-10-06T00:00:00",
+        )
+    }
+
+    #[test]
+    fn reload_adds_lens_data_and_turns_the_correction_on_for_an_untouched_photo() {
+        let ph = old_rw2();
+        let info = crate::media::ProbeInfo { embedded_lens: Some(lens()), ..Default::default() };
+        let ops = lens_ops(ph.id, &ph, &info);
+        assert!(matches!(ops.first(), Some(Op::SetEmbeddedLens { lens: Some(_), .. })), "{ops:?}");
+        let Some(Op::SetDevelop { settings, .. }) = ops.get(1) else { panic!("{ops:?}") };
+        assert!(settings.optics.lens_profile);
+        // once applied, the photo is still "unedited" and has what import would have given it
+        let mut c = lightcraft_catalog::Catalog::default();
+        c.apply(Op::AddPhoto { photo: Box::new(ph) }).unwrap();
+        for op in ops {
+            c.apply(op).unwrap();
+        }
+        let after = c.photo(lightcraft_catalog::PhotoId(1)).unwrap();
+        assert_eq!(after.embedded_lens, Some(lens()));
+        assert!(!after.is_edited());
+        assert_eq!(*after.develop, after.camera_defaults());
+        assert!(lens_ops(after.id, after, &info).is_empty(), "nothing more to do the second time");
+    }
+
+    #[test]
+    fn reload_adds_lens_data_but_keeps_an_edited_photos_settings() {
+        let mut ph = old_rw2();
+        let mut d = (*ph.develop).clone();
+        d.light.exposure = 0.7;
+        ph.develop = std::sync::Arc::new(d);
+        assert!(ph.is_edited());
+        let info = crate::media::ProbeInfo { embedded_lens: Some(lens()), ..Default::default() };
+        let ops = lens_ops(ph.id, &ph, &info);
+        assert!(matches!(ops.as_slice(), [Op::SetEmbeddedLens { lens: Some(_), .. }]), "{ops:?}");
+    }
+
+    #[test]
+    fn reload_leaves_a_photo_whose_user_switched_the_correction_off_alone() {
+        let mut ph = old_rw2();
+        ph.embedded_lens = Some(lens());
+        let mut d = ph.camera_defaults();
+        d.optics.lens_profile = false;
+        ph.develop = std::sync::Arc::new(d);
+        let info = crate::media::ProbeInfo { embedded_lens: Some(lens()), ..Default::default() };
+        assert!(lens_ops(ph.id, &ph, &info).is_empty());
+    }
+
+    /// End to end on a public Panasonic raw (skipped without the corpus): a catalog from before the lens data was read
+    /// gets it on Reload, the render changes to the corrected one, and Undo takes it all back.
+    #[test]
+    fn corpus_reload_corrects_an_rw2_catalogued_without_lens_data() {
+        let root = std::env::var_os("LIGHTCRAFT_CORPUS")
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(|| Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus"));
+        let f = root.join("raw/rw2-panasonic-gx80.rw2");
+        if !f.exists() {
+            eprintln!("skip: {} absent", f.display());
+            return;
+        }
+        let mut s = Session::new().with_fs();
+        s.execute("library.import", &json!({"paths": [f.to_string_lossy()]})).unwrap();
+        let id = s.active().unwrap();
+        let ph = s.catalog.photo(id).unwrap().clone();
+        assert!(ph.embedded_lens.is_some() && ph.develop.optics.lens_profile, "import reads it");
+        // back to how 0.4.0 catalogued it
+        let mut old = (*ph.develop).clone();
+        old.optics.lens_profile = false;
+        s.catalog.apply(Op::SetEmbeddedLens { id, lens: None }).unwrap();
+        s.catalog.apply(Op::SetDevelop { id, settings: std::sync::Arc::new(old), label: "x".into(), edited: None }).unwrap();
+        s.media.forget(id);
+        let before = s.render_now(id, 160, 120).unwrap().image.data;
+        let r = s.execute("photo.reload", &json!({"ids": [id.0]})).unwrap();
+        assert_eq!(r["reloaded"], json!([id.0]));
+        let now = s.catalog.photo(id).unwrap().clone();
+        assert_eq!(now.embedded_lens, ph.embedded_lens);
+        assert!(now.develop.optics.lens_profile && !now.is_edited());
+        assert_ne!(s.render_now(id, 160, 120).unwrap().image.data, before, "the corrected render differs");
+        s.execute("edit.undo", &json!({})).unwrap();
+        let undone = s.catalog.photo(id).unwrap();
+        assert!(undone.embedded_lens.is_none() && !undone.develop.optics.lens_profile, "one undo step");
+    }
 }
diff --git a/crates/engine/src/cmd/develop.rs b/crates/engine/src/cmd/develop.rs
index e0aaaf95..33570f47 100644
--- a/crates/engine/src/cmd/develop.rs
+++ b/crates/engine/src/cmd/develop.rs
@@ -1,7 +1,7 @@
 //! Develop commands. All operate on the active photo unless `ids` are given (sync).
 
 use lightcraft_catalog::{Op, PhotoId, Version};
-use lightcraft_develop::{DevelopSettings, Preset, Section, SettingsGroup, Treatment, Upright, WbMode, controls};
+use lightcraft_develop::{DevelopSettings, Preset, ProcessVersion, Section, SettingsGroup, Treatment, Upright, WbMode, controls};
 use lightcraft_geom::{CropGeometry, CropHandle, Point, Rect, crop_fit_angle, drag_crop};
 use serde_json::{Value, json};
 
@@ -74,6 +74,49 @@ fn set_aspect(d: &mut DevelopSettings, w: f64, h: f64, aspect: Option<(u32, u32)
     d.crop.geometry = crop_fit_angle(w, h, angle, a);
 }
 
+/// Photo `id` is on an older rendering process than [`ProcessVersion::LATEST`].
+fn outdated(s: &Session, id: PhotoId) -> bool {
+    s.catalog.photo(id).is_some_and(|p| p.develop.process.is_outdated())
+}
+
+fn already_current() -> String {
+    format!("already on the current process (version {})", ProcessVersion::LATEST.0)
+}
+
+/// Update to Current Process applies to the selection (the selected photos, else the active
+/// photo): one of them is on an older rendering process. Calls that name their photos are
+/// checked by the command instead (`explicit_targets`).
+fn has_outdated_process(s: &Session) -> std::result::Result<(), String> {
+    has_selection(s)?;
+    let sel = &s.selection;
+    let targets = if sel.ids.is_empty() { sel.active.as_slice() } else { sel.ids.as_slice() };
+    if targets.iter().any(|id| outdated(s, *id)) { Ok(()) } else { Err(already_current()) }
+}
+
+/// The photos a call names (`ids`, or `id`), each of which must be in the library; `None` when it
+/// names none (the selection applies).
+fn named_photos(s: &Session, p: &Value, c: &str) -> Result<Option<Vec<PhotoId>>> {
+    if !super::names_photos(p) {
+        return Ok(None);
+    }
+    let given = match p.get("ids").filter(|v| !v.is_null()) {
+        Some(Value::Array(a)) => a.clone(),
+        Some(_) => return Err(bad(c, "`ids` must be a list of photo ids")),
+        None => p.get("id").cloned().into_iter().collect(),
+    };
+    if given.is_empty() {
+        return Err(bad(c, "`ids` names no photos"));
+    }
+    let ids = given
+        .iter()
+        .map(|v| match v.as_u64().map(PhotoId) {
+            Some(id) if s.catalog.photo(id).is_some() => Ok(id),
+            _ => Err(bad(c, format!("no such photo {v}"))),
+        })
+        .collect::<Result<Vec<_>>>()?;
+    Ok(Some(ids))
+}
+
 /// The user preset named by `p.id` (built-ins can't be changed).
 fn user_preset<'a>(s: &'a mut Session, p: &Value, c: &str) -> Result<&'a mut Preset> {
     let pid = str_param(p, "id").ok_or_else(|| bad(c, "missing id"))?;
@@ -203,12 +246,44 @@ pub fn specs() -> Vec<CommandSpec> {
                             }
                         }
                     };
-                    s.develop_op(id, fresh, "Reset")
+                    // a fresh start renders with the current process (a section or slider reset doesn't change it)
+                    s.develop_op(id, DevelopSettings { process: ProcessVersion::LATEST, ..fresh }, "Reset")
                 })
                 .collect();
             s.commit("Reset", Op::Batch { ops })?;
             ok()
         }),
+        CommandSpec {
+            explicit_targets: true,
+            ..cmd!(
+                "develop.updateProcess",
+                "Update to Current Process",
+                ["Photo"],
+                None,
+                "{ids?}: moves the target photos (`ids`, else the selection) that are on an older rendering process to the current one, as one undo step (their look can change; the sliders keep their values; see docs/process-versions.md). Enabled while a selected photo is on an older process; named photos are checked themselves (each must exist, one must be on an older process) → {changed, process}",
+                has_outdated_process,
+                |s, p| {
+                    const C: &str = "develop.updateProcess";
+                    const LABEL: &str = "Update to Current Process";
+                    let targets = match named_photos(s, p, C)? {
+                        Some(ids) if !ids.iter().any(|id| outdated(s, *id)) => return Err(crate::EngineError::Disabled(C.into(), already_current())),
+                        Some(ids) => ids,
+                        None => s.targets(p),
+                    };
+                    let ops: Vec<Op> = targets
+                        .into_iter()
+                        .filter_map(|id| s.develop_of(id).map(|d| (id, d)))
+                        .filter(|(_, d)| d.process.is_outdated())
+                        .filter_map(|(id, d)| s.develop_op(id, DevelopSettings { process: ProcessVersion::LATEST, ..(*d).clone() }, LABEL))
+                        .collect();
+                    let n = ops.len();
+                    if n > 0 {
+                        s.commit(LABEL, Op::Batch { ops })?;
+                    }
+                    Ok(json!({"changed": n, "process": ProcessVersion::LATEST}))
+                }
+            )
+        },
         cmd!(
             "develop.resetSection",
             "Reset Section",
@@ -572,6 +647,33 @@ pub fn specs() -> Vec<CommandSpec> {
                 Ok(())
             })
         }),
+        // ---- HDR editing
+        cmd!(
+            "develop.hdr",
+            "HDR",
+            [],
+            None,
+            "{enabled?: bool (default: toggle), maxEv?: number 0..5 (headroom limit, stops above SDR white)} — HDR editing: highlights above SDR white for HDR exports and displays; every SDR render uses the SDR rendition (the hdr.sdr* controls)",
+            has_active,
+            |s, p| {
+                let id = active(s, "develop.hdr")?;
+                let cur = s.develop_of(id).unwrap_or_default().hdr;
+                let enabled = bool_or(p, "enabled", !cur.enabled);
+                let max_ev = match p.get("maxEv") {
+                    None => None,
+                    Some(v) => Some(v.as_f64().filter(|x| x.is_finite()).ok_or_else(|| bad("develop.hdr", "`maxEv` must be a number"))?),
+                };
+                let label = if enabled { "HDR On" } else { "HDR Off" };
+                edit(s, "develop.hdr", label, |d| {
+                    d.hdr.enabled = enabled;
+                    if let Some(m) = max_ev {
+                        d.hdr.max_ev = m.clamp(0.0, lightcraft_develop::Hdr::MAX_EV_LIMIT);
+                    }
+                    Ok(())
+                })?;
+                Ok(json!({"enabled": enabled, "maxEv": s.develop_of(id).map(|d| d.hdr.max_ev)}))
+            }
+        ),
         // ---- geometry: Upright
         cmd!(
             "geometry.upright",
diff --git a/crates/engine/src/cmd/export.rs b/crates/engine/src/cmd/export.rs
index a8b25023..e08d0d17 100644
--- a/crates/engine/src/cmd/export.rs
+++ b/crates/engine/src/cmd/export.rs
@@ -80,6 +80,17 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
 
 pub fn specs() -> Vec<CommandSpec> {
     vec![
+        cmd!(query "export.contactSheet", "Export Contact Sheet PDF", [], None,
+            "{path, ids?: photo ids (default selection), paper?: a4|letter, landscape?: bool, columns?: 1..8, rows?: 1..10, captions?: bool} → {path, pages, photos, bytes}; replaces an existing output, never an original",
+            always, |s, p| {
+                let path = p.get("path").and_then(Value::as_str).filter(|s| !s.trim().is_empty()).ok_or_else(|| bad("export.contactSheet", "missing path"))?;
+                s.check_write_target(path).map_err(|e| bad("export.contactSheet", e))?;
+                let doc = crate::contact_sheet::prepare(s, p).and_then(|work| work.run(&mut |_, _| true)).map_err(|e| bad("export.contactSheet", e))?;
+                s.check_write_target(path).map_err(|e| bad("export.contactSheet", e))?;
+                crate::export::write_file(path, &doc.bytes).map_err(|e| bad("export.contactSheet", e))?;
+                Ok(json!({"path": path, "pages": doc.pages, "photos": doc.photos, "bytes": doc.bytes.len()}))
+            }
+        ),
         cmd!(
             "export.presets",
             "Export Presets",
diff --git a/crates/engine/src/cmd/keywords.rs b/crates/engine/src/cmd/keywords.rs
index 876cf485..b2c7e90f 100644
--- a/crates/engine/src/cmd/keywords.rs
+++ b/crates/engine/src/cmd/keywords.rs
@@ -1,10 +1,10 @@
 //! Library-wide keyword commands: list (tree with counts), suggestions, rename, delete, merge;
 //! keyword sets (nine keywords a keystroke away: ⌥1–⌥9) and Recent Keywords.
 
-use lightcraft_catalog::keywords::{clean, is_under};
+use lightcraft_catalog::keywords::{KeywordInfo, clean, closest, is_under, reparent};
 use serde_json::{Value, json};
 
-use super::{CommandSpec, always, bad, cmd, str_param};
+use super::{CommandSpec, always, bad, bool_or, cmd, str_param};
 use crate::{Result, Session};
 
 fn strs(p: &Value, key: &str) -> Vec<String> {
@@ -15,20 +15,54 @@ fn strs(p: &Value, key: &str) -> Vec<String> {
     }
 }
 
-/// Commit a keyword batch; returns how many photos changed. The keyword filter follows a renamed
-/// keyword and is cleared when its keyword is deleted.
+/// Commit a keyword batch; returns `{changed: photos changed, listed: keyword list changes}`. The
+/// keyword filter follows a renamed keyword and is cleared when its keyword is deleted.
 fn commit_keywords(s: &mut Session, label: &str, op: lightcraft_catalog::Op, follow: impl Fn(&str) -> Option<String>) -> Result<Value> {
-    let n = match &op {
-        lightcraft_catalog::Op::Batch { ops } => ops.len(),
-        _ => 1,
+    use lightcraft_catalog::Op;
+    let (photos, listed) = match &op {
+        Op::Batch { ops } => {
+            (ops.iter().filter(|o| matches!(o, Op::SetMeta { .. })).count(), ops.iter().filter(|o| matches!(o, Op::SetKeyword { .. })).count())
+        }
+        Op::SetMeta { .. } => (1, 0),
+        _ => (0, 1),
     };
-    if n > 0 {
+    if photos + listed > 0 {
         s.commit(label, op)?;
     }
     if let Some(k) = s.filter.keyword.clone() {
         s.filter.keyword = follow(&k);
     }
-    Ok(json!({"changed": n}))
+    Ok(json!({"changed": photos, "listed": listed}))
+}
+
+/// A keyword's attributes from command params over `base`: those not given keep their value.
+fn info_from(p: &Value, base: KeywordInfo) -> KeywordInfo {
+    KeywordInfo {
+        synonyms: if p.get("synonyms").is_some() {
+            strs(p, "synonyms").into_iter().map(|s| s.trim().to_string()).filter(|s| !s.is_empty()).collect()
+        } else {
+            base.synonyms
+        },
+        include_on_export: bool_or(p, "includeOnExport", base.include_on_export),
+        export_containing: bool_or(p, "exportContaining", base.export_containing),
+        export_synonyms: bool_or(p, "exportSynonyms", base.export_synonyms),
+        person: bool_or(p, "person", base.person),
+        new_keywords_inside: base.new_keywords_inside,
+    }
+}
+
+/// The keyword a command names (`keyword`), as the library writes it.
+fn named_keyword(s: &Session, p: &Value, command: &str) -> Result<String> {
+    let k = str_param(p, "keyword").ok_or_else(|| bad(command, "missing `keyword`"))?;
+    s.catalog.keyword_path(k).ok_or_else(|| bad(command, format!("no keyword “{}”", clean(k))))
+}
+
+/// A catalog refusal as a command error; a taken name says how to merge.
+fn refused(command: &str, e: lightcraft_catalog::CatalogError, how_to_merge: &str) -> crate::EngineError {
+    match e {
+        lightcraft_catalog::CatalogError::KeywordExists(k) => bad(command, format!("there is a keyword “{k}” already{how_to_merge}")),
+        e => bad(command, e.to_string()),
+    }
 }
 
 /// A named set of up to nine keywords.
@@ -38,6 +72,12 @@ pub struct KeywordSet {
     pub keywords: Vec<String>,
 }
 
+/// Two set names (or recent keywords) are the same whatever the case of any of their letters, as
+/// keywords are.
+fn same_set(a: &str, b: &str) -> bool {
+    lightcraft_catalog::keywords::same(a.trim(), b.trim())
+}
+
 /// The set name meaning "the nine most recently added keywords".
 pub const RECENT: &str = "Recent Keywords";
 
@@ -48,16 +88,54 @@ pub fn note_recent(s: &mut Session, added: &[String]) {
         if k.is_empty() {
             continue;
         }
-        s.recent_keywords.retain(|x| !x.eq_ignore_ascii_case(&k));
+        s.recent_keywords.retain(|x| !same_set(x, &k));
         s.recent_keywords.insert(0, k);
     }
     s.recent_keywords.truncate(9);
     let _ = s.save_prefs();
 }
 
+/// The largest keyword list file read: a file is input (a list of 100,000 keywords is ~2 MB).
+const MAX_LIST_BYTES: u64 = 16 << 20;
+
+/// The characters Capture One's keyword importer refuses in a list (`|` can't be in a name here).
+const CAPTURE_ONE_REFUSES: [char; 4] = [';', ',', '<', '>'];
+
+/// A keyword list file's text: at most `MAX_LIST_BYTES`, UTF-8 (with or without a byte-order mark).
+fn read_list(path: &str) -> Result<String> {
+    use std::io::Read;
+    let file = std::fs::File::open(path).map_err(|e| bad("keyword.import", format!("{path}: {e}")))?;
+    let mut bytes = Vec::new();
+    file.take(MAX_LIST_BYTES + 1).read_to_end(&mut bytes).map_err(|e| bad("keyword.import", format!("{path}: {e}")))?;
+    if bytes.len() as u64 > MAX_LIST_BYTES {
+        return Err(bad("keyword.import", format!("{path}: larger than {} MB, not a keyword list", MAX_LIST_BYTES >> 20)));
+    }
+    // Notepad and some exporters save UTF-16: say how to get the file in, not just that it isn't
+    if bytes.starts_with(&[0xff, 0xfe]) || bytes.starts_with(&[0xfe, 0xff]) {
+        return Err(bad("keyword.import", format!("{path}: UTF-16 text — save it as UTF-8 and import it again")));
+    }
+    String::from_utf8(bytes).map_err(|_| bad("keyword.import", format!("{path}: not UTF-8 text")))
+}
+
+/// A set's slots as typed: each cleaned in its place (an empty one is an empty slot, so the others
+/// keep their ⌥ keys), each keyword once whatever its case (a second one leaves its slot empty),
+/// nine at most, no empty ones at the end.
+pub fn slots(typed: &[String]) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    for k in typed.iter().take(9) {
+        let k = clean(k);
+        let twice = !k.is_empty() && out.iter().any(|x| lightcraft_catalog::keywords::same(x, &k));
+        out.push(if twice { String::new() } else { k });
+    }
+    while out.last().is_some_and(String::is_empty) {
+        out.pop();
+    }
+    out
+}
+
 /// The nine keywords ⌥1–⌥9 apply: the current set's, or the recent ones.
 pub fn current_keywords(s: &Session) -> Vec<String> {
-    let set = s.keyword_set.as_deref().and_then(|n| s.keyword_sets.iter().find(|x| x.name.eq_ignore_ascii_case(n)));
+    let set = s.keyword_set.as_deref().and_then(|n| s.keyword_sets.iter().find(|x| same_set(&x.name, n)));
     let mut v = set.map_or_else(|| s.recent_keywords.clone(), |x| x.keywords.clone());
     v.truncate(9);
     v
@@ -75,13 +153,13 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!(query "keyword.sets", "Keyword Sets", [], None, "{} → {sets: [{name, keywords}], current, keywords: the nine ⌥1–⌥9 apply}", always, |s, _| Ok(keyword_sets_json(s))),
         cmd!("keyword.useSet", "Use Keyword Set", [], None, "{name} (\"Recent Keywords\" = the recently added ones)", always, |s, p| {
             let name = str_param(p, "name").map(str::trim).unwrap_or(RECENT);
-            s.keyword_set = if name.eq_ignore_ascii_case(RECENT) || name.is_empty() {
+            s.keyword_set = if same_set(name, RECENT) || name.is_empty() {
                 None
             } else {
                 Some(
                     s.keyword_sets
                         .iter()
-                        .find(|x| x.name.eq_ignore_ascii_case(name))
+                        .find(|x| same_set(&x.name, name))
                         .ok_or_else(|| bad("keyword.useSet", format!("no keyword set `{name}`")))?
                         .name
                         .clone(),
@@ -95,24 +173,53 @@ pub fn specs() -> Vec<CommandSpec> {
             "Save Keyword Set",
             [],
             None,
-            "{name, keywords?: [up to 9] (default: the current nine)} — replaces a set of that name and makes it current",
+            "{name, keywords?: [up to 9, \"\" = an empty slot] (default: the renamed set's, else the current nine), replace?: the set it renames, new?: refuse a name another set has} — replaces a set of that name (or `replace`, in its place) and makes it current",
             always,
             |s, p| {
                 let name = str_param(p, "name")
                     .map(str::trim)
-                    .filter(|n| !n.is_empty() && !n.eq_ignore_ascii_case(RECENT))
+                    .filter(|n| !n.is_empty() && !same_set(n, RECENT))
                     .ok_or_else(|| bad("keyword.saveSet", "missing or reserved `name`"))?
                     .to_string();
-                let mut keywords: Vec<String> = if p.get("keywords").is_some() {
-                    strs(p, "keywords").iter().map(|k| clean(k)).filter(|k| !k.is_empty()).collect()
-                } else {
-                    current_keywords(s)
+                let same_name = |x: &KeywordSet, n: &str| same_set(&x.name, n);
+                // the set it renames, if any (an empty `replace` is none)
+                let renames = match str_param(p, "replace").map(str::trim).filter(|o| !o.is_empty()) {
+                    Some(old) => Some(
+                        s.keyword_sets
+                            .iter()
+                            .position(|x| same_name(x, old))
+                            .ok_or_else(|| bad("keyword.saveSet", format!("no keyword set `{old}`")))?,
+                    ),
+                    None => None,
+                };
+                // keywords not given: the renamed set's own, else the current nine
+                let keywords = if p.get("keywords").is_some() {
+                    slots(&strs(p, "keywords"))
+                } else {
+                    match renames.and_then(|at| s.keyword_sets.get(at)) {
+                        Some(x) => x.keywords.clone(),
+                        None => current_keywords(s),
+                    }
                 };
-                keywords.truncate(9);
                 let set = KeywordSet { name: name.clone(), keywords };
-                match s.keyword_sets.iter_mut().find(|x| x.name.eq_ignore_ascii_case(&name)) {
-                    Some(x) => *x = set,
-                    None => s.keyword_sets.push(set),
+                match renames {
+                    // rename: in its place, onto a name no other set has
+                    Some(at) => {
+                        if s.keyword_sets.iter().enumerate().any(|(i, x)| i != at && same_name(x, &name)) {
+                            return Err(bad("keyword.saveSet", format!("there is a keyword set “{name}” already")));
+                        }
+                        if let Some(x) = s.keyword_sets.get_mut(at) {
+                            *x = set;
+                        }
+                    }
+                    // a new set (`new`) never takes another set's name
+                    None if bool_or(p, "new", false) && s.keyword_sets.iter().any(|x| same_name(x, &name)) => {
+                        return Err(bad("keyword.saveSet", format!("there is a keyword set “{name}” already")));
+                    }
+                    None => match s.keyword_sets.iter_mut().find(|x| same_name(x, &name)) {
+                        Some(x) => *x = set,
+                        None => s.keyword_sets.push(set),
+                    },
                 }
                 s.keyword_set = Some(name);
                 s.save_prefs()?;
@@ -122,11 +229,11 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("keyword.deleteSet", "Delete Keyword Set", [], None, "{name}", always, |s, p| {
             let name = str_param(p, "name").ok_or_else(|| bad("keyword.deleteSet", "missing `name`"))?;
             let before = s.keyword_sets.len();
-            s.keyword_sets.retain(|x| !x.name.eq_ignore_ascii_case(name));
+            s.keyword_sets.retain(|x| !same_set(&x.name, name));
             if s.keyword_sets.len() == before {
                 return Err(bad("keyword.deleteSet", format!("no keyword set `{name}`")));
             }
-            if s.keyword_set.as_deref().is_some_and(|c| c.eq_ignore_ascii_case(name)) {
+            if s.keyword_set.as_deref().is_some_and(|c| same_set(c, name)) {
                 s.keyword_set = None;
             }
             s.save_prefs()?;
@@ -145,12 +252,17 @@ pub fn specs() -> Vec<CommandSpec> {
                     .and_then(Value::as_u64)
                     .filter(|i| (1..=9).contains(i))
                     .ok_or_else(|| bad("keyword.toggleFromSet", "`index` must be 1..9"))?;
-                let Some(k) = current_keywords(s).get(i as usize - 1).cloned() else {
+                // (an empty slot does nothing)
+                let Some(k) = current_keywords(s).get(i as usize - 1).cloned().filter(|k| !k.is_empty()) else {
                     return Ok(json!({"changed": 0}));
                 };
                 let ids = s.targets(p);
                 let all = !ids.is_empty()
-                    && ids.iter().all(|id| s.catalog.photo(*id).is_some_and(|ph| ph.meta.keywords.iter().any(|x| x.eq_ignore_ascii_case(&k))));
+                    && ids.iter().all(|id| {
+                        s.catalog
+                            .photo(*id)
+                            .is_some_and(|ph| ph.meta.keywords.iter().any(|x| lightcraft_catalog::keywords::same(&clean(x), &clean(&k))))
+                    });
                 let ids: Vec<u64> = ids.iter().map(|i| i.0).collect();
                 let key = if all { "removeKeywords" } else { "addKeywords" };
                 // applying from Recent Keywords mustn't reshuffle the numbers under the keys
@@ -185,6 +297,184 @@ pub fn specs() -> Vec<CommandSpec> {
                 Ok(json!(s.catalog.keyword_suggestions(&current, str_param(p, "prefix").unwrap_or(""), n)))
             }
         ),
+        cmd!(
+            query "keyword.info",
+            "Keyword Info",
+            [],
+            None,
+            "{keyword} → {path, listed, count, synonyms, includeOnExport, exportContaining, exportSynonyms, person}",
+            always,
+            |s, p| {
+                let path = named_keyword(s, p, "keyword.info")?;
+                let info = s.catalog.keyword_info(&path).cloned();
+                let count = s.catalog.photos().filter(|ph| ph.in_library() && ph.meta.keywords.iter().any(|k| is_under(k, &path))).count();
+                let mut v = serde_json::to_value(info.clone().unwrap_or_default()).unwrap_or_default();
+                if let Some(o) = v.as_object_mut() {
+                    o.insert("path".into(), json!(path));
+                    o.insert("listed".into(), json!(info.is_some()));
+                    o.insert("count".into(), json!(count));
+                    o.entry("synonyms").or_insert(json!([]));
+                }
+                Ok(v)
+            }
+        ),
+        cmd!(
+            "keyword.create",
+            "Create Keyword",
+            [],
+            None,
+            "{name, parent?: keyword | null (default: the default parent; null = the top level), synonyms?, includeOnExport?, exportContaining?, exportSynonyms?, person?, addToSelected?: bool, ids?} → {keyword}",
+            always,
+            |s, p| {
+                let name = str_param(p, "name").map(clean).filter(|n| !n.is_empty()).ok_or_else(|| bad("keyword.create", "missing `name`"))?;
+                let parent = match p.get("parent") {
+                    Some(Value::String(k)) => Some(s.catalog.keyword_path(k).unwrap_or_else(|| clean(k))),
+                    Some(_) => None,
+                    None => s.catalog.default_keyword_parent(),
+                };
+                let path = clean(&match parent {
+                    Some(parent) => format!("{parent}|{name}"),
+                    None => name,
+                });
+                let photos = if bool_or(p, "addToSelected", false) { s.targets(p) } else { Vec::new() };
+                let op = s
+                    .catalog
+                    .create_keyword_ops(&path, info_from(p, KeywordInfo::default()), &photos)
+                    .map_err(|e| refused("keyword.create", e, ""))?;
+                s.commit("Create Keyword", op)?;
+                if !photos.is_empty() {
+                    note_recent(s, std::slice::from_ref(&path));
+                }
+                Ok(json!({"keyword": path}))
+            }
+        ),
+        cmd!(
+            "keyword.edit",
+            "Edit Keyword",
+            [],
+            None,
+            "{keyword, name?: its new name (one level), synonyms?, includeOnExport?, exportContaining?, exportSynonyms?, person?} — what isn't given keeps its value",
+            always,
+            |s, p| {
+                let from = named_keyword(s, p, "keyword.edit")?;
+                let leaf = from.rsplit('|').next().unwrap_or(&from).to_string();
+                let name = str_param(p, "name").unwrap_or(&leaf).to_string();
+                let info = info_from(p, s.catalog.keyword_info(&from).cloned().unwrap_or_default());
+                let op =
+                    s.catalog.edit_keyword_ops(&from, &name, info).map_err(|e| refused("keyword.edit", e, " (to merge them, use keyword.merge)"))?;
+                let to = match from.rsplit_once('|') {
+                    Some((parent, _)) => format!("{parent}|{}", name.trim()),
+                    None => name.trim().to_string(),
+                };
+                commit_keywords(s, "Edit Keyword", op, |k| Some(if is_under(k, &from) { reparent(k, &from, &to) } else { k.to_string() }))
+            }
+        ),
+        cmd!(
+            "keyword.move",
+            "Move Keyword",
+            [],
+            None,
+            "{keyword, parent: keyword | null (the top level), merge?: bool} — with the keywords below it; onto a name that is taken only with `merge: true`",
+            always,
+            |s, p| {
+                let from = named_keyword(s, p, "keyword.move")?;
+                let parent = match p.get("parent") {
+                    Some(Value::String(k)) => Some(k.clone()),
+                    Some(Value::Null) => None,
+                    _ => return Err(bad("keyword.move", "`parent` is a keyword, or null for the top level")),
+                };
+                // where it lands, as the catalog spells it: a parent that doesn't exist yet is made
+                let leaf = from.rsplit('|').next().unwrap_or(&from).to_string();
+                let to = match parent.as_deref().map(|k| s.catalog.keyword_path(k).unwrap_or_else(|| clean(k))).filter(|k| !k.is_empty()) {
+                    Some(parent) => format!("{parent}|{leaf}"),
+                    None => leaf,
+                };
+                let op = s
+                    .catalog
+                    .move_keyword_ops(&from, parent.as_deref(), bool_or(p, "merge", false))
+                    .map_err(|e| refused("keyword.move", e, ": moving would merge the two (merge: true)"))?;
+                commit_keywords(s, "Move Keyword", op, |k| Some(if is_under(k, &from) { reparent(k, &from, &to) } else { k.to_string() }))
+            }
+        ),
+        cmd!(
+            "keyword.purgeUnused",
+            "Purge Unused Keywords",
+            [],
+            None,
+            "{} — takes off the keyword list the keywords no photo has → {purged}",
+            always,
+            |s, _| {
+                let op = s.catalog.purge_unused_keywords_ops();
+                let r = commit_keywords(s, "Purge Unused Keywords", op, |k| Some(k.to_string()))?;
+                Ok(json!({"purged": r["listed"]}))
+            }
+        ),
+        cmd!(
+            "keyword.setDefaultParent",
+            "Put New Keywords Inside",
+            [],
+            None,
+            "{keyword: keyword | null} — the parent keyword.create puts new keywords inside (null: the top level)",
+            always,
+            |s, p| {
+                let keyword = match p.get("keyword") {
+                    Some(Value::Null) | None => None,
+                    Some(_) => Some(named_keyword(s, p, "keyword.setDefaultParent")?),
+                };
+                let op = s.catalog.set_default_parent_ops(keyword.as_deref()).map_err(|e| bad("keyword.setDefaultParent", e.to_string()))?;
+                commit_keywords(s, "Put New Keywords Inside", op, |k| Some(k.to_string()))?;
+                Ok(json!({"keyword": s.catalog.default_keyword_parent()}))
+            }
+        ),
+        cmd!(
+            "keyword.export",
+            "Export Keywords",
+            [],
+            None,
+            "{path?} — the keyword list as a file (Lightroom Classic's format, which Capture One, Photo Supreme and Bridge read) → {keywords, captureOneRefuses: keywords with ; , < > that Capture One's importer refuses, unwritable: keywords left out because the format can't hold them (a name in brackets or braces, a line break, deeper than 64 levels; a synonym as \"path {synonym}\"), text when there is no path}",
+            always,
+            |s, p| {
+                let file = s.catalog.keyword_list_text();
+                // Capture One's importer refuses ; , < > in a keyword's name
+                let refuses: Vec<&str> = file
+                    .written
+                    .iter()
+                    .filter_map(|p| p.rsplit(lightcraft_catalog::keywords::SEP).next())
+                    .filter(|n| n.contains(CAPTURE_ONE_REFUSES))
+                    .collect();
+                let mut r = json!({"keywords": file.written.len(), "captureOneRefuses": refuses, "unwritable": file.unwritable});
+                match str_param(p, "path").map(str::trim).filter(|x| !x.is_empty()) {
+                    Some(path) => {
+                        std::fs::write(path, &file.text).map_err(|e| crate::EngineError::Other(format!("{path}: {e}")))?;
+                        r["path"] = json!(path);
+                    }
+                    None => r["text"] = json!(file.text),
+                }
+                Ok(r)
+            }
+        ),
+        cmd!(
+            "keyword.import",
+            "Import Keywords",
+            [],
+            None,
+            "{path | text} — a keyword list (Lightroom Classic's format, also Capture One's and Photo Supreme's Formatted Vocabulary File): adds the keywords the library doesn't have, gives those it has the list's synonyms; one undo step → {added, updated}",
+            always,
+            |s, p| {
+                let text = match (str_param(p, "path").map(str::trim).filter(|x| !x.is_empty()), str_param(p, "text")) {
+                    (Some(path), _) => read_list(path)?,
+                    (None, Some(text)) if text.len() as u64 > MAX_LIST_BYTES => {
+                        return Err(bad("keyword.import", format!("larger than {} MB, not a keyword list", MAX_LIST_BYTES >> 20)));
+                    }
+                    (None, Some(text)) => text.to_string(),
+                    (None, None) => return Err(bad("keyword.import", "give `path` or `text`")),
+                };
+                let entries = lightcraft_catalog::keywords::parse_keyword_list(&text).map_err(|e| bad("keyword.import", e.to_string()))?;
+                let (op, added, updated) = s.catalog.import_keywords_ops(&entries);
+                commit_keywords(s, "Import Keywords", op, |k| Some(k.to_string()))?;
+                Ok(json!({"added": added, "updated": updated}))
+            }
+        ),
         cmd!(
             "keyword.rename",
             "Rename Keyword",
@@ -197,9 +487,7 @@ pub fn specs() -> Vec<CommandSpec> {
                 let to = str_param(p, "to").ok_or_else(|| bad("keyword.rename", "missing `to`"))?.to_string();
                 let op = s.catalog.rename_keyword_ops(&from, &to).map_err(|e| bad("keyword.rename", e.to_string()))?;
                 let (f, t) = (clean(&from), clean(&to));
-                commit_keywords(s, "Rename Keyword", op, |k| {
-                    Some(if is_under(k, &f) { format!("{t}{}", &k[f.len().min(k.len())..]) } else { k.to_string() })
-                })
+                commit_keywords(s, "Rename Keyword", op, |k| Some(if is_under(k, &f) { reparent(k, &f, &t) } else { k.to_string() }))
             }
         ),
         cmd!(
@@ -229,8 +517,8 @@ pub fn specs() -> Vec<CommandSpec> {
                 let op = s.catalog.merge_keywords_ops(&from, &into).map_err(|e| bad("keyword.merge", e.to_string()))?;
                 let (from, into) = (from.iter().map(|f| clean(f)).collect::<Vec<_>>(), clean(&into));
                 commit_keywords(s, "Merge Keywords", op, |k| {
-                    Some(match from.iter().find(|f| is_under(k, f)) {
-                        Some(f) => format!("{into}{}", &k[f.len().min(k.len())..]),
+                    Some(match closest(k, &from) {
+                        Some(f) => reparent(k, f, &into),
                         None => k.to_string(),
                     })
                 })
diff --git a/crates/engine/src/cmd/library.rs b/crates/engine/src/cmd/library.rs
index d900eacf..27e96f4f 100644
--- a/crates/engine/src/cmd/library.rs
+++ b/crates/engine/src/cmd/library.rs
@@ -7,6 +7,20 @@ use serde_json::{Value, json};
 use super::{CommandSpec, always, bad, bool_or, cmd, has_active, has_selection, ok, str_param};
 use crate::{LibrarySource, Result, Selection, Session};
 
+fn select_after_deletion(s: &mut Session, before: &[PhotoId]) {
+    let at = before.iter().position(|id| Some(*id) == s.selection.active);
+    let remaining: std::collections::HashSet<_> = s.visible_cloned().into_iter().collect();
+    s.selection.ids.retain(|id| remaining.contains(id));
+    s.selection.active = s.selection.active.filter(|id| remaining.contains(id)).or_else(|| s.selection.ids.first().copied());
+    if s.selection.active.is_none()
+        && let Some(at) = at
+    {
+        // Keep culling near the deleted photo: next visible survivor, or the previous one at the end.
+        let neighbour = before.iter().skip(at.saturating_add(1)).chain(before.iter().take(at).rev()).find(|id| remaining.contains(id));
+        s.selection = neighbour.map(|id| Selection::single(*id)).unwrap_or_default();
+    }
+}
+
 /// The auto-import folder's visible files with their sizes (the file-system half of
 /// `library.autoImportScan`; the app lists on a worker thread and passes `listing`).
 pub fn list_auto_import_folder(folder: &str) -> std::result::Result<Vec<(String, u64)>, String> {
@@ -146,6 +160,24 @@ fn for_targets(s: &mut Session, p: &Value, label: &str, f: impl Fn(PhotoId) -> O
     Ok(json!({"changed": n}))
 }
 
+/// Adjust each target's own rating; unchanged bounds do not create an undo step.
+fn change_rating(s: &mut Session, p: &Value, delta: i8, label: &str) -> Result<Value> {
+    let mut ops = Vec::new();
+    for id in s.targets(p) {
+        let old = s.catalog.photo(id).ok_or(lightcraft_catalog::CatalogError::NoPhoto(id))?.rating;
+        let rating = (i16::from(old) + i16::from(delta)).clamp(0, 5) as u8;
+        if rating != old {
+            ops.push(Op::SetRating { id, rating });
+        }
+    }
+    let n = ops.len();
+    if n > 0 {
+        s.commit(label, Op::Batch { ops })?;
+    }
+    advance_if(s, p);
+    Ok(json!({"changed": n}))
+}
+
 fn advance_if(s: &mut Session, p: &Value) {
     if bool_or(p, "advance", false) {
         let _ = step(s, 1);
@@ -330,6 +362,16 @@ pub fn specs() -> Vec<CommandSpec> {
                 if f.library_folder.is_some() && s.source == LibrarySource::LibraryFolder {
                     return Err(bad("library.filter", "a folder is already shown (library.source): show another source first"));
                 }
+                // checked like a smart album's rules when this call sets them: an unknown field or a value
+                // that can't match is an error, not an empty grid. Rules that stopped checking since
+                // (their album was deleted) don't block other filter changes.
+                if let Some(rules) = f.rule_set.as_mut() {
+                    rules.upgrade();
+                }
+                let sets_rules = p.get("ruleSet").is_some_and(|r| !r.is_null());
+                if let Some(problems) = f.rule_set.as_ref().filter(|_| sets_rules).map(|rs| rs.check(&s.catalog)).filter(|p| !p.is_empty()) {
+                    return Err(bad("library.filter", problems.iter().map(ToString::to_string).collect::<Vec<_>>().join("; ")));
+                }
                 s.filter = f;
                 Ok(json!({"count": s.visible().len()}))
             }
@@ -339,7 +381,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Library Folders",
             [],
             None,
-            "{} → [{name, path, count, own, volume, selectable, children}] the disks and the folders the library's photos were imported from, with photo counts (subfolders included in `count`); show one with library.source {kind: libraryFolder, path} (rows with selectable false only open)",
+            "{} → [{name, path, count, own, volume, selectable, label?, children}] the disks and the folders the library's photos were imported from, with photo counts (subfolders included in `count`); show one with library.source {kind: libraryFolder, path} (rows with selectable false only open)",
             always,
             |s, _| Ok(serde_json::to_value(s.catalog.folder_tree()).unwrap_or_default())
         ),
@@ -387,6 +429,33 @@ pub fn specs() -> Vec<CommandSpec> {
                 Ok(json!({"removed": ids.len()}))
             }
         ),
+        cmd!(
+            "folder.label",
+            "Set Folder Color Label",
+            [],
+            None,
+            "{path, label: red|yellow|green|blue|purple|none} — give a folder of the library (one its photos were imported from, see library.folders) a colour label, or take it off (also once its photos are gone); one undo step. The label follows the folder when it is renamed or moved with folder.rename / folder.move → {path, label}",
+            always,
+            |s, p| {
+                const C: &str = "folder.label";
+                let path = str_param(p, "path").filter(|d| !d.trim().is_empty()).ok_or_else(|| bad(C, "missing `path`"))?;
+                let label = match str_param(p, "label").ok_or_else(|| bad(C, "missing `label` (red|yellow|green|blue|purple|none)"))? {
+                    "none" => None,
+                    x => Some(ColorLabel::parse(x).ok_or_else(|| bad(C, format!("unknown label {x:?}")))?),
+                };
+                // taking a label off always works, also once the folder's photos are gone
+                let f = Filter { library_folder: Some(path.to_string()), ..Default::default() };
+                if label.is_some() && s.catalog.query(&f, &Sort::default()).is_empty() {
+                    return Err(bad(C, format!("{path}: no photo in the library was imported from it")));
+                }
+                if label.is_none() && s.catalog.folder_record(path).is_none() {
+                    return Ok(json!({"path": path, "label": label}));
+                }
+                let op = s.catalog.folder_label_op(path, label);
+                s.commit(if label.is_some() { "Set Folder Color Label" } else { "Remove Folder Color Label" }, op)?;
+                Ok(json!({"path": path, "label": label}))
+            }
+        ),
         cmd!("library.clearFilter", "Clear Filters", ["View"], None, "{}", always, |s, _| {
             s.filter = Default::default();
             Ok(json!({"count": s.visible().len()}))
@@ -564,6 +633,12 @@ pub fn specs() -> Vec<CommandSpec> {
             advance_if(s, p);
             Ok(v)
         }),
+        cmd!("photo.decreaseRating", "Decrease Rating", [], None, "{ids?, advance?: bool}", has_selection, |s, p| {
+            change_rating(s, p, -1, "Decrease Rating")
+        }),
+        cmd!("photo.increaseRating", "Increase Rating", [], None, "{ids?, advance?: bool}", has_selection, |s, p| {
+            change_rating(s, p, 1, "Increase Rating")
+        }),
         cmd!("photo.flag", "Set Flag", ["Photo", "Set Flag"], None, "{flag: pick|reject|none, ids?, advance?: bool}", has_selection, |s, p| {
             let f = str_param(p, "flag").and_then(Flag::parse).ok_or_else(|| bad("photo.flag", "flag must be pick|reject|none"))?;
             let v = for_targets(s, p, "Set Flag", |id| Some(Op::SetFlag { id, flag: f }))?;
@@ -661,9 +736,9 @@ pub fn specs() -> Vec<CommandSpec> {
         ),
         // ---- delete / restore
         cmd!("photo.delete", "Delete Photo", ["Photo"], Some("Delete"), "{ids?} — moves to Recently Deleted", has_selection, |s, p| {
+            let before = s.visible_cloned();
             let v = for_targets(s, p, "Delete", |id| Some(Op::SetDeleted { id, deleted: true }))?;
-            let vis = s.visible_cloned();
-            s.selection = vis.first().map(|f| Selection::single(*f)).unwrap_or_default();
+            select_after_deletion(s, &before);
             Ok(v)
         }),
         cmd!("photo.restore", "Restore", ["Photo"], None, "{ids?}", has_selection, |s, p| for_targets(s, p, "Restore", |id| Some(Op::SetDeleted {
@@ -689,10 +764,11 @@ pub fn specs() -> Vec<CommandSpec> {
             }
         ),
         cmd!("photo.deletePermanently", "Delete Permanently", ["Photo"], None, "{ids?}", has_selection, |s, p| {
+            let before = s.visible_cloned();
             let t = s.targets(p);
             let op = s.catalog.delete_photos_permanently_ops(&t);
             s.commit("Delete Permanently", op)?;
-            s.selection = Selection::default();
+            select_after_deletion(s, &before);
             Ok(json!({"deleted": t.len()}))
         }),
         // ---- metadata
@@ -756,16 +832,26 @@ pub fn specs() -> Vec<CommandSpec> {
                             *field = v.to_string();
                         }
                     }
-                    if let Some(k) = strs("keywords") {
-                        m.keywords = k;
-                    }
-                    for k in strs("addKeywords").unwrap_or_default() {
-                        if !m.keywords.iter().any(|x| x.eq_ignore_ascii_case(&k)) {
+                    // keywords are stored cleaned (`a | b ` is `a|b`), each once whatever its case
+                    use lightcraft_catalog::keywords::{clean, same};
+                    let add = |m: &mut lightcraft_catalog::Meta, k: &str| {
+                        let k = clean(k);
+                        if !k.is_empty() && !m.keywords.iter().any(|x| same(x, &k)) {
                             m.keywords.push(k);
                         }
+                    };
+                    if let Some(k) = strs("keywords") {
+                        m.keywords.clear();
+                        for k in k {
+                            add(&mut m, &k);
+                        }
+                    }
+                    for k in strs("addKeywords").unwrap_or_default() {
+                        add(&mut m, &k);
                     }
                     for k in strs("removeKeywords").unwrap_or_default() {
-                        m.keywords.retain(|x| !x.eq_ignore_ascii_case(&k));
+                        let k = clean(&k);
+                        m.keywords.retain(|x| !same(&clean(x), &k));
                     }
                     ops.push(Op::SetMeta { id, meta: Box::new(m) });
                 }
@@ -809,7 +895,7 @@ pub fn specs() -> Vec<CommandSpec> {
                     return Err(bad("album.createSmart", "empty name"));
                 }
                 let rules = match p.get("rules") {
-                    Some(r) => merge_rules(&lightcraft_catalog::Filter::default(), r, "album.createSmart")?,
+                    Some(r) => merge_rules(&lightcraft_catalog::Filter::default(), r, "album.createSmart", &s.catalog, None)?,
                     None => view_rules(s),
                 };
                 let parent = p.get("parent").and_then(Value::as_u64).map(AlbumId);
@@ -819,8 +905,8 @@ pub fn specs() -> Vec<CommandSpec> {
                 Ok(json!({"id": id.0, "count": s.catalog.album_count(id)}))
             }
         ),
-        cmd!(query "album.ruleFields", "Smart Album Rule Fields", [], None, "{} → [{field, label, kind, ops: [{op, label}], choices?}] for ruleSet rules", always, |_, _| {
-            use lightcraft_catalog::rules::{FIELDS, Kind, ops_for};
+        cmd!(query "album.ruleFields", "Smart Album Rule Fields", [], None, "{} → [{field, label, kind (text|keywords|number|date|choice|bool|album: an album id), group (field-menu submenu, null at the top level), ops: [{op, label}], choices? (ids), choiceLabels? ({id: label})}] for ruleSet rules, in menu order", always, |_, _| {
+            use lightcraft_catalog::rules::{FIELDS, Kind, field_group, ops_for};
             Ok(json!(FIELDS
                 .iter()
                 .map(|(id, label, kind)| {
@@ -828,13 +914,15 @@ pub fn specs() -> Vec<CommandSpec> {
                         Kind::Text => "text",
                         Kind::Keywords => "keywords",
                         Kind::Number => "number",
+                        Kind::Album => "album",
                         Kind::Date => "date",
                         Kind::Choice(_) => "choice",
                         Kind::Bool => "bool",
                     };
-                    let mut v = json!({"field": id, "label": label, "kind": k, "ops": ops_for(*kind).iter().map(|(o, l)| json!({"op": o, "label": l})).collect::<Vec<_>>()});
+                    let mut v = json!({"field": id, "label": label, "kind": k, "group": field_group(id), "ops": ops_for(*kind).iter().map(|(o, l)| json!({"op": o, "label": l})).collect::<Vec<_>>()});
                     if let Kind::Choice(c) = kind {
-                        v["choices"] = json!(c);
+                        v["choices"] = json!(c.iter().map(|c| c.0).collect::<Vec<_>>());
+                        v["choiceLabels"] = c.iter().map(|(id, label)| (id.to_string(), json!(label))).collect::<serde_json::Map<_, _>>().into();
                     }
                     v
                 })
@@ -845,18 +933,34 @@ pub fn specs() -> Vec<CommandSpec> {
             "Edit Smart Album",
             [],
             None,
-            "{id, rules?: partial Filter merged onto the current rules (null clears a field), replace?: bool, fromView?: bool (use the current view)}",
+            "{id, rules?: partial Filter merged onto the current rules (null clears a field), replace?: bool, fromView?: bool (use the current view), name?: also rename it (blank keeps the name) — one undo step, both or neither}",
             always,
             |s, p| {
                 let id = album_param(p, "id", "album.setRules")?;
                 let cur = s.catalog.album(id).and_then(|a| a.smart.as_deref().cloned()).ok_or_else(|| bad("album.setRules", "not a smart album"))?;
                 let rules = if bool_or(p, "fromView", false) {
-                    view_rules(s)
+                    // the view is saved as it is, but never as a loop (showing A, which tests this
+                    // album, and saving that view here would make it test itself)
+                    let view = view_rules(s);
+                    let loops: Vec<String> = view
+                        .rule_set
+                        .as_ref()
+                        .map(|r| r.check_for(&s.catalog, Some(id)))
+                        .unwrap_or_default()
+                        .into_iter()
+                        .chain(s.catalog.album_filter_problem(&view, Some(id)))
+                        .filter(|p| p.issue == lightcraft_catalog::rules::Issue::AlbumLoop)
+                        .map(|p| p.to_string())
+                        .collect();
+                    if !loops.is_empty() {
+                        return Err(bad("album.setRules", loops.join("; ")));
+                    }
+                    view
                 } else {
                     let replace = bool_or(p, "replace", false);
                     let folder = cur.library_folder.clone();
                     let base = if replace { Default::default() } else { cur };
-                    let mut r = merge_rules(&base, p.get("rules").unwrap_or(&Value::Null), "album.setRules")?;
+                    let mut r = merge_rules(&base, p.get("rules").unwrap_or(&Value::Null), "album.setRules", &s.catalog, Some(id))?;
                     // the rules dialog has no folder field: replacing its rules keeps the folder
                     // unless the call says (`libraryFolder: null`) to drop it
                     if replace && p.get("rules").and_then(|r| r.get("libraryFolder")).is_none() {
@@ -864,7 +968,13 @@ pub fn specs() -> Vec<CommandSpec> {
                     }
                     r
                 };
-                s.commit("Edit Smart Album", Op::SetAlbumRules { id, rules: Box::new(rules) })?;
+                let set = Op::SetAlbumRules { id, rules: Box::new(rules) };
+                // a new name goes with the rules: one step, applied (and undone) together
+                let rename = str_param(p, "name").map(str::trim).filter(|n| !n.is_empty() && s.catalog.album(id).is_some_and(|a| a.name != *n));
+                match rename {
+                    Some(name) => s.commit("Edit Smart Album", Op::Batch { ops: vec![Op::RenameAlbum { id, name: name.to_string() }, set] })?,
+                    None => s.commit("Edit Smart Album", set)?,
+                };
                 Ok(json!({"count": s.catalog.album_count(id)}))
             }
         ),
@@ -874,14 +984,45 @@ pub fn specs() -> Vec<CommandSpec> {
             s.commit("Rename Album", Op::RenameAlbum { id, name })?;
             ok()
         }),
-        cmd!("album.delete", "Delete Album", [], None, "{id}", always, |s, p| {
-            let id = album_param(p, "id", "album.delete")?;
-            s.commit("Delete Album", Op::RemoveAlbum { id })?;
-            if s.source == LibrarySource::Album(id) {
-                s.source = LibrarySource::All;
+        cmd!(
+            "album.delete",
+            "Delete Album",
+            [],
+            None,
+            "{id} — deletes the album or folder and its descendants, keeping photos in the library; one undo step",
+            always,
+            |s, p| {
+                let id = album_param(p, "id", "album.delete")?;
+                let folder = s.catalog.album(id).ok_or_else(|| bad("album.delete", "no such album"))?.folder;
+                let mut children = std::collections::BTreeMap::<AlbumId, Vec<AlbumId>>::new();
+                for album in s.catalog.albums() {
+                    if let Some(parent) = album.parent {
+                        children.entry(parent).or_default().push(album.id);
+                    }
+                }
+                // Iterative traversal: even a malformed cycle is rejected before any change.
+                // Reverse parent-first order removes children first; the batch inverse restores
+                // parents first, including memberships, smart rules, covers and manual ordering.
+                let mut pending = vec![id];
+                let mut order = Vec::new();
+                let mut removed = std::collections::BTreeSet::new();
+                while let Some(next) = pending.pop() {
+                    if !removed.insert(next) {
+                        return Err(bad("album.delete", "cycle in album folders"));
+                    }
+                    order.push(next);
+                    if let Some(nested) = children.remove(&next) {
+                        pending.extend(nested);
+                    }
+                }
+                let ops = order.into_iter().rev().map(|id| Op::RemoveAlbum { id }).collect();
+                s.commit(if folder { "Delete Folder" } else { "Delete Album" }, Op::Batch { ops })?;
+                if matches!(s.source, LibrarySource::Album(current) if removed.contains(&current)) {
+                    s.source = LibrarySource::All;
+                }
+                ok()
             }
-            ok()
-        }),
+        ),
         cmd!("album.move", "Move Album", [], None, "{id, parent?: folderId|null}", always, |s, p| {
             let id = album_param(p, "id", "album.move")?;
             let parent = p.get("parent").and_then(Value::as_u64).map(AlbumId);
@@ -1273,12 +1414,39 @@ pub fn specs() -> Vec<CommandSpec> {
 }
 
 /// `base` with a partial Filter (JSON) merged on top.
-fn merge_rules(base: &lightcraft_catalog::Filter, patch: &Value, c: &str) -> Result<lightcraft_catalog::Filter> {
+/// `patch` merged onto `base`, its rules brought up to date (`RuleSet::upgrade`), unchecked (see
+/// [`merge_rules`]).
+fn merge_filter(base: &lightcraft_catalog::Filter, patch: &Value, c: &str) -> Result<lightcraft_catalog::Filter> {
     let mut v = serde_json::to_value(base).unwrap_or_default();
     lightcraft_develop::presets::deep_merge(&mut v, patch);
-    let f: lightcraft_catalog::Filter = serde_json::from_value(v).map_err(|e| bad(c, e.to_string()))?;
-    if let Some(problem) = f.rule_set.as_ref().and_then(|r| r.problems().into_iter().next()) {
-        return Err(bad(c, problem));
+    let mut f: lightcraft_catalog::Filter = serde_json::from_value(v).map_err(|e| bad(c, e.to_string()))?;
+    if let Some(rules) = f.rule_set.as_mut() {
+        rules.upgrade();
+    }
+    Ok(f)
+}
+
+/// `patch` merged onto `base`, refused when the rule set it sets has problems (`RuleSet::check_for`;
+/// `owner` is the smart album the rules are for, so testing an album that leads back to it is a
+/// problem too).
+fn merge_rules(
+    base: &lightcraft_catalog::Filter,
+    patch: &Value,
+    c: &str,
+    cat: &lightcraft_catalog::Catalog,
+    owner: Option<AlbumId>,
+) -> Result<lightcraft_catalog::Filter> {
+    let f = merge_filter(base, patch, c)?;
+    // only rules this change sets are checked: one that stopped checking since (its album was
+    // deleted) doesn't block editing the album's other settings
+    let sets_rules = patch.get("ruleSet").is_some_and(|r| !r.is_null());
+    let mut problems = f.rule_set.as_ref().filter(|_| sets_rules).map(|r| r.check_for(cat, owner)).unwrap_or_default();
+    // and a loop through the album field the change sets
+    if patch.get("album").is_some_and(|a| !a.is_null()) {
+        problems.extend(cat.album_filter_problem(&f, owner));
+    }
+    if !problems.is_empty() {
+        return Err(bad(c, problems.iter().map(ToString::to_string).collect::<Vec<_>>().join("; ")));
     }
     Ok(f)
 }
@@ -1286,7 +1454,7 @@ fn merge_rules(base: &lightcraft_catalog::Filter, patch: &Value, c: &str) -> Res
 /// Whether `path` lies above a disk: some of its `ids` photos are on a disk (not the startup
 /// disk) that the folder does not lie in. Such a folder (`/Volumes`, `/mnt`…) is not a folder of
 /// one disk but a way to reach several.
-fn covers_other_disks(s: &Session, path: &str, ids: &[PhotoId]) -> bool {
+pub(crate) fn covers_other_disks(s: &Session, path: &str, ids: &[PhotoId]) -> bool {
     ids.iter()
         .filter_map(|id| s.catalog.photo(*id))
         .filter_map(|p| lightcraft_catalog::folders::volume_of(p))
@@ -1314,7 +1482,9 @@ fn view_rules(s: &Session) -> lightcraft_catalog::Filter {
                     }
                 }
             }
-            merge_rules(&base, &Value::Object(patch), "").unwrap_or(base)
+            // the view as it is: a rule that no longer checks (its album was deleted) just matches
+            // nothing there, and mustn't cost the filter bar's settings
+            merge_filter(&base, &Value::Object(patch), "").unwrap_or(base)
         }
         None => {
             let mut f = s.source.to_filter(&s.filter, &s.catalog);
@@ -1382,3 +1552,7 @@ mod gps_tests {
         assert_eq!(p("hello"), None);
     }
 }
+
+#[cfg(test)]
+#[path = "library/tests_relative_ratings.rs"]
+mod relative_rating_tests;
diff --git a/crates/engine/src/cmd/library/tests_relative_ratings.rs b/crates/engine/src/cmd/library/tests_relative_ratings.rs
new file mode 100644
index 00000000..1a1b8b23
--- /dev/null
+++ b/crates/engine/src/cmd/library/tests_relative_ratings.rs
@@ -0,0 +1,102 @@
+//! Relative ratings dispatch through the real engine, including history and AutoWrite.
+use lightcraft_catalog::{Op, Photo, PhotoId, Source};
+use serde_json::json;
+
+use crate::{Result, Selection, Session};
+
+fn session() -> Result<Session> {
+    let mut s = Session::new();
+    for (id, rating) in [(1, 0), (2, 2), (3, 5), (4, 1)] {
+        let mut photo = Photo::new(
+            PhotoId(id),
+            Source::File { path: format!("/lightcraft-relative-ratings/{id}.jpg") },
+            &format!("{id}.jpg"),
+            "JPEG",
+            40,
+            30,
+            "2026-10-09",
+        );
+        photo.rating = rating;
+        s.catalog.apply(Op::AddPhoto { photo: Box::new(photo) })?;
+    }
+    s.execute("library.sort", &json!({"key": "fileName", "ascending": true}))?;
+    s.execute("library.select", &json!({"ids": [1, 2, 3], "active": 2}))?;
+    Ok(s)
+}
+
+fn ratings(s: &Session) -> Result<Vec<u8>> {
+    (1..=4)
+        .map(|id| s.catalog.photo(PhotoId(id)).map(|p| p.rating).ok_or_else(|| lightcraft_catalog::CatalogError::NoPhoto(PhotoId(id)).into()))
+        .collect()
+}
+
+#[test]
+fn relative_ratings_clamp_each_photo_and_form_one_history_step() {
+    let mut s = session().unwrap();
+    let undo = s.undo.len();
+    assert_eq!(s.execute("photo.increaseRating", &json!({})).unwrap()["changed"], 2);
+    assert_eq!(ratings(&s).unwrap(), [1, 3, 5, 1]);
+    assert_eq!(s.undo.len(), undo + 1);
+    assert_eq!(s.active(), Some(PhotoId(2)));
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(ratings(&s).unwrap(), [0, 2, 5, 1]);
+    s.execute("edit.redo", &json!({})).unwrap();
+    assert_eq!(ratings(&s).unwrap(), [1, 3, 5, 1]);
+    assert_eq!(s.execute("photo.decreaseRating", &json!({})).unwrap()["changed"], 3);
+    assert_eq!(ratings(&s).unwrap(), [0, 2, 4, 1]);
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(ratings(&s).unwrap(), [1, 3, 5, 1]);
+}
+
+#[test]
+fn bounds_active_fallback_explicit_targets_and_errors_preserve_history() {
+    let mut s = session().unwrap();
+    assert_eq!(s.execute("photo.decreaseRating", &json!({"ids": [1]})).unwrap()["changed"], 0);
+    assert_eq!(s.execute("photo.increaseRating", &json!({"ids": [3]})).unwrap()["changed"], 0);
+    assert!(s.undo.is_empty());
+    s.selection = Selection { ids: vec![], active: Some(PhotoId(2)) };
+    assert_eq!(s.execute("photo.increaseRating", &json!({})).unwrap()["changed"], 1);
+    assert_eq!(ratings(&s).unwrap(), [0, 3, 5, 1]);
+    assert_eq!(s.execute("photo.decreaseRating", &json!({"ids": [4]})).unwrap()["changed"], 1);
+    assert_eq!(ratings(&s).unwrap(), [0, 3, 5, 0]);
+    let undo = s.undo.len();
+    assert!(s.execute("photo.increaseRating", &json!({"ids": [1, 999]})).is_err());
+    assert_eq!(ratings(&s).unwrap(), [0, 3, 5, 0]);
+    assert_eq!(s.undo.len(), undo);
+    s.execute("photo.increaseRating", &json!({"advance": true})).unwrap();
+    assert_eq!(s.active(), Some(PhotoId(3)));
+    s.selection = Selection::default();
+    assert!(s.execute("photo.decreaseRating", &json!({})).is_err());
+}
+
+#[test]
+fn relative_ratings_and_history_use_auto_write() {
+    let mut s = session().unwrap();
+    let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+    let dir = std::env::temp_dir().join(format!("lc-relative-ratings-{}-{stamp}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    // Metadata-only fixtures: no import, image decoding or model/service dependency.
+    for id in 1..=4 {
+        s.catalog
+            .apply(Op::SetFile {
+                id: PhotoId(id),
+                file_name: format!("{id}.jpg"),
+                source: Source::File { path: dir.join(format!("{id}.jpg")).to_string_lossy().into_owned() },
+            })
+            .unwrap();
+    }
+    s.execute("library.xmpPreferences", &json!({"autoWrite": true})).unwrap();
+    s.execute("photo.increaseRating", &json!({})).unwrap();
+    assert!(std::fs::read_to_string(dir.join("1.xmp")).unwrap().contains("<xmp:Rating>1</xmp:Rating>"));
+    assert!(std::fs::read_to_string(dir.join("2.xmp")).unwrap().contains("<xmp:Rating>3</xmp:Rating>"));
+    assert!(!dir.join("3.xmp").exists(), "unchanged upper bound must not write");
+    assert!(!dir.join("4.xmp").exists(), "unselected photo must not write");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert!(std::fs::read_to_string(dir.join("1.xmp")).unwrap().contains("<xmp:Rating>0</xmp:Rating>"));
+    assert!(std::fs::read_to_string(dir.join("2.xmp")).unwrap().contains("<xmp:Rating>2</xmp:Rating>"));
+    s.execute("edit.redo", &json!({})).unwrap();
+    assert!(std::fs::read_to_string(dir.join("2.xmp")).unwrap().contains("<xmp:Rating>3</xmp:Rating>"));
+    s.execute("photo.decreaseRating", &json!({})).unwrap();
+    assert!(std::fs::read_to_string(dir.join("3.xmp")).unwrap().contains("<xmp:Rating>4</xmp:Rating>"));
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/engine/src/cmd/manage.rs b/crates/engine/src/cmd/manage.rs
index 41b43cab..d0627152 100644
--- a/crates/engine/src/cmd/manage.rs
+++ b/crates/engine/src/cmd/manage.rs
@@ -189,7 +189,13 @@ pub fn specs() -> Vec<CommandSpec> {
                 }
                 // photos without a capture time start from their import time
                 let base = |s: &crate::Session, id| s.catalog.photo(id).map(|p| p.date().to_string()).unwrap_or_default();
-                let mut delta = (f64_or(p, "shift", 0.0) + f64_or(p, "hours", 0.0) * 3600.0).round() as i64;
+                // seconds; a shift beyond 10,000 years is a mistake (and would overflow), not a date
+                const MAX_SHIFT: f64 = 10_000.0 * 365.25 * 86_400.0;
+                let shift = f64_or(p, "shift", 0.0) + f64_or(p, "hours", 0.0) * 3600.0;
+                if shift.is_nan() || shift.abs() > MAX_SHIFT {
+                    return Err(bad(c, "the shift is more than 10,000 years"));
+                }
+                let mut delta = shift.round() as i64;
                 let mut each: Option<String> = None;
                 if let Some(t) = str_param(p, "time") {
                     let t = normalize_iso(t).ok_or_else(|| bad(c, format!("`{t}` is not a date (YYYY-MM-DDTHH:MM:SS)")))?;
@@ -197,23 +203,38 @@ pub fn specs() -> Vec<CommandSpec> {
                         each = Some(t);
                     } else {
                         let anchor = s.active().filter(|a| targets.contains(a)).unwrap_or(targets[0]);
-                        let from = iso_seconds(&base(s, anchor)).ok_or_else(|| bad(c, "the photo's date doesn't parse"))?;
+                        let anchor_date = base(s, anchor);
+                        // An impossible calendar date cannot anchor changes to the other photos.
+                        let from = normalize_iso(anchor_date.trim().get(..10).unwrap_or(""))
+                            .and_then(|_| iso_seconds(&anchor_date))
+                            .ok_or_else(|| bad(c, "the photo's date doesn't parse"))?;
                         delta += iso_seconds(&t).unwrap_or(from) - from;
                     }
                 }
                 let mut ops = Vec::new();
                 let mut out = Vec::new();
+                let mut out_of_range = 0usize;
                 for id in &targets {
-                    let new = match &each {
-                        Some(t) => shift_iso(t, delta),
-                        None => shift_iso(&base(s, *id), delta),
+                    let from = match &each {
+                        Some(t) => t.clone(),
+                        None => base(s, *id),
+                    };
+                    let Some(new) = shift_iso(&from, delta) else {
+                        // a date that reads but would leave years 0000–9999 is refused below; one
+                        // that doesn't read is skipped, as before
+                        if iso_seconds(&from).is_some() {
+                            out_of_range += 1;
+                        }
+                        continue;
                     };
-                    let Some(new) = new else { continue };
                     out.push(json!(new));
                     if s.catalog.photo(*id).and_then(|p| p.captured.as_deref()) != Some(new.as_str()) {
                         ops.push(Op::SetCaptured { id: *id, captured: Some(new) });
                     }
                 }
+                if out_of_range > 0 {
+                    return Err(bad(c, format!("the shift would take {out_of_range} photo(s) outside the years 0000–9999; nothing was changed")));
+                }
                 let n = ops.len();
                 if n > 0 {
                     s.commit("Edit Capture Time", Op::Batch { ops })?;
diff --git a/crates/engine/src/cmd/masks.rs b/crates/engine/src/cmd/masks.rs
index dd1fa77c..d7299652 100644
--- a/crates/engine/src/cmd/masks.rs
+++ b/crates/engine/src/cmd/masks.rs
@@ -255,7 +255,7 @@ pub fn specs() -> Vec<CommandSpec> {
                         }
                     };
                     let m = &mut masks[i];
-                    if let Some(MaskComponent { name: None, shape: MaskShape::Brush { strokes }, .. }) =
+                    if let Some(MaskComponent { shape: MaskShape::Brush { strokes }, .. }) =
                         m.components.iter_mut().rev().find(|c| matches!(c.shape, MaskShape::Brush { .. }))
                     {
                         strokes.push(stroke);
diff --git a/crates/engine/src/cmd/missing.rs b/crates/engine/src/cmd/missing.rs
index 3d5fb49a..6f194c65 100644
--- a/crates/engine/src/cmd/missing.rs
+++ b/crates/engine/src/cmd/missing.rs
@@ -51,7 +51,7 @@ pub fn is_missing(cat: &Catalog, avail: &crate::availability::Availability, id:
     !cfg!(target_arch = "wasm32") && cat.photo(id).and_then(|p| checked_path(p)).is_some_and(|f| avail.is_offline(f))
 }
 
-fn relink_op(id: PhotoId, path: &str) -> Op {
+pub(crate) fn relink_op(id: PhotoId, path: &str) -> Op {
     let file_name = Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string());
     Op::Relink { id, file_name, source: Source::File { path: path.to_string() }, format: None }
 }
diff --git a/crates/engine/src/cmd/mod.rs b/crates/engine/src/cmd/mod.rs
index ef838fe0..ebc82862 100644
--- a/crates/engine/src/cmd/mod.rs
+++ b/crates/engine/src/cmd/mod.rs
@@ -31,6 +31,7 @@ mod prefs;
 mod preset_files;
 pub mod previews;
 mod query;
+mod sync;
 mod xmp;
 
 use serde::Serialize;
@@ -54,6 +55,10 @@ pub struct CommandSpec {
     pub run: Run,
     /// Record in the journal (false for queries).
     pub journal: bool,
+    /// `enabled` judges the selection (menus, shortcuts); a call that names its photos (`ids` /
+    /// `id`, see [`names_photos`]) skips it, and the command validates those photos itself.
+    /// Off unless a command opts in (`CommandSpec { explicit_targets: true, ..cmd!(…) }`).
+    pub explicit_targets: bool,
 }
 
 #[derive(Clone, Debug, Serialize)]
@@ -107,10 +112,10 @@ pub fn has_clipboard(s: &Session) -> std::result::Result<(), String> {
 
 macro_rules! cmd {
     ($id:literal, $label:literal, [$($m:literal),*], $sc:expr, $params:literal, $en:expr, $run:expr) => {
-        $crate::cmd::CommandSpec { id: $id, label: $label, menu: &[$($m),*], shortcut: $sc, params: $params, enabled: $en, run: $run, journal: true }
+        $crate::cmd::CommandSpec { id: $id, label: $label, menu: &[$($m),*], shortcut: $sc, params: $params, enabled: $en, run: $run, journal: true, explicit_targets: false }
     };
     (query $id:literal, $label:literal, [$($m:literal),*], $sc:expr, $params:literal, $en:expr, $run:expr) => {
-        $crate::cmd::CommandSpec { id: $id, label: $label, menu: &[$($m),*], shortcut: $sc, params: $params, enabled: $en, run: $run, journal: false }
+        $crate::cmd::CommandSpec { id: $id, label: $label, menu: &[$($m),*], shortcut: $sc, params: $params, enabled: $en, run: $run, journal: false, explicit_targets: false }
     };
 }
 pub(crate) use cmd;
@@ -142,6 +147,7 @@ pub fn command_specs() -> &'static [CommandSpec] {
         v.extend(before::specs());
         v.extend(browse::specs());
         v.extend(missing::specs());
+        v.extend(sync::specs());
         v.extend(metadata::specs());
         v.extend(filters::specs());
         v.extend(denoise::specs());
@@ -158,6 +164,11 @@ pub fn find_command(id: &str) -> Option<&'static CommandSpec> {
 
 // ---------- param helpers
 
+/// The call names its target photos (`ids` or `id`, not null) instead of using the selection.
+pub(crate) fn names_photos(p: &Value) -> bool {
+    ["ids", "id"].iter().any(|k| p.get(k).is_some_and(|v| !v.is_null()))
+}
+
 pub(crate) fn bad(cmd: &str, msg: impl Into<String>) -> EngineError {
     EngineError::BadParams { cmd: cmd.into(), msg: msg.into() }
 }
diff --git a/crates/engine/src/cmd/query.rs b/crates/engine/src/cmd/query.rs
index 824039e4..fcf56f7b 100644
--- a/crates/engine/src/cmd/query.rs
+++ b/crates/engine/src/cmd/query.rs
@@ -43,7 +43,9 @@ fn album_json(a: &Album, all: &[Album], cat: &lightcraft_catalog::Catalog) -> Va
     if let Some(rules) = &a.smart {
         v["smart"] = json!(true);
         v["rules"] = serde_json::to_value(rules).unwrap_or_default();
-        v["rulesText"] = json!(rules.describe());
+        v["rulesText"] = json!(rules.describe_with(cat));
+        // rules that no longer check (an album they test was deleted…), as `rule 1: …`
+        v["problems"] = json!(cat.smart_album_problems(a.id).iter().map(ToString::to_string).collect::<Vec<_>>());
     }
     v
 }
@@ -149,9 +151,18 @@ pub fn specs() -> Vec<CommandSpec> {
             }
             Ok(v)
         }),
-        cmd!(query "develop.get", "Get Develop Settings", [], None, "{id?}", always, |s, p| {
+        cmd!(query "develop.get", "Get Develop Settings", [], None, "{id?} → the photo's develop settings; `process` is the rendering process they are interpreted by (see develop.updateProcess)", always, |s, p| {
             let id = photo_arg(s, p, "develop.get")?;
-            Ok(s.develop_of(id).map(|d| d.to_json()).unwrap_or(Value::Null))
+            Ok(s.develop_of(id)
+                .map(|d| {
+                    let mut v = d.to_json();
+                    // saved settings leave V1 out (`ProcessVersion::is_legacy`); here it is always stated
+                    if let Some(o) = v.as_object_mut() {
+                        o.insert("process".into(), json!(d.process));
+                    }
+                    v
+                })
+                .unwrap_or(Value::Null))
         }),
         cmd!(query "develop.controls", "List Develop Controls", [], None, "{section?} — every slider with range, default and current value", always, |s, p| {
             let d = s.active().and_then(|id| s.develop_of(id)).unwrap_or_default();
diff --git a/crates/engine/src/cmd/sync.rs b/crates/engine/src/cmd/sync.rs
new file mode 100644
index 00000000..81693e5a
--- /dev/null
+++ b/crates/engine/src/cmd/sync.rs
@@ -0,0 +1,61 @@
+//! Synchronize Folder commands (see [`crate::sync`]).
+
+use serde_json::{Value, json};
+
+use super::{CommandSpec, always, bad, bool_or, cmd, str_param};
+use crate::sync::{SyncChoice, scan, synchronize};
+use crate::{Result, Session};
+
+fn path(p: &Value, c: &str) -> Result<String> {
+    str_param(p, "path").filter(|d| !d.trim().is_empty()).map(str::to_string).ok_or_else(|| bad(c, "missing `path`"))
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!(
+            query "folder.scanChanges",
+            "Scan Folder for Changes",
+            [],
+            None,
+            "{path, disk?: bool (a whole disk or share, or a folder holding disks)} — compare a folder of the library (and the folders inside it) with the disk; changes nothing → {path, new: [{path, name, format, …}] files the library doesn't have, duplicates: files whose content it already has, unreadable: [{path, error}], missing: [{id, path}] photos whose file is gone, moved: [{id, from, to}] photos whose file is elsewhere in the folder (same content), metadata: [{id, path}] photos whose XMP sidecar was saved after they came in or were last edited here and says something the library doesn't}",
+            always,
+            |s, p| {
+                const C: &str = "folder.scanChanges";
+                let path = path(p, C)?;
+                let changes = scan(s, &path, bool_or(p, "disk", false)).map_err(|e| bad(C, e.to_string()))?;
+                let v = serde_json::to_value(&changes).unwrap_or_default();
+                s.folder_changes = Some(changes);
+                Ok(v)
+            }
+        ),
+        cmd!(
+            "folder.synchronize",
+            "Synchronize Folder",
+            [],
+            None,
+            "{path, disk?: bool, scanned?: bool, importNew?: true, relinkMoved?: true, removeMissing?: false, readMetadata?: false} — bring a folder of the library up to date with the disk (see folder.scanChanges): import its new files in place, relink photos whose file was renamed or moved within it, move photos whose file is gone to Recently Deleted, read XMP sidecars saved by other apps (the sidecar wins); acts on the last folder.scanChanges of the folder while it is current (the folder's photos unchanged), else scans again — or, with `scanned: true`, refuses; one undo step, no file is touched → {imported, relinked, removed, read, failed: [[path, error]]}",
+            always,
+            sync
+        ),
+    ]
+}
+
+fn sync(s: &mut Session, p: &Value) -> Result<Value> {
+    const C: &str = "folder.synchronize";
+    let path = path(p, C)?;
+    let d = SyncChoice::default();
+    let choice = SyncChoice {
+        import_new: bool_or(p, "importNew", d.import_new),
+        relink_moved: bool_or(p, "relinkMoved", d.relink_moved),
+        remove_missing: bool_or(p, "removeMissing", d.remove_missing),
+        read_metadata: bool_or(p, "readMetadata", d.read_metadata),
+    };
+    let changes = match s.take_folder_changes(&path) {
+        Some(c) => c,
+        // the person agreed to what a scan showed: never act on something else
+        None if bool_or(p, "scanned", false) => return Err(bad(C, format!("{path} changed since it was scanned: scan again"))),
+        None => scan(s, &path, bool_or(p, "disk", false)).map_err(|e| bad(C, e.to_string()))?,
+    };
+    let r = synchronize(s, changes, choice)?;
+    Ok(json!({"imported": r.imported, "relinked": r.relinked, "removed": r.removed, "read": r.read, "failed": r.failed}))
+}
diff --git a/crates/engine/src/contact_sheet.rs b/crates/engine/src/contact_sheet.rs
new file mode 100644
index 00000000..663d6f82
--- /dev/null
+++ b/crates/engine/src/contact_sheet.rs
@@ -0,0 +1,378 @@
+//! Paginated contact sheets, rendered with the normal export pipeline and packaged as PDF.
+use crate::export::{Anchor, ExportFormat, ExportOptions, Watermark, draw_watermark, encode_image};
+use crate::{Session, media::RenderJob};
+use lightcraft_pipeline::{OutputDepth, OutputSpace};
+use lightcraft_raster::Rgba8;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase", deny_unknown_fields)]
+pub struct Options {
+    pub paper: String,
+    pub landscape: bool,
+    pub columns: usize,
+    pub rows: usize,
+    pub captions: bool,
+}
+
+impl Default for Options {
+    fn default() -> Self {
+        Self { paper: "a4".into(), landscape: false, columns: 3, rows: 4, captions: true }
+    }
+}
+
+impl Options {
+    pub fn parse(p: &Value) -> Result<Self, String> {
+        let mut settings = p.as_object().cloned().ok_or("params must be an object")?;
+        settings.remove("path");
+        settings.remove("ids");
+        settings.remove("id");
+        let o: Self = serde_json::from_value(Value::Object(settings)).map_err(|e| e.to_string())?;
+        o.layout()?;
+        Ok(o)
+    }
+
+    fn layout(&self) -> Result<Layout, String> {
+        if !(1..=8).contains(&self.columns) || !(1..=10).contains(&self.rows) {
+            return Err("columns must be 1–8 and rows 1–10".into());
+        }
+        let (mut w, mut h) = match self.paper.as_str() {
+            "a4" => (595.28, 841.89),
+            "letter" => (612.0, 792.0),
+            _ => return Err("paper must be a4 or letter".into()),
+        };
+        if self.landscape {
+            std::mem::swap(&mut w, &mut h);
+        }
+        // Fixed 150 dpi, bounded paper sizes and grid dimensions keep allocations predictable.
+        let width = (w * 150.0 / 72.0_f64).round() as usize;
+        let height = (h * 150.0 / 72.0_f64).round() as usize;
+        Ok(Layout { points: (w, h), width, height, cell_w: (width - 120) / self.columns, cell_h: (height - 120) / self.rows })
+    }
+}
+
+struct Layout {
+    points: (f64, f64),
+    width: usize,
+    height: usize,
+    cell_w: usize,
+    cell_h: usize,
+}
+
+pub struct Prepared {
+    options: Options,
+    items: Vec<(String, RenderJob)>,
+}
+
+pub struct Document {
+    pub bytes: Vec<u8>,
+    pub pages: usize,
+    pub photos: usize,
+}
+
+pub fn prepare(session: &mut Session, p: &Value) -> Result<Prepared, String> {
+    let options = Options::parse(p)?;
+    if let Some(ids) = p.get("ids") {
+        let a = ids.as_array().ok_or("ids must be an array of photo ids")?;
+        if a.iter().any(|v| v.as_u64().is_none()) {
+            return Err("ids must contain only photo ids".into());
+        }
+    }
+    if p.get("id").is_some_and(|v| v.as_u64().is_none()) {
+        return Err("id must be a photo id".into());
+    }
+    let ids = session.targets(p);
+    if ids.is_empty() || ids.len() > 1000 {
+        return Err("select between 1 and 1000 photos".into());
+    }
+    let l = options.layout()?;
+    if ids.len().div_ceil(options.columns * options.rows) > 100 {
+        return Err("contact sheets are limited to 100 pages; increase the grid size or select fewer photos".into());
+    }
+    let mut items = Vec::with_capacity(ids.len());
+    for id in ids {
+        let name = session.catalog.photo(id).ok_or("no such photo")?.file_name.clone();
+        let job = session.export_job(id, l.cell_w - 16, l.cell_h - 48, OutputSpace::Srgb, OutputDepth::U8)?;
+        items.push((name, job));
+    }
+    Ok(Prepared { options, items })
+}
+
+impl Prepared {
+    pub fn len(&self) -> usize {
+        self.items.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.items.is_empty()
+    }
+
+    /// Cancellation produces no partial document; callers write only after this succeeds.
+    pub fn run(self, progress: &mut dyn FnMut(usize, &str) -> bool) -> Result<Document, String> {
+        let l = self.options.layout()?;
+        let capacity = self.options.columns * self.options.rows;
+        let photos = self.items.len();
+        let pages = photos.div_ceil(capacity);
+        let mut pdf = Pdf::new(pages, l.points);
+        let mut page = Rgba8::filled(l.width, l.height, [255; 4]);
+        for (i, (name, job)) in self.items.into_iter().enumerate() {
+            if !progress(i, &name) {
+                return Err("Contact sheet cancelled".into());
+            }
+            let image = job.run().rendered?.image;
+            let slot = i % capacity;
+            let x = 60 + slot % self.options.columns * l.cell_w;
+            let y = 60 + slot / self.options.columns * l.cell_h;
+            // The renderer fits within the requested rectangle and applies crop/orientation.
+            if image.width > l.cell_w - 16 || image.height > l.cell_h - 48 {
+                return Err("render exceeded contact sheet cell".into());
+            }
+            blit(&mut page, &image, x + (l.cell_w - image.width) / 2, y + (l.cell_h - 40 - image.height) / 2)?;
+            if self.options.captions {
+                let mut caption = Rgba8::filled(l.cell_w - 16, 28, [255; 4]);
+                draw_watermark(
+                    &mut caption,
+                    &Watermark {
+                        text: caption_text(&name, l.cell_w - 16),
+                        size: 0.5,
+                        opacity: 1.0,
+                        anchor: Anchor::Center,
+                        inset: 0.0,
+                        color: [32; 3],
+                        shadow: false,
+                        ..Default::default()
+                    },
+                );
+                blit(&mut page, &caption, x + 8, y + l.cell_h - 36)?;
+            }
+            if slot + 1 == capacity || i + 1 == photos {
+                let jpg = encode_image(&page, &ExportOptions { format: ExportFormat::Jpeg, quality: 92, ..Default::default() })?;
+                if pdf.bytes.len().saturating_add(jpg.len()) > 256 * 1024 * 1024 {
+                    return Err("contact sheet exceeds 256 MiB; select fewer photos".into());
+                }
+                pdf.page(i / capacity, &jpg, l.width, l.height);
+                page.data.fill([255; 4]);
+            }
+        }
+        if !progress(photos, "PDF") {
+            return Err("Contact sheet cancelled".into());
+        }
+        Ok(Document { bytes: pdf.finish(), pages, photos })
+    }
+}
+
+fn caption_text(name: &str, width: usize) -> String {
+    use unicode_segmentation::UnicodeSegmentation;
+    let clean: String = name.chars().map(|c| if c.is_control() { ' ' } else { c }).collect();
+    let cells: Vec<_> = clean.graphemes(true).collect();
+    // A conservative one-em budget at 14 px also accommodates the optional CJK faces.
+    let limit = (width / 14).max(3);
+    if cells.len() <= limit {
+        return clean;
+    }
+    let left = limit / 2;
+    let right = limit - left - 1;
+    format!("{}…{}", cells.iter().take(left).copied().collect::<String>(), cells.iter().skip(cells.len() - right).copied().collect::<String>())
+}
+
+fn blit(dst: &mut Rgba8, src: &Rgba8, x: usize, y: usize) -> Result<(), String> {
+    if x.checked_add(src.width).is_none_or(|w| w > dst.width) || y.checked_add(src.height).is_none_or(|h| h > dst.height) {
+        return Err("contact sheet image outside page".into());
+    }
+    for row in 0..src.height {
+        let start = (y + row) * dst.width + x;
+        let a = dst.data.get_mut(start..start + src.width).ok_or("invalid page buffer")?;
+        let b = src.data.get(row * src.width..(row + 1) * src.width).ok_or("invalid render buffer")?;
+        for (dst, src) in a.iter_mut().zip(b) {
+            let alpha = u32::from(src[3]);
+            for channel in 0..3 {
+                dst[channel] = ((u32::from(src[channel]) * alpha + u32::from(dst[channel]) * (255 - alpha) + 127) / 255) as u8;
+            }
+            dst[3] = 255;
+        }
+    }
+    Ok(())
+}
+
+// Minimal PDF 1.4: one JPEG XObject per page, explicit byte lengths and classic xref offsets.
+struct Pdf {
+    bytes: Vec<u8>,
+    offsets: Vec<usize>,
+    points: (f64, f64),
+}
+
+impl Pdf {
+    fn new(pages: usize, points: (f64, f64)) -> Self {
+        let mut p = Self { bytes: b"%PDF-1.4\n%\xe2\xe3\xcf\xd3\n".to_vec(), offsets: vec![0], points };
+        p.object(1, b"<< /Type /Catalog /Pages 2 0 R >>");
+        let kids = (0..pages).map(|i| format!("{} 0 R", 3 + i * 3)).collect::<Vec<_>>().join(" ");
+        p.object(2, format!("<< /Type /Pages /Count {pages} /Kids [{kids}] >>").as_bytes());
+        p
+    }
+
+    fn object(&mut self, id: usize, body: &[u8]) {
+        self.offsets.push(self.bytes.len());
+        self.bytes.extend_from_slice(format!("{id} 0 obj\n").as_bytes());
+        self.bytes.extend_from_slice(body);
+        self.bytes.extend_from_slice(b"\nendobj\n");
+    }
+
+    fn stream(&mut self, id: usize, dictionary: &str, bytes: &[u8]) {
+        let mut body = format!("<< {dictionary} /Length {} >>\nstream\n", bytes.len()).into_bytes();
+        body.extend_from_slice(bytes);
+        body.extend_from_slice(b"\nendstream");
+        self.object(id, &body);
+    }
+
+    fn page(&mut self, index: usize, jpg: &[u8], width: usize, height: usize) {
+        let id = 3 + index * 3;
+        let (w, h) = self.points;
+        self.object(
+            id,
+            format!(
+                "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 {w:.2} {h:.2}] /Resources << /XObject << /Im {} 0 R >> >> /Contents {} 0 R >>",
+                id + 2,
+                id + 1
+            )
+            .as_bytes(),
+        );
+        self.stream(id + 1, "", format!("q {w:.2} 0 0 {h:.2} 0 0 cm /Im Do Q").as_bytes());
+        self.stream(
+            id + 2,
+            &format!("/Type /XObject /Subtype /Image /Width {width} /Height {height} /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /DCTDecode"),
+            jpg,
+        );
+    }
+
+    fn finish(mut self) -> Vec<u8> {
+        let start = self.bytes.len();
+        self.bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", self.offsets.len()).as_bytes());
+        for offset in self.offsets.iter().skip(1) {
+            self.bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+        }
+        self.bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{start}\n%%EOF\n", self.offsets.len()).as_bytes());
+        self.bytes
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn validates_settings_and_selection() {
+        let mut s = Session::with_demo();
+        for p in [
+            json!({"columns": 0}),
+            json!({"rows": 11}),
+            json!({"paper": "poster"}),
+            json!({"landscape": "yes"}),
+            json!({"typo": 2}),
+            json!({"ids": ["bad"]}),
+            json!({"ids": []}),
+        ] {
+            assert!(prepare(&mut s, &p).is_err(), "{p}");
+        }
+        let a = Options::default().layout().unwrap();
+        let b = Options { landscape: true, ..Default::default() }.layout().unwrap();
+        assert_eq!((a.width, a.height), (b.height, b.width));
+        let id = s.catalog.photos().next().unwrap().id.0;
+        assert!(prepare(&mut s, &json!({"ids": [id, u64::MAX]})).is_err());
+        assert!(prepare(&mut s, &json!({"ids": vec![id; 1001]})).is_err());
+        assert!(prepare(&mut s, &json!({"ids": vec![id; 101], "columns": 1, "rows": 1})).is_err());
+    }
+
+    #[test]
+    fn transparent_pixels_composite_over_white() {
+        let mut dst = Rgba8::filled(3, 1, [255; 4]);
+        let src = Rgba8 { width: 3, height: 1, data: vec![[0, 0, 0, 0], [255, 0, 0, 128], [10, 20, 30, 255]] };
+        blit(&mut dst, &src, 0, 0).unwrap();
+        assert_eq!(dst.data, vec![[255; 4], [255, 127, 127, 255], [10, 20, 30, 255]]);
+        assert!(blit(&mut dst, &src, usize::MAX, 0).is_err());
+    }
+
+    #[test]
+    fn unicode_captions_are_rasterized() {
+        assert_eq!(caption_text("very-long-éééé-filename.jpg", 140), "very-….jpg");
+        assert_eq!(caption_text("café\n.jpg", 300), "café .jpg");
+        let mut img = Rgba8::filled(360, 28, [255; 4]);
+        draw_watermark(
+            &mut img,
+            &Watermark {
+                text: "Été – Straße café.jpg".into(),
+                size: 0.5,
+                opacity: 1.0,
+                anchor: Anchor::Center,
+                inset: 0.0,
+                color: [32; 3],
+                shadow: false,
+                ..Default::default()
+            },
+        );
+        assert!(img.data.iter().filter(|p| p[0] < 128).count() > 100);
+        let mut ascii = Rgba8::filled(360, 28, [255; 4]);
+        draw_watermark(
+            &mut ascii,
+            &Watermark {
+                text: "Ete - Strasse cafe.jpg".into(),
+                size: 0.5,
+                opacity: 1.0,
+                anchor: Anchor::Center,
+                inset: 0.0,
+                color: [32; 3],
+                shadow: false,
+                ..Default::default()
+            },
+        );
+        assert_ne!(img, ascii);
+    }
+
+    #[test]
+    fn pagination_xref_and_cancellation() {
+        let mut s = Session::with_demo();
+        let ids: Vec<_> = s.catalog.photos().take(3).map(|p| p.id.0).collect();
+        let p = json!({"ids": ids, "columns": 1, "rows": 2, "captions": false});
+        let mut seen = Vec::new();
+        let doc = prepare(&mut s, &p)
+            .unwrap()
+            .run(&mut |i, _| {
+                seen.push(i);
+                true
+            })
+            .unwrap();
+        assert_eq!((doc.pages, doc.photos), (2, 3));
+        assert_eq!(seen, vec![0, 1, 2, 3]);
+        let text = String::from_utf8_lossy(&doc.bytes);
+        assert!(text.contains("/Count 2 /Kids [3 0 R 6 0 R]"));
+        let xref = text.rsplit("startxref\n").next().unwrap().lines().next().unwrap().parse::<usize>().unwrap();
+        assert!(doc.bytes[xref..].starts_with(b"xref\n0 9\n"));
+        let xref_text = std::str::from_utf8(&doc.bytes[xref..]).unwrap();
+        for (index, line) in xref_text.lines().skip(3).take(8).enumerate() {
+            let offset = line.split_whitespace().next().unwrap().parse::<usize>().unwrap();
+            assert!(doc.bytes[offset..].starts_with(format!("{} 0 obj\n", index + 1).as_bytes()));
+        }
+        assert!(prepare(&mut s, &p).unwrap().run(&mut |_, _| false).is_err());
+    }
+
+    fn first_page(bytes: &[u8]) -> Rgba8 {
+        let start = bytes.windows(2).position(|v| v == [0xff, 0xd8]).unwrap();
+        let end = bytes[start..].windows(2).position(|v| v == [0xff, 0xd9]).unwrap() + start + 2;
+        lightcraft_codecs::decode(&bytes[start..end], Default::default()).unwrap().to_srgb8()
+    }
+
+    #[test]
+    fn sheet_uses_current_edits_and_captions() {
+        let mut s = Session::with_demo();
+        let p = json!({"columns": 1, "rows": 2, "captions": false});
+        let plain = first_page(&prepare(&mut s, &p).unwrap().run(&mut |_, _| true).unwrap().bytes);
+        s.execute("develop.set", &json!({"control": "light.exposure", "value": 2.0})).unwrap();
+        let bright = first_page(&prepare(&mut s, &p).unwrap().run(&mut |_, _| true).unwrap().bytes);
+        let sum = |img: &Rgba8| img.data.iter().map(|p| u64::from(p[0]) + u64::from(p[1]) + u64::from(p[2])).sum::<u64>();
+        assert!(sum(&bright) > sum(&plain), "sheet ignored develop settings");
+        let captions = first_page(&prepare(&mut s, &json!({"columns": 1, "rows": 2})).unwrap().run(&mut |_, _| true).unwrap().bytes);
+        assert!(sum(&captions) < sum(&bright), "captions absent from PDF pixels");
+        assert_eq!((plain.width, plain.height), (1240, 1754));
+    }
+}
diff --git a/crates/engine/src/crs.rs b/crates/engine/src/crs.rs
index 0b0c83b9..86c26c69 100644
--- a/crates/engine/src/crs.rs
+++ b/crates/engine/src/crs.rs
@@ -18,6 +18,43 @@ use serde_json::{Map, Value, json};
 /// Properties keyed `prefix:name` (as produced by [`lightcraft_meta::parse_xmp`]).
 pub type Props = BTreeMap<String, Vec<String>>;
 
+/// What the mapped settings will develop. It decides how a `crs:` white balance is read: a raw
+/// with a measured illuminant takes `Temperature` as Kelvin; everything developed relative to its
+/// as-shot look (rendered files, and raws whose readers have no illuminant,
+/// [`lightcraft_catalog::relative_wb_format`]) needs a shift from the other app's as-shot white
+/// instead, because on that scale 6500 K / 0 means *as shot* (issue #510).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Target {
+    /// A preset: raw or rendered unknown. Absolute Kelvin first, else the relative scale.
+    Any,
+    /// A rendered photo (or a raw shown from its embedded preview): `Incremental*` fields on our
+    /// relative scale.
+    Rendered,
+    /// A raw developed with an absolute white balance (DNG and other files with a measured
+    /// illuminant): Kelvin as written.
+    RawAbsolute,
+    /// A raw developed relative to its as-shot look ([`lightcraft_catalog::Photo::relative_wb`]).
+    RawRelative,
+}
+
+impl Target {
+    /// The target for a file of this media kind and format (its extension or Lightroom's
+    /// `fileFormat` name); `preview_only` for a raw that can't be decoded yet.
+    pub fn for_file(kind: lightcraft_catalog::MediaKind, format: &str, preview_only: bool) -> Target {
+        if kind != lightcraft_catalog::MediaKind::Raw || preview_only {
+            Target::Rendered
+        } else if lightcraft_catalog::relative_wb_format(format) {
+            Target::RawRelative
+        } else {
+            Target::RawAbsolute
+        }
+    }
+    /// The target for a photo in the catalog.
+    pub fn for_photo(p: &lightcraft_catalog::Photo) -> Target {
+        Target::for_file(p.kind, &p.format, p.preview_only.is_some())
+    }
+}
+
 /// Band names as they appear in `crs:` field names, in our mixer order.
 const CRS_BANDS: [&str; 8] = ["Red", "Orange", "Yellow", "Green", "Aqua", "Blue", "Purple", "Magenta"];
 
@@ -69,6 +106,8 @@ pub fn has_adjustments(props: &Props) -> bool {
 thread_local! {
     /// Keys read by [`to_partial`] while [`to_partial_report`] runs.
     static READ: std::cell::RefCell<Option<std::collections::BTreeSet<String>>> = const { std::cell::RefCell::new(None) };
+    /// Adjustments [`to_partial`] read but deliberately left out, for the report.
+    static SKIPPED: std::cell::RefCell<Option<Vec<String>>> = const { std::cell::RefCell::new(None) };
 }
 
 fn note(k: &str) {
@@ -79,6 +118,14 @@ fn note(k: &str) {
     });
 }
 
+fn skipped(what: &str) {
+    SKIPPED.with(|r| {
+        if let Some(s) = r.borrow_mut().as_mut() {
+            s.push(what.to_string());
+        }
+    });
+}
+
 fn first<'a>(props: &'a Props, k: &str) -> Option<&'a str> {
     note(k);
     props.get(k).and_then(|v| v.first()).map(|s| s.trim()).filter(|s| !s.is_empty())
@@ -138,10 +185,8 @@ fn curve(props: &Props, k: &str) -> Option<Value> {
 
 /// Map the `crs:` fields of an XMP packet to a partial develop-settings JSON object.
 ///
-/// `raw`: the target is a raw file (absolute Kelvin white balance) — `Some(false)` prefers the
-/// relative `Incremental*` white balance used for rendered files, `None` (presets) takes whichever
-/// is present, absolute first.
-pub fn to_partial(props: &Props, raw: Option<bool>) -> Value {
+/// `target` decides how the white balance is read (see [`Target`]).
+pub fn to_partial(props: &Props, target: Target) -> Value {
     let mut out = Value::Object(Map::new());
     let o = &mut out;
     let n = |o: &mut Value, crs: &str, path: &str| {
@@ -200,10 +245,24 @@ pub fn to_partial(props: &Props, raw: Option<bool>) -> Value {
     let rel = num(props, "crs:IncrementalTemperature")
         .or(num(props, "crs:IncrementalTint").map(|_| 0.0))
         .map(|t| (rel_to_kelvin(t), num(props, "crs:IncrementalTint")));
-    let wb = match raw {
-        Some(true) => abs,
-        Some(false) => rel.or(abs),
-        None => abs.or(rel),
+    // A Kelvin value for something we develop relative to its as-shot look: the other app's
+    // as-shot white (`AsShotTemperature` / `AsShotTint`, written next to the edit) is the
+    // reference, so the edit is the same mired shift from ours (issue #510).
+    let shifted = || {
+        let (t, tint) = abs?;
+        let as_shot = num(props, "crs:AsShotTemperature").filter(|k| *k > 0.0)?;
+        if t <= 0.0 {
+            return None;
+        }
+        let r = (1e6 / as_shot - 1e6 / t) / 0.8;
+        let tint = tint.map(|v| v - num(props, "crs:AsShotTint").unwrap_or(0.0));
+        Some((rel_to_kelvin(r), tint))
+    };
+    let wb = match target {
+        Target::RawAbsolute => abs,
+        Target::Any => abs.or(rel),
+        Target::Rendered => rel.or_else(shifted).or(abs),
+        Target::RawRelative => rel.or_else(shifted),
     };
     match (mode, wb) {
         (Some(m), _) if m != "custom" => put(o, "wb.mode", json!(m)),
@@ -214,6 +273,13 @@ pub fn to_partial(props: &Props, raw: Option<bool>) -> Value {
                 put(o, "wb.tint", json!(tint));
             }
         }
+        // a custom Kelvin with nothing to shift it from: read on the relative scale it would be a
+        // large colour shift (ΔE 22 against Lightroom's export on the photos of issue #510), so
+        // the photo stays As Shot (ΔE 12 there) and the report says so
+        (_, None) if target == Target::RawRelative && abs.is_some() => {
+            put(o, "wb.mode", json!("asShot"));
+            skipped("Temperature, Tint (custom white balance without AsShotTemperature: kept As Shot)");
+        }
         (Some(m), None) => put(o, "wb.mode", json!(m)),
         (None, None) => {}
     }
@@ -244,13 +310,19 @@ pub fn to_partial(props: &Props, raw: Option<bool>) -> Value {
             put(o, "curve.master", c);
         }
     }
-    // Lightroom Classic reads the red / green / blue curves only together with the master 2012
-    // curve: a channel curve without `ToneCurvePV2012` leaves the photo unchanged
+    // Lightroom Classic reads the red / green / blue curves only when the packet holds the master
+    // 2012 curve and all three channel curves (as its own packets always do): a packet missing any
+    // of them imports without channel curves (master + red, master + red + green, or red / green /
+    // blue without the master all leave the photo's channels unchanged there)
     if let Some(c) = curve(props, "crs:ToneCurvePV2012") {
         put(o, "curve.master", c);
-        for (crs, ch) in [("ToneCurvePV2012Red", "red"), ("ToneCurvePV2012Green", "green"), ("ToneCurvePV2012Blue", "blue")] {
-            if let Some(c) = curve(props, &format!("crs:{crs}")) {
-                put(o, &format!("curve.{ch}"), c);
+        let channels = [("ToneCurvePV2012Red", "red"), ("ToneCurvePV2012Green", "green"), ("ToneCurvePV2012Blue", "blue")]
+            .map(|(crs, ch)| (curve(props, &format!("crs:{crs}")), ch));
+        if channels.iter().all(|(c, _)| c.is_some()) {
+            for (c, ch) in channels {
+                if let Some(c) = c {
+                    put(o, &format!("curve.{ch}"), c);
+                }
             }
         }
     }
@@ -375,11 +447,12 @@ pub fn to_partial(props: &Props, raw: Option<bool>) -> Value {
 /// With `values` (the packet's structured properties), local corrections become masks too
 /// ([`crate::crs_masks`]; radial masks fitted to `aspect` = width / height); components that
 /// can't be carried over are reported as `Mask: <kind>`.
-pub fn to_partial_report(props: &Props, values: Option<&crate::crs_masks::Values>, raw: Option<bool>, aspect: f64) -> (Value, Vec<String>) {
+pub fn to_partial_report(props: &Props, values: Option<&crate::crs_masks::Values>, target: Target, aspect: f64) -> (Value, Vec<String>) {
     READ.with(|r| *r.borrow_mut() = Some(Default::default()));
-    let mut out = to_partial(props, raw);
+    SKIPPED.with(|r| *r.borrow_mut() = Some(Vec::new()));
+    let mut out = to_partial(props, target);
     let mut read = READ.with(|r| r.borrow_mut().take()).unwrap_or_default();
-    let mut mask_skips = Vec::new();
+    let mut mask_skips = SKIPPED.with(|r| r.borrow_mut().take()).unwrap_or_default();
     if let Some(values) = values {
         let (masks, skipped) = crate::crs_masks::masks(values, aspect);
         if !masks.is_empty() {
@@ -387,7 +460,7 @@ pub fn to_partial_report(props: &Props, values: Option<&crate::crs_masks::Values
         }
         if values.keys().any(|k| crate::crs_masks::CONTAINERS.contains(&k.as_str())) {
             read.extend(crate::crs_masks::CONTAINERS.iter().map(|c| c.to_string()));
-            mask_skips = skipped.into_iter().map(|k| format!("Mask: {k}")).collect();
+            mask_skips.extend(skipped.into_iter().map(|k| format!("Mask: {k}")));
         }
     }
     // fields that only switch a panel on/off or name things: not adjustments by themselves; an
@@ -421,7 +494,7 @@ pub fn to_partial_report(props: &Props, values: Option<&crate::crs_masks::Values
 pub fn preset_from_xmp(xmp: &str, fallback_name: &str) -> Option<Preset> {
     let d = lightcraft_meta::parse_xmp(xmp).ok()?;
     let props = &d.properties;
-    let settings = to_partial(props, None);
+    let settings = to_partial(props, Target::Any);
     if settings.as_object().is_none_or(Map::is_empty) {
         return None;
     }
@@ -474,7 +547,7 @@ mod tests {
     fn maps_common_fields() {
         let p = props(SIDECAR);
         assert!(has_adjustments(&p));
-        let partial = to_partial(&p, Some(true));
+        let partial = to_partial(&p, Target::RawAbsolute);
         let s = apply_partial(&DevelopSettings::for_raw(5000.0, 0.0), &partial, 1.0);
         assert_eq!(s.wb.mode, WbMode::Custom);
         assert_eq!((s.wb.temp, s.wb.tint), (5150.0, 12.0));
@@ -516,7 +589,7 @@ mod tests {
     fn only_present_fields_are_in_the_partial() {
         let x = r#"<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description
             xmlns:c="http://ns.adobe.com/camera-raw-settings/1.0/" c:Vibrance="+30" c:GrainAmount="10"/></rdf:RDF>"#;
-        let partial = to_partial(&props(x), None);
+        let partial = to_partial(&props(x), Target::Any);
         assert_eq!(partial, json!({"color": {"vibrance": 30.0}, "grain": {"amount": 10.0}}));
     }
 
@@ -531,12 +604,12 @@ mod tests {
             <crs:Temperature>4800</crs:Temperature>
           </rdf:Description></rdf:RDF></x:xmpmeta>"#;
         let p = props(x);
-        let rendered = apply_partial(&DevelopSettings::default(), &to_partial(&p, Some(false)), 1.0);
+        let rendered = apply_partial(&DevelopSettings::default(), &to_partial(&p, Target::Rendered), 1.0);
         assert_eq!(rendered.treatment, lightcraft_develop::Treatment::Bw);
         assert_eq!(rendered.bw_mix.blue, -35.0);
         assert!((rendered.wb.temp - rel_to_kelvin(25.0)).abs() < 1e-6 && rendered.wb.temp > 6500.0);
         assert_eq!(rendered.wb.tint, -6.0);
-        let raw = apply_partial(&DevelopSettings::default(), &to_partial(&p, Some(true)), 1.0);
+        let raw = apply_partial(&DevelopSettings::default(), &to_partial(&p, Target::RawAbsolute), 1.0);
         assert_eq!(raw.wb.temp, 4800.0);
     }
 
@@ -545,13 +618,72 @@ mod tests {
         let x = r#"<rdf:Description xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/"
              crs:WhiteBalance="Daylight" crs:Temperature="5500" crs:Tint="10" crs:AlreadyApplied="True"/>"#;
         let p = props(x);
-        assert_eq!(to_partial(&p, Some(true)), json!({"wb": {"mode": "daylight"}}));
+        assert_eq!(to_partial(&p, Target::RawAbsolute), json!({"wb": {"mode": "daylight"}}));
         assert!(!has_adjustments(&p));
         let bookkeeping = r#"<rdf:Description xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
              xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/" crs:Version="1" crs:HasSettings="True"/>"#;
         assert!(!has_adjustments(&props(bookkeeping)));
     }
 
+    #[test]
+    fn custom_kelvin_on_relative_wb_raws_shifts_from_the_as_shot_white() {
+        // Issue #510: a Sony ARW edited in Lightroom to Custom 3578 K / −5 next to an as-shot white
+        // of 3650 K / −2 (written for this test from the numbers in the issue).
+        let x = r#"<rdf:Description xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/"
+             crs:WhiteBalance="Custom" crs:Temperature="3578" crs:Tint="-5" crs:AsShotTemperature="3650" crs:AsShotTint="-2"/>"#;
+        let p = props(x);
+        let rel = to_partial(&p, Target::RawRelative);
+        // 3650 → 3578 K is +5.5 mired: the same shift from 6500 K lands near 6275 K on our scale
+        let t = rel["wb"]["temp"].as_f64().unwrap();
+        assert!((t - 6275.0).abs() < 5.0, "{t}");
+        assert_eq!(rel["wb"]["tint"], -3.0);
+        assert_eq!(rel["wb"]["mode"], "custom");
+        // a rendered file without `Incremental*` fields shifts the same way; a raw with a measured
+        // illuminant (and a preset) keeps the Kelvin value
+        assert_eq!(to_partial(&p, Target::Rendered)["wb"]["temp"], rel["wb"]["temp"]);
+        assert_eq!(to_partial(&p, Target::RawAbsolute)["wb"]["temp"], 3578.0);
+        assert_eq!(to_partial(&p, Target::Any)["wb"]["temp"], 3578.0);
+        // the as-shot fields are a reference, not an adjustment: nothing to report
+        assert!(to_partial_report(&p, None, Target::RawRelative, 1.5).1.is_empty());
+        // no tint next to the as-shot tint: the custom tint is taken as the shift itself
+        let no_tint = props(&x.replace(r#" crs:AsShotTint="-2""#, ""));
+        assert_eq!(to_partial(&no_tint, Target::RawRelative)["wb"]["tint"], -5.0);
+    }
+
+    #[test]
+    fn custom_kelvin_without_an_as_shot_reference_stays_as_shot_and_is_reported() {
+        // The same edit from a Lightroom catalog, which keeps no as-shot white for Custom photos:
+        // 3578 K read on the relative scale would be a large blue shift (issue #510)
+        let x = r#"<rdf:Description xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/"
+             crs:WhiteBalance="Custom" crs:Temperature="3578" crs:Tint="-5" crs:Exposure2012="+0.3"/>"#;
+        let p = props(x);
+        let (partial, unmapped) = to_partial_report(&p, None, Target::RawRelative, 1.5);
+        assert_eq!(partial["wb"], json!({"mode": "asShot"}));
+        assert_eq!(partial["light"]["exposure"], 0.3);
+        assert_eq!(unmapped.len(), 1, "{unmapped:?}");
+        assert!(unmapped[0].starts_with("Temperature, Tint"), "{unmapped:?}");
+        // a raw with a measured illuminant and a rendered file read it as before, and report nothing
+        assert_eq!(to_partial(&p, Target::RawAbsolute)["wb"]["temp"], 3578.0);
+        assert_eq!(to_partial(&p, Target::Rendered)["wb"]["temp"], 3578.0);
+        assert!(to_partial_report(&p, None, Target::RawAbsolute, 1.5).1.is_empty());
+        // an unusable reference (zero) counts as none
+        let zero = props(&x.replace(r#" crs:Tint="-5""#, r#" crs:Tint="-5" crs:AsShotTemperature="0""#));
+        assert_eq!(to_partial(&zero, Target::RawRelative)["wb"], json!({"mode": "asShot"}));
+    }
+
+    #[test]
+    fn target_follows_the_file() {
+        use lightcraft_catalog::MediaKind;
+        assert_eq!(Target::for_file(MediaKind::Raw, "ARW", false), Target::RawRelative);
+        assert_eq!(Target::for_file(MediaKind::Raw, "nef", false), Target::RawRelative);
+        // Lightroom's `fileFormat` name for proprietary raws
+        assert_eq!(Target::for_file(MediaKind::Raw, "RAW", false), Target::RawRelative);
+        assert_eq!(Target::for_file(MediaKind::Raw, "DNG", false), Target::RawAbsolute);
+        // a raw shown from its embedded preview develops like a rendered file
+        assert_eq!(Target::for_file(MediaKind::Raw, "ARW", true), Target::Rendered);
+        assert_eq!(Target::for_file(MediaKind::Image, "JPG", false), Target::Rendered);
+    }
+
     #[test]
     fn xmp_preset_with_name_and_group() {
         // Written for this test: a minimal preset-shaped packet with localized name/group.
@@ -584,25 +716,38 @@ mod tests {
     }
 
     #[test]
-    fn channel_curves_need_the_master_curve() {
-        // Lightroom ignores a red / green / blue curve without `ToneCurvePV2012`
-        let packet = |master: &str| {
+    fn channel_curves_need_the_master_and_all_channel_curves() {
+        // Lightroom applies red / green / blue curves only when the master and all three are present
+        let seq = |name: &str, pts: &str| format!("<crs:{name}><rdf:Seq>{pts}</rdf:Seq></crs:{name}>");
+        let identity = "<rdf:li>0, 0</rdf:li><rdf:li>255, 255</rdf:li>";
+        let bent = "<rdf:li>0, 0</rdf:li><rdf:li>64, 40</rdf:li><rdf:li>255, 255</rdf:li>";
+        let packet = |curves: &[String]| {
             format!(
                 r#"<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
-          <rdf:Description rdf:about="" xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/" crs:ToneCurveName2012="Custom">{master}
-           <crs:ToneCurvePV2012Green><rdf:Seq><rdf:li>0, 0</rdf:li><rdf:li>64, 40</rdf:li><rdf:li>255, 255</rdf:li></rdf:Seq></crs:ToneCurvePV2012Green>
-          </rdf:Description></rdf:RDF></x:xmpmeta>"#
+          <rdf:Description rdf:about="" xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/" crs:ToneCurveName2012="Custom">{}
+          </rdf:Description></rdf:RDF></x:xmpmeta>"#,
+                curves.concat()
             )
         };
-        let alone = to_partial(&props(&packet("")), Some(true));
+        let partial = |curves: &[String]| to_partial(&props(&packet(curves)), Target::RawAbsolute);
+        let (master, red, green, blue) = (
+            seq("ToneCurvePV2012", identity),
+            seq("ToneCurvePV2012Red", identity),
+            seq("ToneCurvePV2012Green", bent),
+            seq("ToneCurvePV2012Blue", identity),
+        );
+        // a channel curve alone, or with the master but without its two siblings: ignored
+        let alone = partial(std::slice::from_ref(&green));
         assert!(alone.pointer("/curve/green").is_none(), "{alone}");
-        let master = "<crs:ToneCurvePV2012><rdf:Seq><rdf:li>0, 0</rdf:li><rdf:li>255, 255</rdf:li></rdf:Seq></crs:ToneCurvePV2012>";
-        let with = to_partial(&props(&packet(master)), Some(true));
-        assert!(with.pointer("/curve/green").is_some() && with.pointer("/curve/master").is_some(), "{with}");
+        let master_and_green = partial(&[master.clone(), green.clone()]);
+        assert!(master_and_green.pointer("/curve/green").is_none() && master_and_green.pointer("/curve/master").is_some(), "{master_and_green}");
+        // all four: read
+        let all = partial(&[master, red, green, blue]);
+        assert!(["/curve/master", "/curve/red", "/curve/green", "/curve/blue"].iter().all(|p| all.pointer(p).is_some()), "{all}");
     }
 
     fn unmapped(x: &str) -> Vec<String> {
-        to_partial_report(&props(x), None, None, 1.5).1
+        to_partial_report(&props(x), None, Target::Any, 1.5).1
     }
 
     #[test]
@@ -622,8 +767,8 @@ mod tests {
         let p = props(&preset_packet("", ""));
         let mut d = DevelopSettings::default();
         d.optics.lens_profile = true;
-        assert!(apply_partial(&d, &to_partial(&p, None), 1.0).optics.lens_profile);
+        assert!(apply_partial(&d, &to_partial(&p, Target::Any), 1.0).optics.lens_profile);
         let on = props(&preset_packet("", "").replace(r#"crs:LensProfileEnable="0""#, r#"crs:LensProfileEnable="1""#));
-        assert!(apply_partial(&DevelopSettings::default(), &to_partial(&on, None), 1.0).optics.lens_profile);
+        assert!(apply_partial(&DevelopSettings::default(), &to_partial(&on, Target::Any), 1.0).optics.lens_profile);
     }
 }
diff --git a/crates/engine/src/crs_masks.rs b/crates/engine/src/crs_masks.rs
index feea9234..b1c987ab 100644
--- a/crates/engine/src/crs_masks.rs
+++ b/crates/engine/src/crs_masks.rs
@@ -298,7 +298,7 @@ mod tests {
 
     fn settings() -> (DevelopSettings, Vec<String>) {
         let d = lightcraft_meta::parse_xmp(PACKET).unwrap();
-        let (partial, unmapped) = crate::crs::to_partial_report(&d.properties, Some(&d.values), None, 1.5);
+        let (partial, unmapped) = crate::crs::to_partial_report(&d.properties, Some(&d.values), crate::crs::Target::Any, 1.5);
         (DevelopSettings::default().merged(&partial).expect("valid settings"), unmapped)
     }
 
diff --git a/crates/engine/src/demo.rs b/crates/engine/src/demo.rs
index 48da21e2..6a89dda8 100644
--- a/crates/engine/src/demo.rs
+++ b/crates/engine/src/demo.rs
@@ -101,14 +101,15 @@ pub fn load(s: &mut Session) {
 /// functions, so a 24 MP demo original takes minutes of CPU time on a small machine (a 4-core CI
 /// VM). Each scene at each size is therefore generated once per process and shared:
 ///
-/// - concurrent requests wait for one generation (Before and After at 1:1 both load the
-///   original; sessions side by side, e.g. parallel tests, open the same photo);
+/// - one generation per scene and size, which concurrent requests wait for (Before and After at
+///   1:1 both load the original; sessions side by side, e.g. parallel tests, open the same photo;
+///   how it renders: [`generate`]);
 /// - the most recently used results are kept, up to [`scene_cache_limit`] bytes. They are the same
 ///   allocations the sessions' source caches hold, so they cost extra memory only once no session
 ///   holds them any more.
 ///
 /// Only demo photos use this; real files are decoded by their loader as before.
-pub(crate) fn scene_pixels(scene: &lightcraft_scenes::Scene, max_edge: usize) -> Arc<lightcraft_raster::Rgb32f> {
+pub(crate) fn scene_pixels(scene: &lightcraft_scenes::Scene, max_edge: usize) -> Result<Arc<lightcraft_raster::Rgb32f>, String> {
     let key = SceneKey { kind: scene.kind, seed: scene.seed, width: scene.width, height: scene.height, max_edge };
     let slot = {
         let mut c = scene_cache();
@@ -120,18 +121,152 @@ pub(crate) fn scene_pixels(scene: &lightcraft_scenes::Scene, max_edge: usize) ->
                 e.slot.clone()
             }
             None => {
-                let slot = Arc::new(std::sync::OnceLock::new());
+                let slot = Arc::new(SceneSlot::default());
                 c.entries.push(SceneEntry { key, slot: slot.clone(), used: tick });
                 slot
             }
         }
     };
-    // (no lock held while generating: other scenes and sizes are served meanwhile)
-    let pixels = slot.get_or_init(|| Arc::new(scene.render_fit(max_edge))).clone();
+    let pixels = slot.get_or_generate(|how| match how {
+        Render::Parallel => scene.render_fit(max_edge),
+        Render::Serial => scene.render_fit_serial(max_edge),
+    });
     trim_scene_cache(&mut scene_cache(), scene_cache_limit());
     pixels
 }
 
+/// How a generation renders (see [`generate`]).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Render {
+    /// On rayon threads that do nothing else.
+    Parallel,
+    /// On the calling thread alone, without rayon.
+    Serial,
+}
+
+const FAILED: &str = "the demo scene could not be generated";
+
+/// Render a scene for [`SceneSlot::get_or_generate`], so that it never needs a thread that waits
+/// for a generation. A rayon worker renders on its own thread alone: rendering in parallel, it
+/// would run queued jobs while it waits for rows other workers took, and one of them could ask for
+/// this very scene and wait for the generation further down its own stack (the faces scan's pool
+/// threads hung that way). That also keeps the work within the caller's pool and its limits (the
+/// scan's pace, `LIGHTCRAFT_FACE_THREADS`). Any other caller (the render workers, which are plain
+/// threads) renders in parallel on [`render_pool`], whose threads only ever render, and blocks
+/// without running other work meanwhile; where that pool can't be started it renders alone too.
+fn generate(render: impl FnOnce(Render) -> lightcraft_raster::Rgb32f + Send) -> lightcraft_raster::Rgb32f {
+    if rayon::current_thread_index().is_some() {
+        return render(Render::Serial);
+    }
+    match render_pool() {
+        Some(pool) => pool.install(|| render(Render::Parallel)),
+        None => render(Render::Serial),
+    }
+}
+
+/// The threads non-rayon callers' generations render on: rayon's default count (`RAYON_NUM_THREADS`,
+/// else the available parallelism), like the global pool they used before, without touching that
+/// pool (asking it for its size starts it, which panics where its threads can't start); `None`
+/// where this pool's threads can't start.
+fn render_pool() -> Option<&'static rayon::ThreadPool> {
+    static POOL: std::sync::OnceLock<Option<rayon::ThreadPool>> = std::sync::OnceLock::new();
+    POOL.get_or_init(|| rayon::ThreadPoolBuilder::new().thread_name(|i| format!("lc-demo-scene-{i}")).build().ok()).as_ref()
+}
+
+/// One scene at one size: generated once, then shared.
+#[derive(Default)]
+struct SceneSlot {
+    state: std::sync::Mutex<SlotState>,
+    /// Signalled when a generation ends.
+    ended: std::sync::Condvar,
+}
+
+#[derive(Default)]
+struct SlotState {
+    generation: Generation,
+    /// Generations started so far; the one running or last ended is number `started`.
+    started: u64,
+    /// Callers waiting for the generation running (for the tests).
+    waiting: usize,
+}
+
+#[derive(Default)]
+enum Generation {
+    #[default]
+    Empty,
+    Running,
+    Ready(Arc<lightcraft_raster::Rgb32f>),
+    /// The last generation failed (its render panicked); the next request tries again.
+    Failed,
+}
+
+impl SlotState {
+    /// Start a generation; its number.
+    fn start(&mut self) -> u64 {
+        self.started += 1;
+        self.generation = Generation::Running;
+        self.started
+    }
+
+    /// What came of generation `n`, once it has ended: its pixels, or an error when it failed
+    /// (even if a retry has started or finished since: callers get the outcome they waited for).
+    fn outcome(&self, n: u64) -> Option<Result<Arc<lightcraft_raster::Rgb32f>, String>> {
+        match &self.generation {
+            Generation::Running if self.started == n => None,
+            // pixels are kept for good once made, so only generation `n` itself can have made them
+            Generation::Ready(p) if self.started == n => Some(Ok(p.clone())),
+            _ => Some(Err(FAILED.into())),
+        }
+    }
+}
+
+impl SceneSlot {
+    fn lock(&self) -> std::sync::MutexGuard<'_, SlotState> {
+        self.state.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
+    }
+
+    fn ready(&self) -> Option<Arc<lightcraft_raster::Rgb32f>> {
+        match &self.lock().generation {
+            Generation::Ready(p) => Some(p.clone()),
+            _ => None,
+        }
+    }
+
+    /// The pixels `render` makes ([`generate`]), generated once: the first caller renders, with no
+    /// lock held, and later ones wait for its outcome. A render that panics is an error for the
+    /// callers of its generation, and the next request tries again.
+    fn get_or_generate(&self, render: impl FnOnce(Render) -> lightcraft_raster::Rgb32f + Send) -> Result<Arc<lightcraft_raster::Rgb32f>, String> {
+        let mut g = self.lock();
+        let n = match &g.generation {
+            Generation::Ready(p) => return Ok(p.clone()),
+            Generation::Running => {
+                let n = g.started;
+                g.waiting += 1;
+                let outcome = loop {
+                    if let Some(o) = g.outcome(n) {
+                        break o;
+                    }
+                    g = self.ended.wait(g).unwrap_or_else(std::sync::PoisonError::into_inner);
+                };
+                g.waiting -= 1;
+                return outcome;
+            }
+            Generation::Empty | Generation::Failed => g.start(),
+        };
+        drop(g);
+        let made = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| generate(render)));
+        let mut g = self.lock();
+        g.generation = match made {
+            Ok(pixels) => Generation::Ready(Arc::new(pixels)),
+            Err(_) => Generation::Failed,
+        };
+        let outcome = g.outcome(n).unwrap_or_else(|| Err(FAILED.into()));
+        drop(g);
+        self.ended.notify_all();
+        outcome
+    }
+}
+
 /// Bytes of generated scenes kept for reuse: half the memory budget (768 MB by default; enough
 /// for one 24 MP original and the previews around it).
 fn scene_cache_limit() -> usize {
@@ -147,11 +282,9 @@ struct SceneKey {
     max_edge: usize,
 }
 
-type SceneSlot = Arc<std::sync::OnceLock<Arc<lightcraft_raster::Rgb32f>>>;
-
 struct SceneEntry {
     key: SceneKey,
-    slot: SceneSlot,
+    slot: Arc<SceneSlot>,
     used: u64,
 }
 
@@ -167,7 +300,7 @@ fn scene_cache() -> std::sync::MutexGuard<'static, SceneCache> {
 }
 
 fn scene_bytes(slot: &SceneSlot) -> usize {
-    slot.get().map_or(0, |img| img.data.len().saturating_mul(std::mem::size_of::<[f32; 3]>()))
+    slot.ready().map_or(0, |img| img.data.len().saturating_mul(std::mem::size_of::<[f32; 3]>()))
 }
 
 /// Drop the least recently used generated scenes until the rest fit in `limit` bytes. Scenes still
@@ -178,7 +311,7 @@ fn trim_scene_cache(c: &mut SceneCache, limit: usize) {
         if total <= limit {
             return;
         }
-        let Some(i) = c.entries.iter().enumerate().filter(|(_, e)| e.slot.get().is_some()).min_by_key(|(_, e)| e.used).map(|(i, _)| i) else {
+        let Some(i) = c.entries.iter().enumerate().filter(|(_, e)| e.slot.ready().is_some()).min_by_key(|(_, e)| e.used).map(|(i, _)| i) else {
             return;
         };
         c.entries.swap_remove(i);
@@ -196,12 +329,12 @@ mod tests {
     #[test]
     fn a_scene_is_generated_once_per_size_and_shared() {
         let s = small_scene();
-        let a = scene_pixels(&s, 48);
-        let b = scene_pixels(&s, 48);
+        let a = scene_pixels(&s, 48).unwrap();
+        let b = scene_pixels(&s, 48).unwrap();
         assert!(Arc::ptr_eq(&a, &b), "the second request reuses the first generation");
         assert_eq!(a.width.max(a.height), 48);
         assert_eq!(a.data, s.render_fit(48).data, "the same pixels as generating it directly");
-        let c = scene_pixels(&s, 40);
+        let c = scene_pixels(&s, 40).unwrap();
         assert_eq!(c.width.max(c.height), 40, "another size is its own generation");
     }
 
@@ -210,19 +343,332 @@ mod tests {
         let s = small_scene();
         let edge = 37; // a size no other test asks for
         let got: Vec<_> = std::thread::scope(|sc| {
-            let hs: Vec<_> = (0..4).map(|_| sc.spawn(|| scene_pixels(&s, edge))).collect();
+            let hs: Vec<_> = (0..4).map(|_| sc.spawn(|| scene_pixels(&s, edge).unwrap())).collect();
             hs.into_iter().map(|h| h.join().unwrap()).collect()
         });
         assert!(got.windows(2).all(|w| Arc::ptr_eq(&w[0], &w[1])), "every request got the same pixels");
     }
 
+    /// Run `f` on a thread of its own and wait for it at most `secs`: a deadlock fails the test instead of hanging it.
+    fn within<T: Send + 'static>(secs: u64, f: impl FnOnce() -> T + Send + 'static) -> T {
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let _ = tx.send(f());
+        });
+        rx.recv_timeout(std::time::Duration::from_secs(secs)).expect("deadlocked")
+    }
+
+    /// Wait (at most ten seconds) until `n` callers wait for `slot`'s generation.
+    fn until_waiting(slot: &SceneSlot, n: usize) {
+        let started = std::time::Instant::now();
+        while slot.lock().waiting < n {
+            assert!(started.elapsed() < std::time::Duration::from_secs(10), "the callers never got to wait");
+            std::thread::sleep(std::time::Duration::from_millis(1));
+        }
+    }
+
+    fn pixels(n: usize) -> lightcraft_raster::Rgb32f {
+        lightcraft_raster::Rgb32f::new(n, 1)
+    }
+
+    /// Rayon workers asking for a scene while it is generated never deadlock. The render is parallel, and a rayon worker
+    /// waiting for rows another worker took runs queued jobs on top of itself: generating on the caller's thread, the
+    /// faces scan's pool threads ended up waiting on the generation further down their own stack and hung. Requests
+    /// keep arriving on a four-thread pool while the scene is generated, as when several photos are queued; every one
+    /// of them must come back, at least four of them must have overlapped the generation, and the test waits with a
+    /// timeout, so a deadlock fails it instead of hanging.
+    #[test]
+    fn rayon_workers_asking_for_a_scene_being_generated_never_deadlock() {
+        let scene = Arc::new(small_scene());
+        let edge = 601; // a size no other test asks for
+        const ASKED: usize = 24;
+        let (overlap, sizes) = within(120, move || {
+            let pool = rayon::ThreadPoolBuilder::new().num_threads(4).build().unwrap();
+            let issued = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+            let (done_tx, done_rx) = std::sync::mpsc::channel();
+            for _ in 0..ASKED {
+                let (scene, done, issued) = (scene.clone(), done_tx.clone(), issued.clone());
+                issued.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                pool.spawn(move || {
+                    let got = scene_pixels(&scene, edge).unwrap();
+                    // how many requests had been made when this one came back
+                    let _ = done.send((issued.load(std::sync::atomic::Ordering::SeqCst), got.data.len()));
+                });
+                std::thread::sleep(std::time::Duration::from_millis(1));
+            }
+            let replies: Vec<(usize, usize)> = (0..ASKED).map(|_| done_rx.recv().unwrap()).collect();
+            (replies.iter().map(|r| r.0).min().unwrap(), replies.iter().map(|r| r.1).collect::<Vec<_>>())
+        });
+        assert_eq!(sizes.len(), ASKED, "every request came back");
+        assert!(sizes.iter().all(|n| *n == sizes[0] && *n > 0));
+        assert!(overlap >= 4, "requests overlapped the generation (only {overlap} had been made when the first came back)");
+    }
+
+    /// However many requests (from rayon workers and other threads) arrive while a scene is generated, it is rendered
+    /// once, and never twice at the same time: duplicates would each hold a whole image (288 MB for a 24 MP original).
+    #[test]
+    fn a_scene_is_rendered_once_however_many_ask() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+        let (renders, peak) = within(60, || {
+            let slot = Arc::new(SceneSlot::default());
+            let (running, peak, renders) = (Arc::new(AtomicUsize::new(0)), Arc::new(AtomicUsize::new(0)), Arc::new(AtomicUsize::new(0)));
+            let render = {
+                let (running, peak, renders) = (running.clone(), peak.clone(), renders.clone());
+                move |how: Render| {
+                    let now = running.fetch_add(1, Ordering::SeqCst) + 1;
+                    peak.fetch_max(now, Ordering::SeqCst);
+                    renders.fetch_add(1, Ordering::SeqCst);
+                    // work like the real render's: in parallel, the rendering thread waits for rows other threads took
+                    use rayon::prelude::*;
+                    let sum: u64 = match how {
+                        Render::Parallel => (0..2_000_000u64).into_par_iter().map(|i| i % 7).sum(),
+                        Render::Serial => (0..2_000_000u64).map(|i| i % 7).sum(),
+                    };
+                    std::thread::sleep(std::time::Duration::from_millis(100));
+                    running.fetch_sub(1, Ordering::SeqCst);
+                    pixels(sum as usize % 5 + 1)
+                }
+            };
+            let pool = rayon::ThreadPoolBuilder::new().num_threads(4).build().unwrap();
+            let (tx, rx) = std::sync::mpsc::channel();
+            for _ in 0..16 {
+                let (slot, render, tx) = (slot.clone(), render.clone(), tx.clone());
+                pool.spawn(move || {
+                    let _ = tx.send(slot.get_or_generate(render).unwrap());
+                });
+            }
+            for _ in 0..4 {
+                let (slot, render, tx) = (slot.clone(), render.clone(), tx.clone());
+                std::thread::spawn(move || {
+                    let _ = tx.send(slot.get_or_generate(render).unwrap());
+                });
+            }
+            let got: Vec<_> = (0..20).map(|_| rx.recv().unwrap()).collect();
+            assert!(got.windows(2).all(|w| Arc::ptr_eq(&w[0], &w[1])), "every request got the same pixels");
+            (renders.load(Ordering::SeqCst), peak.load(Ordering::SeqCst))
+        });
+        assert_eq!((renders, peak), (1, 1));
+    }
+
+    /// A rayon worker (the faces scan's) renders a scene on its own thread alone, so the work stays within its pool
+    /// and that pool's limits; other threads render in parallel on the scene pool.
+    #[test]
+    fn a_rayon_worker_renders_alone_on_its_own_thread() {
+        let ((how, caller, renderer), (other_how, other_name)) = within(30, || {
+            let pool = rayon::ThreadPoolBuilder::new().num_threads(2).build().unwrap();
+            let slot = SceneSlot::default();
+            let mut seen = None;
+            pool.install(|| {
+                let caller = std::thread::current().id();
+                slot.get_or_generate(|how| {
+                    seen = Some((how, caller, std::thread::current().id()));
+                    pixels(1)
+                })
+                .unwrap();
+            });
+            let other = SceneSlot::default();
+            let mut other_seen = None;
+            other
+                .get_or_generate(|how| {
+                    other_seen = Some((how, std::thread::current().name().unwrap_or_default().to_string()));
+                    pixels(1)
+                })
+                .unwrap();
+            (seen.unwrap(), other_seen.unwrap())
+        });
+        assert_eq!((how, renderer), (Render::Serial, caller));
+        assert_eq!(other_how, Render::Parallel);
+        assert!(other_name.starts_with("lc-demo-scene-"), "{other_name}");
+    }
+
+    /// A caller finding a generation running waits for it instead of rendering its own (one 24 MP original costs
+    /// minutes of CPU time on a small machine).
+    #[test]
+    fn callers_wait_for_the_generation_running() {
+        let (a, b, renders) = within(30, || {
+            let slot = Arc::new(SceneSlot::default());
+            let renders = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+            let (started_tx, started) = std::sync::mpsc::channel::<()>();
+            let (go, go_rx) = std::sync::mpsc::channel::<()>();
+            let (started_tx, go_rx) = (Arc::new(std::sync::Mutex::new(started_tx)), Arc::new(std::sync::Mutex::new(go_rx)));
+            let ask = |slot: &Arc<SceneSlot>| {
+                let (slot, renders, started_tx, go_rx) = (slot.clone(), renders.clone(), started_tx.clone(), go_rx.clone());
+                std::thread::spawn(move || {
+                    slot.get_or_generate(move |_| {
+                        renders.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                        let _ = started_tx.lock().unwrap().send(());
+                        let _ = go_rx.lock().unwrap().recv();
+                        pixels(1)
+                    })
+                })
+            };
+            let first = ask(&slot);
+            started.recv().unwrap();
+            let second = ask(&slot);
+            until_waiting(&slot, 1);
+            go.send(()).unwrap();
+            let (a, b) = (first.join().unwrap().unwrap(), second.join().unwrap().unwrap());
+            (a, b, renders.load(std::sync::atomic::Ordering::SeqCst))
+        });
+        assert!(Arc::ptr_eq(&a, &b) && a.width == 1, "one generation, shared");
+        assert_eq!(renders, 1);
+    }
+
+    /// A generation that fails (its render panicked) is an error for its callers, never a hang, and the next request
+    /// generates the scene again.
+    #[test]
+    fn a_failed_generation_is_an_error_and_the_next_request_tries_again() {
+        let (first, waiters, again) = within(30, || {
+            let slot = Arc::new(SceneSlot::default());
+            let (started_tx, started) = std::sync::mpsc::channel::<()>();
+            let (go, go_rx) = std::sync::mpsc::channel::<()>();
+            let failing = {
+                let slot = slot.clone();
+                std::thread::spawn(move || {
+                    slot.get_or_generate(move |_| {
+                        let _ = started_tx.send(());
+                        let _ = go_rx.recv();
+                        panic!("render failed");
+                    })
+                })
+            };
+            started.recv().unwrap();
+            let waiters: Vec<_> = (0..2)
+                .map(|_| {
+                    let slot = slot.clone();
+                    std::thread::spawn(move || slot.get_or_generate(|_| pixels(2)))
+                })
+                .collect();
+            until_waiting(&slot, 2);
+            drop(go);
+            let first = failing.join().unwrap();
+            let waiters: Vec<_> = waiters.into_iter().map(|w| w.join().unwrap()).collect();
+            (first, waiters, slot.get_or_generate(|_| pixels(3)))
+        });
+        assert!(first.is_err() && waiters.iter().all(Result::is_err), "the callers of the failed generation get its error");
+        assert_eq!(again.unwrap().width, 3);
+    }
+
+    /// Callers get the outcome of the generation they waited for, even when a retry starts (or finishes) before they
+    /// look: a failed generation followed by a retry is still an error for them.
+    #[test]
+    fn a_retry_never_changes_the_outcome_waited_for() {
+        let mut st = SlotState::default();
+        let n = st.start();
+        assert!(st.outcome(n).is_none(), "running");
+        st.generation = Generation::Failed;
+        let m = st.start();
+        assert!(matches!(st.outcome(n), Some(Err(_))));
+        assert!(st.outcome(m).is_none());
+        st.generation = Generation::Ready(Arc::new(pixels(1)));
+        assert!(matches!(st.outcome(n), Some(Err(_))), "even once the retry succeeded");
+        assert!(matches!(st.outcome(m), Some(Ok(_))));
+        // and with threads: a retry racing the waiters of a failed generation never hands them its result
+        let wrong = within(60, || {
+            let mut wrong = 0;
+            for _ in 0..20 {
+                let slot = Arc::new(SceneSlot::default());
+                let (started_tx, started) = std::sync::mpsc::channel::<()>();
+                let (go, go_rx) = std::sync::mpsc::channel::<()>();
+                let failing = {
+                    let slot = slot.clone();
+                    std::thread::spawn(move || {
+                        slot.get_or_generate(move |_| {
+                            let _ = started_tx.send(());
+                            let _ = go_rx.recv();
+                            panic!("render failed");
+                        })
+                    })
+                };
+                started.recv().unwrap();
+                let waiters: Vec<_> = (0..3)
+                    .map(|_| {
+                        let slot = slot.clone();
+                        std::thread::spawn(move || slot.get_or_generate(|_| pixels(2)))
+                    })
+                    .collect();
+                until_waiting(&slot, 3);
+                let retry = {
+                    let slot = slot.clone();
+                    std::thread::spawn(move || {
+                        loop {
+                            if matches!(slot.lock().generation, Generation::Failed) {
+                                return slot.get_or_generate(|_| pixels(4));
+                            }
+                            std::hint::spin_loop();
+                        }
+                    })
+                };
+                drop(go);
+                let _ = failing.join().unwrap();
+                wrong += waiters.into_iter().map(|w| w.join().unwrap()).filter(Result::is_ok).count();
+                assert!(retry.join().unwrap().is_ok());
+            }
+            wrong
+        });
+        assert_eq!(wrong, 0, "waiters of a failed generation got a retry's pixels");
+    }
+
+    /// Generating a scene never touches the global rayon pool, so a process whose global pool couldn't start (asking it
+    /// anything then panics) still gets its demo scenes. Run in a process of its own: the global pool is the process's.
+    #[test]
+    fn scenes_are_generated_when_the_global_pool_is_broken() {
+        use std::io::Read;
+        use std::process::Stdio;
+        let mut child = std::process::Command::new(std::env::current_exe().unwrap())
+            .args(["--exact", "demo::tests::with_a_broken_global_pool", "--ignored", "--test-threads=1"])
+            .env("LC_DEMO_BROKEN_GLOBAL_POOL", "1")
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        // Drain both pipes on threads so a chatty child can't block on a full pipe.
+        let drain = |mut r: Box<dyn Read + Send>| {
+            std::thread::spawn(move || {
+                let mut s = String::new();
+                let _ = r.read_to_string(&mut s);
+                s
+            })
+        };
+        let (stdout, stderr) = (drain(Box::new(child.stdout.take().unwrap())), drain(Box::new(child.stderr.take().unwrap())));
+        // A deadlocked child fails the test instead of hanging CI.
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(120);
+        let status = loop {
+            if let Some(status) = child.try_wait().unwrap() {
+                break status;
+            }
+            if std::time::Instant::now() > deadline {
+                let _ = child.kill();
+                let _ = child.wait();
+                panic!("the child process did not finish within 120 s");
+            }
+            std::thread::sleep(std::time::Duration::from_millis(20));
+        };
+        let (stdout, stderr) = (stdout.join().unwrap(), stderr.join().unwrap());
+        assert!(status.success() && stdout.contains("1 passed"), "{stdout}\n{stderr}");
+    }
+
+    #[test]
+    #[ignore = "run in a process of its own by scenes_are_generated_when_the_global_pool_is_broken"]
+    fn with_a_broken_global_pool() {
+        if std::env::var_os("LC_DEMO_BROKEN_GLOBAL_POOL").is_none() {
+            return;
+        }
+        let broken = rayon::ThreadPoolBuilder::new().spawn_handler(|_| Err(std::io::Error::other("no threads"))).build_global();
+        assert!(broken.is_err());
+        assert!(std::panic::catch_unwind(rayon::current_num_threads).is_err(), "the global pool is broken");
+        let s = small_scene();
+        let got = scene_pixels(&s, 33).unwrap();
+        assert_eq!(got.data, s.render_fit_serial(33).data);
+    }
+
     #[test]
     fn the_cache_keeps_the_most_recent_scenes_within_its_limit() {
         let key = |max_edge| SceneKey { kind: lightcraft_scenes::Kind::Dunes, seed: 1, width: 3, height: 2, max_edge };
         let entry = |max_edge, used, px: Option<usize>| {
-            let slot: SceneSlot = Arc::new(std::sync::OnceLock::new());
+            let slot = Arc::new(SceneSlot::default());
             if let Some(n) = px {
-                let _ = slot.set(Arc::new(lightcraft_raster::Rgb32f::new(n, 1)));
+                slot.lock().generation = Generation::Ready(Arc::new(lightcraft_raster::Rgb32f::new(n, 1)));
             }
             SceneEntry { key: key(max_edge), slot, used }
         };
diff --git a/crates/engine/src/display.rs b/crates/engine/src/display.rs
new file mode 100644
index 00000000..f47e099b
--- /dev/null
+++ b/crates/engine/src/display.rs
@@ -0,0 +1,176 @@
+//! The monitor profile (`app.displayProfile`): previews shown on a wide-gamut or calibrated
+//! display through its ICC profile.
+//!
+//! The frontend holds the profile in use (Settings ▸ Display, the UI command `app.displayProfile`).
+//! With a profile, the loupe renders into the display's own primaries
+//! ([`RenderJob::with_display`](crate::media::RenderJob::with_display)) and everything else made
+//! for sRGB (thumbnails, cached previews, embedded camera JPEGs) is converted to it
+//! ([`present`]). Histograms and the preview caches stay sRGB, and exports never use it.
+
+pub use lightcraft_codecs::display::DisplayKind;
+use lightcraft_codecs::display::{DisplayProfile, MAX_PROFILE_BYTES};
+use lightcraft_pipeline::DisplaySpace;
+use lightcraft_raster::{Histogram, Rgba8};
+use serde_json::{Value, json};
+use std::sync::Arc;
+
+use crate::media::RenderResult;
+
+/// A loaded display profile: its transforms and the pipeline target.
+#[derive(Debug)]
+pub struct Display {
+    /// The file it came from.
+    pub path: String,
+    pub profile: DisplayProfile,
+    pub space: DisplaySpace,
+}
+
+impl Display {
+    /// Load the ICC profile at `path`.
+    pub fn load(path: &str) -> Result<Display, String> {
+        let path = path.trim();
+        let meta = std::fs::metadata(path).map_err(|e| format!("{path}: {e}"))?;
+        if meta.len() > MAX_PROFILE_BYTES as u64 {
+            return Err(format!("{path}: too large for an ICC profile"));
+        }
+        let bytes = std::fs::read(path).map_err(|e| format!("{path}: {e}"))?;
+        Display::from_bytes(path, &bytes)
+    }
+
+    pub fn from_bytes(path: &str, bytes: &[u8]) -> Result<Display, String> {
+        let profile = DisplayProfile::from_icc(bytes).map_err(|e| format!("{path}: {e}"))?;
+        let space = DisplaySpace::new(profile.to_rec2020, profile.id).ok_or_else(|| format!("{path}: the profile's primaries are degenerate"))?;
+        Ok(Display { path: path.to_string(), profile, space })
+    }
+
+    pub fn id(&self) -> u64 {
+        self.profile.id
+    }
+
+    /// Load the profile at `path` (`""`: none, the display is treated as sRGB).
+    pub fn load_opt(path: &str) -> Result<Option<Arc<Display>>, String> {
+        if path.trim().is_empty() { Ok(None) } else { Display::load(path).map(|d| Some(Arc::new(d))) }
+    }
+
+    /// For `app.displayProfile` and Settings: path, description, kind, primaries (xy).
+    pub fn describe(&self) -> Value {
+        let to_xyz = lightcraft_color::REC2020.to_xyz().mul(&self.profile.to_rec2020).0;
+        let xy = |c: usize| {
+            let (x, y, z) = (to_xyz[0][c], to_xyz[1][c], to_xyz[2][c]);
+            let s = x + y + z;
+            if s.abs() < 1e-12 { json!([0.0, 0.0]) } else { json!([round4(x / s), round4(y / s)]) }
+        };
+        json!({
+            "path": self.path,
+            "description": self.profile.description,
+            "kind": self.profile.kind.label(),
+            "primaries": {"red": xy(0), "green": xy(1), "blue": xy(2)},
+        })
+    }
+}
+
+fn round4(v: f64) -> f64 {
+    (v * 1e4).round() / 1e4
+}
+
+/// Make `r` ready for `display`: an sRGB image (thumbnail, cached preview, camera JPEG) is
+/// converted to the display's values. A render made for the display (see
+/// [`RenderJob::with_display`](crate::media::RenderJob::with_display)) is already.
+pub fn present(r: &mut RenderResult, display: &Display) {
+    if r.display.is_some() {
+        return;
+    }
+    if let Ok(rendered) = &mut r.rendered {
+        match display.profile.from_srgb(&mut rendered.image) {
+            Ok(()) => r.display = Some(display.id()),
+            Err(e) => log::warn!("display profile: {e}"),
+        }
+    }
+}
+
+/// A render into `display`'s primaries (sRGB curve) → in place, the display's device values; and
+/// its sRGB histogram, plus (`full_srgb`: for the cached view preview) its whole sRGB version.
+/// The histogram samples the same pixels [`Histogram::of_srgb8`] would, so only those are
+/// converted when the sRGB image itself isn't needed (slider drags).
+pub(crate) fn finish_render(image: &mut Rgba8, display: &Display, full_srgb: bool) -> (Option<Rgba8>, Option<Histogram>) {
+    let warn = |e: String| log::warn!("display profile: {e}");
+    let (srgb, histogram) = if full_srgb {
+        let srgb = display.profile.to_srgb(image).map_err(warn).ok();
+        let h = srgb.as_ref().map(Histogram::of_srgb8);
+        (srgb, h)
+    } else {
+        let sample = histogram_sample(image);
+        (None, display.profile.to_srgb(&sample).map_err(warn).ok().map(|s| Histogram::of_srgb8(&s)))
+    };
+    if let Err(e) = display.profile.correct(image) {
+        warn(e);
+    }
+    (srgb, histogram)
+}
+
+/// The pixels [`Histogram::of_srgb8`] reads (at most ~1 MP, a regular grid), as an image of
+/// their own (which it then reads whole).
+fn histogram_sample(img: &Rgba8) -> Rgba8 {
+    let step = ((img.len() as f64 / 1_000_000.0).sqrt().ceil() as usize).max(1);
+    if step == 1 {
+        return img.clone();
+    }
+    let (w, h) = (img.width.div_ceil(step), img.height.div_ceil(step));
+    let mut data = Vec::with_capacity(w * h);
+    for y in (0..img.height).step_by(step) {
+        for x in (0..img.width).step_by(step) {
+            data.push(img.get(x, y));
+        }
+    }
+    Rgba8 { width: w, height: h, data }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn p3() -> Display {
+        Display::from_bytes("p3.icc", &lightcraft_codecs::icc::write_named(lightcraft_codecs::NamedSpace::DisplayP3)).unwrap()
+    }
+
+    fn picture(w: usize, h: usize) -> Rgba8 {
+        Rgba8 { width: w, height: h, data: (0..w * h).map(|i| [(i * 7 % 256) as u8, (i * 13 % 256) as u8, (i * 29 % 256) as u8, 255]).collect() }
+    }
+
+    /// The sampled histogram of a drag render is exactly the histogram of the whole sRGB image.
+    #[test]
+    fn sampled_histogram_matches_the_full_one() {
+        let d = p3();
+        for (w, h) in [(40, 30), (1500, 1100), (2561, 1709)] {
+            let img = picture(w, h);
+            let (mut a, mut b) = (img.clone(), img.clone());
+            let (srgb, full) = finish_render(&mut a, &d, true);
+            let (none, sampled) = finish_render(&mut b, &d, false);
+            assert!(srgb.is_some() && none.is_none());
+            assert_eq!(full.unwrap(), sampled.unwrap(), "{w}x{h}");
+            assert_eq!(a, b);
+        }
+    }
+
+    #[test]
+    fn load_reports_and_rejects() {
+        let dir = std::env::temp_dir().join(format!("lightcraft-display-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let good = dir.join("p3.icc");
+        std::fs::write(&good, lightcraft_codecs::icc::write_named(lightcraft_codecs::NamedSpace::DisplayP3)).unwrap();
+        let bad = dir.join("bad.icc");
+        std::fs::write(&bad, b"not a profile").unwrap();
+
+        let d = Display::load_opt(&good.to_string_lossy()).unwrap().unwrap();
+        let r = d.describe();
+        assert_eq!(r["kind"], "matrix");
+        assert_eq!(r["description"], "Display P3");
+        let red = r["primaries"]["red"].as_array().unwrap();
+        assert!((red[0].as_f64().unwrap() - 0.68).abs() < 2e-3 && (red[1].as_f64().unwrap() - 0.32).abs() < 2e-3, "{r}");
+        assert!(Display::load_opt("  ").unwrap().is_none());
+        let e = Display::load(&bad.to_string_lossy()).unwrap_err();
+        assert!(e.contains("not a valid ICC profile"), "{e}");
+        assert!(Display::load(&dir.join("missing.icc").to_string_lossy()).is_err());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/engine/src/export.rs b/crates/engine/src/export.rs
index 33366285..6a9e9147 100644
--- a/crates/engine/src/export.rs
+++ b/crates/engine/src/export.rs
@@ -600,6 +600,11 @@ pub struct ExportOptions {
     /// Bits per channel: 8, 16 (PNG, TIFF), 32 (TIFF: float, linear) or 10 (AVIF); `None` = the
     /// format's default (TIFF 16, everything else 8). See [`ExportOptions::effective_depth`].
     pub bit_depth: Option<u8>,
+    /// HDR output for photos edited in HDR: JPEG as an ISO 21496-1 gain map JPEG (the SDR
+    /// rendition plus a gain map, so the file looks right everywhere; quality as set, `limit_kb`
+    /// not applied), AVIF as 10-bit Rec. 2020 PQ, 32-bit float TIFF with the highlights above SDR
+    /// white kept. Other formats, and photos without an HDR edit, are SDR.
+    pub hdr: bool,
 }
 
 impl Default for ExportOptions {
@@ -623,6 +628,7 @@ impl Default for ExportOptions {
             watermark: None,
             color_space: OutputSpace::Srgb,
             bit_depth: None,
+            hdr: false,
         }
     }
 }
@@ -658,6 +664,7 @@ pub const OPTION_PARAMS: &[&str] = &[
     "watermark",
     "colorSpace",
     "bitDepth",
+    "hdr",
 ];
 
 /// The keys of a `watermark` object ([`Watermark`], camelCase).
@@ -789,7 +796,7 @@ impl ExportOptions {
                     }
                     serde_json::from_value::<Resize>(v.clone()).map_err(|e| bad(format!("`{k}`: {e}")))?;
                 }
-                "dontEnlarge" | "removeLocation" | "background" => {
+                "dontEnlarge" | "removeLocation" | "background" | "hdr" => {
                     boolean(k, v)?;
                 }
                 "naming" | "subfolder" | "path" | "dir" | "preset" => {
@@ -922,6 +929,7 @@ impl ExportOptions {
             .filter(|w: &Watermark| !w.text.trim().is_empty() || !w.image.trim().is_empty()),
             color_space: s("colorSpace").and_then(OutputSpace::parse).unwrap_or(d.color_space),
             bit_depth: u("bitDepth").filter(|b| matches!(b, 8 | 10 | 16 | 32)).map(|b| b as u8),
+            hdr: p.get("hdr").and_then(Value::as_bool).unwrap_or(d.hdr),
         }
     }
 
@@ -990,8 +998,10 @@ impl ExportOptions {
             (ExportFormat::Png, Some(16 | 32)) => OutputDepth::U16,
             (ExportFormat::Png, _) => OutputDepth::U8,
             (ExportFormat::Tiff, Some(8)) => OutputDepth::U8,
+            (ExportFormat::Tiff, Some(32)) if self.hdr => OutputDepth::F32Hdr,
             (ExportFormat::Tiff, Some(32)) => OutputDepth::F32Linear,
             (ExportFormat::Tiff, _) => OutputDepth::U16,
+            (ExportFormat::Avif, _) if self.hdr => OutputDepth::F32Hdr,
             (ExportFormat::Avif, Some(10 | 16 | 32)) => OutputDepth::U16,
             (ExportFormat::Avif, _) => OutputDepth::U8,
         }
@@ -1007,9 +1017,19 @@ impl ExportOptions {
         }
     }
 
-    /// The colour space the file is actually written in (AVIF: sRGB).
+    /// Whether these options write HDR files (for photos edited in HDR): JPEG (gain map), AVIF
+    /// (PQ) or 32-bit float TIFF with [`ExportOptions::hdr`].
+    pub fn hdr_output(&self) -> bool {
+        self.hdr && matches!((self.format, self.bit_depth), (ExportFormat::Jpeg | ExportFormat::Avif, _) | (ExportFormat::Tiff, Some(32)))
+    }
+
+    /// The colour space the file is actually written in (AVIF: sRGB, or Rec. 2020 for HDR).
     pub fn effective_space(&self) -> OutputSpace {
-        if self.format == ExportFormat::Avif { OutputSpace::Srgb } else { self.color_space }
+        match self.format {
+            ExportFormat::Avif if self.hdr => OutputSpace::Rec2020,
+            ExportFormat::Avif => OutputSpace::Srgb,
+            _ => self.color_space,
+        }
     }
 
     /// Output file name for photo `p` at 1-based position `seq` in a batch (the original's
@@ -1119,13 +1139,8 @@ pub fn encode_image(img: &Rgba8, o: &ExportOptions) -> Result<Vec<u8>, String> {
 
 /// Like [`encode_image`], embedding `meta` (already filtered by the policy) as EXIF + XMP.
 pub fn encode_with_metadata(img: &Rgba8, o: &ExportOptions, meta: Option<&Metadata>) -> Result<Vec<u8>, String> {
-    let mut img = img.clone();
-    output_sharpen(&mut img, o.sharpen, o.sharpen_amount);
+    let img = finish_8bit(img, o);
     let space = o.effective_space();
-    if let Some(wm) = &o.watermark {
-        let wm = Watermark { color: srgb8_in(space, wm.color), target: Some(space), ..wm.clone() };
-        draw_watermark(&mut img, &wm);
-    }
     let profile = icc::write_named(named_space(space));
     let exif = meta.map(lightcraft_meta::write_exif);
     let xmp = meta.map(|m| lightcraft_meta::write_xmp(m, None));
@@ -1168,6 +1183,56 @@ pub fn encode_with_metadata(img: &Rgba8, o: &ExportOptions, meta: Option<&Metada
     r.map_err(|e| e.to_string())
 }
 
+/// Output sharpening and the watermark on an 8-bit render in `o.effective_space()`.
+fn finish_8bit(img: &Rgba8, o: &ExportOptions) -> Rgba8 {
+    let mut img = img.clone();
+    output_sharpen(&mut img, o.sharpen, o.sharpen_amount);
+    let space = o.effective_space();
+    if let Some(wm) = &o.watermark {
+        let wm = Watermark { color: srgb8_in(space, wm.color), target: Some(space), ..wm.clone() };
+        draw_watermark(&mut img, &wm);
+    }
+    img
+}
+
+/// Output sharpening and the watermark on a high-bit-depth render.
+fn finish_deep(img: &DeepImage, o: &ExportOptions) -> DeepImage {
+    let mut img = img.clone();
+    output_sharpen_deep(&mut img, o.sharpen, o.sharpen_amount);
+    if let Some(wm) = &o.watermark {
+        let wm = Watermark { color: srgb8_in(img.space, wm.color), target: Some(img.space), ..wm.clone() };
+        draw_watermark_deep(&mut img, &wm);
+    }
+    img
+}
+
+/// Encode an ISO 21496-1 gain map JPEG from the SDR rendition `sdr` (8-bit, in the output space)
+/// and the HDR rendition `hdr` (float linear, same space and size). The gain map is measured
+/// against the base as written, so its 8-bit rounding is handed back by the map.
+pub fn encode_gain_map_jpeg(sdr: &Rgba8, hdr: &DeepImage, o: &ExportOptions, meta: Option<&Metadata>) -> Result<Vec<u8>, String> {
+    use lightcraft_codecs::gainmap;
+    let base = finish_8bit(sdr, o);
+    let hdr = finish_deep(hdr, o);
+    let DeepSamples::F32(hv) = &hdr.samples else {
+        return Err("HDR export needs a float HDR render".into());
+    };
+    let (w, h) = (base.width, base.height);
+    if (hdr.width, hdr.height) != (w, h) || hv.len() < w * h * 3 {
+        return Err("HDR and SDR renders differ in size".into());
+    }
+    let space = o.effective_space();
+    let trc = space.trc();
+    let sdr_lin: Vec<[f32; 3]> = base.data.iter().map(|p| [0, 1, 2].map(|c| trc.decode(p[c] as f32 / 255.0))).collect();
+    let hdr_lin: &[[f32; 3]] = hv.as_chunks::<3>().0;
+    let (map, gm) = gainmap::compute(&sdr_lin, hdr_lin, w, h, space.luma(), &gainmap::GainMapOptions::default()).map_err(|e| e.to_string())?;
+    let profile = icc::write_named(named_space(space));
+    let exif = meta.map(lightcraft_meta::write_exif);
+    let xmp = meta.map(|m| lightcraft_meta::write_xmp(m, None));
+    let em = EncodeMeta { icc: Some(&profile), exif: exif.as_deref(), xmp: xmp.as_deref(), ppi: Some(o.ppi) };
+    let sub = if o.limit_kb.is_some() { ChromaSubsampling::S420 } else { ChromaSubsampling::S444 };
+    gainmap::encode_jpeg(&EncodeImage::rgba8(&base), &map, &gm, o.quality, sub, &em).map_err(|e| e.to_string())
+}
+
 /// The codecs' name of an output space (for its ICC profile).
 pub fn named_space(s: OutputSpace) -> NamedSpace {
     match s {
@@ -1204,12 +1269,7 @@ pub fn encode_rendered(r: &lightcraft_pipeline::Rendered, o: &ExportOptions, met
 
 /// Encode a high-bit-depth image (see [`encode_rendered`]).
 pub fn encode_deep(img: &DeepImage, o: &ExportOptions, meta: Option<&Metadata>) -> Result<Vec<u8>, String> {
-    let mut img = img.clone();
-    output_sharpen_deep(&mut img, o.sharpen, o.sharpen_amount);
-    if let Some(wm) = &o.watermark {
-        let wm = Watermark { color: srgb8_in(img.space, wm.color), target: Some(img.space), ..wm.clone() };
-        draw_watermark_deep(&mut img, &wm);
-    }
+    let img = finish_deep(img, o);
     let profile = match img.samples {
         DeepSamples::F32(_) => icc::write_matrix_trc(&img.space.rgb_space(), &lightcraft_codecs::Trc::Linear),
         DeepSamples::U16(_) => icc::write_named(named_space(img.space)),
@@ -1222,27 +1282,21 @@ pub fn encode_deep(img: &DeepImage, o: &ExportOptions, meta: Option<&Metadata>)
         DeepSamples::U16(v) => EncodeImage::new(w, h, 3, Samples::U16(v)),
         DeepSamples::F32(v) => EncodeImage::new(w, h, 3, Samples::F32(v)),
     };
-    let r = match o.format {
-        ExportFormat::Png => encode::encode_png(&e, &meta),
-        ExportFormat::Tiff => encode::encode_tiff(&e, o.tiff_compression, &meta),
-        ExportFormat::Avif => encode::encode_avif(&e, o.quality, 8, &meta),
-        f => return Err(format!("{f:?} export is 8-bit only")),
+    let r = match (o.format, &img.samples) {
+        (ExportFormat::Png, _) => encode::encode_png(&e, &meta),
+        (ExportFormat::Tiff, _) => encode::encode_tiff(&e, o.tiff_compression, &meta),
+        (ExportFormat::Avif, DeepSamples::F32(v)) if img.space == OutputSpace::Rec2020 => {
+            lightcraft_codecs::encode_avif_pq(w, h, v, o.quality, 8, &meta)
+        }
+        (ExportFormat::Avif, _) => encode::encode_avif(&e, o.quality, 8, &meta),
+        (f, _) => return Err(format!("{f:?} export is 8-bit only")),
     };
     r.map_err(|e| e.to_string())
 }
 
-/// Parse a shutter speed such as `1/250`, `0.5` or `2"` into seconds.
-fn parse_shutter(s: &str) -> Option<f64> {
-    let s = s.trim().trim_end_matches(['s', '"']).trim();
-    match s.split_once('/') {
-        Some((n, d)) => Some(n.trim().parse::<f64>().ok()? / d.trim().parse::<f64>().ok()?),
-        None => s.parse().ok(),
-    }
-    .filter(|v: &f64| v.is_finite() && *v > 0.0)
-}
-
 /// The metadata to embed for `photo` under `o.metadata` / `o.remove_location`. `None` = embed nothing.
-pub fn export_metadata(photo: &lightcraft_catalog::Photo, o: &ExportOptions) -> Option<Metadata> {
+/// Keywords follow the catalog's keyword list (`Catalog::export_keywords`).
+pub fn export_metadata(photo: &lightcraft_catalog::Photo, catalog: &lightcraft_catalog::Catalog, o: &ExportOptions) -> Option<Metadata> {
     let m = &photo.meta;
     let text = |s: &str| (!s.trim().is_empty()).then(|| s.to_string());
     // copyright info (also under "copyright only"): notice, creator, status, usage terms, info URL
@@ -1270,7 +1324,9 @@ pub fn export_metadata(photo: &lightcraft_catalog::Photo, o: &ExportOptions) ->
         out.state = text(&m.state);
         out.country = text(&m.country);
     }
-    out.keywords = m.keywords.clone();
+    let keywords = catalog.export_keywords(&m.keywords);
+    out.keywords = keywords.flat;
+    out.hierarchical_keywords = keywords.hierarchical;
     out.capture_time = photo.captured.as_deref().and_then(DateTime::parse_iso);
     out.rating = (photo.rating > 0).then_some(photo.rating as i8);
     // Pixels are exported upright: orientation is baked in.
@@ -1283,7 +1339,7 @@ pub fn export_metadata(photo: &lightcraft_catalog::Photo, o: &ExportOptions) ->
         out.lens_model = text(&m.lens);
         out.focal_length = m.focal_mm.map(f64::from);
         out.f_number = m.aperture.map(f64::from);
-        out.exposure_time = parse_shutter(&m.shutter);
+        out.exposure_time = lightcraft_catalog::parse_shutter_seconds(&m.shutter);
         out.iso = m.iso;
     }
     Some(out)
@@ -1324,10 +1380,15 @@ pub struct PreparedExport {
     work: Work,
     /// The library's originals, which [`run_batch`] never writes over (shared by a batch).
     guard: std::sync::Arc<crate::originals::OriginalGuard>,
+    /// Estimated working memory of [`Self::run`] (bytes), held from [`crate::memory::export_gate`]
+    /// while it runs beside other photos of a batch.
+    weight: usize,
 }
 
 struct RenderWork {
     job: crate::media::RenderJob,
+    /// The HDR rendition of a gain map JPEG (`job` renders its SDR base).
+    hdr_job: Option<crate::media::RenderJob>,
     meta: Option<Metadata>,
     opts: ExportOptions,
 }
@@ -1373,25 +1434,52 @@ fn prepare_guarded(
 ) -> Result<PreparedExport, String> {
     let p = session.catalog.photo(id).ok_or("no such photo")?;
     let file_name = o.file_name_for(p, seq);
-    let work = if o.format.is_rendered() {
+    // HDR output only for photos edited in HDR; the rest of the batch exports as usual
+    let sdr_opts;
+    let o = if o.hdr && !p.develop.hdr.enabled {
+        sdr_opts = ExportOptions { hdr: false, ..o.clone() };
+        &sdr_opts
+    } else {
+        o
+    };
+    let (full_px, long) = ((p.width as usize).saturating_mul(p.height as usize), p.width.max(p.height) as usize);
+    let (work, weight) = if o.format.is_rendered() {
         let (w, h) = output_size(p, o);
-        let meta = export_metadata(p, o);
+        let meta = export_metadata(p, &session.catalog, o);
+        let gain_map = o.hdr_output() && o.format == ExportFormat::Jpeg;
         let job = session.export_job(id, w, h, o.effective_space(), o.effective_depth())?;
-        Work::Render(Box::new(RenderWork { job, meta, opts: o.clone() }))
+        let weight = render_weight(full_px, long, job.level, w.saturating_mul(h));
+        let hdr_job = if gain_map { Some(session.export_job(id, w, h, o.effective_space(), OutputDepth::F32Hdr)?) } else { None };
+        (Work::Render(Box::new(RenderWork { job, hdr_job, meta, opts: o.clone() })), weight)
     } else {
         let lightcraft_catalog::Source::File { path } = &p.source else {
             return Err(format!("{} is a generated demo photo: it has no original file to export", p.file_name));
         };
-        Work::File {
+        let dng = (o.format == ExportFormat::Dng).then_some(o.dng_compression);
+        // the file's bytes; a DNG also decodes the raw data (16-bit samples) and writes it again
+        let weight = (p.file_size as usize).saturating_add(if dng.is_some() { full_px.saturating_mul(6) } else { 0 });
+        let work = Work::File {
             path: path.clone(),
             read: session.media.file_bytes.clone(),
             packet: crate::sidecar::sidecar_packet(p, &session.catalog),
-            dng: (o.format == ExportFormat::Dng).then_some(o.dng_compression),
+            dng,
             label: p.file_name.clone(),
             size: (p.width as usize, p.height as usize),
-        }
+        };
+        (work, weight)
     };
-    Ok(PreparedExport { photo: id, file_name, work, guard })
+    Ok(PreparedExport { photo: id, file_name, work, guard, weight })
+}
+
+/// Working memory of rendering a photo of `full_px` pixels (long edge `long`) from source level
+/// `level` into `out_px` output pixels: the decoded source (linear RGB f32, 12 B/px) plus the
+/// pipeline's planes and the encoded output (~36 B per output pixel). Measured: a 24 MP export
+/// peaks at ~1.2 GB, one at 2048 px from the 2560 px preview at ~150 MB.
+fn render_weight(full_px: usize, long: usize, level: crate::media::SourceLevel, out_px: usize) -> usize {
+    let edge = level.max_edge().min(long.max(1));
+    let scale = edge as f64 / long.max(1) as f64;
+    let src_px = (full_px as f64 * scale * scale).min(usize::MAX as f64 / 64.0) as usize;
+    src_px.saturating_mul(12).saturating_add(out_px.saturating_mul(36))
 }
 
 impl PreparedExport {
@@ -1399,9 +1487,16 @@ impl PreparedExport {
         let file_name = self.file_name;
         match self.work {
             Work::Render(w) => {
-                let RenderWork { job, meta, opts } = *w;
+                let RenderWork { job, hdr_job, meta, opts } = *w;
                 let r = job.run().rendered?;
-                let bytes = encode_rendered(&r, &opts, meta.as_ref())?;
+                let bytes = match hdr_job {
+                    Some(hj) => {
+                        let hr = hj.run().rendered?;
+                        let hdr = hr.deep.ok_or("the HDR render has no float samples")?;
+                        encode_gain_map_jpeg(&r.image, &hdr, &opts, meta.as_ref())?
+                    }
+                    None => encode_rendered(&r, &opts, meta.as_ref())?,
+                };
                 Ok(Exported { file_name, bytes, width: r.image.width, height: r.image.height, sidecars: Vec::new() })
             }
             Work::File { path, read, packet, dng, label, size } => {
@@ -1501,6 +1596,11 @@ fn sidecar_path(main: &str, ext: &str) -> String {
 /// policy. `progress(done, next file)` is called before each photo; returning false cancels the
 /// rest. Returns one JSON object per photo: `{path, width, height, bytes, sidecars}`,
 /// `{skipped: path}` or (unless `stop_on_error`) `{photo, file, error}`.
+///
+/// Several photos render side by side ([`export_parallelism`], within the memory of
+/// [`crate::memory::export_gate`]), so one photo's decode, encode or GPU wait overlaps another's
+/// render (issue #496). Paths, writes, results and `progress` still follow the batch order, and the
+/// files are the same as one at a time.
 pub fn run_batch(
     items: Vec<PreparedExport>,
     o: &ExportOptions,
@@ -1510,31 +1610,226 @@ pub fn run_batch(
     stop_on_error: bool,
     progress: &mut dyn FnMut(usize, &str) -> bool,
 ) -> Result<Vec<serde_json::Value>, String> {
-    use serde_json::json;
-    let join = |a: &str, b: &str| if a.is_empty() { b.to_string() } else { format!("{}/{b}", a.trim_end_matches('/')) };
-    let dir = if o.subfolder.is_empty() { to.dir.clone() } else { join(&to.dir, &o.subfolder) };
-    let single = items.len() == 1;
-    let mut taken = std::collections::HashSet::new();
-    let mut out = Vec::new();
-    for (i, item) in items.into_iter().enumerate() {
-        if !progress(i, &item.file_name) {
-            break;
+    let lanes = export_parallelism(items.len());
+    run_batch_with(items, &mut Placer::new(o, to, write, exists, stop_on_error), progress, lanes)
+}
+
+/// How many photos of a batch of `n` render side by side. Each render already spreads its rows
+/// over every core; the others fill the cores while it decodes, encodes or waits for the GPU.
+/// One on wasm32 (no threads).
+pub fn export_parallelism(n: usize) -> usize {
+    if cfg!(target_arch = "wasm32") {
+        return 1;
+    }
+    let cores = std::thread::available_parallelism().map_or(1, |c| c.get());
+    (cores / 4).clamp(1, 4).min(n.max(1))
+}
+
+/// [`run_batch`] with `lanes` photos in flight (the calling thread is one of them).
+fn run_batch_with(
+    items: Vec<PreparedExport>,
+    placer: &mut Placer<'_>,
+    progress: &mut dyn FnMut(usize, &str) -> bool,
+    lanes: usize,
+) -> Result<Vec<serde_json::Value>, String> {
+    placer.single = items.len() == 1;
+    if lanes <= 1 || items.len() <= 1 {
+        for (i, item) in items.into_iter().enumerate() {
+            if !progress(i, &item.file_name) {
+                break;
+            }
+            let (photo, name, guard) = (item.photo, item.file_name.clone(), item.guard.clone());
+            placer.place(photo, name, &guard, run_gated(item))?;
         }
-        let (photo, name, guard) = (item.photo, item.file_name.clone(), item.guard.clone());
-        let e = match item.run() {
-            Ok(e) => e,
-            Err(err) if stop_on_error => return Err(err),
-            Err(err) => {
-                out.push(json!({"photo": photo.0, "file": name, "error": err}));
+        return Ok(std::mem::take(&mut placer.out));
+    }
+    let heads: Vec<_> = items.iter().map(|i| (i.photo, i.file_name.clone(), i.guard.clone())).collect();
+    let queue = Queue {
+        lane: std::sync::Mutex::new(Lane { items: items.into_iter().map(Some).collect(), next: 0, placed: 0, stop: false, done: Default::default() }),
+        cv: std::sync::Condvar::new(),
+        ahead: lanes,
+    };
+    std::thread::scope(|sc| {
+        for k in 1..lanes {
+            let q = &queue;
+            // a lane that can't start leaves its photos to the others (and to this thread)
+            if std::thread::Builder::new().name(format!("export-{k}")).spawn_scoped(sc, move || q.work()).is_err() {
+                break;
+            }
+        }
+        let placed = || {
+            for (i, (photo, name, guard)) in heads.into_iter().enumerate() {
+                if !progress(i, &name) {
+                    break;
+                }
+                let e = queue.result(i);
+                placer.place(photo, name, &guard, e)?;
+            }
+            Ok::<_, String>(())
+        };
+        let r = placed();
+        queue.stop();
+        r
+    })?;
+    Ok(std::mem::take(&mut placer.out))
+}
+
+/// Run one photo's export holding its working memory from [`crate::memory::export_gate`]; a panic
+/// becomes that photo's error, not the batch's end.
+fn run_gated(item: PreparedExport) -> Result<Exported, String> {
+    let _held = crate::memory::export_gate().acquire(item.weight);
+    let what = format!("exporting {}", item.file_name);
+    crate::guard::catch(&what, || item.run()).and_then(|r| r)
+}
+
+/// The photos of a batch shared by its lanes: each lane takes the next one, at most
+/// [`Queue::ahead`] past the last placed. That bounds the finished files waiting in memory for
+/// their turn too (their working memory is given back to the gate as soon as they are encoded).
+struct Queue {
+    lane: std::sync::Mutex<Lane>,
+    cv: std::sync::Condvar,
+    ahead: usize,
+}
+
+struct Lane {
+    items: Vec<Option<PreparedExport>>,
+    /// The next photo to start.
+    next: usize,
+    /// Photos handed to the placer so far.
+    placed: usize,
+    stop: bool,
+    done: std::collections::HashMap<usize, Result<Exported, String>>,
+}
+
+impl Lane {
+    fn take_next(&mut self) -> Option<(usize, PreparedExport)> {
+        let i = self.next;
+        let item = self.items.get_mut(i)?.take()?;
+        self.next += 1;
+        Some((i, item))
+    }
+}
+
+impl Queue {
+    fn lock(&self) -> std::sync::MutexGuard<'_, Lane> {
+        self.lane.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
+    }
+
+    fn wait<'a>(&self, g: std::sync::MutexGuard<'a, Lane>) -> std::sync::MutexGuard<'a, Lane> {
+        self.cv.wait(g).unwrap_or_else(std::sync::PoisonError::into_inner)
+    }
+
+    fn finish(&self, i: usize, r: Result<Exported, String>) {
+        self.lock().done.insert(i, r);
+        self.cv.notify_all();
+    }
+
+    /// A lane thread: run photos until none is left or the batch stops.
+    fn work(&self) {
+        loop {
+            let mut l = self.lock();
+            let (i, item) = loop {
+                if l.stop || l.next >= l.items.len() {
+                    return;
+                }
+                if l.next < l.placed.saturating_add(self.ahead) {
+                    match l.take_next() {
+                        Some(t) => break t,
+                        None => return,
+                    }
+                }
+                l = self.wait(l);
+            };
+            drop(l);
+            self.finish(i, run_gated(item));
+        }
+    }
+
+    /// Photo `i`'s result, waiting for it; run here when no lane has started it yet.
+    fn result(&self, i: usize) -> Result<Exported, String> {
+        let mut l = self.lock();
+        loop {
+            if let Some(r) = l.done.remove(&i) {
+                l.placed = i + 1;
+                drop(l);
+                self.cv.notify_all();
+                return r;
+            }
+            if l.next == i {
+                let Some((_, item)) = l.take_next() else {
+                    return Err("export: photo missing from the batch".into());
+                };
+                drop(l);
+                self.finish(i, run_gated(item));
+                l = self.lock();
                 continue;
             }
+            l = self.wait(l);
+        }
+    }
+
+    fn stop(&self) {
+        self.lock().stop = true;
+        self.cv.notify_all();
+    }
+}
+
+/// Where a batch's files go: each photo's path (subfolder, conflict policy, sidecars, never an
+/// original) and its write, in batch order.
+struct Placer<'a> {
+    o: &'a ExportOptions,
+    to: &'a Destination,
+    dir: String,
+    single: bool,
+    taken: std::collections::HashSet<String>,
+    out: Vec<serde_json::Value>,
+    write: &'a mut dyn FnMut(&str, &[u8]) -> Result<(), String>,
+    exists: &'a dyn Fn(&str) -> bool,
+    stop_on_error: bool,
+}
+
+fn join_path(a: &str, b: &str) -> String {
+    if a.is_empty() { b.to_string() } else { format!("{}/{b}", a.trim_end_matches('/')) }
+}
+
+impl<'a> Placer<'a> {
+    fn new(
+        o: &'a ExportOptions,
+        to: &'a Destination,
+        write: &'a mut dyn FnMut(&str, &[u8]) -> Result<(), String>,
+        exists: &'a dyn Fn(&str) -> bool,
+        stop_on_error: bool,
+    ) -> Placer<'a> {
+        let dir = if o.subfolder.is_empty() { to.dir.clone() } else { join_path(&to.dir, &o.subfolder) };
+        Placer { o, to, dir, single: false, taken: Default::default(), out: Vec::new(), write, exists, stop_on_error }
+    }
+
+    /// Place photo `photo`'s export result (file `name`): write it and record the outcome. `Err`
+    /// only when it failed and `stop_on_error` is set.
+    fn place(
+        &mut self,
+        photo: lightcraft_catalog::PhotoId,
+        name: String,
+        guard: &crate::originals::OriginalGuard,
+        e: Result<Exported, String>,
+    ) -> Result<(), String> {
+        use serde_json::json;
+        let (o, dir, exists) = (self.o, &self.dir, self.exists);
+        let e = match e {
+            Ok(e) => e,
+            Err(err) if self.stop_on_error => return Err(err),
+            Err(err) => {
+                self.out.push(json!({"photo": photo.0, "file": name, "error": err}));
+                return Ok(());
+            }
         };
         // the exported file and its sidecars
         let group = |main: &str| std::iter::once(main.to_string()).chain(e.sidecars.iter().map(|(x, _)| sidecar_path(main, x))).collect::<Vec<_>>();
-        let path = match to.exact.as_deref().filter(|_| single) {
+        let path = match self.to.exact.as_deref().filter(|_| self.single) {
             Some(p) => Ok(p.to_string()),
             None => {
-                let path = join(&dir, &e.file_name);
+                let path = join_path(dir, &e.file_name);
+                let taken = &self.taken;
                 let busy = |main: &str| group(main).iter().any(|p| taken.contains(p) || exists(p));
                 if !busy(&path) {
                     Ok(path)
@@ -1542,12 +1837,12 @@ pub fn run_batch(
                     match o.conflict {
                         Conflict::Overwrite => Ok(path),
                         Conflict::Skip => {
-                            out.push(json!({"skipped": path}));
-                            continue;
+                            self.out.push(json!({"skipped": path}));
+                            return Ok(());
                         }
                         Conflict::Unique => {
                             let (stem, ext) = e.file_name.rsplit_once('.').map_or((e.file_name.as_str(), None), |(a, b)| (a, Some(b)));
-                            let name = |n: usize| join(&dir, &ext.map_or(format!("{stem}-{n}"), |x| format!("{stem}-{n}.{x}")));
+                            let name = |n: usize| join_path(dir, &ext.map_or(format!("{stem}-{n}"), |x| format!("{stem}-{n}.{x}")));
                             (2..1_000_000).map(name).find(|p| !busy(p)).ok_or_else(|| format!("{path}: no free file name"))
                         }
                     }
@@ -1555,6 +1850,7 @@ pub fn run_batch(
             }
         };
         let file = path.clone().unwrap_or_else(|_| name.clone());
+        let write = &mut *self.write;
         let written = path.and_then(|path| {
             let files = group(&path);
             // never over an original, whatever the conflict policy or the exact path said
@@ -1571,14 +1867,14 @@ pub fn run_batch(
         });
         match written {
             Ok((path, files, sidecars)) => {
-                taken.extend(files);
-                out.push(json!({"path": path, "width": e.width, "height": e.height, "bytes": e.bytes.len(), "sidecars": sidecars}));
+                self.taken.extend(files);
+                self.out.push(json!({"path": path, "width": e.width, "height": e.height, "bytes": e.bytes.len(), "sidecars": sidecars}));
             }
-            Err(err) if stop_on_error => return Err(err),
-            Err(err) => out.push(json!({"photo": photo.0, "file": file, "error": err})),
+            Err(err) if self.stop_on_error => return Err(err),
+            Err(err) => self.out.push(json!({"photo": photo.0, "file": file, "error": err})),
         }
+        Ok(())
     }
-    Ok(out)
 }
 
 #[cfg(test)]
@@ -1626,9 +1922,28 @@ mod tests {
         assert!(img.data[3][0] < 80 && img.data[4][0] > 170);
     }
 
+    /// Exported files carry keywords as Lightroom Classic writes them: names flat in `dc:subject`
+    /// (with the keywords containing them), full paths in `lr:hierarchicalSubject`, and nothing of
+    /// a keyword left out of export. They used to carry the `a|b` paths in `dc:subject`.
+    #[test]
+    fn exported_keywords_follow_their_options() {
+        use lightcraft_catalog::{Catalog, Op, Photo, PhotoId, Source, keywords::KeywordInfo};
+        let mut c = Catalog::new();
+        c.apply(Op::SetKeyword { path: "Places".into(), info: Some(KeywordInfo { include_on_export: false, ..KeywordInfo::default() }) }).unwrap();
+        c.apply(Op::SetKeyword { path: "draft".into(), info: Some(KeywordInfo { include_on_export: false, ..KeywordInfo::default() }) }).unwrap();
+        let mut p = Photo::new(PhotoId(1), Source::Demo { scene: 0 }, "a.jpg", "jpeg", 10, 10, "2026-09-30T00:00:00");
+        p.meta.keywords = vec!["Places|Lisbon".into(), "travel|Italy".into(), "draft".into()];
+        let m = export_metadata(&p, &c, &ExportOptions::default()).unwrap();
+        assert_eq!(m.keywords, ["Lisbon", "Italy", "travel"]);
+        assert_eq!(m.hierarchical_keywords, ["Places|Lisbon", "travel|Italy"]);
+        let jpg = encode_with_metadata(&test_image(), &ExportOptions::default(), Some(&m)).unwrap();
+        let back = lightcraft_meta::extract(&jpg);
+        assert_eq!((back.keywords, back.hierarchical_keywords), (m.keywords.clone(), m.hierarchical_keywords.clone()));
+    }
+
     #[test]
     fn metadata_policies() {
-        use lightcraft_catalog::{Photo, PhotoId, Source};
+        use lightcraft_catalog::{Catalog, Photo, PhotoId, Source};
         let mut p = Photo::new(PhotoId(1), Source::Demo { scene: 0 }, "a.jpg", "jpeg", 10, 10, "2026-09-30T00:00:00");
         p.meta.camera = "Synthetic X2".into();
         p.meta.copyright = "(c) Me".into();
@@ -1637,21 +1952,21 @@ mod tests {
         p.meta.copyright_url = "https://example.com/rights".into();
         p.meta.shutter = "1/250".into();
         p.meta.gps = Some((43.0, -110.0));
-        let all = export_metadata(&p, &ExportOptions::default()).unwrap();
+        let all = export_metadata(&p, &Catalog::new(), &ExportOptions::default()).unwrap();
         assert_eq!(all.model.as_deref(), Some("Synthetic X2"));
         assert!((all.exposure_time.unwrap() - 0.004).abs() < 1e-9);
         assert!(all.gps.is_some());
         let o = ExportOptions { metadata: MetadataPolicy::AllExceptCamera, remove_location: true, ..Default::default() };
-        let m = export_metadata(&p, &o).unwrap();
+        let m = export_metadata(&p, &Catalog::new(), &o).unwrap();
         assert!(m.model.is_none() && m.gps.is_none() && m.copyright.is_some());
-        let c = export_metadata(&p, &ExportOptions { metadata: MetadataPolicy::Copyright, ..Default::default() }).unwrap();
+        let c = export_metadata(&p, &Catalog::new(), &ExportOptions { metadata: MetadataPolicy::Copyright, ..Default::default() }).unwrap();
         assert!(c.model.is_none() && c.gps.is_none() && c.copyright.as_deref() == Some("(c) Me"));
         // "copyright only" keeps all the copyright info: status, usage terms, info URL
         assert_eq!(
             (c.copyright_marked, c.usage_terms.as_deref(), c.copyright_url.as_deref()),
             (Some(true), Some("Editorial use only"), Some("https://example.com/rights"))
         );
-        assert!(export_metadata(&p, &ExportOptions { metadata: MetadataPolicy::None, ..Default::default() }).is_none());
+        assert!(export_metadata(&p, &Catalog::new(), &ExportOptions { metadata: MetadataPolicy::None, ..Default::default() }).is_none());
         // embedded and readable back from the JPEG
         let jpg = encode_with_metadata(&test_image(), &ExportOptions::default(), Some(&all)).unwrap();
         let back = lightcraft_meta::extract(&jpg);
@@ -2225,4 +2540,103 @@ mod tests {
         assert!(WATERMARK_SIZE_RANGE.0 <= 0.01 && WATERMARK_SIZE_RANGE.1 >= 0.15);
         assert!(WATERMARK_IMAGE_WIDTH_RANGE.0 <= 0.02 && WATERMARK_IMAGE_WIDTH_RANGE.1 >= 1.0);
     }
+
+    /// A batch with `lanes` photos in flight into a fake folder `out` (nothing exists there):
+    /// results, writes (path, bytes) and progress calls; `progress` returns false at `cancel_at`.
+    #[allow(clippy::type_complexity)]
+    fn lanes_batch(
+        s: &mut crate::Session,
+        ids: &[lightcraft_catalog::PhotoId],
+        o: &ExportOptions,
+        lanes: usize,
+        stop_on_error: bool,
+        cancel_at: usize,
+    ) -> (Result<Vec<serde_json::Value>, String>, Vec<(String, Vec<u8>)>, Vec<(usize, String)>) {
+        let items = prepare_batch(s, ids, o).unwrap();
+        let to = Destination { dir: "out".into(), exact: None };
+        let mut written = Vec::new();
+        let mut write = |p: &str, b: &[u8]| {
+            written.push((p.to_string(), b.to_vec()));
+            Ok(())
+        };
+        let mut seen = Vec::new();
+        let mut progress = |i: usize, name: &str| {
+            seen.push((i, name.to_string()));
+            i < cancel_at
+        };
+        let files = run_batch_with(items, &mut Placer::new(o, &to, &mut write, &|_| false, stop_on_error), &mut progress, lanes);
+        (files, written, seen)
+    }
+
+    /// The files of a batch without their byte counts: a GPU render (when another test turns the
+    /// GPU off mid-run) may differ from a CPU one by an LSB, never in name, size or order.
+    fn shape(files: &[serde_json::Value]) -> Vec<serde_json::Value> {
+        files.iter().map(|f| json!({"path": f["path"], "width": f["width"], "height": f["height"], "error": f["error"]})).collect()
+    }
+
+    // Issue #496: photos rendered side by side give the same files, names, order and progress as
+    // one at a time, and a cancel stops at the same photo
+    #[test]
+    fn side_by_side_batches_match_one_at_a_time() {
+        let mut s = crate::Session::with_demo();
+        let ids: Vec<_> = s.visible().iter().copied().take(5).collect();
+        // one name for all: the Unique numbering follows the order the files are placed in
+        let o = ExportOptions::from_json(&json!({"format": "png", "width": 40, "naming": "same"}));
+        let (files, written, seen) = lanes_batch(&mut s, &ids, &o, 1, true, usize::MAX);
+        let files = files.unwrap();
+        let paths: Vec<_> = written.iter().map(|(p, _)| p.clone()).collect();
+        assert_eq!(paths, ["out/same.png", "out/same-2.png", "out/same-3.png", "out/same-4.png", "out/same-5.png"]);
+        let heights: std::collections::HashSet<_> = files.iter().map(|f| f["height"].as_u64()).collect();
+        assert!(heights.len() > 1, "photos of different shapes show the order: {files:?}");
+        for lanes in [2, 3, 8] {
+            let (f, w, sn) = lanes_batch(&mut s, &ids, &o, lanes, true, usize::MAX);
+            assert_eq!(shape(&f.unwrap()), shape(&files), "{lanes} lanes");
+            assert_eq!(w.iter().map(|(p, _)| p.clone()).collect::<Vec<_>>(), paths, "{lanes} lanes");
+            assert_eq!(sn, seen, "{lanes} lanes");
+        }
+        let (f, w, sn) = lanes_batch(&mut s, &ids, &o, 3, true, 2);
+        assert_eq!(shape(&f.unwrap()), shape(&files[..2]));
+        assert_eq!((w.len(), sn.len()), (2, 3), "photos past the cancel are never written");
+    }
+
+    // A photo that fails is reported in its place while the others are exported; with
+    // stop_on_error the batch ends there and nothing after it is written
+    #[test]
+    fn side_by_side_batches_report_failures_in_order() {
+        use lightcraft_catalog::{Op, Photo, PhotoId, Source};
+        let mut s = crate::Session::with_demo();
+        let mut ids: Vec<_> = s.visible().iter().copied().take(3).collect();
+        let gone =
+            Photo::new(PhotoId(9_496), Source::File { path: "no/such/dir/gone.jpg".into() }, "gone.jpg", "JPEG", 600, 400, "2026-10-09T00:00:00");
+        s.catalog.apply(Op::AddPhoto { photo: Box::new(gone) }).unwrap();
+        ids.insert(1, PhotoId(9_496));
+        let o = ExportOptions::from_json(&json!({"format": "jpeg", "width": 40}));
+        let (files, written, _) = lanes_batch(&mut s, &ids, &o, 3, false, usize::MAX);
+        let files = files.unwrap();
+        assert_eq!(files.len(), 4);
+        assert_eq!((files[1]["photo"].as_u64(), files[1]["file"].as_str()), (Some(9_496), Some("gone.jpg")), "{files:?}");
+        assert!(files[1]["error"].is_string());
+        assert!([0, 2, 3].iter().all(|&i| files[i]["path"].is_string()), "{files:?}");
+        assert_eq!(written.len(), 3);
+        let one = lanes_batch(&mut s, &ids, &o, 1, false, usize::MAX).0.unwrap();
+        assert_eq!(shape(&files), shape(&one));
+
+        let (r, written, _) = lanes_batch(&mut s, &ids, &o, 3, true, usize::MAX);
+        assert!(r.is_err());
+        assert_eq!(written.len(), 1, "only the photo before the failure");
+    }
+
+    #[test]
+    fn export_weights_follow_the_source_and_output_sizes() {
+        use crate::media::SourceLevel;
+        let mb = |b: usize| b >> 20;
+        // a full-size 24 MP export (measured peak ~1.2 GB)
+        assert_eq!(mb(render_weight(6000 * 4000, 6000, SourceLevel::Full, 6000 * 4000)), 1098);
+        // 2048 px from the 2560 px preview (measured ~150 MB)
+        assert_eq!(mb(render_weight(6000 * 4000, 6000, SourceLevel::Preview, 2048 * 1365)), 145);
+        // a photo smaller than the preview level is its own source
+        assert_eq!(render_weight(1000 * 500, 1000, SourceLevel::Preview, 0), 1000 * 500 * 12);
+        assert_eq!(render_weight(0, 0, SourceLevel::Full, 0), 0);
+        assert!(render_weight(usize::MAX, 1, SourceLevel::Full, usize::MAX) > 0, "no overflow");
+    }
 }
diff --git a/crates/engine/src/files.rs b/crates/engine/src/files.rs
index c81c7c97..eba894c7 100644
--- a/crates/engine/src/files.rs
+++ b/crates/engine/src/files.rs
@@ -37,7 +37,8 @@ fn meta_of(m: &lightcraft_meta::Metadata) -> (Meta, Option<String>) {
         usage_terms: m.usage_terms.clone().unwrap_or_default(),
         copyright_url: m.copyright_url.clone().unwrap_or_default(),
         creator: m.artist.clone().unwrap_or_default(),
-        keywords: m.keywords.clone(),
+        // paths from `lr:hierarchicalSubject`, names from `dc:subject` that aren't their levels
+        keywords: lightcraft_catalog::keywords::from_file(&m.keywords, &m.hierarchical_keywords),
         regions: m.regions.clone(),
     };
     (meta, m.capture_time.as_ref().map(|d| d.to_iso()))
@@ -102,69 +103,58 @@ pub fn probe_bytes(name: &str, bytes: &[u8]) -> Result<ProbeInfo, String> {
     let (meta, captured) = meta_of(&m);
     if lightcraft_raw::probe(bytes).is_some() {
         let raw = match lightcraft_raw::probe_info(bytes).map_err(|e| preview_reason(bytes, e)) {
-            Ok(r) => Some(r),
+            Ok(r) => r,
             Err(Ok(why)) => {
                 // a raw variant we can't decode yet: describe it from its embedded preview
-                if let Some((w, h)) = embedded_preview_size(bytes) {
-                    return Ok(ProbeInfo {
-                        width: w,
-                        height: h,
-                        format: ext_upper(name),
-                        kind: MediaKind::Raw,
-                        file_size: bytes.len() as u64,
-                        captured,
-                        meta,
-                        as_shot_wb: None,
-                        content_hash,
-                        xmp: lightcraft_meta::embedded(bytes).xmp,
-                        preview_only: Some(why),
-                        ..Default::default()
-                    });
-                }
-                if !(lightcraft_codecs::sniff(bytes).is_some_and(|f| f.can_decode()) && lightcraft_codecs::read_header(bytes).is_ok()) {
-                    return Err(format!("unsupported raw ({why}) without an embedded preview"));
-                }
-                None
-            }
-            Err(Err(e)) => {
-                if !(lightcraft_codecs::sniff(bytes).is_some_and(|f| f.can_decode()) && lightcraft_codecs::read_header(bytes).is_ok()) {
-                    return Err(e);
-                }
-                None
+                let (w, h) = embedded_preview_size(bytes).ok_or(format!("unsupported raw ({why}) without an embedded preview"))?;
+                return Ok(ProbeInfo {
+                    width: w,
+                    height: h,
+                    format: ext_upper(name),
+                    kind: MediaKind::Raw,
+                    file_size: bytes.len() as u64,
+                    captured,
+                    meta,
+                    as_shot_wb: None,
+                    content_hash,
+                    xmp: lightcraft_meta::embedded(bytes).xmp,
+                    preview_only: Some(why),
+                    ..Default::default()
+                });
             }
+            Err(Err(e)) => return Err(e),
         };
-        if let Some(raw) = raw {
-            let (mut w, mut h) = (raw.crop.width.max(1) as u32, raw.crop.height.max(1) as u32);
-            if w <= 1 || h <= 1 {
-                (w, h) = (raw.active_area.width as u32, raw.active_area.height as u32);
-            }
-            if raw.orientation.swaps_axes() {
-                std::mem::swap(&mut w, &mut h);
-            }
-            let (t, tint) = xy_to_temp_tint(lightcraft_raw::color::as_shot_white_xy_of(&raw));
-            // Vendor RGB multipliers do not identify an absolute illuminant without camera calibration.
-            let relative = crate::camera_preview::file_local_look(raw.format) && !lightcraft_raw::color::has_matrix(&raw.color);
-            let as_shot_wb = Some(if relative { (6500.0, 0.0) } else { (t.round(), tint.round()) });
-            let embedded_lens = embedded_lens(&raw);
-            return Ok(ProbeInfo {
-                embedded_lens,
-                width: w,
-                height: h,
-                format: ext_upper(name),
-                kind: MediaKind::Raw,
-                file_size: bytes.len() as u64,
-                captured,
-                meta,
-                as_shot_wb,
-                content_hash,
-                xmp: lightcraft_meta::embedded(bytes).xmp,
-                preview_only: None,
-            });
+        let (mut w, mut h) = (raw.crop.width.max(1) as u32, raw.crop.height.max(1) as u32);
+        if w <= 1 || h <= 1 {
+            (w, h) = (raw.active_area.width as u32, raw.active_area.height as u32);
         }
+        if raw.orientation.swaps_axes() {
+            std::mem::swap(&mut w, &mut h);
+        }
+        let (t, tint) = xy_to_temp_tint(lightcraft_raw::color::as_shot_white_xy_of(&raw));
+        // Vendor RGB multipliers do not identify an absolute illuminant without camera calibration.
+        let relative = crate::camera_preview::file_local_look(raw.format) && !lightcraft_raw::color::has_matrix(&raw.color);
+        let as_shot_wb = Some(if relative { (6500.0, 0.0) } else { (t.round(), tint.round()) });
+        let embedded_lens = embedded_lens(&raw);
+        return Ok(ProbeInfo {
+            embedded_lens,
+            width: w,
+            height: h,
+            format: ext_upper(name),
+            kind: MediaKind::Raw,
+            file_size: bytes.len() as u64,
+            captured,
+            meta,
+            as_shot_wb,
+            content_hash,
+            xmp: lightcraft_meta::embedded(bytes).xmp,
+            preview_only: None,
+        });
     }
     let fmt = lightcraft_codecs::sniff(bytes).ok_or("unrecognized file format")?;
-    if !fmt.can_decode() {
-        return Err(format!("{fmt:?} files are not supported yet"));
+    if let Some(why) = fmt.not_decodable() {
+        // e.g. "Heif files can't be opened: HEIC/HEIF support isn't included in this build of LightCraft"
+        return Err(format!("{fmt:?} files can't be opened: {why}"));
     }
     // headers only (issue #367: decoding the pixels was nearly all of an import's CPU time)
     let header = lightcraft_codecs::read_header(bytes).map_err(|e| e.to_string())?;
@@ -212,6 +202,86 @@ fn preview_reason(bytes: &[u8], e: lightcraft_raw::RawError) -> Result<String, S
 /// Sensor clip level (normalised) for highlight reconstruction.
 const HIGHLIGHT_CLIP: f32 = 0.99;
 
+/// How a raw's camera RGB becomes the linear Rec.2020 the pipeline takes.
+pub(crate) struct CameraColourModel<'a> {
+    /// White-balance multipliers (as shot).
+    pub wb: [f32; 3],
+    /// White-balanced camera RGB → linear Rec.2020: the camera matrix, or a look fitted to the camera's JPEG on top.
+    pub matrix: lightcraft_color::Mat3,
+    /// Baseline exposure, as a gain.
+    pub gain: f32,
+    /// A DNG profile's hue/saturation map and look table.
+    pub tables: Option<&'a lightcraft_raw::profile::ProfileTables>,
+    /// A fitted camera look's hue/saturation table.
+    pub hue_sat: Option<&'a crate::camera_preview::HueSat<'a>>,
+}
+
+impl CameraColourModel<'_> {
+    /// Rebuild sensor-clipped channels; fully clipped highlights become [`clipped_white`] of the matrix, so they
+    /// come out of [`Self::apply`] neutral.
+    pub fn rebuild_highlights(&self, img: &mut Rgb32f) {
+        lightcraft_raw::highlight::reconstruct_with(img, self.wb, HIGHLIGHT_CLIP, clipped_white(&self.matrix));
+    }
+
+    /// White balance, matrix, tables and baseline exposure, in place.
+    pub fn apply(&self, img: &mut Rgb32f) {
+        let (wb, m, gain) = (self.wb, self.matrix.to_f32(), self.gain);
+        img.map_in_place(|p| {
+            let c = [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]];
+            let rgb = [
+                m[0][0] * c[0] + m[0][1] * c[1] + m[0][2] * c[2],
+                m[1][0] * c[0] + m[1][1] * c[1] + m[1][2] * c[2],
+                m[2][0] * c[0] + m[2][1] * c[1] + m[2][2] * c[2],
+            ];
+            let rgb = match self.tables {
+                Some(tables) => tables.apply(rgb, gain),
+                None => rgb.map(|v| v * gain),
+            };
+            self.hue_sat.map_or(rgb, |h| h.apply(rgb)).map(|v| v.max(0.0))
+        });
+    }
+}
+
+/// The white-balanced camera RGB that `model` (white-balanced camera RGB → linear Rec.2020) renders
+/// neutral, as bright as it renders `[1, 1, 1]`: what fully clipped highlights are rebuilt to, so they come out
+/// neutral whatever the colour model does to the camera's own neutral (a look fitted to the camera's JPEG or a
+/// camera profile often tints it by a few per cent, which any darkening of the highlights would show).
+/// `[1, 1, 1]` (the camera's own neutral, as before this existed) when the model can't be trusted with it: not
+/// invertible or nearly so, an answer far from the camera's neutral (a sane colour model moves white by a few per
+/// cent), or one that isn't neutral through the `f32` matrix the decode applies.
+pub(crate) fn clipped_white(model: &lightcraft_color::Mat3) -> [f32; 3] {
+    const CAMERA: [f32; 3] = [1.0; 3];
+    /// Largest condition number (max row sum norm) of a model trusted for this.
+    const CONDITION: f64 = 1e3;
+    /// Largest factor between the answer and the camera's neutral, per channel.
+    const SPREAD: f64 = 4.0;
+    let norm = |m: &lightcraft_color::Mat3| m.0.iter().map(|row| row.iter().map(|v| v.abs()).sum::<f64>()).fold(0.0, f64::max);
+    let Some(inverse) = model.inverse() else { return CAMERA };
+    let condition = norm(model) * norm(&inverse);
+    if !condition.is_finite() || condition > CONDITION {
+        return CAMERA;
+    }
+    let luma = |v: [f64; 3]| {
+        let c = model.apply(v);
+        (0..3).map(|i| c[i] * f64::from(lightcraft_color::LUMA_2020[i])).sum::<f64>()
+    };
+    let n = inverse.apply([1.0; 3]);
+    let (target, own) = (luma([1.0; 3]), luma(n));
+    if !(target > 0.0 && own > 0.0 && target.is_finite() && own.is_finite()) {
+        return CAMERA;
+    }
+    let white = n.map(|v| v * target / own);
+    if !white.iter().all(|v| v.is_finite() && (1.0 / SPREAD..=SPREAD).contains(v)) {
+        return CAMERA;
+    }
+    let white = white.map(|v| v as f32);
+    // neutral through the matrix as the decode applies it
+    let m = model.to_f32();
+    let out: [f32; 3] = std::array::from_fn(|i| m[i][0] * white[0] + m[i][1] * white[1] + m[i][2] * white[2]);
+    let (lo, hi) = (out[0].min(out[1]).min(out[2]), out[0].max(out[1]).max(out[2]));
+    if lo > 0.0 && hi.is_finite() && hi - lo <= 1e-3 * hi { white } else { CAMERA }
+}
+
 /// The largest block size to bin a raw's mosaic by for a source of at most `max_edge` pixels:
 /// the binned image must keep at least 90 % of `max_edge` (a 16 MP sensor still bins 2× for the
 /// 2560 px preview). X-Trans can only bin 3× (its 6×6 pattern), and its full demosaic is ~5× the
@@ -275,118 +345,110 @@ fn load_bytes_now(
     denoise: Option<&DenoiseSpec>,
 ) -> Result<(Rgb32f, Option<Rgb32f>, SourceInfo), String> {
     if lightcraft_raw::probe(&bytes).is_some() {
-        let raw = match lightcraft_raw::decode(&bytes).map_err(|e| preview_reason(&bytes, e)) {
-            Ok(r) => Some(r),
+        let mut raw = match lightcraft_raw::decode(&bytes).map_err(|e| preview_reason(&bytes, e)) {
+            Ok(r) => r,
             Err(Ok(why)) => {
                 // show the camera's embedded JPEG (rendered, not raw) until the variant is supported
-                if let Some((img, info)) = load_embedded_preview(&bytes, max_edge) {
-                    return Ok((img, None, info));
-                }
-                if !lightcraft_codecs::sniff(&bytes).is_some_and(|f| f.can_decode()) {
-                    return Err(format!("unsupported raw ({why}) without an embedded preview"));
-                }
-                None
+                return load_embedded_preview(&bytes, max_edge)
+                    .map(|(img, info)| (img, None, info))
+                    .ok_or(format!("unsupported raw ({why}) without an embedded preview"));
             }
-            Err(Err(e)) => {
-                if !lightcraft_codecs::sniff(&bytes).is_some_and(|f| f.can_decode()) {
-                    return Err(e);
-                }
-                None
+            Err(Err(e)) => return Err(e),
+        };
+        // Embedded lens corrections are applied by the pipeline ("Enable Profile Corrections"), not baked in
+        // (removed before the camera look's binned sensor proxy too, which needs an empty `OpcodeList3`).
+        let lens = embedded_lens(&raw.info());
+        raw.opcodes.list3.retain(|op| !op.is_lens_correction());
+        let xy = lightcraft_raw::color::as_shot_white_xy(&raw);
+        let t = lightcraft_raw::color::camera_transform(&raw, xy);
+        // the source's segmentation mattes (DNG semantic masks), read while the preview is fitted
+        let (camera_look, mattes) = rayon::join(|| crate::camera_preview::fit_preview(&raw, &bytes, &t), || dng_mattes(&bytes, &raw));
+        drop(bytes);
+        // Previews and thumbnails bin the mosaic straight to (about) the size they need; only
+        // larger levels (exports, 1:1) demosaic the whole sensor.
+        let t0 = web_time::Instant::now();
+        let bin = bin_factor(&raw, max_edge);
+        let binned = match bin {
+            Some(k) => raw.develop_binned(k, HIGHLIGHT_CLIP).map_err(|e| e.to_string())?,
+            None => None,
+        };
+        let factor = if binned.is_some() { bin.unwrap_or(1) } else { 1 };
+        let img = match binned {
+            Some(img) => img,
+            None => {
+                let method = if max_edge <= 600 { lightcraft_raw::Method::Bilinear } else { lightcraft_raw::Method::Ahd };
+                raw.develop(method).map_err(|e| e.to_string())?
             }
         };
-        if let Some(mut raw) = raw {
-            // Embedded lens corrections are applied by the pipeline ("Enable Profile Corrections"), not baked in
-            // (removed before the camera look's binned sensor proxy too, which needs an empty `OpcodeList3`).
-            let lens = embedded_lens(&raw.info());
-            raw.opcodes.list3.retain(|op| !op.is_lens_correction());
-            let xy = lightcraft_raw::color::as_shot_white_xy(&raw);
-            let t = lightcraft_raw::color::camera_transform(&raw, xy);
-            // the source's segmentation mattes (DNG semantic masks), read while the preview is fitted
-            let (camera_look, mattes) = rayon::join(|| crate::camera_preview::fit_preview(&raw, &bytes, &t), || dng_mattes(&bytes, &raw));
-            drop(bytes);
-            // Previews and thumbnails bin the mosaic straight to (about) the size they need; only
-            // larger levels (exports, 1:1) demosaic the whole sensor.
-            let t0 = web_time::Instant::now();
-            let bin = bin_factor(&raw, max_edge);
-            let binned = match bin {
-                Some(k) => raw.develop_binned(k, HIGHLIGHT_CLIP).map_err(|e| e.to_string())?,
-                None => None,
-            };
-            let factor = if binned.is_some() { bin.unwrap_or(1) } else { 1 };
-            let img = match binned {
-                Some(img) => img,
-                None => {
-                    let method = if max_edge <= 600 { lightcraft_raw::Method::Bilinear } else { lightcraft_raw::Method::Ahd };
-                    raw.develop(method).map_err(|e| e.to_string())?
-                }
-            };
-            // the same development from the denoised mosaic, when the photo has been denoised
-            let twin = denoise.and_then(|spec| denoised_camera_rgb(&raw, spec, factor)).filter(|d| d.width == img.width && d.height == img.height);
-            // the samples aren't needed any more (the colour model below reads only the tags)
-            raw.data = lightcraft_raw::RawData::U16(Vec::new());
-            let wb = t.wb;
-            let m = camera_look.as_ref().map(|p| p.matrix.mul(&t.matrix)).unwrap_or(t.matrix).to_f32();
-            let hue_sat = camera_look.as_ref().and_then(|p| p.hue_sat.as_ref()).and_then(crate::camera_preview::HueSat::new);
-            let gain = 2f32.powf(t.baseline_exposure as f32);
-            // A DNG's own profile look (hue/saturation map, look table), DNG spec chapter 6.
-            let tables = lightcraft_raw::profile::ProfileTables::new(&raw.color.profile, lightcraft_raw::color::illuminant_weight(&raw.color, xy));
-            // camera RGB → what the pipeline takes: clipped highlights rebuilt, white balance and the colour model applied,
-            // fitted to `max_edge` and upright (the same for the plain and the denoised picture)
-            let finish = |mut img: Rgb32f| {
-                let mut stages = vec![("develop", t0.elapsed())];
-                stages.push(("transform", t0.elapsed()));
-                lightcraft_raw::highlight::reconstruct(&mut img, wb, HIGHLIGHT_CLIP);
-                stages.push(("highlights", t0.elapsed()));
-                img.map_in_place(|p| {
-                    let c = [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]];
-                    let rgb = [
-                        m[0][0] * c[0] + m[0][1] * c[1] + m[0][2] * c[2],
-                        m[1][0] * c[0] + m[1][1] * c[1] + m[1][2] * c[2],
-                        m[2][0] * c[0] + m[2][1] * c[1] + m[2][2] * c[2],
-                    ];
-                    let rgb = match &tables {
-                        Some(tables) => tables.apply(rgb, gain),
-                        None => rgb.map(|v| v * gain),
-                    };
-                    hue_sat.as_ref().map_or(rgb, |h| h.apply(rgb)).map(|v| v.max(0.0))
-                });
-                stages.push(("colour", t0.elapsed()));
-                let img = fit(&img, max_edge, max_edge, Filter::Box);
-                stages.push(("fit", t0.elapsed()));
-                let img = img.into_oriented(raw.orientation);
-                stages.push(("orient", t0.elapsed()));
-                (img, stages)
-            };
-            let (img, stages) = finish(img);
-            if lightcraft_pipeline::profiling() {
-                let mut prev = std::time::Duration::ZERO;
-                let parts: Vec<String> = stages
-                    .iter()
-                    .map(|(n, t)| {
-                        let d = *t - prev;
-                        prev = *t;
-                        format!("{n} {:.1}", d.as_secs_f64() * 1e3)
-                    })
-                    .collect();
-                eprintln!("[profile] raw source {}×{} (max {max_edge}, ms after decode): {}", img.width, img.height, parts.join(", "));
-            }
-            let twin = twin.map(|picture| finish(picture).0);
-            let (temp, tint) = xy_to_temp_tint(xy);
-            let relative = crate::camera_preview::file_local_look(raw.format) && t.matrix_is_fallback;
-            // White balance re-evaluates the file's own colour model (when it has one and no
-            // file-local look matrix sits on top of it)
-            let camera_color = (!t.matrix_is_fallback && camera_look.is_none()).then(|| {
-                let tags = lightcraft_raw::ColorData { profile: Default::default(), ..raw.color.clone() };
-                Arc::new(lightcraft_pipeline::CameraColor { tags, developed_for: xy })
-            });
-            let camera_tone = camera_look.as_ref().map(|p| p.tone).or_else(|| raw.color.profile.tone_curve.as_ref().and_then(dng_tone_curve));
-            let (temp, tint) = if relative { (6500.0, 0.0) } else { (temp.round(), tint.round()) };
-            return Ok((
-                img,
-                twin,
-                SourceInfo { raw: true, as_shot_temp: temp, as_shot_tint: tint, lens, relative_wb: relative, camera_color, camera_tone, mattes },
-            ));
+        // the same development from the denoised mosaic, when the photo has been denoised
+        let twin = denoise.and_then(|spec| denoised_camera_rgb(&raw, spec, factor)).filter(|d| d.width == img.width && d.height == img.height);
+        // the samples aren't needed any more (the colour model below reads only the tags)
+        raw.data = lightcraft_raw::RawData::U16(Vec::new());
+        let hue_sat = camera_look.as_ref().and_then(|p| p.hue_sat.as_ref()).and_then(crate::camera_preview::HueSat::new);
+        // A DNG's own profile look (hue/saturation map, look table), DNG spec chapter 6.
+        let tables = lightcraft_raw::profile::ProfileTables::new(&raw.color.profile, lightcraft_raw::color::illuminant_weight(&raw.color, xy));
+        let colour = CameraColourModel {
+            wb: t.wb,
+            matrix: camera_look.as_ref().map(|p| p.matrix.mul(&t.matrix)).unwrap_or(t.matrix),
+            gain: 2f32.powf(t.baseline_exposure as f32),
+            tables: tables.as_ref(),
+            hue_sat: hue_sat.as_ref(),
+        };
+        // camera RGB → what the pipeline takes: clipped highlights rebuilt, white balance and the colour model applied,
+        // fitted to `max_edge` and upright (the same for the plain and the denoised picture)
+        let finish = |mut img: Rgb32f| {
+            let mut stages = vec![("develop", t0.elapsed())];
+            stages.push(("transform", t0.elapsed()));
+            colour.rebuild_highlights(&mut img);
+            stages.push(("highlights", t0.elapsed()));
+            colour.apply(&mut img);
+            stages.push(("colour", t0.elapsed()));
+            let img = fit(&img, max_edge, max_edge, Filter::Box);
+            stages.push(("fit", t0.elapsed()));
+            let img = img.into_oriented(raw.orientation);
+            stages.push(("orient", t0.elapsed()));
+            (img, stages)
+        };
+        let (img, stages) = finish(img);
+        if lightcraft_pipeline::profiling() {
+            let mut prev = std::time::Duration::ZERO;
+            let parts: Vec<String> = stages
+                .iter()
+                .map(|(n, t)| {
+                    let d = *t - prev;
+                    prev = *t;
+                    format!("{n} {:.1}", d.as_secs_f64() * 1e3)
+                })
+                .collect();
+            eprintln!("[profile] raw source {}×{} (max {max_edge}, ms after decode): {}", img.width, img.height, parts.join(", "));
         }
+        let twin = twin.map(|picture| finish(picture).0);
+        let (temp, tint) = xy_to_temp_tint(xy);
+        let relative = crate::camera_preview::file_local_look(raw.format) && t.matrix_is_fallback;
+        // White balance re-evaluates the file's own colour model (when it has one and no
+        // file-local look matrix sits on top of it)
+        let camera_color = (!t.matrix_is_fallback && camera_look.is_none()).then(|| {
+            let tags = lightcraft_raw::ColorData { profile: Default::default(), ..raw.color.clone() };
+            Arc::new(lightcraft_pipeline::CameraColor { tags, developed_for: xy })
+        });
+        let camera_tone = camera_look.as_ref().map(|p| p.tone).or_else(|| raw.color.profile.tone_curve.as_ref().and_then(dng_tone_curve));
+        let local_tone = local_tone(&raw);
+        let (temp, tint) = if relative { (6500.0, 0.0) } else { (temp.round(), tint.round()) };
+        return Ok((
+            img,
+            twin,
+            SourceInfo {
+                raw: true,
+                as_shot_temp: temp,
+                as_shot_tint: tint,
+                lens,
+                relative_wb: relative,
+                camera_color,
+                camera_tone,
+                mattes,
+                local_tone,
+            },
+        ));
     }
     let d = lightcraft_codecs::decode(&bytes, fit_box(max_edge)).map_err(|e| e.to_string())?;
     drop(bytes);
@@ -395,6 +457,18 @@ fn load_bytes_now(
     Ok((img.into_oriented(Orientation::from_exif(d.orientation)), None, SourceInfo::default()))
 }
 
+/// The raw's gain table map with where its developed picture (the default crop, oriented) sits in
+/// the active area: rendered when the photo's "Camera local tone mapping" option is on.
+fn local_tone(raw: &lightcraft_raw::RawImage) -> Option<Arc<lightcraft_pipeline::local_tone::LocalTone>> {
+    let map = raw.color.profile.gain_table_map.clone()?;
+    let a = raw.active_area;
+    let (aw, ah) = (a.width.max(1) as f64, a.height.max(1) as f64);
+    let c = raw.develop_crop(a.width, a.height);
+    let rect = [c.x as f64 / aw, c.y as f64 / ah, c.width as f64 / aw, c.height as f64 / ah];
+    let placement = lightcraft_raw::gaintable::SourcePlacement { rect, orientation: raw.orientation };
+    Some(Arc::new(lightcraft_pipeline::local_tone::LocalTone { map, placement }))
+}
+
 /// The semantic masks of a DNG that AI masks understand, over the developed image (default crop,
 /// oriented like it). Person mattes without a confidently selected pixel are left out (the
 /// Subject mask then falls back to its heuristic); a sky matte counts even when empty (no sky).
@@ -587,6 +661,19 @@ impl crate::Session {
 
 #[cfg(test)]
 mod tests {
+    /// Keywords from a file keep their hierarchy: the paths of `lr:hierarchicalSubject`, not the
+    /// flat names of `dc:subject` that LightCraft's exports (and Lightroom Classic) write besides
+    /// them; an exported `travel|Italy|Rome` comes back as itself.
+    #[test]
+    fn imported_keywords_keep_their_hierarchy() {
+        let m = lightcraft_meta::Metadata {
+            keywords: vec!["Rome".into(), "Italy".into(), "travel".into(), "beach".into()],
+            hierarchical_keywords: vec!["travel|Italy|Rome".into()],
+            ..Default::default()
+        };
+        assert_eq!(super::meta_of(&m).0.keywords, ["travel|Italy|Rome", "beach"]);
+    }
+
     use super::*;
     use lightcraft_codecs::{ChromaSubsampling, EncodeImage, EncodeMeta, Samples, encode_jpeg};
 
@@ -868,6 +955,240 @@ mod tests {
         assert!((mean(&dim) / mean(&before) - 0.5).abs() < 0.02, "{} vs {}", mean(&dim), mean(&before));
     }
 
+    /// A look fitted to a camera's JPEG, as `camera_preview` makes them: its rows don't sum to one, so the camera's
+    /// own white-balanced neutral comes out yellow (blue 12 % low).
+    fn yellowing_look() -> lightcraft_color::Mat3 {
+        lightcraft_color::Mat3([[0.42, 0.548, 0.04], [0.246, 0.728, 0.033], [-0.247, 0.679, 0.447]])
+    }
+
+    #[test]
+    fn clipped_white_renders_neutral_through_the_colour_model() {
+        use lightcraft_color::{LUMA_2020, Mat3};
+        let look = yellowing_look();
+        let white = clipped_white(&look);
+        let out = look.apply(white.map(f64::from));
+        assert!(out.iter().all(|v| (v - out[1]).abs() < 1e-5), "{white:?} renders {out:?}");
+        let luma = |c: [f64; 3]| (0..3).map(|i| c[i] * f64::from(LUMA_2020[i])).sum::<f64>();
+        assert!((luma(out) - luma(look.apply([1.0; 3]))).abs() < 1e-5, "as bright as the camera's neutral");
+        assert_eq!(clipped_white(&Mat3::IDENTITY), [1.0; 3]);
+        // a model that can't be inverted, or only just, keeps the camera's neutral
+        assert_eq!(clipped_white(&Mat3([[1.0, 0.0, 0.0], [1.0, 0.0, 0.0], [0.0, 0.0, 1.0]])), [1.0; 3]);
+        assert_eq!(clipped_white(&Mat3([[1.0, 1.0, 0.0], [1.0, 1.0 + 1e-8, 0.0], [0.0, 0.0, 1.0]])), [1.0; 3]);
+        // so does one whose white would overflow the rebuilt highlights (2.5e38 in red here)
+        assert_eq!(clipped_white(&Mat3([[3e-39, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]])), [1.0; 3]);
+        // or move the camera's neutral implausibly far
+        assert_eq!(clipped_white(&Mat3([[0.1, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]])), [1.0; 3]);
+        // what it answers renders neutral through the f32 matrix, and fully clipped highlights stay finite
+        for model in [look, Mat3([[1.9, -0.7, -0.2], [-0.3, 1.4, -0.1], [0.0, -0.4, 1.4]])] {
+            let w = clipped_white(&model);
+            let m = model.to_f32();
+            let out: [f32; 3] = std::array::from_fn(|i| m[i][0] * w[0] + m[i][1] * w[1] + m[i][2] * w[2]);
+            assert!(out.iter().all(|v| (v - out[1]).abs() <= 1e-3 * out[1]), "{w:?} renders {out:?}");
+            let colour = CameraColourModel { wb: [2.5, 1.0, 1.6], matrix: model, gain: 1.0, tables: None, hue_sat: None };
+            let mut img = Rgb32f::filled(4, 4, [1.0; 3]);
+            colour.rebuild_highlights(&mut img);
+            colour.apply(&mut img);
+            assert!(img.data.iter().flatten().all(|v| v.is_finite()), "{:?}", img.get(0, 0));
+        }
+    }
+
+    /// Issue #523: fully clipped highlights are neutral in the white-balanced camera RGB, but a colour model that
+    /// doesn't map that neutral to neutral tinted them. The tone map's roll-off to white hid the tint at Neutral;
+    /// Highlights -100, or the issue's edit (Exposure -0.88, Highlights -75…), showed it.
+    #[test]
+    fn clipped_highlights_stay_neutral_when_darkened() {
+        use lightcraft_pipeline::{RenderRequest, render};
+        let wb = [2.4f32, 1.0, 1.6];
+        let colour = CameraColourModel { wb, matrix: yellowing_look(), gain: 1.0, tables: None, hue_sat: None };
+        // a grey wall (camera neutral) with a fully clipped light and a light clipped in green only
+        let mut img = Rgb32f::from_fn(96, 64, |x, y| {
+            let d = |cx: f32| ((x as f32 - cx).powi(2) + (y as f32 - 32.0).powi(2)).sqrt();
+            if d(28.0) < 14.0 {
+                [1.0; 3]
+            } else if d(70.0) < 12.0 {
+                [0.6 / wb[0], 1.0, 0.7 / wb[2]]
+            } else {
+                [0.3 / wb[0], 0.3, 0.3 / wb[2]]
+            }
+        });
+        colour.rebuild_highlights(&mut img);
+        colour.apply(&mut img);
+        let info = SourceInfo { raw: true, ..Default::default() };
+        let mut issue = lightcraft_develop::DevelopSettings::default();
+        let l = &mut issue.light;
+        (l.exposure, l.contrast, l.highlights, l.shadows, l.whites, l.blacks) = (-0.88, 5.0, -75.0, 52.0, 6.0, -37.0);
+        let mut h100 = lightcraft_develop::DevelopSettings::default();
+        h100.light.highlights = -100.0;
+        for (name, s) in [("Highlights -100", h100), ("#523's edit", issue)] {
+            let out = render(&img, &info, &s, &RenderRequest::fit(96, 64)).image;
+            let p = out.get(28, 32);
+            assert!(p[1] < 250, "{name}: the clipped light is darkened ({p:?})");
+            let spread = p[0].max(p[1]).max(p[2]) - p[0].min(p[1]).min(p[2]);
+            assert!(spread <= 1, "{name}: clipped light {p:?} is not neutral");
+        }
+    }
+
+    /// A smooth pink gradient (`[0.9k, k, 0.8k]` in the sensor, k from 0.8 to 1.35, white balance `[2.5, 1, 1.6]`)
+    /// through the point where green clips, 1600 px long, in `rows` of a 1600 × `height` picture that is otherwise
+    /// near black, rebuilt and rendered at Exposure -2. Returns the rendered colour of the middle row's last
+    /// unclipped pixel and the next two, and the largest step between neighbouring pixels along that row.
+    fn darkened_ramp(rows: std::ops::Range<usize>, height: usize) -> ([[u8; 4]; 3], u8) {
+        use lightcraft_pipeline::{RenderRequest, render};
+        let wb = [2.5f32, 1.0, 1.6];
+        let colour = CameraColourModel { wb, matrix: lightcraft_color::Mat3::IDENTITY, gain: 1.0, tables: None, hue_sat: None };
+        let w = 1600usize;
+        let k = |x: usize| 0.8 + 0.55 * x as f32 / (w - 1) as f32;
+        let sensor =
+            Rgb32f::from_fn(w, height, |x, y| if rows.contains(&y) { [0.9 * k(x), k(x), 0.8 * k(x)].map(|v| v.min(1.0)) } else { [0.01; 3] });
+        let y = (rows.start + rows.end) / 2;
+        let first = (0..w).find(|&x| sensor.get(x, y)[1] >= HIGHLIGHT_CLIP).unwrap();
+        let mut img = sensor.clone();
+        colour.rebuild_highlights(&mut img);
+        colour.apply(&mut img);
+        let mut s = lightcraft_develop::DevelopSettings::default();
+        s.light.exposure = -2.0;
+        let out = render(&img, &SourceInfo { raw: true, ..Default::default() }, &s, &RenderRequest::fit(w, height)).image;
+        let step = |x: usize| {
+            let (a, b) = (out.get(x - 1, y), out.get(x, y));
+            (0..3).map(|c| a[c].abs_diff(b[c])).max().unwrap_or(0)
+        };
+        ([out.get(first - 1, y), out.get(first, y), out.get(first + 1, y)], (1..w).map(step).max().unwrap_or(0))
+    }
+
+    /// The darkened pink gradient carries on across the point where green clips: before the fix the fade towards
+    /// the clipped neutral, driven by how close the other channels were to their clip, made a step of 37 levels
+    /// there.
+    #[test]
+    fn rendered_colour_is_continuous_where_the_first_channel_clips() {
+        let ([a, b, c], worst) = darkened_ramp(0..16, 16);
+        let step = |p: [u8; 4], q: [u8; 4]| (0..3).map(|i| p[i].abs_diff(q[i])).max().unwrap_or(0);
+        assert!(step(a, b) <= 1 && step(b, c) <= 1, "at the first clip: {a:?} {b:?} {c:?}");
+        assert!(worst <= 3, "largest step between neighbouring pixels: {worst} levels");
+    }
+
+    /// The same gradient as a thin bright line on near black: every pixel of it is next to a strong edge, so there
+    /// is no reliable colour around it. It still carries on across the first clip, however thin the line and however
+    /// much dark background there is (a 4-row line on 32 rows used to jump from [225, 126, 153] to [198, 177, 163];
+    /// on 512 rows, from [225, 126, 153] to [218, 145, 151]).
+    #[test]
+    fn rendered_thin_line_is_continuous_where_the_first_channel_clips() {
+        let step = |p: [u8; 4], q: [u8; 4]| (0..3).map(|i| p[i].abs_diff(q[i])).max().unwrap_or(0);
+        for height in [32usize, 128, 512, 1024] {
+            for width in [1usize, 2, 4, 16] {
+                let top = (height - width) / 2;
+                let ([a, b, c], worst) = darkened_ramp(top..top + width, height);
+                let case = format!("{width} rows of {height}");
+                assert!(step(a, b) <= 1 && step(b, c) <= 1, "{case}, at the first clip: {a:?} {b:?} {c:?}");
+                assert!(worst <= 3, "{case}: largest step between neighbouring pixels {worst} levels");
+            }
+        }
+    }
+
+    /// A band clipped in green whose red rises through its own clip from left to right (sensor `[0.985 + 0.01 t, 1,
+    /// 0.8]`, t from 0 to 1 across 320 px), `band` rows at the bottom of the picture, below `strip` rows of a pale
+    /// surface just under the clip (`[0.4, 0.95, 0.8]`: the band's rim, of another colour) and above those `top` rows
+    /// of a strongly coloured reliable surface (`[0.8, 0.35, 0.3]`). Rebuilt and rendered at Exposure -2: the
+    /// rendered colour on either side of where red clips on the band's middle row, and the largest step between
+    /// neighbouring pixels along that row.
+    fn second_clip(top: usize, strip: usize, band: usize) -> ([[u8; 4]; 2], u8) {
+        use lightcraft_pipeline::{RenderRequest, render};
+        let wb = [2.5f32, 1.0, 1.6];
+        let colour = CameraColourModel { wb, matrix: lightcraft_color::Mat3::IDENTITY, gain: 1.0, tables: None, hue_sat: None };
+        let (w, h) = (320usize, top + strip + band);
+        let sensor = Rgb32f::from_fn(w, h, |x, y| {
+            if y < top {
+                [0.8, 0.35, 0.3]
+            } else if y < top + strip {
+                [0.4, 0.95, 0.8]
+            } else {
+                [0.985 + 0.01 * x as f32 / (w - 1) as f32, 1.0, 0.8]
+            }
+        });
+        let y = top + strip + band / 2;
+        let at = (0..w).find(|&x| sensor.get(x, y)[0] >= HIGHLIGHT_CLIP).unwrap();
+        let mut img = sensor.clone();
+        colour.rebuild_highlights(&mut img);
+        colour.apply(&mut img);
+        let mut s = lightcraft_develop::DevelopSettings::default();
+        s.light.exposure = -2.0;
+        let out = render(&img, &SourceInfo { raw: true, ..Default::default() }, &s, &RenderRequest::fit(w, h)).image;
+        let step = |x: usize| {
+            let (a, b) = (out.get(x - 1, y), out.get(x, y));
+            (0..3).map(|c| a[c].abs_diff(b[c])).max().unwrap_or(0)
+        };
+        ([out.get(at - 1, y), out.get(at, y)], (1..w).map(step).max().unwrap_or(0))
+    }
+
+    /// Where a second channel clips within reach of the surface's own rim, the rebuilt colour carries on too. The
+    /// rim's comparison with the pixel used to drop each clipped channel, so a rim far from the pixel in red suddenly
+    /// matched it once red clipped (80 rows of colour, 16 of rim and 32 of band: [237, 124, 153] then
+    /// [205, 181, 168]); and a channel about to clip counted as an uncapped floor that was capped once it clipped
+    /// (without the coloured surface: [198, 195, 178] then [205, 181, 168]).
+    #[test]
+    fn rendered_colour_is_continuous_where_a_second_channel_clips() {
+        for (top, strip, band) in [(80, 16, 32), (0, 16, 32), (80, 16, 4), (200, 4, 8), (16, 64, 16), (8, 32, 24)] {
+            let ([a, b], worst) = second_clip(top, strip, band);
+            let case = format!("{top} rows of colour, {strip} of rim, {band} of band");
+            let step = (0..3).map(|i| a[i].abs_diff(b[i])).max().unwrap_or(0);
+            assert!(step <= 1, "{case}: {a:?} then {b:?} where red clips");
+            assert!(worst <= 3, "{case}: largest step between neighbouring pixels {worst} levels");
+        }
+    }
+
+    /// Issue #523 on a public ILCE-7RM4 raw (raw.pixls.us, CC0; skipped without the corpus): a dusk sky clipped in
+    /// green behind a poplar. Its rebuilt colour used to come from the tree's foliage and lens fringes, a green halo
+    /// on one side of the tree and a magenta one on the other (Highlights -100 or the issue's edit show them).
+    #[test]
+    fn corpus_clipped_sky_beside_a_tree_has_no_coloured_halo() {
+        let dir = std::env::var_os("LIGHTCRAFT_CORPUS")
+            .map(std::path::PathBuf::from)
+            .unwrap_or_else(|| std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus"))
+            .join("raw");
+        let Ok(bytes) = std::fs::read(dir.join("arw-sony-a7rm4-14bit-compressed.arw")) else {
+            eprintln!("skip: {} absent", dir.display());
+            return;
+        };
+        let (img, _) = load_bytes(&bytes, 1600).unwrap();
+        let (w, h) = (img.width, img.height);
+        let lum = |p: [f32; 3]| lightcraft_color::luminance_2020(p);
+        let chroma = |p: [f32; 3]| {
+            let s = (p[0] + p[1] + p[2]).max(1e-6);
+            [p[0] / s, p[2] / s]
+        };
+        // the poplar stands at about 30 % of the width, its top 25 to 34 % down the frame
+        let px = |f: f32, n: usize| (f * n as f32) as usize;
+        let (mut near, mut far) = ([[0f64; 2]; 2], [[0f64; 2]; 2]);
+        let mut rows = 0;
+        for y in px(0.24, h)..px(0.34, h) {
+            let row = &img.data[y * w..(y + 1) * w];
+            let sky = lum(row[px(0.2, w)]);
+            let dark: Vec<usize> = (px(0.25, w)..px(0.35, w)).filter(|&x| lum(row[x]) < 0.5 * sky).collect();
+            let (Some(&left), Some(&right)) = (dark.first(), dark.last()) else { continue };
+            let k = w as f32 / 6000.0;
+            let mean = |a: usize, b: usize| {
+                let n = (b - a) as f64;
+                (a..b).map(|x| chroma(row[x])).fold([0f64; 2], |s, c| [s[0] + c[0] as f64 / n, s[1] + c[1] as f64 / n])
+            };
+            let (n0, n1, f0, f1) = (px(8.0 / 6000.0, w).max(2), px(40.0 / 6000.0, w), (200.0 * k) as usize, (320.0 * k) as usize);
+            for (side, (n, f)) in
+                [(mean(left - n1, left - n0), mean(left - f1, left - f0)), (mean(right + n0, right + n1), mean(right + f0, right + f1))]
+                    .into_iter()
+                    .enumerate()
+            {
+                for c in 0..2 {
+                    near[side][c] += n[c];
+                    far[side][c] += f[c];
+                }
+            }
+            rows += 1;
+        }
+        assert!(rows > 50, "the tree was not found ({rows} rows)");
+        for side in 0..2 {
+            let d = (0..2).map(|c| ((near[side][c] - far[side][c]) / rows as f64).abs()).fold(0.0, f64::max);
+            assert!(d < 0.004, "{} of the tree the clipped sky's chromaticity is off by {d:.4}", ["left", "right"][side]);
+        }
+    }
+
     /// iPhone ProRAW-style semantic masks drive the Sky mask: Apple's sky matte (here the right
     /// half of the sensor, i.e. the bottom of the photo once turned 90° clockwise — where the sky
     /// heuristic would never look) is used; a matte with an unknown name is ignored.
@@ -981,6 +1302,59 @@ mod tests {
         assert_eq!(before.data, after.data);
     }
 
+    /// The Profile option "Camera local tone mapping" renders the map by position (in the raw's
+    /// active area, whatever the photo's orientation), and only when it's on.
+    #[test]
+    fn dng_gain_table_map_renders_when_asked() {
+        use lightcraft_pipeline::{RenderRequest, render};
+        use lightcraft_raw::gaintable::GainTableMap;
+        let plain = crate::tests_xmp::synthetic_dng_with(None, Default::default());
+        let mut raw = lightcraft_raw::decode(&plain).unwrap();
+        // ×1 at the active area's left edge rising to ×4 at its right edge, whatever the colour
+        raw.color.profile.gain_table_map = Some(GainTableMap {
+            points_v: 1,
+            points_h: 2,
+            points_n: 1,
+            spacing_v: 1.0,
+            spacing_h: 1.0,
+            origin_v: 0.0,
+            origin_h: 0.0,
+            weights: [1.0 / 3.0, 1.0 / 3.0, 1.0 / 3.0, 0.0, 0.0],
+            gamma: 1.0,
+            gains: vec![1.0, 4.0],
+        });
+        let with_map = lightcraft_raw::write_dng(&raw, &Default::default()).unwrap();
+        let (img, info) = load_bytes(&with_map, 64).unwrap();
+        let (_, plain_info) = load_bytes(&plain, 64).unwrap();
+        assert!(info.local_tone.is_some() && plain_info.local_tone.is_none());
+        let req = RenderRequest::fit(64, 64);
+        let mut s = lightcraft_develop::DevelopSettings::default();
+        // (darker, so that ×4 never reaches white)
+        s.light.exposure = -3.0;
+        let off = render(&img, &info, &s, &req).image;
+        assert_eq!(off.data, render(&img, &plain_info, &s, &req).image.data, "off: the map changes nothing");
+        s.profile.camera_local_tone = true;
+        assert!(s.to_json().to_string().contains("camera_local_tone"), "the option is part of the settings (and their hash)");
+        let on = render(&img, &info, &s, &req).image;
+        // brightness gained, per column: none at the left edge, most at the right
+        let column = |im: &lightcraft_raster::Rgba8, x: usize| (0..im.height).map(|y| im.data[y * im.width + x][1] as f32).sum::<f32>();
+        let gain = |x: usize| column(&on, x) / column(&off, x).max(1.0);
+        let last = on.width - 1;
+        assert!((gain(0) - 1.0).abs() < 0.08, "left ×{}", gain(0));
+        assert!(gain(last) > 1.4 && gain(last) > gain(last / 2) && gain(last / 2) > gain(0), "{} {} {}", gain(0), gain(last / 2), gain(last));
+        // the photo turned upside down: the map follows the raw, so the brightened side swaps
+        s.orientation = lightcraft_geom::Orientation::Rotate180;
+        s.profile.camera_local_tone = false;
+        let off = render(&img, &info, &s, &req).image;
+        s.profile.camera_local_tone = true;
+        let on = render(&img, &info, &s, &req).image;
+        let gain = |x: usize| column(&on, x) / column(&off, x).max(1.0);
+        assert!(gain(0) > 1.4 && (gain(last) - 1.0).abs() < 0.08, "rotated: {} … {}", gain(0), gain(last));
+        // a rendered (non-raw) source never gets it
+        let jpeg = SourceInfo { raw: false, ..info.clone() };
+        assert!(!lightcraft_pipeline::local_tone::enabled(&jpeg, &s));
+    }
+
     #[test]
     fn unsupported_raw_falls_back_to_embedded_preview() {
         let b = cr3_with_preview(48, 32);
@@ -1091,7 +1465,7 @@ mod tests {
         assert_eq!((plain.kind, plain.preview_only, plain.width, plain.height), (MediaKind::Image, None, 24, 16));
         assert!(lightcraft_raw::probe(&tiff_shell(24, 16, false)).is_none());
 
-        // TIFFs preserving camera Make tags (SONY, NIKON, etc.) are ordinary images, not raws
+        // TIFFs preserving camera Make tags (SONY, NIKON, etc.) are ordinary images, not raws (#281)
         for make in ["SONY", "NIKON CORPORATION", "PENTAX", "RICOH", "SAMSUNG"] {
             use lightcraft_tiff::{IfdBuilder, ImageData, TiffWriter, Value, tags as t};
             let mut ifd0 = IfdBuilder::new();
@@ -1133,6 +1507,30 @@ mod tests {
         assert!(e.contains("without an embedded preview"), "{e}");
     }
 
+    /// A GoPro GPR (DNG with VC-5 coded data, no preview anywhere) still imports, described from its
+    /// headers; loading it says what is wrong instead of naming a bare TIFF compression number.
+    #[test]
+    fn gopro_vc5_dng_imports_and_fails_to_load_with_a_clear_reason() {
+        use lightcraft_tiff::{IfdBuilder, ImageData, TiffWriter, Value, tags as t};
+        let mut ifd = IfdBuilder::new();
+        ifd.set(t::NEW_SUBFILE_TYPE, Value::Long(vec![0]));
+        ifd.set(t::IMAGE_WIDTH, Value::Long(vec![32]));
+        ifd.set(t::IMAGE_LENGTH, Value::Long(vec![16]));
+        ifd.set(t::BITS_PER_SAMPLE, Value::Short(vec![16]));
+        ifd.set(t::SAMPLES_PER_PIXEL, Value::Short(vec![1]));
+        ifd.set(t::PHOTOMETRIC, Value::Short(vec![32803]));
+        ifd.set(t::COMPRESSION, Value::Short(vec![9]));
+        ifd.set(t::DNG_VERSION, Value::Byte(vec![1, 4, 0, 0]));
+        ifd.set(t::CFA_REPEAT_PATTERN_DIM, Value::Short(vec![2, 2]));
+        ifd.set(t::CFA_PATTERN_EP, Value::Byte(vec![0, 1, 1, 2]));
+        ifd.set_image(ImageData::Tiles { tile_width: 32, tile_height: 16, tiles: vec![vec![0x5au8; 400]] });
+        let f = TiffWriter::default().write(&[ifd]).unwrap();
+        let p = probe_bytes("GOPR0001.GPR", &f).unwrap();
+        assert_eq!((p.kind, p.preview_only, p.width, p.height), (MediaKind::Raw, None, 32, 16));
+        let e = load_bytes(&f, 16).unwrap_err();
+        assert!(e.contains("GoPro VC-5") && e.contains("not decoded yet"), "{e}");
+    }
+
     /// Any failure of a recognised raw (not only an unsupported variant) can fall back to its preview;
     /// CR3 keeps its own wording.
     #[test]
diff --git a/crates/engine/src/import.rs b/crates/engine/src/import.rs
index 282d93b7..ac5640a4 100644
--- a/crates/engine/src/import.rs
+++ b/crates/engine/src/import.rs
@@ -32,9 +32,12 @@ use crate::media::ProbeInfo;
 
 /// File extensions LightCraft imports (lower case).
 pub const EXTENSIONS: &[&str] = &[
-    "jpg", "jpeg", "png", "tif", "tiff", "webp", "dng", "cr2", "cr3", "nef", "nrw", "arw", "raf", "orf", "rw2", "rwl", "raw", "pef", "psd", "jxl",
-    "gif", "bmp", "heic", "avif", // containers LightCraft cannot decode but imports as preview only (their embedded JPEG)
-    "iiq", "crw", "mrw", "x3f", "kdc", "mos", "erf",
+    "jpg", "jpeg", "png", "tif", "tiff", "webp", "dng", "cr2", "cr3", "nef", "nrw", "arw", "raf", "orf", "rw2", "rwl", "raw", "pef", "srw", "psd",
+    "jxl", "gif", "bmp",
+    // Decoded when built with the codecs' `heif` feature; otherwise the import reports them as
+    // failed with the reason ("HEIC/HEIF support isn't included in this build").
+    "heic", "heif", "avif", // no AV1 decoder yet: reported as failed, like a HEIC without the feature
+    "iiq", "crw", "mrw", "x3f", "kdc", "mos", "erf", "3fr", "fff",
 ];
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
@@ -850,8 +853,17 @@ impl ImportJob {
             }
         }
 
-        // files a preceding scan already probed are not read again (a network share is slow to read)
-        let cached: Vec<Option<ProbeInfo>> = todo.iter().map(|f| self.cache.remove(f)).collect();
+        // files a preceding scan already probed are not read again (a network share is slow to read),
+        // as long as they are still there, as they were: a file gone or changed since is probed again
+        let cached: Vec<Option<ProbeInfo>> = todo
+            .iter()
+            .map(|f| {
+                // (the web's files are not std::fs files: kept as probed)
+                self.cache
+                    .remove(f)
+                    .filter(|info| cfg!(target_arch = "wasm32") || std::fs::metadata(f).is_ok_and(|m| m.is_file() && m.len() == info.file_size))
+            })
+            .collect();
         let missing: Vec<String> = todo.iter().zip(&cached).filter(|(_, c)| c.is_none()).map(|(f, _)| f.clone()).collect();
         let progress = ScanProgress::default();
         let mut fresh = probe_all(self.probe.as_ref(), &missing, &progress).into_iter();
@@ -899,7 +911,8 @@ impl ImportJob {
             let packet = crate::sidecar::find_sidecar(&path, self.naming)
                 .and_then(|f| std::fs::read_to_string(f).ok())
                 .or_else(|| info.xmp.clone().filter(|_| raw));
-            let sidecar = packet.and_then(|x| match crate::sidecar::parse_sidecar(&x, raw) {
+            let target = crate::crs::Target::for_file(info.kind, &info.format, info.preview_only.is_some());
+            let sidecar = packet.and_then(|x| match crate::sidecar::parse_sidecar(&x, target) {
                 Ok(sc) => Some(sc),
                 Err(e) => {
                     log::warn!("import {path}: XMP: {e}");
@@ -1044,7 +1057,7 @@ fn name_family(name: &str) -> String {
 
 /// Threads for `jobs` file reads (probes, copies) at once.
 #[cfg(not(target_arch = "wasm32"))]
-fn workers(jobs: usize) -> usize {
+pub(crate) fn workers(jobs: usize) -> usize {
     std::thread::available_parallelism().map(|n| n.get()).unwrap_or(4).clamp(1, 8).min(jobs.max(1))
 }
 
@@ -1371,6 +1384,7 @@ impl Session {
             cache: None,
             stages: None,
             view_cache: None,
+            display: None,
         };
         let embedded = match (&self.media.preview_loader, c.kind) {
             (Some(l), MediaKind::Raw) => Some((c.path.clone(), l.clone(), edge)),
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index a6c5f642..22faff70 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -19,11 +19,13 @@ mod camera_preview;
 pub mod camera_profiles;
 pub mod cmd;
 pub mod config;
+pub mod contact_sheet;
 pub mod crs;
 pub mod crs_masks;
 pub mod demo;
 pub mod denoise;
 pub mod devices;
+pub mod display;
 pub mod export;
 pub mod face_download;
 #[cfg(not(target_arch = "wasm32"))]
@@ -53,6 +55,7 @@ pub mod rename;
 pub mod segment;
 pub mod sidecar;
 pub mod smart;
+pub mod sync;
 mod view;
 pub mod walk;
 
@@ -166,6 +169,9 @@ pub struct Session {
     /// Photos in the current source with no filter on (cached like `visible`).
     total: Option<((u64, String), usize)>,
     pub undo: Vec<UndoEntry>,
+    /// Undo steps committed in this session, ever (the history drops its oldest past 1000, so
+    /// its length can't tell how many steps a command just made; see [`Session::commits`]).
+    commits: u64,
     pub redo: Vec<UndoEntry>,
     pub interaction: Option<Interaction>,
     /// Set by a command whose change must not rewrite the photo's XMP sidecar even with auto-write on
@@ -252,6 +258,9 @@ pub struct Session {
     pub before: std::collections::HashMap<PhotoId, Arc<DevelopSettings>>,
     /// File probes from the last import review (`library.importPreview`), reused by the import.
     pub import_probes: std::collections::HashMap<String, media::ProbeInfo>,
+    /// The last Synchronize Folder scan, which `folder.synchronize` acts on while it is current
+    /// (see [`Session::take_folder_changes`]).
+    pub folder_changes: Option<sync::FolderChanges>,
     /// The last (or running) Build Previews.
     pub preview_build: Option<std::sync::Arc<cmd::previews::PreviewBuild>>,
     /// Develop defaults applied on import (persisted in prefs.json).
@@ -290,6 +299,7 @@ impl Session {
             visible_gen: 0,
             total: None,
             undo: Vec::new(),
+            commits: 0,
             redo: Vec::new(),
             interaction: None,
             skip_auto_write: false,
@@ -334,6 +344,7 @@ impl Session {
             recent_keywords: Vec::new(),
             before: Default::default(),
             import_probes: Default::default(),
+            folder_changes: None,
             preview_build: None,
             import_defaults: import::ImportDefaults::default(),
             cache_mb: 0,
@@ -352,7 +363,10 @@ impl Session {
     /// Run a command by id. THE entry point for every frontend.
     pub fn execute(&mut self, id: &str, params: &Value) -> Result<Value> {
         let spec = find_command(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
-        (spec.enabled)(self).map_err(|why| EngineError::Disabled(id.to_string(), why))?;
+        // a command that validates the photos a call names isn't held back by the selection
+        if !(spec.explicit_targets && cmd::names_photos(params)) {
+            (spec.enabled)(self).map_err(|why| EngineError::Disabled(id.to_string(), why))?;
+        }
         let empty = Value::Object(Default::default());
         let params = if params.is_null() { &empty } else { params };
         self.run_command(id, spec.journal.then_some(params), |s| (spec.run)(s, params))
@@ -422,6 +436,7 @@ impl Session {
         let inv = self.catalog.apply(op)?;
         self.pending_log.push(fwd);
         self.undo.push(UndoEntry { label: label.to_string(), op: inv, folder: None });
+        self.commits = self.commits.wrapping_add(1);
         if self.undo.len() > 1000 {
             self.undo.remove(0);
         }
@@ -486,6 +501,12 @@ impl Session {
 
     /// Fold the last `n` undo steps into one (commands that commit step by step because each op
     /// depends on the state the previous one left).
+    /// How many undo steps were committed in this session so far: what a command that commits
+    /// several steps compares before and after to merge them ([`Session::merge_undo`]).
+    pub fn commits(&self) -> u64 {
+        self.commits
+    }
+
     pub fn merge_undo(&mut self, n: usize, label: &str) {
         if n < 2 || n > self.undo.len() {
             return;
@@ -626,7 +647,8 @@ impl Session {
 
     /// With Auto Sync on, the ops that carry an edit of the active photo `id` (to `new`) over to the
     /// other selected photos: only the settings that changed; never spot removal or red eye (they
-    /// belong to one photo's pixels), nor history / snapshot restores.
+    /// belong to one photo's pixels), nor the rendering process (Sync doesn't carry it either), nor
+    /// history / snapshot restores.
     fn auto_sync_ops(&self, id: PhotoId, new: &DevelopSettings, label: &str) -> Vec<Op> {
         if !self.auto_sync
             || self.active() != Some(id)
@@ -639,7 +661,7 @@ impl Session {
         let Some(old) = self.develop_of(id) else { return Vec::new() };
         let Some(mut delta) = json_delta(&old.to_json(), &new.to_json()) else { return Vec::new() };
         if let Some(o) = delta.as_object_mut() {
-            for k in ["spots", "red_eye", "version"] {
+            for k in ["spots", "red_eye", "version", "process"] {
                 o.remove(k);
             }
             if o.is_empty() {
@@ -859,6 +881,8 @@ mod tests_import;
 #[cfg(test)]
 mod tests_import_move;
 #[cfg(test)]
+mod tests_keyword_list;
+#[cfg(test)]
 mod tests_libops;
 #[cfg(test)]
 mod tests_library;
@@ -871,10 +895,14 @@ mod tests_persist;
 #[cfg(test)]
 mod tests_prefs;
 #[cfg(test)]
+mod tests_process;
+#[cfg(test)]
 mod tests_segment;
 #[cfg(test)]
 mod tests_settings_files;
 #[cfg(test)]
 mod tests_spots;
 #[cfg(test)]
+mod tests_sync;
+#[cfg(test)]
 mod tests_xmp;
diff --git a/crates/engine/src/lightroom_catalog.rs b/crates/engine/src/lightroom_catalog.rs
index 3c510fde..6c1c7724 100644
--- a/crates/engine/src/lightroom_catalog.rs
+++ b/crates/engine/src/lightroom_catalog.rs
@@ -10,6 +10,7 @@ use std::sync::{
 
 use crate::lightroom_sqlite::{Database, LiveTable, Value as SqlValue};
 use lightcraft_catalog::{Album, Flag, Op, Photo, PhotoId, Source};
+use lightcraft_geom::{Affine, Orientation, Point, Rect};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
 
@@ -477,17 +478,83 @@ fn ensure_read_active(cancel: &AtomicBool) -> Result<(), String> {
     if cancel.load(Ordering::Relaxed) { Err("Lightroom import cancelled".into()) } else { Ok(()) }
 }
 
-fn mapped_settings(text: &str, raw: bool, aspect: f64) -> Result<(Value, Vec<String>), String> {
+fn mapped_settings(
+    text: &str,
+    target: crate::crs::Target,
+    aspect: f64,
+    orientation: Orientation,
+    stored_aspect: f64,
+) -> Result<(Value, Vec<String>), String> {
     let mut root = crate::preset_import::parse_lua(text)?;
     let deferred = strip_lua_sentinels(&mut root);
-    let (props, values) = crate::preset_import::lua_settings_props(&root)?;
-    let (partial, mut unknown) = crate::crs::to_partial_report(&props, Some(&values), Some(raw), aspect);
+    let (mut props, values) = crate::preset_import::lua_settings_props(&root)?;
+    // A catalog's develop settings carry the crop edges and angle but no `HasCrop` (XMP has it):
+    // any crop field means the photo is cropped.
+    const CROP: [&str; 5] = ["crs:CropLeft", "crs:CropTop", "crs:CropRight", "crs:CropBottom", "crs:CropAngle"];
+    if !props.contains_key("crs:HasCrop") && CROP.iter().any(|k| props.contains_key(*k)) {
+        props.insert("crs:HasCrop".into(), vec!["True".into()]);
+    }
+    let (mut partial, mut unknown) = crate::crs::to_partial_report(&props, Some(&values), target, aspect);
+    catalog_crop(&mut partial, orientation, stored_aspect);
     if deferred > 0 {
         unknown.push("Deferred Lightroom adjustments (-999999)".into());
     }
     Ok((partial, unknown))
 }
 
+/// Lightroom's `Adobe_images.orientation`: where the stored image's top-left and top-right corners
+/// land in the displayed photo, naming the displayed corners A, B, C, D clockwise from the top left
+/// (`AB` upright, `BC` a quarter turn clockwise, `DA` a quarter turn counter-clockwise, `BA` mirrored).
+fn lightroom_orientation(code: &str) -> Option<Orientation> {
+    const ALL: [Orientation; 8] = [
+        Orientation::Normal,
+        Orientation::FlipH,
+        Orientation::Rotate180,
+        Orientation::FlipV,
+        Orientation::Transpose,
+        Orientation::Rotate90,
+        Orientation::Transverse,
+        Orientation::Rotate270,
+    ];
+    let corner = |o: Orientation, x: f64, y: f64| match o.map(x, y, 1.0, 1.0) {
+        (u, v) if u < 0.5 && v < 0.5 => 'A',
+        (_, v) if v < 0.5 => 'B',
+        (u, _) if u >= 0.5 => 'C',
+        _ => 'D',
+    };
+    ALL.into_iter().find(|&o| code.chars().eq([corner(o, 0.0, 0.0), corner(o, 1.0, 0.0)]))
+}
+
+/// Lightroom's crop in LightCraft's frame. `crs` gives the crop's top-left (`CropLeft`, `CropTop`)
+/// and bottom-right (`CropRight`, `CropBottom`) corners on the stored image (before orientation and
+/// straightening), normalized to its size, plus a straighten angle that turns the other way to
+/// LightCraft's. LightCraft's crop is a rectangle in the oriented image rotated by `angle` about its
+/// centre, normalized to the oriented image's size, so the corners go through the orientation and
+/// then the rotation; `stored_aspect` (width / height of the stored image) matters once the
+/// rectangle turns. On a real catalog this reproduced the frame aspect of all 223 straightened crops
+/// in Lightroom's exports within 1%.
+fn catalog_crop(partial: &mut Value, orientation: Orientation, stored_aspect: f64) {
+    let Some(geometry) = partial.pointer_mut("/crop/geometry").and_then(Value::as_object_mut) else { return };
+    let edge = |k: &str| geometry.get("rect").and_then(|r| r.get(k)).and_then(Value::as_f64);
+    let (Some(x0), Some(y0), Some(x1), Some(y1)) = (edge("x0"), edge("y0"), edge("x1"), edge("y1")) else { return };
+    let lightroom_angle = geometry.get("angle").and_then(Value::as_f64).unwrap_or(0.0);
+    if orientation == Orientation::Normal && lightroom_angle == 0.0 {
+        return;
+    }
+    let w = if stored_aspect.is_finite() && stored_aspect > 0.0 { stored_aspect } else { 1.0 };
+    let (ow, oh) = if orientation.swaps_axes() { (1.0, w) } else { (w, 1.0) };
+    // a mirror turns the straighten the other way too
+    let angle = if orientation.to_parts().0 { lightroom_angle } else { -lightroom_angle };
+    let to_rotated = Affine::rotate_about(angle.to_radians(), Point::new(ow / 2.0, oh / 2.0));
+    let corner = |x: f64, y: f64| {
+        let (u, v) = orientation.map(x * w, y, w, 1.0);
+        to_rotated.apply(Point::new(u, v))
+    };
+    let r = Rect::from_points(corner(x0, y0), corner(x1, y1));
+    geometry.insert("rect".into(), json!({"x0": r.x0 / ow, "y0": r.y0 / oh, "x1": r.x1 / ow, "y1": r.y1 / oh}));
+    geometry.insert("angle".into(), json!(angle));
+}
+
 fn strip_lua_sentinels(value: &mut crate::preset_import::Lua) -> usize {
     use crate::preset_import::Lua;
     match value {
@@ -656,7 +723,7 @@ pub(crate) fn apply_prepared(s: &mut crate::Session, data: CatalogImport, contex
             preserved += 1;
         }
         if !src.xmp.is_empty() {
-            match crate::sidecar::parse_sidecar(&src.xmp, p.kind == lightcraft_catalog::MediaKind::Raw) {
+            match crate::sidecar::parse_sidecar(&src.xmp, crate::crs::Target::for_photo(&p)) {
                 Ok(mut sc) => {
                     if let Some(crate::sidecar::DevelopPatch::Partial(partial)) = &mut sc.develop {
                         strip_xmp_sentinels(partial);
@@ -680,7 +747,15 @@ pub(crate) fn apply_prepared(s: &mut crate::Session, data: CatalogImport, contex
             p.meta.keywords = src.keywords.clone();
         }
         if !src.settings.is_empty() && !keep_develop {
-            match mapped_settings(&src.settings, p.kind == lightcraft_catalog::MediaKind::Raw, p.width.max(1) as f64 / p.height.max(1) as f64) {
+            let orientation = lightroom_orientation(text(&src.image, "orientation")).unwrap_or_default();
+            let stored_aspect = number(&src.image, "fileWidth") as f64 / number(&src.image, "fileHeight") as f64;
+            match mapped_settings(
+                &src.settings,
+                crate::crs::Target::for_photo(&p),
+                p.width.max(1) as f64 / p.height.max(1) as f64,
+                orientation,
+                stored_aspect,
+            ) {
                 Ok((partial, unknown)) => {
                     p.develop = Arc::new(lightcraft_develop::apply_partial(&p.develop, &partial, 1.0));
                     p.edited = Some(now.clone());
@@ -788,6 +863,7 @@ pub(crate) fn apply_prepared(s: &mut crate::Session, data: CatalogImport, contex
 #[cfg(test)]
 mod tests {
     use super::*;
+    use lightcraft_geom::CropGeometry;
     fn row(v: Value) -> Row {
         serde_json::from_value(v).unwrap()
     }
@@ -866,7 +942,10 @@ mod tests {
         cyclic.collections[0].insert("parent".into(), json!(10));
         assert!(apply(&mut s, cyclic, false).is_err());
         assert_eq!(s.catalog.to_snapshot(), before);
-        assert!(mapped_settings(&format!("{}0{}", "{".repeat(1000), "}".repeat(1000)), true, 1.0).is_err());
+        assert!(
+            mapped_settings(&format!("{}0{}", "{".repeat(1000), "}".repeat(1000)), crate::crs::Target::RawAbsolute, 1.0, Orientation::Normal, 1.5)
+                .is_err()
+        );
     }
     #[test]
     fn compressed_xmp_is_bounded_and_settings_are_data_only() {
@@ -876,10 +955,180 @@ mod tests {
         assert_eq!(xmp(Some(&json!(encoded))).unwrap(), String::from_utf8_lossy(packet));
         encoded[0] = 0xff;
         assert!(xmp(Some(&json!(encoded))).is_err());
-        let (partial, _) = mapped_settings("s = { Exposure2012 = 0.75, ToneCurvePV2012 = {0,0,128,150,255,255} }", true, 1.5).unwrap();
+        let (partial, _) = mapped_settings(
+            "s = { Exposure2012 = 0.75, ToneCurvePV2012 = {0,0,128,150,255,255} }",
+            crate::crs::Target::RawAbsolute,
+            1.5,
+            Orientation::Normal,
+            1.5,
+        )
+        .unwrap();
         assert_eq!(partial["light"]["exposure"], 0.75);
     }
 
+    #[test]
+    fn custom_white_balance_on_relative_wb_raws_is_not_read_as_kelvin() {
+        // Issue #510: a catalog keeps no as-shot white for Custom photos, so on a raw developed
+        // relative to its as-shot look the edit stays As Shot and is reported; a DNG keeps the Kelvin
+        let settings =
+            "s = { WhiteBalance = \"Custom\", Temperature = 3578, Tint = -5, CustomTemperature = 3578.95, CustomTint = -5, Exposure2012 = 0.5 }";
+        let (partial, unknown) = mapped_settings(settings, crate::crs::Target::RawRelative, 1.5, Orientation::Normal, 1.5).unwrap();
+        assert_eq!(partial["wb"], json!({"mode": "asShot"}), "{partial}");
+        assert_eq!(partial["light"]["exposure"], 0.5);
+        assert!(unknown.iter().any(|k| k.starts_with("Temperature, Tint")), "{unknown:?}");
+        let (partial, unknown) = mapped_settings(settings, crate::crs::Target::RawAbsolute, 1.5, Orientation::Normal, 1.5).unwrap();
+        assert_eq!(
+            (partial["wb"]["mode"].as_str(), partial["wb"]["temp"].as_f64(), partial["wb"]["tint"].as_f64()),
+            (Some("custom"), Some(3578.0), Some(-5.0))
+        );
+        assert!(!unknown.iter().any(|k| k.starts_with("Temperature")), "{unknown:?}");
+    }
+
+    #[test]
+    fn catalog_crops_without_has_crop_are_imported() {
+        // Lightroom Classic catalogs store crop edges and angle but never `HasCrop`
+        let (partial, unknown) = mapped_settings(
+            "s = { CropConstrainAspectRatio = true, CropLeft = 0.042702, CropRight = 0.957298, CropTop = 0.1 }",
+            crate::crs::Target::RawAbsolute,
+            1.5,
+            Orientation::Normal,
+            1.5,
+        )
+        .unwrap();
+        let crop = &partial["crop"]["geometry"];
+        assert_eq!(crop["rect"]["x0"], 0.042702);
+        assert_eq!(crop["rect"]["y0"], 0.1);
+        assert_eq!(crop["rect"]["x1"], 0.957298);
+        assert_eq!(crop["rect"]["y1"], 1.0);
+        assert_eq!(crop["angle"], 0.0);
+        assert!(!unknown.iter().any(|k| k.starts_with("CropLeft")), "{unknown:?}");
+        // an angle alone still means a crop (Lightroom's angle turns the other way to LightCraft's)
+        let (partial, unknown) = mapped_settings("s = { CropAngle = -1.5 }", crate::crs::Target::RawAbsolute, 1.5, Orientation::Normal, 1.5).unwrap();
+        assert_eq!(partial["crop"]["geometry"]["angle"], 1.5);
+        assert!(!unknown.iter().any(|k| k.starts_with("CropAngle")), "{unknown:?}");
+        // no crop fields: the crop stays untouched
+        let (partial, _) = mapped_settings("s = { Exposure2012 = 0.5 }", crate::crs::Target::RawAbsolute, 1.5, Orientation::Normal, 1.5).unwrap();
+        assert!(partial.get("crop").is_none());
+    }
+
+    #[test]
+    fn lightroom_orientation_codes() {
+        // the three seen in a real catalog, checked against each file's EXIF orientation (1, 6, 8)
+        assert_eq!(lightroom_orientation("AB"), Some(Orientation::Normal));
+        assert_eq!(lightroom_orientation("BC"), Some(Orientation::Rotate90));
+        assert_eq!(lightroom_orientation("DA"), Some(Orientation::Rotate270));
+        assert_eq!(lightroom_orientation("CD"), Some(Orientation::Rotate180));
+        assert_eq!(lightroom_orientation("BA"), Some(Orientation::FlipH));
+        assert_eq!(lightroom_orientation("DC"), Some(Orientation::FlipV));
+        assert_eq!(lightroom_orientation("AD"), Some(Orientation::Transpose));
+        assert_eq!(lightroom_orientation("CB"), Some(Orientation::Transverse));
+        for code in ["", "A", "ABC", "AC", "ab", "XY"] {
+            assert_eq!(lightroom_orientation(code), None, "{code:?}");
+        }
+    }
+
+    #[test]
+    fn catalog_crops_follow_the_photo_orientation() {
+        let crop = |o: Orientation| {
+            let settings = "s = { CropLeft = 0.1, CropRight = 0.6, CropTop = 0.2, CropBottom = 0.9 }";
+            let (partial, _) = mapped_settings(settings, crate::crs::Target::RawAbsolute, 1.5, o, 1.5).unwrap();
+            let g = &partial["crop"]["geometry"];
+            let r = &g["rect"];
+            [r["x0"].as_f64(), r["y0"].as_f64(), r["x1"].as_f64(), r["y1"].as_f64(), g["angle"].as_f64()].map(|v| (v.unwrap() * 1e9).round() / 1e9)
+        };
+        // (x, y) of the stored image → (1 − y, x) a quarter turn clockwise, (y, 1 − x) counter-clockwise
+        assert_eq!(crop(Orientation::Normal), [0.1, 0.2, 0.6, 0.9, 0.0]);
+        assert_eq!(crop(Orientation::Rotate90), [0.1, 0.1, 0.8, 0.6, 0.0]);
+        assert_eq!(crop(Orientation::Rotate270), [0.2, 0.4, 0.9, 0.9, 0.0]);
+        assert_eq!(crop(Orientation::Rotate180), [0.4, 0.1, 0.9, 0.8, 0.0]);
+        assert_eq!(crop(Orientation::FlipH), [0.4, 0.2, 0.9, 0.9, 0.0]);
+        // a mirror turns the straighten the other way
+        let angle = |o: Orientation| {
+            let (partial, _) = mapped_settings("s = { CropAngle = 2 }", crate::crs::Target::RawAbsolute, 1.5, o, 1.5).unwrap();
+            partial["crop"]["geometry"]["angle"].as_f64().unwrap()
+        };
+        assert_eq!(angle(Orientation::Rotate90), -2.0);
+        assert_eq!(angle(Orientation::FlipH), 2.0);
+        // no crop: nothing to orient
+        let (partial, _) = mapped_settings("s = { Exposure2012 = 0.5 }", crate::crs::Target::RawAbsolute, 1.5, Orientation::Rotate90, 1.5).unwrap();
+        assert!(partial.get("crop").is_none());
+    }
+
+    /// The `crs` corners and angle Lightroom would store for LightCraft crop `g` on a stored image
+    /// of aspect `w` (height 1) shown with orientation `o`.
+    fn lightroom_crop(g: CropGeometry, o: Orientation, w: f64) -> String {
+        let (ow, oh) = if o.swaps_axes() { (1.0, w) } else { (w, 1.0) };
+        let to_source = Affine::rotate_about(-g.angle.to_radians(), Point::new(ow / 2.0, oh / 2.0));
+        let stored = |x: f64, y: f64| {
+            let p = to_source.apply(Point::new(x * ow, y * oh));
+            o.inverse().map(p.x, p.y, ow, oh)
+        };
+        // the rectangle's corners that land top-left and bottom-right on the stored image
+        let corners = [stored(g.rect.x0, g.rect.y0), stored(g.rect.x1, g.rect.y0), stored(g.rect.x1, g.rect.y1), stored(g.rect.x0, g.rect.y1)];
+        let (tl, br) = (0..4).map(|i| (corners[i], corners[(i + 2) % 4])).find(|(a, b)| a.0 < b.0 && a.1 < b.1).unwrap();
+        let angle = if o.to_parts().0 { g.angle } else { -g.angle };
+        format!("s = {{ CropLeft = {}, CropTop = {}, CropRight = {}, CropBottom = {}, CropAngle = {angle} }}", tl.0 / w, tl.1, br.0 / w, br.1)
+    }
+
+    #[test]
+    fn straightened_catalog_crops_round_trip() {
+        let g = CropGeometry { rect: Rect::new(0.2, 0.15, 0.7, 0.8), angle: 6.5 };
+        for o in [Orientation::Normal, Orientation::Rotate90, Orientation::Rotate270, Orientation::Rotate180, Orientation::FlipH] {
+            for angle in [6.5, -6.5] {
+                let g = CropGeometry { angle, ..g };
+                let (partial, _) = mapped_settings(&lightroom_crop(g, o, 1.5), crate::crs::Target::RawAbsolute, 1.5, o, 1.5).unwrap();
+                let got: CropGeometry = serde_json::from_value(partial["crop"]["geometry"].clone()).unwrap();
+                let close = |a: f64, b: f64| (a - b).abs() < 1e-9;
+                assert!(
+                    close(got.angle, g.angle)
+                        && [(got.rect.x0, g.rect.x0), (got.rect.y0, g.rect.y0), (got.rect.x1, g.rect.x1), (got.rect.y1, g.rect.y1)]
+                            .iter()
+                            .all(|&(a, b)| close(a, b)),
+                    "{o:?} {angle}: {got:?}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn straightened_catalog_crops_match_lightroom_exports() {
+        // Settings and pixel sizes from a real Lightroom Classic catalog (9504 × 6336 stored) and the
+        // JPEGs Lightroom exported from it at full size.
+        for (settings, o, export) in [
+            (
+                "s = { CropAngle = -9.34444, CropBottom = 0.802034, CropLeft = 0.05499, CropRight = 0.94501, CropTop = 0.197966 }",
+                Orientation::Normal,
+                (7725.0, 5150.0),
+            ),
+            (
+                "s = { CropAngle = -1.48964, CropBottom = 0.962457, CropLeft = 0.010429, CropRight = 0.989571, CropTop = 0.037543 }",
+                Orientation::Rotate90,
+                (6100.0, 9150.0),
+            ),
+        ] {
+            let (partial, _) = mapped_settings(settings, crate::crs::Target::RawAbsolute, 1.5, o, 9504.0 / 6336.0).unwrap();
+            let r: Rect = serde_json::from_value(partial["crop"]["geometry"]["rect"].clone()).unwrap();
+            let (ow, oh) = if o.swaps_axes() { (6336.0, 9504.0) } else { (9504.0, 6336.0) };
+            let (w, h) = (r.width() * ow, r.height() * oh);
+            assert!((w - export.0).abs() <= 3.0 && (h - export.1).abs() <= 3.0, "{o:?}: {w:.1} × {h:.1}, Lightroom exported {export:?}");
+        }
+    }
+
+    #[test]
+    fn imported_crops_use_the_catalog_orientation() {
+        let mut data = sample();
+        data.photos.truncate(1);
+        data.photos[0].image.remove("masterImage");
+        data.photos[0].image.insert("orientation".into(), json!("BC"));
+        data.photos[0].settings = "s = { CropLeft = 0.1, CropRight = 0.6, CropTop = 0.2, CropBottom = 0.9 }".into();
+        data.photos[0].xmp = String::new();
+        let mut s = crate::Session::new();
+        apply(&mut s, data, false).unwrap();
+        let g = s.catalog.photos().next().unwrap().develop.crop.geometry;
+        let r = [g.rect.x0, g.rect.y0, g.rect.x1, g.rect.y1].map(|v| (v * 1e9).round() / 1e9);
+        assert_eq!(r, [0.1, 0.1, 0.8, 0.6]);
+    }
+
     #[test]
     fn deferred_auto_tone_sentinels_never_become_real_slider_values() {
         let mut data = sample();
@@ -896,7 +1145,9 @@ mod tests {
         assert_eq!(p.develop.light.shadows, 65.0);
         assert_eq!(p.develop.light.blacks, -22.0);
         assert!(report["unmapped"]["2"].as_array().unwrap().iter().any(|v| v.as_str().is_some_and(|v| v.contains("Deferred"))));
-        let (partial, _) = mapped_settings("s = { Exposure2012 = -5, Contrast2012 = -100 }", true, 1.0).unwrap();
+        let (partial, _) =
+            mapped_settings("s = { Exposure2012 = -5, Contrast2012 = -100 }", crate::crs::Target::RawAbsolute, 1.0, Orientation::Normal, 1.5)
+                .unwrap();
         assert_eq!(partial["light"]["exposure"], -5.0);
         assert_eq!(partial["light"]["contrast"], -100.0);
     }
diff --git a/crates/engine/src/media.rs b/crates/engine/src/media.rs
index b0439390..1e2a7d3e 100644
--- a/crates/engine/src/media.rs
+++ b/crates/engine/src/media.rs
@@ -62,7 +62,7 @@ impl SettingsHashes {
 }
 
 /// Bump when the pipeline's output changes, to invalidate cached thumbnails.
-pub const RENDER_CACHE_VERSION: u64 = 16;
+pub const RENDER_CACHE_VERSION: u64 = 37;
 
 /// Thumbnails render at one of these long edges (so window/cell size changes reuse the cache).
 pub const THUMB_SIZES: [usize; 4] = [128, 256, 384, 512];
@@ -209,6 +209,7 @@ impl DecodedSource {
     /// Cache cost: the picture, its segmentation mattes, its denoised twin and room for the lazy mix.
     pub fn bytes(&self) -> usize {
         let mattes = self.info.as_ref().and_then(|i| i.mattes.as_ref()).map_or(0, |m| m.bytes());
+        let mattes = mattes + self.info.as_ref().and_then(|i| i.local_tone.as_ref()).map_or(0, |t| t.map.gains.len() * 4);
         self.image.data.len() * 12 + 64 + std::mem::size_of::<SourceInfo>() + mattes + self.denoised.as_ref().map_or(0, |t| t.bytes())
     }
 
@@ -250,7 +251,7 @@ impl SourceRef {
     pub fn load_source(&self) -> Result<DecodedSource, String> {
         let image = match self {
             SourceRef::Loaded(a) => return Ok((**a).clone()),
-            SourceRef::Demo { scene, max_edge } => crate::demo::scene_pixels(scene, *max_edge),
+            SourceRef::Demo { scene, max_edge } => crate::demo::scene_pixels(scene, *max_edge)?,
             SourceRef::File { path, max_edge, loader, fallback, denoise } => {
                 let plain = || match loader {
                     Some(l) => l(path, *max_edge).map(|(image, info)| DecodedSource::new(Arc::new(image), Some(info))),
@@ -673,6 +674,8 @@ pub struct RenderJob {
     pub stages: Option<Arc<StageCache>>,
     /// Keep a full-quality result here as the photo's view preview ([`crate::Session::loupe_job`]).
     pub view_cache: Option<(Arc<PreviewCache>, Hash128)>,
+    /// Render for this monitor profile ([`Self::with_display`]).
+    pub display: Option<Arc<crate::display::Display>>,
 }
 
 pub struct RenderResult {
@@ -686,6 +689,9 @@ pub struct RenderResult {
     pub loaded: Option<DecodedSource>,
     /// Set for a [`QuickJob`]'s stand-in: where the image came from.
     pub quick: Option<QuickSource>,
+    /// The display profile (id) the image is encoded for; `None`: sRGB (see
+    /// [`crate::display::present`]).
+    pub display: Option<u64>,
 }
 
 impl RenderJob {
@@ -733,6 +739,21 @@ impl RenderJob {
         self
     }
 
+    /// Render for a monitor profile: into the display's primaries (its gamut, not sRGB's), ready
+    /// to show ([`RenderResult::display`]). The histogram and the cached view preview stay sRGB.
+    /// Gets its own result key. Thumbnail jobs (rendered-thumbnail cache) are left as they are:
+    /// [`crate::display::present`] converts their sRGB results.
+    pub fn with_display(mut self, display: Option<Arc<crate::display::Display>>) -> Self {
+        if self.cache.is_some() || self.request.depth != lightcraft_pipeline::OutputDepth::U8 {
+            return self;
+        }
+        let k = |d: &Option<Arc<crate::display::Display>>| d.as_ref().map_or(0, |d| d.id()).wrapping_mul(0xd6e8_feb8_6659_fd93);
+        self.key ^= k(&self.display) ^ k(&display);
+        self.request.display = display.as_ref().map(|d| d.space);
+        self.display = display;
+        self
+    }
+
     pub fn run(self) -> RenderResult {
         if let Some((cache, key)) = &self.cache
             && let Some(img) = cache.get_at(self.cache_generation, *key)
@@ -748,10 +769,18 @@ impl RenderJob {
                 rendered: Ok(Rendered { image, histogram, deep: None }),
                 loaded: None,
                 quick: None,
+                display: None,
             };
         }
         let was_loaded = matches!(self.source, SourceRef::Loaded(_));
-        match self.source.load_source() {
+        // The app is closing (issue #620): nobody is left to show this, and quitting waits for the
+        // jobs that are running. Without this, one that lost the GPU mid-way would render on the CPU.
+        let closing = || lightcraft_gpu::shutting_down().then(|| "LightCraft is closing".to_string());
+        let source = match closing() {
+            Some(e) => Err(e),
+            None => self.source.load_source().and_then(|s| closing().map_or(Ok(s), Err)),
+        };
+        match source {
             Ok(source) => {
                 // the plain picture, or (Denoise amount above 0 and a denoised picture cached) the mix the amount asks for
                 let src = &source.image_for(self.settings.denoise_amount());
@@ -759,14 +788,30 @@ impl RenderJob {
                 // Thumbnails (many small jobs side by side) stay on the CPU; views and exports use
                 // the GPU when there is one.
                 let gpu = self.cache.is_none();
-                let rendered = develop(src, &info, &self.settings, &self.request, self.stages.as_deref(), gpu);
+                let mut rendered = develop(src, &info, &self.settings, &self.request, self.stages.as_deref(), gpu);
+                // for a display profile: the image goes to the display's values, the histogram
+                // and the cached view preview stay sRGB
+                let mut srgb = None;
+                let display = match (&self.display, self.request.display) {
+                    (Some(d), Some(_)) => {
+                        let keep = self.view_cache.is_some() && self.request.quality == Quality::Full;
+                        let (s, h) = crate::display::finish_render(&mut rendered.image, d, keep);
+                        if let Some(h) = h {
+                            rendered.histogram = h;
+                        }
+                        srgb = s;
+                        Some(d.id())
+                    }
+                    _ => None,
+                };
                 if let Some((cache, key)) = &self.cache {
                     cache.put_at(self.cache_generation, *key, Arc::new(rendered.image.clone()));
                 }
                 if let Some((cache, key)) = &self.view_cache
                     && self.request.quality == Quality::Full
+                    && (display.is_none() || srgb.is_some())
                 {
-                    cache.put_deferred_at(self.cache_generation, *key, Arc::new(rendered.image.clone()));
+                    cache.put_deferred_at(self.cache_generation, *key, Arc::new(srgb.unwrap_or_else(|| rendered.image.clone())));
                 }
                 RenderResult {
                     request_id: self.request_id,
@@ -777,6 +822,7 @@ impl RenderJob {
                     rendered: Ok(rendered),
                     loaded: (!was_loaded).then_some(source),
                     quick: None,
+                    display,
                 }
             }
             Err(e) => RenderResult {
@@ -788,6 +834,7 @@ impl RenderJob {
                 rendered: Err(e),
                 loaded: None,
                 quick: None,
+                display: None,
             },
         }
     }
@@ -852,6 +899,7 @@ impl QuickJob {
             rendered,
             loaded: None,
             quick,
+            display: None,
         };
         let rendered = |image: Rgba8| {
             let histogram = Histogram::of_srgb8(&image);
@@ -971,6 +1019,7 @@ impl crate::Session {
             cache,
             stages: None,
             view_cache: None,
+            display: None,
         })
     }
 
@@ -1021,6 +1070,7 @@ impl crate::Session {
             cache: Some((self.media.rendered.clone(), ck)),
             stages: None,
             view_cache: None,
+            display: None,
         })
     }
 
@@ -1066,6 +1116,7 @@ impl crate::Session {
             cache: Some((self.media.rendered.clone(), ck)),
             stages: None,
             view_cache: None,
+            display: None,
         })
     }
 
diff --git a/crates/engine/src/memory.rs b/crates/engine/src/memory.rs
index d231bf65..8c421668 100644
--- a/crates/engine/src/memory.rs
+++ b/crates/engine/src/memory.rs
@@ -18,7 +18,9 @@ use serde::Serialize;
 /// - a quarter for the working memory of decodes in flight ([`work_gate`]);
 /// - an eighth for the GPU renderer's pool of recycled buffers (trimmed when the app is idle).
 ///
-/// The rest is headroom for what isn't cached (renders in progress, textures, the UI). Default:
+/// The rest is headroom for what isn't cached (renders in progress, textures, the UI). An export
+/// batch may, in addition, hold up to twice the budget in photos rendering side by side
+/// ([`export_gate`]): transient memory, given back when the batch ends. Default:
 /// a quarter of the machine's RAM, at most 1.5 GiB (`LIGHTCRAFT_MEMORY_MB` overrides it).
 pub fn default_budget() -> usize {
     if let Some(mb) = std::env::var("LIGHTCRAFT_MEMORY_MB").ok().and_then(|v| v.trim().parse::<usize>().ok()).filter(|m| *m >= 64) {
@@ -83,6 +85,9 @@ fn apply(b: usize) {
     if let Some(g) = GATE.get() {
         g.set_limit(b / 4);
     }
+    if let Some(g) = EXPORT_GATE.get() {
+        g.set_limit(export_share(b));
+    }
     lightcraft_gpu::set_pool_limit((b / 8) as u64);
 }
 
@@ -174,6 +179,19 @@ pub fn work_gate() -> &'static WorkGate {
 
 static GATE: OnceLock<WorkGate> = OnceLock::new();
 
+/// The process-wide gate for the photos of an export batch rendering side by side
+/// ([`crate::export::run_batch`]; limit: twice the budget). Separate from [`work_gate`], which the
+/// decodes inside each export take: one gate held across the other's acquire could deadlock.
+pub fn export_gate() -> &'static WorkGate {
+    EXPORT_GATE.get_or_init(|| WorkGate::new(export_share(budget())))
+}
+
+fn export_share(budget: usize) -> usize {
+    budget.saturating_mul(2)
+}
+
+static EXPORT_GATE: OnceLock<WorkGate> = OnceLock::new();
+
 /// Entries and bytes held by one cache.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize)]
 pub struct Usage {
diff --git a/crates/engine/src/preset_import.rs b/crates/engine/src/preset_import.rs
index 040d46c3..044139ff 100644
--- a/crates/engine/src/preset_import.rs
+++ b/crates/engine/src/preset_import.rs
@@ -464,7 +464,7 @@ pub fn group_from_dir(dir: &str) -> Option<String> {
 }
 
 pub(crate) fn build(props: &Props, values: &crate::crs_masks::Values, name: String, group: Option<String>, from_photo: bool) -> Option<Imported> {
-    let (mut settings, unmapped) = crate::crs::to_partial_report(props, Some(values), None, crate::crs_masks::DEFAULT_ASPECT);
+    let (mut settings, unmapped) = crate::crs::to_partial_report(props, Some(values), crate::crs::Target::Any, crate::crs_masks::DEFAULT_ASPECT);
     if from_photo && let Some(o) = settings.as_object_mut() {
         // a photo's own framing and absolute white balance don't belong in a look
         o.remove("crop");
diff --git a/crates/engine/src/sidecar.rs b/crates/engine/src/sidecar.rs
index 7e924948..e92d193a 100644
--- a/crates/engine/src/sidecar.rs
+++ b/crates/engine/src/sidecar.rs
@@ -114,8 +114,10 @@ pub enum DevelopPatch {
     Partial(Value),
 }
 
-/// Parse a sidecar / XMP packet. `raw` selects absolute (raw) vs relative white balance for `crs:`.
-pub fn parse_sidecar(xmp: &str, raw: bool) -> std::result::Result<SidecarData, String> {
+/// Parse a sidecar / XMP packet. `target` selects how a `crs:` white balance is read
+/// ([`crate::crs::Target`]: absolute Kelvin for raws with a measured illuminant, a shift from the
+/// as-shot white for everything developed relative to it).
+pub fn parse_sidecar(xmp: &str, target: crate::crs::Target) -> std::result::Result<SidecarData, String> {
     let d = lightcraft_meta::parse_xmp(xmp).map_err(|e| e.to_string())?;
     let m = &d.metadata;
     let lc = |k: &str| d.properties.get(&format!("lc:{k}")).and_then(|v| v.first()).cloned();
@@ -133,7 +135,8 @@ pub fn parse_sidecar(xmp: &str, raw: bool) -> std::result::Result<SidecarData, S
         country: m.country.clone(),
         alt_text: m.alt_text.clone(),
         extended_description: m.extended_description.clone(),
-        keywords: (!m.keywords.is_empty()).then(|| m.keywords.clone()),
+        keywords: (!m.keywords.is_empty() || !m.hierarchical_keywords.is_empty())
+            .then(|| lightcraft_catalog::keywords::from_file(&m.keywords, &m.hierarchical_keywords)),
         // A sidecar that has `mwg-rs:Regions` at all (even an empty list) was written by an app that
         // knows about regions, so it's authoritative: its list, empty or not, replaces the catalog's.
         // One without it (most writers, LightCraft's own included, which keeps another app's
@@ -162,7 +165,7 @@ pub fn parse_sidecar(xmp: &str, raw: bool) -> std::result::Result<SidecarData, S
     out.develop = match full {
         Some(s) => Some(DevelopPatch::Full(Box::new(s))),
         None if crate::crs::has_adjustments(&d.properties) => {
-            Some(DevelopPatch::Partial(crate::crs::to_partial_report(&d.properties, Some(&d.values), Some(raw), crate::crs_masks::DEFAULT_ASPECT).0))
+            Some(DevelopPatch::Partial(crate::crs::to_partial_report(&d.properties, Some(&d.values), target, crate::crs_masks::DEFAULT_ASPECT).0))
         }
         None => None,
     };
@@ -445,6 +448,18 @@ impl Session {
     /// catalogued file shares the stem (`IMG_0001.CR3` + `IMG_0001.JPG`) and owns the stem
     /// sidecar — a raw first, else the first by file name. The others use Full naming
     /// (`IMG_0001.JPG.xmp`), so their metadata never overwrites each other.
+    /// [`Session::sidecar_naming`] for many photos, the catalog's sidecar owners worked out once
+    /// (per photo that is a pass over the whole catalog).
+    pub fn sidecar_namings(&self, ids: &[PhotoId]) -> Vec<SidecarNaming> {
+        let owners = (self.xmp.naming == SidecarNaming::Stem).then(|| StemOwners::of(&self.catalog));
+        ids.iter()
+            .map(|id| match (self.catalog.photo(*id), &owners) {
+                (Some(p), Some(o)) => o.naming(p, self.xmp.naming),
+                _ => self.xmp.naming,
+            })
+            .collect()
+    }
+
     pub fn sidecar_naming(&self, id: PhotoId) -> SidecarNaming {
         match self.catalog.photo(id) {
             Some(p) if self.xmp.naming == SidecarNaming::Stem => StemOwners::of(&self.catalog).naming(p, self.xmp.naming),
@@ -475,9 +490,15 @@ impl Session {
         let p = self.catalog.photo(id).ok_or(lightcraft_catalog::CatalogError::NoPhoto(id))?;
         let Some(orig) = file_path(p) else { return Ok(None) };
         let Some((packet, from)) = read_packet(orig, p.kind, self.sidecar_naming(id)) else { return Ok(None) };
-        let sc = parse_sidecar(&packet, p.kind == MediaKind::Raw)
-            .map_err(|e| EngineError::Other(format!("{}: {e}", from.display())))?
-            .resolve_label(&self.catalog);
+        let sc = parse_sidecar(&packet, crate::crs::Target::for_photo(p)).map_err(|e| EngineError::Other(format!("{}: {e}", from.display())))?;
+        Ok(Some((self.sidecar_op(id, sc)?, from)))
+    }
+
+    /// The op that applies what a sidecar says (already read and parsed, e.g. on a worker
+    /// thread) to photo `id`: the sidecar wins. No file is read.
+    pub fn sidecar_op(&self, id: PhotoId, sc: SidecarData) -> Result<Op> {
+        let p = self.catalog.photo(id).ok_or(lightcraft_catalog::CatalogError::NoPhoto(id))?;
+        let sc = sc.resolve_label(&self.catalog);
         let mut q = (**p).clone();
         let develop_changed = merge_into(&mut q, &sc, &(self.clock)());
         let mut ops = vec![
@@ -492,7 +513,7 @@ impl Session {
         if develop_changed {
             ops.extend(self.develop_op(id, (*q.develop).clone(), "Read Metadata from File"));
         }
-        Ok(Some((Op::Batch { ops }, from)))
+        Ok(Op::Batch { ops })
     }
 
     /// Auto-write: sidecars for photos changed by `ops` (errors are logged, not returned).
@@ -515,6 +536,19 @@ impl Session {
 
 #[cfg(test)]
 mod tests {
+    /// A sidecar written by Lightroom Classic (names flat, paths in `lr:hierarchicalSubject`)
+    /// gives the photo its keywords as paths.
+    #[test]
+    fn sidecar_keywords_keep_their_hierarchy() {
+        let m = lightcraft_meta::Metadata {
+            keywords: vec!["Lisbon".into(), "Places".into()],
+            hierarchical_keywords: vec!["Places|Lisbon".into()],
+            ..Default::default()
+        };
+        let sc = super::parse_sidecar(&lightcraft_meta::write_xmp(&m, None), crate::crs::Target::Rendered).unwrap();
+        assert_eq!(sc.keywords, Some(vec!["Places|Lisbon".to_string()]));
+    }
+
     use super::*;
     use lightcraft_catalog::Meta;
 
@@ -553,7 +587,7 @@ mod tests {
     fn packet_roundtrip_restores_everything() {
         let p = photo();
         let x = sidecar_packet(&p, &lightcraft_catalog::Catalog::new());
-        let sc = parse_sidecar(&x, false).unwrap();
+        let sc = parse_sidecar(&x, crate::crs::Target::Rendered).unwrap();
         assert_eq!(sc.rating, Some(4));
         assert_eq!(sc.flag, Some(Flag::Pick));
         assert_eq!(sc.label, Some(Some(ColorLabel::Purple)));
@@ -572,7 +606,7 @@ mod tests {
         let x = r#"<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
           <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/"
             xmp:Rating="-1" xmp:Label="Green" crs:Exposure2012="-0.40" crs:Vibrance="+12"/></rdf:RDF></x:xmpmeta>"#;
-        let sc = parse_sidecar(x, true).unwrap();
+        let sc = parse_sidecar(x, crate::crs::Target::RawAbsolute).unwrap();
         assert_eq!((sc.rating, sc.flag, sc.label), (Some(0), Some(Flag::Reject), Some(Some(ColorLabel::Green))));
         let mut p = photo();
         let before = p.develop.clone();
diff --git a/crates/engine/src/sync.rs b/crates/engine/src/sync.rs
new file mode 100644
index 00000000..0a00a59a
--- /dev/null
+++ b/crates/engine/src/sync.rs
@@ -0,0 +1,702 @@
+//! Synchronize Folder: bring a folder of the library up to date with what is on disk, as
+//! Lightroom Classic's Synchronize Folder does.
+//!
+//! A [scan](scan_with) compares the folder (and the folders inside it) with the library and finds
+//! three kinds of change, touching nothing:
+//!
+//! - **new** files: supported files the library doesn't have, by path or by content (the import
+//!   scan's duplicate rules, [`crate::import::scan_with`]);
+//! - **missing** photos: library photos in the folder whose file is gone (the Missing Photos rule,
+//!   [`crate::cmd::missing::checked_path`]);
+//! - **metadata** updates: photos whose XMP sidecar file was saved after the photo came into the
+//!   library or was last edited here, and says something the library doesn't (rating, flag,
+//!   label, metadata, capture time or develop settings). Reading one makes the sidecar win, as
+//!   Read Metadata from File does. Embedded XMP in a raw is not a sidecar and is not looked at.
+//!
+//! [`synchronize`] then imports the new files (in place), relinks the moved photos, moves the
+//! missing photos to Recently Deleted and reads the metadata updates — each only when chosen — as
+//! one undo step. It runs in halves ([`SyncJob`]) so that, in the app, every file it reads is
+//! read on a worker thread and only the catalog changes happen on the UI thread — with what every
+//! command does after them there: the library's durable save and, with XMP auto-write on, the
+//! sidecars of the photos whose metadata was read.
+//!
+//! The scan runs without the session ([`SyncInput`] + [`scan_with`]), so the app can run it on a
+//! worker thread: a folder on a sleeping network share must never stall a frame.
+//!
+//! Limits of telling an update from a sidecar that is merely older:
+//! - a sidecar the library itself wrote (auto-write on) agrees with it and is never an update;
+//! - the library records when a photo came in and when its develop settings last changed, not
+//!   when its rating, flag, label or metadata did: a sidecar another app saved, followed by such
+//!   a change made here (with auto-write off), is listed as an update, and reading it puts the
+//!   older value back. Reading updates is therefore never the default;
+//! - times are compared as the clock the session runs with; headless sessions (CLI, MCP) start
+//!   with a fixed clock, so their own times say little;
+//! - a sidecar is found as Read Metadata from File finds it, including the other naming
+//!   scheme's file (`IMG_1.xmp` for `IMG_1.JPG` beside `IMG_1.CR3`).
+//!
+//! The walk for new files stops at the import's limits on depth and entries (logged), and is
+//! not cancelled midway.
+
+use std::collections::HashMap;
+use std::path::Path;
+use std::sync::Arc;
+
+use lightcraft_catalog::{Catalog, Filter, Op, Photo, PhotoId, Sort, Source};
+use serde::Serialize;
+
+use crate::import::{ImportCandidate, ImportMode, ImportOptions, ScanInput, ScanProgress};
+use crate::media::ProbeInfo;
+use crate::sidecar::SidecarNaming;
+use crate::{EngineError, Result, Session};
+
+/// The largest XMP sidecar read when looking for metadata updates; a bigger one is skipped.
+const MAX_SIDECAR_BYTES: u64 = 16 * 1024 * 1024;
+
+/// How far a scan is: the folder's files probed ([`ScanProgress`], whose `cancel` stops the
+/// whole scan) and the library's photos checked.
+#[derive(Default)]
+pub struct SyncProgress {
+    pub files: ScanProgress,
+    pub checked: std::sync::atomic::AtomicUsize,
+    pub to_check: std::sync::atomic::AtomicUsize,
+}
+
+impl SyncProgress {
+    /// (done, of how many), both halves together.
+    pub fn counts(&self) -> (usize, usize) {
+        use std::sync::atomic::Ordering::Relaxed;
+        let done = self.files.done.load(Relaxed).saturating_add(self.checked.load(Relaxed));
+        (done, self.files.total.load(Relaxed).saturating_add(self.to_check.load(Relaxed)))
+    }
+}
+
+/// What a scan of a folder needs, taken from the session so it can run on a worker thread.
+pub struct SyncInput {
+    folder: String,
+    scan: ScanInput,
+    /// The library's photos in the folder, each with how its sidecar is named.
+    photos: Vec<(Arc<Photo>, SidecarNaming)>,
+    /// For the colour label names a sidecar may use.
+    labels: Catalog,
+}
+
+/// What changed in a folder since it came into the library.
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct FolderChanges {
+    /// The folder, as asked for.
+    pub path: String,
+    /// Files to import.
+    pub new: Vec<ImportCandidate>,
+    /// Files whose content the library already has (under another path).
+    pub duplicates: usize,
+    /// Supported files that couldn't be read.
+    pub unreadable: Vec<ImportCandidate>,
+    /// Photos whose file is gone.
+    pub missing: Vec<FolderPhoto>,
+    /// Photos whose sidecar has news.
+    pub metadata: Vec<FolderPhoto>,
+    /// Photos whose file was renamed or moved within the folder (found by its content).
+    pub moved: Vec<FolderMoved>,
+    /// The folder itself is not there (moved or renamed whole, or on a disk that isn't
+    /// connected): nothing else is reported, rather than every photo as missing.
+    pub offline: bool,
+    /// The probes of the new files, kept for the import that follows.
+    #[serde(skip)]
+    probes: HashMap<String, ProbeInfo>,
+    /// The folder's photos as the scan saw them: the scan is current while they are the same
+    /// records (any change to one replaces it in the catalog).
+    #[serde(skip)]
+    seen: Vec<Arc<Photo>>,
+}
+
+/// A photo of the folder and its file.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub struct FolderPhoto {
+    pub id: u64,
+    pub path: String,
+}
+
+/// A photo whose file is now somewhere else in the folder.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub struct FolderMoved {
+    pub id: u64,
+    pub from: String,
+    pub to: String,
+}
+
+/// What [`synchronize`] does with the changes found.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct SyncChoice {
+    pub import_new: bool,
+    pub relink_moved: bool,
+    pub remove_missing: bool,
+    pub read_metadata: bool,
+}
+
+impl Default for SyncChoice {
+    /// Lightroom Classic's defaults: import the new files, leave the rest to be looked at; and
+    /// photos whose file moved follow it (nothing is lost, and undo puts them back).
+    fn default() -> Self {
+        SyncChoice { import_new: true, relink_moved: true, remove_missing: false, read_metadata: false }
+    }
+}
+
+/// What [`synchronize`] did.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize)]
+pub struct SyncReport {
+    pub imported: usize,
+    pub relinked: usize,
+    pub removed: usize,
+    pub read: usize,
+    /// (path or photo, why) for what couldn't be done.
+    pub failed: Vec<(String, String)>,
+}
+
+fn invalid(msg: impl Into<String>) -> EngineError {
+    EngineError::Other(msg.into())
+}
+
+impl SyncInput {
+    /// The scan of folder `path`: a folder the library holds photos in, not the startup disk. A
+    /// whole disk or share, or a folder that holds disks (`/Volumes`, `/mnt`…), only with `disk`
+    /// (as for Remove Disk from Library: its missing photos can be a whole disk's).
+    pub fn new(s: &mut Session, path: &str, disk: bool) -> Result<SyncInput> {
+        let path = path.trim();
+        if path.is_empty() {
+            return Err(invalid("missing `path`"));
+        }
+        if lightcraft_catalog::folders::is_startup_disk(path) {
+            return Err(invalid("choose a folder, not the whole startup disk"));
+        }
+        let f = Filter { library_folder: Some(path.to_string()), ..Default::default() };
+        let ids = s.catalog.query(&f, &Sort::default());
+        if ids.is_empty() {
+            return Err(invalid(format!("{path}: no photo in the library was imported from it")));
+        }
+        if !disk && (lightcraft_catalog::folders::is_disk_root(path) || crate::cmd::library::covers_other_disks(s, path, &ids)) {
+            return Err(invalid(format!("{path} is a whole disk or holds disks: pass `disk: true` to synchronize it")));
+        }
+        let namings = s.sidecar_namings(&ids);
+        let photos = ids.iter().zip(namings).filter_map(|(id, naming)| s.catalog.photo(*id).map(|p| (Arc::clone(p), naming))).collect();
+        let (scan, _) = ScanInput::new(s, &[path.to_string()]);
+        Ok(SyncInput { folder: path.to_string(), scan, photos, labels: s.catalog.clone() })
+    }
+}
+
+/// Find what changed in the folder (see the module docs). Reads the disk, never the session.
+///
+/// Both halves wait on the disk (a network share answers each file slowly), so they run at once:
+/// the look for new files (which probes them on its own threads) beside the checks of the
+/// library's photos, which run on several threads too. Stops early when `progress.files.cancel`
+/// is set.
+pub fn scan_with(input: SyncInput, progress: &SyncProgress) -> FolderChanges {
+    let SyncInput { folder, scan, photos, labels } = input;
+    let seen: Vec<Arc<Photo>> = photos.iter().map(|(p, _)| Arc::clone(p)).collect();
+    if !cfg!(target_arch = "wasm32") && !Path::new(&folder).is_dir() {
+        return FolderChanges { path: folder, seen, offline: true, ..Default::default() };
+    }
+    // (no threads on the web: one after the other there)
+    #[cfg(target_arch = "wasm32")]
+    let (out, checks) = (crate::import::scan_with(scan, std::slice::from_ref(&folder), &progress.files), check_photos(&photos, &labels, progress));
+    #[cfg(not(target_arch = "wasm32"))]
+    let (out, checks) = std::thread::scope(|sc| {
+        let photos = &photos;
+        let labels = &labels;
+        let checks = sc.spawn(move || check_photos(photos, labels, progress));
+        let out = crate::import::scan_with(scan, std::slice::from_ref(&folder), &progress.files);
+        // (a check that panicked counts as nothing found; the scan still reports the rest)
+        (out, checks.join().unwrap_or_default())
+    });
+    let mut changes = FolderChanges { path: folder, seen, ..Default::default() };
+    for ((p, _), check) in photos.iter().zip(checks) {
+        let Some(file) = crate::cmd::missing::checked_path(p) else { continue };
+        let found = FolderPhoto { id: p.id.0, path: file.to_string() };
+        match check {
+            Check::Missing => changes.missing.push(found),
+            Check::News => changes.metadata.push(found),
+            Check::Nothing => {}
+        }
+    }
+    let moved_from = match_moved(&changes.missing, &out.candidates, &out.probes, &labels);
+    for c in out.candidates {
+        if moved_from.values().any(|to| *to == c.path) {
+            continue;
+        }
+        let browsed = c.existing.and_then(|id| labels.photo(PhotoId(id))).is_some_and(|p| p.local && !p.deleted);
+        match (c.duplicate.as_deref(), &c.error) {
+            // a file only looked at in Local is not in the library yet: it is new
+            (Some("path"), _) if browsed => changes.new.push(ImportCandidate { duplicate: None, existing: None, ..c }),
+            (Some("path"), _) => {}
+            (Some(_), _) => changes.duplicates += 1,
+            (None, Some(_)) => changes.unreadable.push(c),
+            (None, None) => changes.new.push(c),
+        }
+    }
+    let missing = std::mem::take(&mut changes.missing);
+    for m in missing {
+        match moved_from.get(&m.path) {
+            Some(to) => changes.moved.push(FolderMoved { id: m.id, from: m.path, to: to.clone() }),
+            None => changes.missing.push(m),
+        }
+    }
+    changes.probes = out.probes;
+    changes
+}
+
+/// Whether a photo is the same as far as synchronizing goes: its file, its place in the library
+/// and what a sidecar is compared with. Face and pet regions found in the background meanwhile
+/// don't make a scan stale.
+fn same_for_sync(a: &Arc<Photo>, b: &Arc<Photo>) -> bool {
+    if Arc::ptr_eq(a, b) {
+        return true;
+    }
+    let meta = |p: &Photo| lightcraft_catalog::Meta { regions: Vec::new(), ..p.meta.clone() };
+    (&a.source, a.deleted, a.local, a.copy_of, &a.content_hash, a.file_size, a.rating, a.flag, a.label, &a.captured, &a.edited, &a.develop)
+        == (&b.source, b.deleted, b.local, b.copy_of, &b.content_hash, b.file_size, b.rating, b.flag, b.label, &b.captured, &b.edited, &b.develop)
+        && meta(a) == meta(b)
+}
+
+/// The content a hash stands for: a Duplicate's own hash is the original's plus `:dup<id>`.
+fn base_hash(h: &str) -> &str {
+    h.split(':').next().unwrap_or(h)
+}
+
+/// Missing photos' files found elsewhere in the folder (old path → new path): the file was
+/// renamed or moved, and the photo (with its edits) follows it rather than going missing.
+///
+/// By content first: each missing file's hash claims one file with that content (two missing
+/// files with the same content claim two). A photo with no hash on record (taken over from a
+/// Lightroom catalog) is matched by file size and dimensions, and only when exactly one missing
+/// file and exactly one unclaimed file of the folder agree on them.
+fn match_moved(
+    missing: &[FolderPhoto],
+    candidates: &[ImportCandidate],
+    probes: &HashMap<String, ProbeInfo>,
+    labels: &Catalog,
+) -> HashMap<String, String> {
+    // distinct missing files (a photo's virtual copies share its file), with what is known of them
+    let mut files: Vec<(&str, Option<&Photo>)> = Vec::new();
+    for m in missing {
+        if !files.iter().any(|(p, _)| *p == m.path) {
+            files.push((m.path.as_str(), labels.photo(PhotoId(m.id)).map(|p| &**p)));
+        }
+    }
+    let mut by_hash: HashMap<&str, std::collections::VecDeque<&str>> = HashMap::new();
+    for (path, p) in &files {
+        if let Some(h) = p.and_then(|p| p.content_hash.as_deref()) {
+            by_hash.entry(base_hash(h)).or_default().push_back(path);
+        }
+    }
+    let usable = |c: &&ImportCandidate| c.error.is_none() && c.duplicate.as_deref() != Some("path");
+    let mut moved: HashMap<String, String> = HashMap::new();
+    for c in candidates.iter().filter(usable) {
+        let hash = probes.get(&c.path).and_then(|i| i.content_hash.as_deref());
+        if let Some(from) = hash.and_then(|h| by_hash.get_mut(base_hash(h))).and_then(std::collections::VecDeque::pop_front) {
+            moved.insert(from.to_string(), c.path.clone());
+        }
+    }
+    let key = |size: u64, w: u32, h: u32| (size > 0 && w > 0 && h > 0).then_some((size, w, h));
+    let mut hashless: HashMap<(u64, u32, u32), Vec<&str>> = HashMap::new();
+    for (path, p) in &files {
+        if let Some(p) = p.filter(|p| p.content_hash.is_none())
+            && let Some(k) = key(p.file_size, p.width, p.height)
+        {
+            hashless.entry(k).or_default().push(path);
+        }
+    }
+    let mut found: HashMap<(u64, u32, u32), Vec<&str>> = HashMap::new();
+    for c in candidates.iter().filter(usable).filter(|c| !moved.values().any(|to| *to == c.path)) {
+        if let Some(k) = key(c.file_size, c.width, c.height) {
+            found.entry(k).or_default().push(c.path.as_str());
+        }
+    }
+    for (k, from) in hashless {
+        if let ([from], Some([to])) = (from.as_slice(), found.get(&k).map(Vec::as_slice)) {
+            moved.insert(from.to_string(), to.to_string());
+        }
+    }
+    moved
+}
+
+/// What checking one photo of the folder found.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+enum Check {
+    #[default]
+    Nothing,
+    Missing,
+    News,
+}
+
+fn check_photo(p: &Photo, naming: SidecarNaming, labels: &Catalog) -> Check {
+    let Some(file) = crate::cmd::missing::checked_path(p) else { return Check::Nothing };
+    if !Path::new(file).exists() {
+        Check::Missing
+    } else if p.copy_of.is_none() && sidecar_has_news(labels, p, naming) {
+        Check::News
+    } else {
+        Check::Nothing
+    }
+}
+
+/// [`check_photo`] for each photo, in order, on several threads (each file is a wait on the
+/// disk, not work for the CPU). Photos not reached before a cancel count as nothing found.
+fn check_photos(photos: &[(Arc<Photo>, SidecarNaming)], labels: &Catalog, progress: &SyncProgress) -> Vec<Check> {
+    use std::sync::atomic::Ordering::Relaxed;
+    progress.to_check.store(photos.len(), Relaxed);
+    let cancel = &progress.files.cancel;
+    let check = |p: &Photo, naming: SidecarNaming| {
+        let c = check_photo(p, naming, labels);
+        progress.checked.fetch_add(1, Relaxed);
+        c
+    };
+    if cfg!(target_arch = "wasm32") {
+        return vec![Check::Nothing; photos.len()];
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let n = crate::import::workers(photos.len());
+        if n > 1 {
+            let next = std::sync::atomic::AtomicUsize::new(0);
+            let found = std::sync::Mutex::new(vec![Check::Nothing; photos.len()]);
+            std::thread::scope(|sc| {
+                for _ in 0..n {
+                    sc.spawn(|| {
+                        while !cancel.load(Relaxed) {
+                            let i = next.fetch_add(1, Relaxed);
+                            let Some((p, naming)) = photos.get(i) else { break };
+                            let c = check(p, *naming);
+                            if let Some(slot) = found.lock().unwrap_or_else(std::sync::PoisonError::into_inner).get_mut(i) {
+                                *slot = c;
+                            }
+                        }
+                    });
+                }
+            });
+            return found.into_inner().unwrap_or_else(std::sync::PoisonError::into_inner);
+        }
+    }
+    photos.iter().map(|(p, naming)| if cancel.load(Relaxed) { Check::Nothing } else { check(p, *naming) }).collect()
+}
+
+/// [`scan_with`] on the calling thread.
+pub fn scan(s: &mut Session, path: &str, disk: bool) -> Result<FolderChanges> {
+    let input = SyncInput::new(s, path, disk)?;
+    let changes = scan_with(input, &SyncProgress::default());
+    if changes.offline {
+        return Err(not_there(&changes.path));
+    }
+    Ok(changes)
+}
+
+fn not_there(path: &str) -> EngineError {
+    invalid(format!("{path} is not there (moved, renamed, or on a disk that isn't connected)"))
+}
+
+impl Session {
+    /// The last scan ([`Session::folder_changes`]) if it is of folder `path` and still current:
+    /// the folder holds the same photos, none of them changed. What the person was shown is what
+    /// gets done. Used once. (Changes elsewhere in the library don't matter.)
+    pub fn take_folder_changes(&mut self, path: &str) -> Option<FolderChanges> {
+        let c = self.folder_changes.take()?;
+        if lightcraft_catalog::query::folder_key(&c.path) != lightcraft_catalog::query::folder_key(path) {
+            return None;
+        }
+        let f = Filter { library_folder: Some(path.to_string()), ..Default::default() };
+        let mut now: Vec<PhotoId> = self.catalog.query(&f, &Sort::default());
+        let mut then: Vec<PhotoId> = c.seen.iter().map(|p| p.id).collect();
+        now.sort();
+        then.sort();
+        let unchanged = now == then && c.seen.iter().all(|p| self.catalog.photo(p.id).is_some_and(|q| same_for_sync(p, q)));
+        unchanged.then_some(c)
+    }
+}
+
+/// Whether `p`'s XMP sidecar file was saved after the library last had its say about the photo
+/// (imported, or edited here) and says something the library doesn't.
+fn sidecar_has_news(labels: &Catalog, p: &Photo, naming: SidecarNaming) -> bool {
+    let Source::File { path } = &p.source else { return false };
+    let Some(file) = crate::sidecar::find_sidecar(path, naming) else { return false };
+    let Ok(meta) = std::fs::metadata(&file) else { return false };
+    if meta.len() > MAX_SIDECAR_BYTES {
+        return false;
+    }
+    let saved = meta.modified().ok().and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok()).map(|d| d.as_secs());
+    let Some(saved) = saved.and_then(|s| i64::try_from(s).ok()) else { return false };
+    let seen = [Some(p.imported.as_str()), p.edited.as_deref()].into_iter().flatten().filter_map(lightcraft_catalog::stacks::iso_seconds).max();
+    if seen.is_some_and(|t| saved <= t) {
+        return false;
+    }
+    let Ok(text) = std::fs::read_to_string(&file) else { return false };
+    let Ok(sc) = crate::sidecar::parse_sidecar(&text, crate::crs::Target::for_photo(p)) else { return false };
+    let sc = sc.resolve_label(labels);
+    let mut q = p.clone();
+    crate::sidecar::merge_into(&mut q, &sc, "");
+    (q.rating, q.flag, q.label, &q.meta, &q.captured, &q.develop) != (p.rating, p.flag, p.label, &p.meta, &p.captured, &p.develop)
+}
+
+/// Act on `changes` as `choice` says, as one undo step ("Synchronize Folder"). A missing photo
+/// whose file is back by now is left alone. Once the import is in, a part that fails is
+/// reported in `failed` and the rest is still done (and still one step).
+pub fn synchronize(s: &mut Session, changes: FolderChanges, choice: SyncChoice) -> Result<SyncReport> {
+    let (work, mut commit) = SyncJob::start(s, changes, choice)?;
+    let mut steps = Vec::new();
+    work.run(&SyncProgress::default(), |step| {
+        steps.push(step);
+        true
+    });
+    for step in steps {
+        commit.apply(s, step);
+    }
+    Ok(commit.finish(s))
+}
+
+/// Synchronizing in halves, so no file is touched on the UI thread: [`SyncJob::start`] takes what
+/// it needs from the session (no file-system call); the [`SyncWork`] does every file read (the
+/// import's probes, whether files are still where the scan found them, the sidecars) and hands
+/// over [`SyncStep`]s — on a worker thread in the app; [`SyncCommit::apply`] puts each into the
+/// catalog and [`SyncCommit::finish`] makes them one undo step.
+pub struct SyncJob;
+
+/// The file-system half of a synchronize (see [`SyncJob`]).
+pub struct SyncWork {
+    /// The import of the new files, and the files.
+    import: Option<(crate::import::ImportJob, Vec<String>)>,
+    moved: Vec<FolderMoved>,
+    missing: Vec<FolderPhoto>,
+    /// (photo, its file, how its sidecar is named)
+    sidecars: Vec<(PhotoId, String, SidecarNaming, crate::crs::Target)>,
+}
+
+/// The catalog half of a synchronize (see [`SyncJob`]).
+pub struct SyncCommit {
+    opts: ImportOptions,
+    now: String,
+    /// The library the run was readied for: steps never land in another one (File › Open
+    /// Library while the work runs), whose photo ids name other photos.
+    library: Arc<()>,
+    /// The run's own undo steps so far, and the history's length after the last of them: they
+    /// are merged only while nothing else came in between (an Undo or an edit made meanwhile
+    /// stays its own step, and the run's parts stay theirs).
+    own: usize,
+    after_last: Option<usize>,
+    interleaved: bool,
+    report: SyncReport,
+}
+
+/// A piece of work done, for [`SyncCommit::apply`].
+pub enum SyncStep {
+    /// A batch of new files, readied for the catalog.
+    Import(crate::import::Prepared),
+    /// Moved photos whose file is still at its new place (photo, new path).
+    Relink(Vec<(PhotoId, String)>),
+    /// Missing photos whose file is still gone.
+    Remove(Vec<PhotoId>),
+    /// Sidecars read (photo, its file, what the sidecar says or why it couldn't be read).
+    Sidecars(Vec<(PhotoId, String, std::result::Result<crate::sidecar::SidecarData, String>)>),
+}
+
+impl SyncJob {
+    /// Ready a synchronize of `changes` as `choice` says. Reads no file.
+    pub fn start(s: &mut Session, changes: FolderChanges, choice: SyncChoice) -> Result<(SyncWork, SyncCommit)> {
+        if changes.offline {
+            return Err(not_there(&changes.path));
+        }
+        let FolderChanges { new, missing, metadata, moved, probes, .. } = changes;
+        let opts = ImportOptions { mode: ImportMode::Add, ..Default::default() };
+        let import = if choice.import_new && !new.is_empty() {
+            s.import_probes = probes;
+            let job = crate::import::ImportJob::new(s, opts.clone())?;
+            Some((job, new.into_iter().map(|c| c.path).collect()))
+        } else {
+            None
+        };
+        let now = import.as_ref().map_or_else(|| (s.clock)(), |(j, _)| j.now().to_string());
+        let sidecars = if choice.read_metadata {
+            let namings = s.sidecar_namings(&metadata.iter().map(|m| PhotoId(m.id)).collect::<Vec<_>>());
+            metadata
+                .into_iter()
+                .zip(namings)
+                .filter_map(|(m, naming)| {
+                    let p = s.catalog.photo(PhotoId(m.id))?;
+                    Some((p.id, m.path, naming, crate::crs::Target::for_photo(p)))
+                })
+                .collect()
+        } else {
+            Vec::new()
+        };
+        let work = SyncWork {
+            import,
+            moved: if choice.relink_moved { moved } else { Vec::new() },
+            missing: if choice.remove_missing { missing } else { Vec::new() },
+            sidecars,
+        };
+        let commit = SyncCommit {
+            opts,
+            now,
+            library: Arc::clone(&s.library_identity),
+            own: 0,
+            after_last: None,
+            interleaved: false,
+            report: SyncReport::default(),
+        };
+        Ok((work, commit))
+    }
+}
+
+impl SyncWork {
+    /// Do the work, handing each step to `send` (`false`: nobody takes them any more — stop).
+    /// Stops before the next piece once `progress.files.cancel` is set; what was handed over
+    /// stays handed over.
+    pub fn run(self, progress: &SyncProgress, mut send: impl FnMut(SyncStep) -> bool) {
+        use std::sync::atomic::Ordering::Relaxed;
+        let cancel = &progress.files.cancel;
+        let SyncWork { import, moved, missing, sidecars } = self;
+        let pieces = import.as_ref().map_or(0, |(_, f)| f.len()) + moved.len() + missing.len() + sidecars.len();
+        progress.to_check.store(pieces, Relaxed);
+        progress.checked.store(0, Relaxed);
+        let step = |n: usize| {
+            progress.checked.fetch_add(n, Relaxed);
+        };
+        if let Some((mut job, files)) = import {
+            for chunk in files.chunks(crate::import::batch_size()) {
+                if cancel.load(Relaxed) {
+                    return;
+                }
+                let prepared = job.prepare_files(chunk.to_vec(), cancel);
+                step(chunk.len());
+                // (the files are added in place: a batch nobody takes leaves nothing behind on disk)
+                if !send(SyncStep::Import(prepared)) {
+                    return;
+                }
+            }
+        }
+        if cancel.load(Relaxed) {
+            return;
+        }
+        // still where the scan found it, and still gone from where the photo says
+        let checked = moved.len();
+        let relink: Vec<(PhotoId, String)> =
+            moved.into_iter().filter(|m| Path::new(&m.to).is_file() && !Path::new(&m.from).exists()).map(|m| (PhotoId(m.id), m.to)).collect();
+        step(checked);
+        if !relink.is_empty() && !send(SyncStep::Relink(relink)) {
+            return;
+        }
+        if cancel.load(Relaxed) {
+            return;
+        }
+        let gone: Vec<PhotoId> = missing.iter().filter(|m| !Path::new(&m.path).exists()).map(|m| PhotoId(m.id)).collect();
+        step(missing.len());
+        if !gone.is_empty() && !send(SyncStep::Remove(gone)) {
+            return;
+        }
+        let mut read = Vec::with_capacity(sidecars.len());
+        for (id, path, naming, target) in sidecars {
+            if cancel.load(Relaxed) {
+                break;
+            }
+            read.push((id, path.clone(), read_sidecar(&path, naming, target)));
+            step(1);
+        }
+        if !read.is_empty() {
+            send(SyncStep::Sidecars(read));
+        }
+    }
+}
+
+/// Read and parse photo file `path`'s XMP sidecar file.
+fn read_sidecar(path: &str, naming: SidecarNaming, target: crate::crs::Target) -> std::result::Result<crate::sidecar::SidecarData, String> {
+    let file = crate::sidecar::find_sidecar(path, naming).ok_or_else(|| "no XMP sidecar".to_string())?;
+    let len = std::fs::metadata(&file).map_err(|e| format!("{}: {e}", file.display()))?.len();
+    if len > MAX_SIDECAR_BYTES {
+        return Err(format!("{}: too large for an XMP sidecar", file.display()));
+    }
+    let text = std::fs::read_to_string(&file).map_err(|e| format!("{}: {e}", file.display()))?;
+    crate::sidecar::parse_sidecar(&text, target).map_err(|e| format!("{}: {e}", file.display()))
+}
+
+impl SyncCommit {
+    /// Put a step into the catalog (no file is touched). A part that fails is reported in the
+    /// end, and the rest is still done.
+    pub fn apply(&mut self, s: &mut Session, step: SyncStep) {
+        if !Arc::ptr_eq(&self.library, &s.library_identity) {
+            self.report.failed.push((String::new(), "another library was opened: the rest of the synchronize was dropped".into()));
+            return;
+        }
+        let commits = s.commits();
+        if self.after_last.is_some_and(|n| n != s.undo.len()) {
+            self.interleaved = true;
+        }
+        self.apply_step(s, step);
+        if s.commits() != commits {
+            self.own += usize::try_from(s.commits().wrapping_sub(commits)).unwrap_or(0);
+            self.after_last = Some(s.undo.len());
+        }
+    }
+
+    fn apply_step(&mut self, s: &mut Session, step: SyncStep) {
+        let report = &mut self.report;
+        match step {
+            SyncStep::Import(prepared) => match crate::import::commit_prepared(s, &self.opts, &self.now, prepared) {
+                Ok(r) => {
+                    report.imported += r.imported.len();
+                    report.failed.extend(r.failed);
+                }
+                Err(e) => report.failed.push((String::new(), e.to_string())),
+            },
+            SyncStep::Relink(moved) => {
+                let ops: Vec<Op> =
+                    moved.iter().filter(|(id, _)| s.catalog.photo(*id).is_some()).map(|(id, to)| crate::cmd::missing::relink_op(*id, to)).collect();
+                let n = ops.len();
+                if n > 0 {
+                    match s.commit("Relink Moved Photos", Op::Batch { ops }) {
+                        Ok(()) => report.relinked += n,
+                        Err(e) => report.failed.push((String::new(), e.to_string())),
+                    }
+                }
+            }
+            SyncStep::Remove(gone) => {
+                let ops: Vec<Op> = gone
+                    .iter()
+                    .filter(|id| s.catalog.photo(**id).is_some_and(|p| p.in_library()))
+                    .map(|id| Op::SetDeleted { id: *id, deleted: true })
+                    .collect();
+                let n = ops.len();
+                if n > 0 {
+                    match s.commit("Remove Missing Photos", Op::Batch { ops }) {
+                        Ok(()) => report.removed += n,
+                        Err(e) => report.failed.push((String::new(), e.to_string())),
+                    }
+                }
+            }
+            SyncStep::Sidecars(read) => {
+                let mut ops = Vec::new();
+                for (id, path, sc) in read {
+                    match sc.map_err(EngineError::Other).and_then(|sc| s.sidecar_op(id, sc)) {
+                        Ok(op) => ops.push(op),
+                        Err(e) => report.failed.push((path, e.to_string())),
+                    }
+                }
+                let n = ops.len();
+                if n > 0 {
+                    match s.commit("Read Metadata from File", Op::Batch { ops }) {
+                        Ok(()) => report.read += n,
+                        Err(e) => report.failed.push((String::new(), e.to_string())),
+                    }
+                }
+            }
+        }
+    }
+
+    /// What was done, as one undo step ("Synchronize Folder").
+    pub fn finish(mut self, s: &mut Session) -> SyncReport {
+        // a report line once, however many steps came after a library switch
+        self.report.failed.dedup();
+        let ours = Arc::ptr_eq(&self.library, &s.library_identity) && !self.interleaved && self.after_last == Some(s.undo.len());
+        let steps = if ours { self.own.min(s.undo.len()) } else { 0 };
+        s.merge_undo(steps, "Synchronize Folder");
+        if let Some(last) = s.undo.last_mut().filter(|_| steps == 1) {
+            last.label = "Synchronize Folder".into();
+        }
+        self.report
+    }
+}
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 9806a81e..7b0f6cae 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1,6 +1,6 @@
 use serde_json::{Value, json};
 
-use crate::{Session, command_specs};
+use crate::{Selection, Session, command_specs};
 
 fn demo() -> Session {
     Session::with_demo()
@@ -14,7 +14,7 @@ fn active_dev(s: &Session) -> lightcraft_develop::DevelopSettings {
 fn changing_one_wb_control_resolves_as_shot_without_stale_tint() {
     use lightcraft_catalog::{Photo, PhotoId, Source};
     use lightcraft_develop::{DevelopSettings, WbMode};
-    for format in ["ARW", "NEF", "NRW", "RAF", "CR2", "PEF"] {
+    for format in ["ARW", "NEF", "NRW", "RAF", "CR2", "PEF", "ORF"] {
         let mut s = demo();
         let id = PhotoId(100);
         let name = format!("synthetic.{format}");
@@ -113,9 +113,10 @@ fn albums_crud() {
     s.execute("library.selectAll", &json!({})).unwrap();
     s.execute("album.addPhotos", &json!({"id": a})).unwrap();
     assert_eq!(s.catalog.album(lightcraft_catalog::AlbumId(a)).unwrap().photos.len(), 24);
-    assert!(s.execute("album.delete", &json!({"id": f})).is_err(), "non-empty folder");
-    s.execute("album.delete", &json!({"id": a})).unwrap();
     s.execute("album.delete", &json!({"id": f})).unwrap();
+    assert!(s.catalog.album(lightcraft_catalog::AlbumId(a)).is_none());
+    assert!(s.catalog.album(lightcraft_catalog::AlbumId(f)).is_none());
+    assert_eq!(s.catalog.photos().count(), 24, "album deletion keeps the photos");
 }
 
 /// Given an album and a folder, when something is created inside each, then only the folder
@@ -157,6 +158,101 @@ fn filters_and_delete_restore() {
     assert_eq!(s.visible().len(), 24);
 }
 
+#[test]
+fn deleting_photos_selects_a_neighbour_in_the_current_view() {
+    for params in [json!({}), json!({"key": "fileName", "ascending": false}), json!({"key": "random", "seed": 123})] {
+        for at_end in [false, true] {
+            let mut s = demo();
+            s.execute("library.sort", &params).unwrap();
+            s.execute("library.filter", &json!({"rating": 2})).unwrap();
+            let visible = s.visible_cloned();
+            assert!(visible.len() > 5);
+            let at = if at_end { visible.len() - 2 } else { visible.len() / 2 };
+            let deleted = &visible[at..at + 2];
+            s.execute("library.select", &json!({"ids": deleted, "active": deleted[0]})).unwrap();
+            s.execute("photo.delete", &json!({})).unwrap();
+            let expected = if at_end { visible[at - 1] } else { visible[at + 2] };
+            assert_eq!(s.selection, Selection::single(expected), "sort {params}, end {at_end}");
+            assert!(deleted.iter().all(|id| s.catalog.photo(*id).unwrap().deleted));
+            s.execute("edit.undo", &json!({})).unwrap();
+            assert!(deleted.iter().all(|id| !s.catalog.photo(*id).unwrap().deleted));
+            s.execute("edit.redo", &json!({})).unwrap();
+            assert!(deleted.iter().all(|id| s.catalog.photo(*id).unwrap().deleted));
+        }
+    }
+    let mut s = demo();
+    s.execute("library.selectAll", &json!({})).unwrap();
+    s.execute("photo.delete", &json!({})).unwrap();
+    assert!(s.visible().is_empty());
+    assert_eq!(s.selection, Selection::default());
+}
+
+#[test]
+fn deleting_explicit_targets_keeps_the_surviving_selection() {
+    let mut s = demo();
+    let visible = s.visible_cloned();
+    s.execute("library.select", &json!({"ids": [visible[8], visible[9]], "active": visible[9]})).unwrap();
+    let before = s.selection.clone();
+    s.execute("photo.delete", &json!({"ids": [visible[3]]})).unwrap();
+    assert_eq!(s.selection, before, "deleting an unselected photo doesn't change selection");
+    s.execute("photo.delete", &json!({"ids": [visible[9]]})).unwrap();
+    assert_eq!(s.selection, Selection::single(visible[8]), "partial deletion retains a selected survivor");
+}
+
+#[test]
+fn permanently_deleting_photos_selects_a_neighbour_in_recently_deleted() {
+    for params in [json!({}), json!({"key": "fileName", "ascending": false}), json!({"key": "random", "seed": 123})] {
+        for at_end in [false, true] {
+            let mut s = demo();
+            s.execute("library.selectAll", &json!({})).unwrap();
+            s.execute("photo.delete", &json!({})).unwrap();
+            s.execute("library.source", &json!({"kind": "recentlyDeleted"})).unwrap();
+            s.execute("library.sort", &params).unwrap();
+            s.execute("library.filter", &json!({"rating": 2})).unwrap();
+            let visible = s.visible_cloned();
+            assert!(visible.len() > 5);
+            let at = if at_end { visible.len() - 2 } else { visible.len() / 2 };
+            let deleted = &visible[at..at + 2];
+            s.execute("library.select", &json!({"ids": deleted, "active": deleted[0]})).unwrap();
+            let snapshot = s.catalog.to_snapshot();
+            let undo_len = s.undo.len();
+            let r = s.execute("photo.deletePermanently", &json!({})).unwrap();
+            assert_eq!(r["deleted"], 2);
+            let expected = if at_end { visible[at - 1] } else { visible[at + 2] };
+            assert_eq!(s.selection, Selection::single(expected), "sort {params}, end {at_end}");
+            assert!(deleted.iter().all(|id| s.catalog.photo(*id).is_none()));
+            assert_eq!(s.undo.len(), undo_len + 1);
+            let removed = s.catalog.to_snapshot();
+            s.execute("edit.undo", &json!({})).unwrap();
+            assert_eq!(s.catalog.to_snapshot(), snapshot);
+            s.execute("edit.redo", &json!({})).unwrap();
+            assert_eq!(s.catalog.to_snapshot(), removed);
+        }
+    }
+    let mut s = demo();
+    s.execute("library.selectAll", &json!({})).unwrap();
+    s.execute("photo.deletePermanently", &json!({})).unwrap();
+    assert!(s.visible().is_empty());
+    assert_eq!(s.selection, Selection::default());
+}
+
+#[test]
+fn permanently_deleting_explicit_targets_keeps_the_surviving_selection() {
+    let mut s = demo();
+    let visible = s.visible_cloned();
+    s.execute("library.select", &json!({"ids": [visible[8], visible[9]], "active": visible[9]})).unwrap();
+    let before = s.selection.clone();
+    s.execute("photo.deletePermanently", &json!({"ids": [visible[3]]})).unwrap();
+    assert_eq!(s.selection, before, "deleting an unselected photo doesn't change selection");
+    s.execute("photo.deletePermanently", &json!({"ids": [visible[9]]})).unwrap();
+    assert_eq!(s.selection, Selection::single(visible[8]), "partial deletion retains a selected survivor");
+    let before = s.selection.clone();
+    let snapshot = s.catalog.to_snapshot();
+    assert!(s.execute("photo.deletePermanently", &json!({"ids": [999_999]})).is_err());
+    assert_eq!(s.selection, before, "a refused deletion doesn't change selection");
+    assert_eq!(s.catalog.to_snapshot(), snapshot);
+}
+
 #[test]
 fn masks_crop_and_render() {
     let mut s = demo();
diff --git a/crates/engine/src/tests_export.rs b/crates/engine/src/tests_export.rs
index faba3e3c..b8636c01 100644
--- a/crates/engine/src/tests_export.rs
+++ b/crates/engine/src/tests_export.rs
@@ -370,3 +370,73 @@ fn exports_are_atomic_without_a_sync() {
     assert!(syncs_on_this_thread() > before, "the durable writer syncs");
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// The demo library's ocean sunset (a sun far above SDR white), selected and active.
+fn sunset(s: &mut Session) -> lightcraft_catalog::PhotoId {
+    let id = s.catalog.photos().find(|p| p.meta.title == "Golden horizon").map(|p| p.id).unwrap();
+    s.execute("library.select", &json!({"ids": [id.0]})).unwrap();
+    id
+}
+
+#[test]
+fn hdr_jpeg_export_writes_a_gain_map_and_sdr_edits_stay_plain() {
+    use lightcraft_codecs::gainmap;
+    let mut s = Session::with_demo();
+    let id = sunset(&mut s);
+    let o = ExportOptions::from_json(&json!({"longEdge": 320, "hdr": true}));
+    assert!(o.hdr_output());
+    // no HDR edit: an ordinary JPEG even with HDR output asked for
+    let plain = export_photo(&mut s, id, &o, 1).unwrap();
+    assert!(!gainmap::is_gain_map_jpeg(&plain.bytes));
+
+    let r = s.execute("develop.hdr", &json!({"enabled": true, "maxEv": 3})).unwrap();
+    assert_eq!(r["enabled"], true);
+    let e = export_photo(&mut s, id, &o, 1).unwrap();
+    assert!(gainmap::is_gain_map_jpeg(&e.bytes));
+    let gm = gainmap::read_jpeg(&e.bytes).unwrap();
+    assert!(gm.meta.alternate_headroom > 0.5 && gm.meta.alternate_headroom <= 3.05, "headroom {}", gm.meta.alternate_headroom);
+    // the base is the SDR rendition: the same pixels as the SDR export (the decoders agree)
+    let a = lightcraft_codecs::decode(&e.bytes, Default::default()).unwrap();
+    let b = lightcraft_codecs::decode(&plain.bytes, Default::default()).unwrap();
+    assert_eq!((a.width, a.height), (b.width, b.height));
+    let diff = a.image.data.iter().zip(&b.image.data).map(|(p, q)| (p[1] - q[1]).abs()).fold(0.0f32, f32::max);
+    assert!(diff < 0.02, "base differs from the SDR export by {diff}");
+    // HDR off again: the gain map goes away
+    s.execute("develop.hdr", &json!({"enabled": false})).unwrap();
+    assert!(!gainmap::is_gain_map_jpeg(&export_photo(&mut s, id, &o, 1).unwrap().bytes));
+}
+
+#[test]
+fn hdr_float_tiff_keeps_highlights_above_white() {
+    let mut s = Session::with_demo();
+    let id = sunset(&mut s);
+    s.execute("develop.hdr", &json!({"enabled": true, "maxEv": 2})).unwrap();
+    let max_of = |s: &mut Session, hdr: bool| {
+        let o = ExportOptions::from_json(&json!({"longEdge": 240, "format": "tiff", "bitDepth": 32, "hdr": hdr}));
+        let e = export_photo(s, id, &o, 1).unwrap();
+        let d = lightcraft_codecs::decode(&e.bytes, Default::default()).unwrap();
+        d.image.data.iter().flat_map(|p| p.iter().copied()).fold(0.0f32, f32::max)
+    };
+    let hdr = max_of(&mut s, true);
+    let sdr = max_of(&mut s, false);
+    assert!(sdr <= 1.0 + 1e-3, "SDR float TIFF stays in 0..1 ({sdr})");
+    assert!(hdr > 1.2 && hdr <= 4.0 + 1e-3, "HDR float TIFF max {hdr}");
+}
+
+#[test]
+fn hdr_avif_export_is_pq_rec2020() {
+    let mut s = Session::with_demo();
+    let id = sunset(&mut s);
+    let o = ExportOptions::from_json(&json!({"longEdge": 160, "format": "avif", "hdr": true, "quality": 70}));
+    assert!(o.hdr_output());
+    let sdr = export_photo(&mut s, id, &o, 1).unwrap();
+    s.execute("develop.hdr", &json!({"enabled": true, "maxEv": 2})).unwrap();
+    let hdr = export_photo(&mut s, id, &o, 1).unwrap();
+    // the `colr` nclx box: BT.2020 primaries (9), PQ (16), BT.2020 NCL (9), full range
+    let nclx = |b: &[u8]| b.windows(4).position(|w| w == b"nclx").map(|i| b[i + 4..i + 11].to_vec());
+    let c = nclx(&hdr.bytes).expect("colr nclx box");
+    assert_eq!(c, vec![0, 9, 0, 16, 0, 9, 0x80]);
+    assert!(hdr.bytes.windows(4).any(|w| w == b"clli"), "content light level box");
+    // a photo without an HDR edit exports as an ordinary (sRGB) AVIF
+    assert!(nclx(&sdr.bytes).is_none_or(|c| c[3] != 16));
+}
diff --git a/crates/engine/src/tests_folders.rs b/crates/engine/src/tests_folders.rs
index a9492137..9f51ab40 100644
--- a/crates/engine/src/tests_folders.rs
+++ b/crates/engine/src/tests_folders.rs
@@ -8,6 +8,11 @@
 //! * Removing a folder from the library moves its photos to Recently Deleted (one undo step) and
 //!   leaves every file where it is.
 //! * Renaming or moving a folder on disk keeps the chosen folder chosen.
+//! * Given a folder of the library, an agent gives it a colour label with `folder.label`; the
+//!   folder list shows it, undo takes it back, and only folders the library holds photos in can
+//!   be labelled.
+//! * A labelled folder keeps its label when it is renamed or moved on disk, and so do the folders
+//!   inside it; undo puts the labels back where they were.
 
 use lightcraft_catalog::{Op, Photo, Source};
 use serde_json::json;
@@ -463,3 +468,99 @@ fn a_blank_folder_filter_is_no_filter() {
     s.execute("library.filter", &json!({"libraryFolder": "  "})).unwrap();
     assert_eq!(s.filter, lightcraft_catalog::Filter::default(), "no hidden 'filters active' state");
 }
+
+/// The label `library.folders` reports for the row at `path`.
+fn listed_label(s: &mut Session, path: &str) -> Option<String> {
+    fn find(rows: &serde_json::Value, key: &str) -> Option<serde_json::Value> {
+        rows.as_array()?.iter().find_map(|r| {
+            if r["path"].as_str().map(lightcraft_catalog::query::folder_key).as_deref() == Some(key) {
+                Some(r.clone())
+            } else {
+                find(&r["children"], key)
+            }
+        })
+    }
+    let rows = s.execute("library.folders", &json!({})).unwrap();
+    let row = find(&rows, &lightcraft_catalog::query::folder_key(path)).unwrap_or_else(|| panic!("no row for {path}: {rows}"));
+    row["label"].as_str().map(str::to_string)
+}
+
+#[test]
+fn a_labelled_folder_shows_its_label_in_the_folder_list_until_undone() {
+    let mut s = session();
+    s.execute("folder.label", &json!({"path": "/pics/trip", "label": "green"})).unwrap();
+    assert_eq!(listed_label(&mut s, "/pics/trip").as_deref(), Some("green"));
+    assert_eq!(listed_label(&mut s, "/pics/home"), None, "its neighbour has none");
+    s.execute("folder.label", &json!({"path": "/pics/trip", "label": "none"})).unwrap();
+    assert_eq!(listed_label(&mut s, "/pics/trip"), None);
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(listed_label(&mut s, "/pics/trip").as_deref(), Some("green"), "undo puts the label back");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(listed_label(&mut s, "/pics/trip"), None);
+}
+
+#[test]
+fn only_a_folder_of_the_library_takes_a_known_label() {
+    let mut s = session();
+    let before = s.catalog.to_snapshot();
+    for (p, why) in [
+        (json!({"path": "/pics/trip", "label": "mauve"}), "unknown label"),
+        (json!({"path": "/pics/trip"}), "missing label"),
+        (json!({"label": "red"}), "missing path"),
+        (json!({"path": "  ", "label": "red"}), "blank path"),
+        (json!({"path": "/elsewhere", "label": "red"}), "no photo was imported from it"),
+        (json!({"path": "pics/trip", "label": "red"}), "a relative path"),
+    ] {
+        assert!(s.execute("folder.label", &p).is_err(), "{why}");
+    }
+    assert_eq!(s.catalog.to_snapshot(), before, "nothing changed");
+}
+
+#[test]
+fn labels_follow_a_renamed_folder_and_undo_puts_them_back() {
+    let dir = Scratch::new("label-rename");
+    std::fs::create_dir_all(dir.0.join("trip/day1")).unwrap();
+    let (trip, day1) = (dir.path("trip"), dir.path("trip/day1"));
+    let mut s = Session::new();
+    add(&mut s, &format!("{trip}/a.jpg"));
+    add(&mut s, &format!("{day1}/b.jpg"));
+    s.execute("folder.label", &json!({"path": trip, "label": "red"})).unwrap();
+    s.execute("folder.label", &json!({"path": day1, "label": "blue"})).unwrap();
+    s.execute("folder.rename", &json!({"path": trip, "name": "holiday"})).unwrap();
+    assert_eq!(listed_label(&mut s, &dir.path("holiday")).as_deref(), Some("red"));
+    assert_eq!(listed_label(&mut s, &dir.path("holiday/day1")).as_deref(), Some("blue"), "the folder inside goes along");
+    assert_eq!(s.catalog.folder_record(&trip), None, "nothing stays behind");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(listed_label(&mut s, &trip).as_deref(), Some("red"));
+    assert_eq!(listed_label(&mut s, &day1).as_deref(), Some("blue"));
+    s.execute("edit.redo", &json!({})).unwrap();
+    assert_eq!(listed_label(&mut s, &dir.path("holiday")).as_deref(), Some("red"), "redo carries them again");
+}
+
+#[test]
+fn labels_follow_a_moved_folder() {
+    let dir = Scratch::new("label-move");
+    std::fs::create_dir_all(dir.0.join("trip")).unwrap();
+    std::fs::create_dir_all(dir.0.join("archive")).unwrap();
+    let trip = dir.path("trip");
+    let mut s = Session::new();
+    add(&mut s, &format!("{trip}/a.jpg"));
+    s.execute("folder.label", &json!({"path": trip, "label": "yellow"})).unwrap();
+    s.execute("folder.move", &json!({"path": trip, "into": dir.path("archive")})).unwrap();
+    assert_eq!(listed_label(&mut s, &dir.path("archive/trip")).as_deref(), Some("yellow"));
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(listed_label(&mut s, &trip).as_deref(), Some("yellow"), "undo moves it back with the folder");
+    assert_eq!(s.catalog.folder_record(&dir.path("archive/trip")), None);
+    s.execute("edit.redo", &json!({})).unwrap();
+    assert_eq!(listed_label(&mut s, &dir.path("archive/trip")).as_deref(), Some("yellow"));
+}
+
+#[test]
+fn a_label_comes_off_a_folder_whose_photos_are_gone() {
+    let mut s = session();
+    s.execute("folder.label", &json!({"path": "/pics/trip", "label": "red"})).unwrap();
+    s.execute("library.removeFolder", &json!({"path": "/pics/trip"})).unwrap();
+    s.execute("folder.label", &json!({"path": "/pics/trip", "label": "none"})).unwrap();
+    assert_eq!(s.catalog.folder_record("/pics/trip"), None);
+    assert!(s.execute("folder.label", &json!({"path": "/pics/trip", "label": "red"})).is_err(), "but a new one needs photos");
+}
diff --git a/crates/engine/src/tests_import.rs b/crates/engine/src/tests_import.rs
index 4a4cad53..78420031 100644
--- a/crates/engine/src/tests_import.rs
+++ b/crates/engine/src/tests_import.rs
@@ -974,8 +974,27 @@ fn emptying_trashed_photos_of_one_album_and_stack_leaves_nothing_dangling() {
 fn deleting_several_photos_permanently_leaves_nothing_dangling() {
     let (mut s, src, ids, al) = two_trashed_in_album_and_stack("trash-perm-refs");
     s.execute("library.select", &json!({"ids": ids})).unwrap();
+    let files = [src.join("a.png"), src.join("b.png")].map(|path| {
+        let bytes = std::fs::read(&path).unwrap();
+        (path, bytes)
+    });
+    let snapshot = s.catalog.to_snapshot();
+    s.drain_log();
     s.execute("photo.deletePermanently", &json!({"ids": ids})).unwrap();
     assert!(s.catalog.album(lightcraft_catalog::AlbumId(al)).unwrap().photos.is_empty());
+    assert!(ids.iter().all(|i| s.catalog.photo(lightcraft_catalog::PhotoId(*i)).is_none()));
+    let removed = s.catalog.to_snapshot();
+    let log: String = s.drain_log().iter().map(lightcraft_catalog::Catalog::op_to_log_line).collect();
+    let mut reopened = lightcraft_catalog::Catalog::from_snapshot(&snapshot).unwrap();
+    reopened.replay(&log).unwrap();
+    assert_eq!(reopened.to_snapshot(), removed);
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.catalog.to_snapshot(), snapshot, "one undo restores photos, album and stack");
+    s.execute("edit.redo", &json!({})).unwrap();
+    assert_eq!(s.catalog.to_snapshot(), removed);
+    for (path, bytes) in files {
+        assert_eq!(std::fs::read(path).unwrap(), bytes, "permanent deletion only removes catalog records");
+    }
     let _ = std::fs::remove_dir_all(&src);
 }
 
@@ -1105,3 +1124,54 @@ fn folder_import_picks_up_undecodable_raw_containers_as_preview_only() {
     assert!(s.catalog.photos().all(|p| p.preview_only.is_some() && p.kind == lightcraft_catalog::MediaKind::Raw && (p.width, p.height) == (40, 30)));
     let _ = std::fs::remove_dir_all(&src);
 }
+
+#[test]
+fn a_file_gone_since_the_import_review_is_not_imported() {
+    let src = temp_dir("gone-since-review");
+    write_png(&src.join("a.png"), 1);
+    write_png(&src.join("b.png"), 2);
+    let mut s = Session::new().with_fs();
+    s.execute("library.importPreview", &json!({"paths": [src.to_string_lossy()]})).unwrap();
+    std::fs::remove_file(src.join("b.png")).unwrap();
+    let r = s.execute("library.import", &json!({"paths": [src.join("a.png").to_string_lossy(), src.join("b.png").to_string_lossy()]})).unwrap();
+    assert_eq!((ids(&r, "imported"), ids(&r, "failed")), (1, 1), "{r}");
+    assert_eq!(s.catalog.len(), 1, "no photo for a file that isn't there");
+    let _ = std::fs::remove_dir_all(&src);
+}
+
+/// A HEIC laid out like an iPhone's (a grid of HEVC pictures, a Display P3 profile, a quarter turn
+/// in the container, a thumbnail) imports as a normal photo that develops and exports upright like
+/// a JPEG. In a build without the codecs' `heif` feature it is reported as failed, saying why.
+#[test]
+fn heic_imports_as_a_normal_photo_or_says_why_not() {
+    use lightcraft_heif::testdata::{Prop, Spec, build};
+    let src = temp_dir("heic");
+    let photo = |x: u32, y: u32| [((x * 7 + y * 13) % 200 + 30) as u16, 110, 150];
+    let p3 = lightcraft_codecs::icc::write_named(lightcraft_codecs::NamedSpace::DisplayP3);
+    let bytes = build(&Spec { props: vec![Prop::Icc(p3), Prop::Irot(1)], thumbnail: Some(&photo), ..Spec::new(96, 64, &photo) });
+    std::fs::write(src.join("IMG_0001.HEIC"), &bytes).unwrap();
+    let mut s = Session::new().with_fs();
+    let r = s.execute("library.import", &json!({"paths": [src.to_string_lossy()]})).unwrap();
+    if !lightcraft_codecs::Format::Heif.can_decode() {
+        assert_eq!((ids(&r, "imported"), ids(&r, "failed")), (0, 1), "{r}");
+        assert!(r["failed"].to_string().contains("isn't included in this build"), "{r}");
+        let _ = std::fs::remove_dir_all(&src);
+        return;
+    }
+    assert_eq!((ids(&r, "imported"), ids(&r, "failed")), (1, 0), "{r}");
+    let p = s.catalog.photos().next().unwrap();
+    let id = p.id;
+    // Upright (the container's turn applied) and not preview-only.
+    assert_eq!((p.kind, p.preview_only.clone(), p.width, p.height), (lightcraft_catalog::MediaKind::Image, None, 64, 96));
+    s.execute("library.select", &json!({"ids": [id.0], "active": id.0})).unwrap();
+    let plain = crate::export::export_photo(&mut s, id, &crate::export::ExportOptions::from_json(&json!({"format": "png"})), 1).unwrap();
+    assert_eq!((plain.width, plain.height), (64, 96));
+    s.execute("develop.set", &json!({"control": "light.exposure", "value": 1.0})).unwrap();
+    let brighter = crate::export::export_photo(&mut s, id, &crate::export::ExportOptions::from_json(&json!({"format": "png"})), 1).unwrap();
+    let mean = |png: &[u8]| {
+        let d = lightcraft_codecs::decode(png, Default::default()).unwrap();
+        d.image.data.iter().map(|p| p[1]).sum::<f32>() / d.image.data.len() as f32
+    };
+    assert!(mean(&brighter.bytes) > mean(&plain.bytes) * 1.3, "exposure +1 brightens the HEIC");
+    let _ = std::fs::remove_dir_all(&src);
+}
diff --git a/crates/engine/src/tests_keyword_list.rs b/crates/engine/src/tests_keyword_list.rs
new file mode 100644
index 00000000..b98b45de
--- /dev/null
+++ b/crates/engine/src/tests_keyword_list.rs
@@ -0,0 +1,341 @@
+//! The keyword list's commands (Lightroom Classic's Keyword List): create, edit, move and purge
+//! keywords, their attributes, and the default parent for new keywords.
+
+use serde_json::json;
+
+use crate::Session;
+
+/// The keyword filter follows a renamed keyword whatever the case it was typed in, also where a
+/// letter's case changes its length (ẞ / ß): it used to be cut by bytes, which could land inside
+/// a letter and panic.
+#[test]
+fn the_filter_follows_a_rename_whatever_the_case() {
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0].0;
+    s.execute("photo.setMeta", &json!({"ids": [id], "keywords": ["ßßa|é"]})).unwrap();
+    s.execute("library.filter", &json!({"keyword": "ßßa|é"})).unwrap();
+    s.execute("keyword.rename", &json!({"from": "ẞẞA", "to": "Road"})).unwrap();
+    assert_eq!(s.filter.keyword.as_deref(), Some("Road|é"));
+    s.execute("keyword.merge", &json!({"from": ["ROAD"], "into": "Weg"})).unwrap();
+    assert_eq!(s.filter.keyword.as_deref(), Some("Weg|é"));
+}
+
+fn temp_dir(tag: &str) -> std::path::PathBuf {
+    let d = std::env::temp_dir().join(format!("lc-keyword-list-{tag}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+fn keywords_of(s: &Session, id: u64) -> Vec<String> {
+    s.catalog.photo(lightcraft_catalog::PhotoId(id)).unwrap().meta.keywords.clone()
+}
+
+/// Create Keyword: a name inside a parent, with attributes, given to the selected photos at once,
+/// in one undo step; `keyword.info` reads it back. A keyword that exists isn't created again.
+#[test]
+fn creating_a_keyword_with_attributes_and_the_selection() {
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0].0;
+    s.execute("library.select", &json!({"ids": [id]})).unwrap();
+    let undo = s.undo.len();
+    let r = s
+        .execute("keyword.create", &json!({"name": "Weddings", "parent": "Events", "synonyms": ["marriage"], "person": false, "addToSelected": true}))
+        .unwrap();
+    assert_eq!(r["keyword"], "Events|Weddings", "{r}");
+    assert_eq!(s.undo.len(), undo + 1, "one undo step");
+    assert!(keywords_of(&s, id).contains(&"Events|Weddings".to_string()));
+    let info = s.execute("keyword.info", &json!({"keyword": "events|weddings"})).unwrap();
+    assert_eq!(info["path"], "Events|Weddings");
+    assert_eq!(info["synonyms"], json!(["marriage"]));
+    assert_eq!((info["includeOnExport"].as_bool(), info["listed"].as_bool(), info["count"].as_u64()), (Some(true), Some(true), Some(1)));
+    let err = s.execute("keyword.create", &json!({"name": "weddings", "parent": "events"})).unwrap_err().to_string();
+    assert!(err.contains("already"), "{err}");
+    assert!(s.execute("keyword.info", &json!({"keyword": "lisbon"})).is_err(), "no such keyword");
+}
+
+/// "Put new keywords inside this keyword": new keywords go inside the default parent unless the
+/// command says otherwise (`parent: null` = the top level). It belongs to its keyword in the
+/// library: it follows a rename, goes with a delete, and undo and redo bring it back with them.
+#[test]
+fn new_keywords_go_inside_the_default_parent() {
+    let dir = temp_dir("default-parent");
+    let mut s = Session::new();
+    s.open_library(&dir, true).unwrap();
+    s.execute("keyword.create", &json!({"name": "Events"})).unwrap();
+    s.execute("keyword.setDefaultParent", &json!({"keyword": "events"})).unwrap();
+    assert_eq!(s.catalog.default_keyword_parent().as_deref(), Some("Events"));
+    assert_eq!(s.execute("keyword.create", &json!({"name": "Birthdays"})).unwrap()["keyword"], "Events|Birthdays");
+    assert_eq!(s.execute("keyword.create", &json!({"name": "Travel", "parent": null})).unwrap()["keyword"], "Travel");
+    s.execute("keyword.rename", &json!({"from": "Events", "to": "Occasions"})).unwrap();
+    assert_eq!(s.catalog.default_keyword_parent().as_deref(), Some("Occasions"), "follows the rename");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.catalog.default_keyword_parent().as_deref(), Some("Events"), "undo takes it back");
+    s.execute("edit.redo", &json!({})).unwrap();
+    drop(s);
+    let mut s = Session::new();
+    s.open_library(&dir, false).unwrap();
+    assert_eq!(s.catalog.default_keyword_parent().as_deref(), Some("Occasions"), "kept with the library");
+    s.execute("keyword.delete", &json!({"keyword": "occasions"})).unwrap();
+    assert_eq!(s.catalog.default_keyword_parent(), None, "gone with its keyword");
+    assert_eq!(s.execute("keyword.create", &json!({"name": "Graduations"})).unwrap()["keyword"], "Graduations", "at the top level");
+    s.execute("edit.undo", &json!({})).unwrap();
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.catalog.default_keyword_parent().as_deref(), Some("Occasions"), "undoing the delete brings it back");
+    s.execute("keyword.setDefaultParent", &json!({"keyword": null})).unwrap();
+    assert_eq!(s.catalog.default_keyword_parent(), None);
+    assert!(s.execute("keyword.setDefaultParent", &json!({"keyword": "lisbon"})).is_err(), "no such keyword");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Edit Keyword: a new name and attributes in one step; attributes not given keep their values.
+#[test]
+fn editing_a_keyword_changes_what_it_is_given() {
+    let mut s = Session::with_demo();
+    s.execute("keyword.create", &json!({"name": "Weddings", "synonyms": ["marriage"]})).unwrap();
+    let undo = s.undo.len();
+    s.execute("keyword.edit", &json!({"keyword": "weddings", "name": "Marriages", "includeOnExport": false})).unwrap();
+    assert_eq!(s.undo.len(), undo + 1);
+    let info = s.execute("keyword.info", &json!({"keyword": "Marriages"})).unwrap();
+    assert_eq!((info["includeOnExport"].as_bool(), info["synonyms"].clone()), (Some(false), json!(["marriage"])));
+    assert!(s.execute("keyword.info", &json!({"keyword": "Weddings"})).is_err());
+}
+
+/// Move Keyword: inside another or to the top level. Onto a name that is taken it is refused with
+/// a message saying it would merge, unless `merge: true`.
+#[test]
+fn moving_a_keyword_merges_only_when_asked() {
+    let mut s = Session::with_demo();
+    let ids: Vec<u64> = s.visible_cloned().iter().take(2).map(|p| p.0).collect();
+    s.execute("photo.setMeta", &json!({"ids": [ids[0]], "keywords": ["Rome"]})).unwrap();
+    s.execute("photo.setMeta", &json!({"ids": [ids[1]], "keywords": ["Europe|Rome"]})).unwrap();
+    let err = s.execute("keyword.move", &json!({"keyword": "rome", "parent": "europe"})).unwrap_err().to_string();
+    assert!(err.contains("merge"), "{err}");
+    s.execute("keyword.move", &json!({"keyword": "rome", "parent": "europe", "merge": true})).unwrap();
+    assert_eq!(keywords_of(&s, ids[0]), ["Europe|Rome"]);
+    s.execute("keyword.move", &json!({"keyword": "europe|rome", "parent": null})).unwrap();
+    assert_eq!((keywords_of(&s, ids[0]), keywords_of(&s, ids[1])), (vec!["Rome".to_string()], vec!["Rome".to_string()]));
+    assert!(s.execute("keyword.move", &json!({"keyword": "rome"})).is_err(), "`parent` must be said, null for the top level");
+}
+
+/// Purge Unused Keywords takes off the list the keywords no photo has, in one undo step.
+#[test]
+fn purging_unused_keywords() {
+    let mut s = Session::with_demo();
+    s.execute("keyword.create", &json!({"name": "Weddings"})).unwrap();
+    let r = s.execute("keyword.purgeUnused", &json!({})).unwrap();
+    assert_eq!(r["purged"], 1, "{r}");
+    assert!(s.execute("keyword.info", &json!({"keyword": "Weddings"})).is_err());
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert!(s.execute("keyword.info", &json!({"keyword": "Weddings"})).is_ok());
+}
+
+/// Moving a keyword into a parent that doesn't exist yet makes that parent, and the keyword filter
+/// follows the keyword there (the grid kept filtering by the old path, and showed nothing).
+#[test]
+fn the_filter_follows_a_keyword_moved_into_a_new_parent() {
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0].0;
+    s.execute("photo.setMeta", &json!({"ids": [id], "keywords": ["Rome"]})).unwrap();
+    s.execute("library.filter", &json!({"keyword": "Rome"})).unwrap();
+    s.execute("keyword.move", &json!({"keyword": "rome", "parent": "Italy"})).unwrap();
+    assert_eq!(keywords_of(&s, id), ["Italy|Rome"]);
+    assert_eq!(s.filter.keyword.as_deref(), Some("Italy|Rome"));
+}
+
+/// Keywords given to photos are stored cleaned (" beach " is "beach", "Travel | Italy" is
+/// "Travel|Italy"), so the list's actions find them; one a photo has already, whatever the case of
+/// any letter, isn't added twice.
+#[test]
+fn keywords_given_to_photos_are_stored_cleaned() {
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0].0;
+    s.execute("photo.setMeta", &json!({"ids": [id], "keywords": [" beach ", "Travel | Italy", "Ärzte"]})).unwrap();
+    s.execute("photo.setMeta", &json!({"ids": [id], "addKeywords": [" sea ", "ÄRZTE", " "]})).unwrap();
+    assert_eq!(keywords_of(&s, id), ["beach", "Travel|Italy", "Ärzte", "sea"]);
+    s.execute("photo.setMeta", &json!({"ids": [id], "removeKeywords": ["travel | italy"]})).unwrap();
+    assert_eq!(keywords_of(&s, id), ["beach", "Ärzte", "sea"]);
+    assert!(s.execute("keyword.info", &json!({"keyword": "beach"})).is_ok());
+}
+
+/// Rename, merge and delete say how many photos they changed, as before the keyword list: the
+/// list's own changes aren't photos.
+#[test]
+fn keyword_actions_count_the_photos_they_change() {
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0].0;
+    s.execute("keyword.create", &json!({"name": "Weddings", "synonyms": ["marriage"]})).unwrap();
+    assert_eq!(s.execute("keyword.rename", &json!({"from": "Weddings", "to": "Marriages"})).unwrap()["changed"], 0);
+    s.execute("photo.setMeta", &json!({"ids": [id], "addKeywords": ["Marriages"]})).unwrap();
+    assert_eq!(s.execute("keyword.rename", &json!({"from": "Marriages", "to": "Weddings"})).unwrap()["changed"], 1);
+    assert_eq!(s.execute("keyword.delete", &json!({"keyword": "weddings"})).unwrap()["changed"], 1);
+}
+
+/// ⌥1–⌥9 take a set's keyword off the selected photos when they all have it, whatever the case of
+/// any of its letters (the set has "ärzte", the photos "ÄRZTE" and "ärzte").
+#[test]
+fn a_set_keyword_toggles_whatever_its_case() {
+    let mut s = Session::with_demo();
+    let ids: Vec<u64> = s.visible_cloned().iter().take(2).map(|p| p.0).collect();
+    s.execute("photo.setMeta", &json!({"ids": [ids[0]], "keywords": ["ÄRZTE"]})).unwrap();
+    s.execute("photo.setMeta", &json!({"ids": [ids[1]], "keywords": ["ärzte"]})).unwrap();
+    s.execute("keyword.saveSet", &json!({"name": "Clinic", "keywords": ["ärzte"]})).unwrap();
+    s.execute("keyword.toggleFromSet", &json!({"index": 1, "ids": ids})).unwrap();
+    assert!(ids.iter().all(|id| keywords_of(&s, *id).is_empty()), "taken off both");
+}
+
+fn set_named(s: &mut Session, name: &str) -> serde_json::Value {
+    let sets = s.execute("keyword.sets", &json!({})).unwrap();
+    sets["sets"].as_array().unwrap().iter().find(|x| x["name"] == name).cloned().unwrap_or(serde_json::Value::Null)
+}
+
+/// Edit Keyword Set: a set's nine slots keep their places, so each keyword stays on its ⌥ key; an
+/// empty slot is allowed and does nothing.
+#[test]
+fn a_keyword_sets_slots_keep_their_places() {
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0].0;
+    s.execute("keyword.saveSet", &json!({"name": "Weddings", "keywords": [" ceremony ", "", "reception", ""]})).unwrap();
+    assert_eq!(set_named(&mut s, "Weddings")["keywords"], json!(["ceremony", "", "reception"]), "trailing empty slots go");
+    let before = keywords_of(&s, id);
+    let r = s.execute("keyword.toggleFromSet", &json!({"index": 2, "ids": [id]})).unwrap();
+    assert_eq!((r["changed"].as_u64(), keywords_of(&s, id)), (Some(0), before), "⌥2 is empty: nothing");
+    s.execute("keyword.toggleFromSet", &json!({"index": 3, "ids": [id]})).unwrap();
+    assert!(keywords_of(&s, id).contains(&"reception".to_string()), "⌥3 is reception");
+}
+
+/// A set holds each keyword once, whatever its case: a second one leaves its slot empty.
+#[test]
+fn a_keyword_set_holds_each_keyword_once() {
+    let mut s = Session::with_demo();
+    s.execute("keyword.saveSet", &json!({"name": "Travel", "keywords": ["Lisbon", "harbour", "LISBON"]})).unwrap();
+    assert_eq!(set_named(&mut s, "Travel")["keywords"], json!(["Lisbon", "harbour"]));
+}
+
+/// Renaming a set keeps its place among the sets and keeps it current; a name another set has is
+/// refused.
+#[test]
+fn renaming_a_keyword_set_keeps_its_place() {
+    let mut s = Session::with_demo();
+    s.execute("keyword.saveSet", &json!({"name": "Weddings", "keywords": ["ceremony"]})).unwrap();
+    s.execute("keyword.saveSet", &json!({"name": "Travel", "keywords": ["harbour"]})).unwrap();
+    s.execute("keyword.useSet", &json!({"name": "Weddings"})).unwrap();
+    let r = s.execute("keyword.saveSet", &json!({"name": "Ceremonies", "replace": "weddings", "keywords": ["ceremony", "rings"]})).unwrap();
+    let names: Vec<String> = r["sets"].as_array().unwrap().iter().map(|x| x["name"].as_str().unwrap().to_string()).collect();
+    assert_eq!(names, ["Recent Keywords", "Ceremonies", "Travel"]);
+    assert_eq!(r["current"], "Ceremonies");
+    assert_eq!(r["keywords"], json!(["ceremony", "rings"]));
+    let err = s.execute("keyword.saveSet", &json!({"name": "travel", "replace": "Ceremonies", "keywords": []})).unwrap_err().to_string();
+    assert!(err.contains("already"), "{err}");
+    assert!(s.execute("keyword.saveSet", &json!({"name": "Rings", "replace": "Lisbon", "keywords": []})).is_err(), "no such set");
+}
+
+/// Renaming a set without giving its keywords keeps its keywords (not the current set's).
+#[test]
+fn renaming_a_set_alone_keeps_its_keywords() {
+    let mut s = Session::with_demo();
+    s.execute("keyword.saveSet", &json!({"name": "Weddings", "keywords": ["ceremony"]})).unwrap();
+    s.execute("keyword.saveSet", &json!({"name": "Travel", "keywords": ["harbour"]})).unwrap();
+    s.execute("keyword.saveSet", &json!({"name": "Ceremonies", "replace": "Weddings"})).unwrap();
+    assert_eq!(set_named(&mut s, "Ceremonies")["keywords"], json!(["ceremony"]));
+}
+
+/// A new set (`new: true`, what Edit Set… on Recent Keywords saves) never takes another set's
+/// name: saving over it silently is refused.
+#[test]
+fn a_new_set_doesnt_take_a_sets_name() {
+    let mut s = Session::with_demo();
+    s.execute("keyword.saveSet", &json!({"name": "Travel", "keywords": ["harbour", "lisbon"]})).unwrap();
+    let err = s.execute("keyword.saveSet", &json!({"name": "travel", "new": true, "keywords": ["x"]})).unwrap_err().to_string();
+    assert!(err.contains("already"), "{err}");
+    assert_eq!(set_named(&mut s, "Travel")["keywords"], json!(["harbour", "lisbon"]), "left as it was");
+}
+
+/// Set names match whatever the case of any of their letters, for every set command alike.
+#[test]
+fn set_names_match_whatever_their_case() {
+    let mut s = Session::with_demo();
+    s.execute("keyword.saveSet", &json!({"name": "ÉTÉ", "keywords": ["sunset"]})).unwrap();
+    s.execute("keyword.useSet", &json!({"name": "Recent Keywords"})).unwrap();
+    s.execute("keyword.useSet", &json!({"name": "été"})).unwrap();
+    assert_eq!(s.execute("keyword.sets", &json!({})).unwrap()["current"], "ÉTÉ");
+    s.execute("keyword.deleteSet", &json!({"name": "été"})).unwrap();
+    assert!(set_named(&mut s, "ÉTÉ").is_null(), "deleted");
+}
+
+/// Export Keywords writes the keyword list file, and names the keywords Capture One's importer
+/// refuses (it allows none of ; , < > in a list); without a path it gives the text.
+#[test]
+fn exporting_keywords_writes_the_list() {
+    let dir = temp_dir("export-keywords");
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0].0;
+    s.execute("photo.setMeta", &json!({"ids": [id], "keywords": ["Places|Lisbon", "fish, chips"]})).unwrap();
+    let path = dir.join("keywords.txt");
+    let r = s.execute("keyword.export", &json!({"path": path.to_string_lossy()})).unwrap();
+    let text = std::fs::read_to_string(&path).unwrap();
+    assert!(text.contains("Places\n\tLisbon\n"), "{text}");
+    assert!(r["keywords"].as_u64().unwrap() >= 3, "{r}");
+    assert_eq!(r["captureOneRefuses"], json!(["fish, chips"]), "{r}");
+    assert_eq!(r["unwritable"], json!([]), "{r}");
+    let r = s.execute("keyword.export", &json!({})).unwrap();
+    assert_eq!(r["text"].as_str(), Some(text.as_str()));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A keyword the format can't hold is left out of the file and named, so the file reads back.
+#[test]
+fn exporting_keywords_names_what_the_list_cant_hold() {
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0].0;
+    s.execute("photo.setMeta", &json!({"ids": [id], "keywords": ["Travel|[draft]", "Travel|Lisbon"]})).unwrap();
+    let before = s.execute("keyword.export", &json!({})).unwrap()["keywords"].as_u64().unwrap();
+    // a name starting with a brace is written, counted and checked for Capture One like any other
+    s.execute("photo.setMeta", &json!({"ids": [id], "addKeywords": ["{draft, notes"]})).unwrap();
+    let r = s.execute("keyword.export", &json!({})).unwrap();
+    assert_eq!(r["keywords"].as_u64(), Some(before + 1), "{r}");
+    assert_eq!(r["captureOneRefuses"], json!(["{draft, notes"]), "{r}");
+    assert_eq!(r["unwritable"], json!(["Travel|[draft]"]), "{r}");
+    let text = r["text"].as_str().unwrap();
+    assert!(text.contains("Travel\n\tLisbon\n") && !text.contains("[draft]"), "{text}");
+    s.execute("keyword.import", &json!({"text": text})).unwrap();
+}
+
+/// A list saved as UTF-16 (as Windows' Notepad can) says to save it as UTF-8, and text too big to
+/// be a keyword list is refused, as a file that big is.
+#[test]
+fn importing_keywords_refuses_what_it_cant_read() {
+    let dir = temp_dir("import-keywords-refused");
+    let mut s = Session::with_demo();
+    let utf16: Vec<u8> = [0xff, 0xfe].into_iter().chain("Travel\r\n".encode_utf16().flat_map(u16::to_le_bytes)).collect();
+    std::fs::write(dir.join("travel.txt"), utf16).unwrap();
+    let err = s.execute("keyword.import", &json!({"path": dir.join("travel.txt").to_string_lossy()})).unwrap_err().to_string();
+    assert!(err.contains("UTF-16") && err.contains("UTF-8"), "{err}");
+    let big = "Travel\n".repeat((17 << 20) / 7);
+    let err = s.execute("keyword.import", &json!({"text": big})).unwrap_err().to_string();
+    assert!(err.contains("16 MB"), "{err}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Import Keywords reads a keyword list file (or text) as one undo step and says what it added;
+/// a file it can't read says which line, and nothing is taken.
+#[test]
+fn importing_keywords_reads_a_list() {
+    let dir = temp_dir("import-keywords");
+    let mut s = Session::with_demo();
+    let path = dir.join("vocabulary.utf8");
+    std::fs::write(&path, "[Places]\r\n\tPortugal\r\n\t\tLisbon\r\n").unwrap();
+    let undo = s.undo.len();
+    let r = s.execute("keyword.import", &json!({"path": path.to_string_lossy()})).unwrap();
+    assert_eq!((r["added"].as_u64(), r["updated"].as_u64()), (Some(3), Some(0)), "{r}");
+    assert_eq!(s.undo.len(), undo + 1);
+    assert!(s.catalog.has_keyword("Places|Portugal|Lisbon"));
+    let r = s.execute("keyword.import", &json!({"text": "Events\n\t{celebrations}\n"})).unwrap();
+    assert_eq!(r["added"], 1);
+    let err = s.execute("keyword.import", &json!({"text": "Events\n\t\tWeddings\n"})).unwrap_err().to_string();
+    assert!(err.contains("line 2"), "{err}");
+    std::fs::write(dir.join("bad.txt"), [0xff, 0xfe, 0x00, 0x41]).unwrap();
+    assert!(s.execute("keyword.import", &json!({"path": dir.join("bad.txt").to_string_lossy()})).is_err(), "not UTF-8: refused");
+    assert!(s.execute("keyword.import", &json!({})).is_err(), "a path or text");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/engine/src/tests_libops.rs b/crates/engine/src/tests_libops.rs
index f9e0f492..b35167c1 100644
--- a/crates/engine/src/tests_libops.rs
+++ b/crates/engine/src/tests_libops.rs
@@ -355,9 +355,9 @@ fn label_sets_and_xmp_label_names() {
     p.label = Some(ColorLabel::Green);
     let x = crate::sidecar::sidecar_packet(&p, &s.catalog);
     assert!(x.contains("Approved"), "{x}");
-    let sc = crate::sidecar::parse_sidecar(&x, false).unwrap().resolve_label(&s.catalog);
+    let sc = crate::sidecar::parse_sidecar(&x, crate::crs::Target::Rendered).unwrap().resolve_label(&s.catalog);
     assert_eq!(sc.label, Some(Some(ColorLabel::Green)));
-    let plain = crate::sidecar::parse_sidecar(&x.replace("Approved", "Blue"), false).unwrap().resolve_label(&s.catalog);
+    let plain = crate::sidecar::parse_sidecar(&x.replace("Approved", "Blue"), crate::crs::Target::Rendered).unwrap().resolve_label(&s.catalog);
     assert_eq!(plain.label, Some(Some(ColorLabel::Blue)), "colour names still work");
     s.execute("label.deleteSet", &json!({"name": "Studio"})).unwrap();
     assert!(s.execute("label.deleteSet", &json!({"name": "Review"})).is_err(), "built-ins stay");
@@ -551,3 +551,41 @@ fn choosing_random_starts_a_fresh_shuffle() {
     assert_eq!(s.sort.seed, 42, "an explicit seed is honoured");
     assert!(s.sort.seed < 1 << 53);
 }
+
+fn capture_time_raw_metadata_session(raw: Option<&str>) -> Session {
+    use lightcraft_catalog::{Op, Photo, PhotoId, Source};
+    let mut s = Session::new();
+    let id = PhotoId(1);
+    let mut p = Photo::new(id, Source::Demo { scene: 0 }, "one.jpg", "JPEG", 4, 3, "2026-04-01T00:00:00");
+    p.captured = raw.map(str::to_string);
+    s.catalog.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+    s.selection = crate::Selection::single(id);
+    s
+}
+
+#[test]
+fn capture_time_invalid_calendar_anchor_keeps_other_targets_and_redo() {
+    use lightcraft_catalog::{Op, Photo, PhotoId, Source};
+    for raw in ["2026-02-30T12:00:00", "2026x03x01T12:00:00"] {
+        let mut s = capture_time_raw_metadata_session(Some(raw));
+        let peer = PhotoId(2);
+        let mut p = Photo::new(peer, Source::Demo { scene: 0 }, "peer.jpg", "JPEG", 4, 3, "2026-10-09T00:00:00");
+        p.captured = Some("2026-03-01T12:00:00.25+02:00".into());
+        s.catalog.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+        s.commit("Earlier rating", Op::SetRating { id: peer, rating: 4 }).unwrap();
+        s.execute("edit.undo", &json!({})).unwrap();
+        s.selection.ids = vec![PhotoId(1), peer];
+        s.selection.active = Some(PhotoId(1));
+        let before = s.catalog.clone();
+        let selection = s.selection.clone();
+        let undo: Vec<_> = s.undo.iter().map(|e| (e.label.clone(), e.op.clone())).collect();
+        let redo: Vec<_> = s.redo.iter().map(|e| (e.label.clone(), e.op.clone())).collect();
+        let log = s.pending_log.clone();
+        assert!(s.execute("photo.setCaptureTime", &json!({"time": "2026-03-03T12:00:00"})).is_err(), "{raw}");
+        assert_eq!(s.catalog, before);
+        assert_eq!(s.selection, selection);
+        assert_eq!(s.undo.iter().map(|e| (e.label.clone(), e.op.clone())).collect::<Vec<_>>(), undo);
+        assert_eq!(s.redo.iter().map(|e| (e.label.clone(), e.op.clone())).collect::<Vec<_>>(), redo);
+        assert_eq!(s.pending_log, log);
+    }
+}
diff --git a/crates/engine/src/tests_library.rs b/crates/engine/src/tests_library.rs
index f7b89225..8a2599e5 100644
--- a/crates/engine/src/tests_library.rs
+++ b/crates/engine/src/tests_library.rs
@@ -252,11 +252,43 @@ fn smart_album_rule_sets() {
     s.clock = Box::new(|| "2026-10-02T12:00:00".to_string());
     let fields = s.execute("album.ruleFields", &serde_json::json!({})).unwrap();
     assert!(fields.as_array().unwrap().iter().any(|f| f["field"] == "keywords" && f["ops"].as_array().unwrap().len() > 3));
+    // each field names its field-menu group (null at the top level)
+    let group = |id: &str| fields.as_array().unwrap().iter().find(|f| f["field"] == id).map(|f| f["group"].clone());
+    assert_eq!(group("filePath"), Some(serde_json::json!("File")));
+    assert_eq!(group("rating"), Some(serde_json::Value::Null));
+    // choices stay the ids rules store; choiceLabels maps them to what people read
+    let flag = fields.as_array().unwrap().iter().find(|f| f["field"] == "copyrightStatus").unwrap();
+    assert_eq!(flag["choices"], serde_json::json!(["copyrighted", "publicDomain", "unknown"]));
+    assert_eq!(flag["choiceLabels"]["publicDomain"], "Public Domain");
+    let album = fields.as_array().unwrap().iter().find(|f| f["field"] == "album").unwrap();
+    assert_eq!((album["kind"].as_str(), album["ops"].as_array().map(Vec::len)), (Some("album"), Some(2)), "an album id, is / isn't");
     let bad = s.execute(
         "album.createSmart",
         &serde_json::json!({"name": "Bad", "rules": {"ruleSet": {"rules": [{"field": "rating", "op": "contains", "value": 1}]}}}),
     );
     assert!(bad.is_err(), "operators are checked");
+    // yes/no values: "false" means no, anything unreadable is an error rather than a silent yes
+    let maybe = s.execute(
+        "album.createSmart",
+        &serde_json::json!({"name": "Maybe", "rules": {"ruleSet": {"rules": [{"field": "edited", "op": "is", "value": "maybe"}]}}}),
+    );
+    assert!(maybe.is_err_and(|e| e.to_string().contains("yes or no")), "unreadable yes/no value");
+    // the library filter checks a rule set the same way, instead of quietly showing nothing
+    for rules in [serde_json::json!([{"field": "edited", "op": "is", "value": "maybe"}]), serde_json::json!([{"field": "nope", "op": "is"}])] {
+        let r = s.execute("library.filter", &serde_json::json!({"ruleSet": {"rules": rules}}));
+        assert!(r.is_err(), "{rules}");
+    }
+    assert!(s.filter.rule_set.is_none(), "a refused filter isn't applied");
+    s.execute("library.filter", &serde_json::json!({"ruleSet": {"rules": [{"field": "edited", "op": "is", "value": "no"}]}})).unwrap();
+    s.execute("library.filter", &serde_json::json!({"ruleSet": null})).unwrap();
+    let r = s
+        .execute(
+            "album.createSmart",
+            &serde_json::json!({"name": "Unedited", "rules": {"ruleSet": {"rules": [{"field": "edited", "op": "is", "value": "false"}]}}}),
+        )
+        .unwrap();
+    let unedited = s.catalog.photos().filter(|p| !p.deleted && !p.is_edited()).count();
+    assert_eq!(r["count"].as_u64(), Some(unedited as u64));
     let r = s
         .execute(
             "album.createSmart",
@@ -440,3 +472,206 @@ fn a_library_open_elsewhere_is_refused() {
     assert_eq!(other.catalog.to_snapshot(), expect);
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// A capture-time shift from an agent can't overflow or write a date no one can read back: a
+/// shift of more than 10,000 years is refused and nothing changes; an ordinary one still works.
+#[test]
+fn capture_time_shift_is_bounded() {
+    let mut s = crate::Session::with_demo();
+    let id = s.catalog.photos().next().unwrap().id;
+    let before = s.catalog.photo(id).unwrap().captured.clone();
+    for p in [
+        serde_json::json!({"ids": [id.0], "shift": 1e30}),
+        serde_json::json!({"ids": [id.0], "hours": -1e15}),
+        serde_json::json!({"ids": [id.0], "shift": 9.3e18}),
+    ] {
+        let r = s.execute("photo.setCaptureTime", &p);
+        // a real refusal, not the panic guard catching an overflow ("failed unexpectedly")
+        assert!(r.as_ref().is_err_and(|e| e.to_string().contains("10,000 years")), "{p}: {r:?}");
+        assert_eq!(s.catalog.photo(id).unwrap().captured, before, "{p} changed nothing");
+    }
+    s.execute("photo.setCaptureTime", &serde_json::json!({"ids": [id.0], "hours": 1})).unwrap();
+    assert_ne!(s.catalog.photo(id).unwrap().captured, before);
+    // a shift that would take a photo past year 9999 says so, rather than skipping it quietly
+    s.execute("photo.setCaptureTime", &serde_json::json!({"ids": [id.0], "time": "9999-12-31T12:00:00"})).unwrap();
+    let r = s.execute("photo.setCaptureTime", &serde_json::json!({"ids": [id.0], "hours": 24}));
+    assert!(r.as_ref().is_err_and(|e| e.to_string().contains("9999")), "{r:?}");
+    assert_eq!(s.catalog.photo(id).unwrap().captured.as_deref(), Some("9999-12-31T12:00:00"), "unchanged");
+}
+
+/// Values are checked too: an agent's rule set with a date that isn't one, or a rating of 9, is
+/// refused with the rule's position, by album.createSmart and library.filter alike.
+#[test]
+fn smart_rule_values_are_checked_by_commands() {
+    let mut s = crate::Session::with_demo();
+    let r = s.execute(
+        "album.createSmart",
+        &serde_json::json!({"name": "Odd", "rules": {"ruleSet": {"rules": [
+            {"field": "rating", "op": "gte", "value": 3},
+            {"field": "captureDate", "op": "is", "value": "banana"}
+        ]}}}),
+    );
+    let e = r.expect_err("a date that isn't one").to_string();
+    assert!(e.contains("rule 2:") && e.contains("needs a date"), "{e}");
+    assert!(s.catalog.albums().all(|a| a.name != "Odd"));
+    let e = s
+        .execute("library.filter", &serde_json::json!({"ruleSet": {"rules": [{"field": "rating", "op": "gte", "value": 9}]}}))
+        .expect_err("rating 9")
+        .to_string();
+    assert!(e.contains("rule 1: no rating 0–5 is ≥ 9"), "{e}");
+}
+
+/// A smart album saved with an old album operator (≥, from when Album was a number field) can
+/// still be edited: its rule is read as the "isn't" it always meant.
+#[test]
+fn old_album_operator_rules_stay_editable() {
+    use lightcraft_catalog::{Album, AlbumId, Op};
+    let mut s = crate::Session::with_demo();
+    let trip = s.execute("album.create", &serde_json::json!({"name": "Trip", "addSelected": false})).unwrap()["id"].as_u64().unwrap();
+    let rules: lightcraft_catalog::Filter =
+        serde_json::from_value(serde_json::json!({"ruleSet": {"rules": [{"field": "album", "op": "gte", "value": trip}]}})).unwrap();
+    let id = s.catalog.alloc_album_id();
+    s.catalog.apply(Op::AddAlbum { album: Album { smart: Some(Box::new(rules)), ..Album::new(id, "Old") } }).unwrap();
+    s.execute("album.setRules", &serde_json::json!({"id": id.0, "rules": {"rating": 2}})).unwrap();
+    let saved = serde_json::to_string(&s.catalog.album(AlbumId(id.0)).unwrap().smart).unwrap();
+    assert!(saved.contains(r#""op":"isNot""#), "{saved}");
+    s.execute("library.filter", &serde_json::json!({"ruleSet": {"rules": [{"field": "album", "op": "lte", "value": trip}]}})).unwrap();
+}
+
+/// Renaming and changing the rules is one step: both or neither, undone together.
+#[test]
+fn set_rules_with_a_name_is_one_step() {
+    let mut s = crate::Session::with_demo();
+    let id = s.execute("album.createSmart", &serde_json::json!({"name": "Old", "rules": {"rating": 3}})).unwrap()["id"].as_u64().unwrap();
+    let album = |s: &crate::Session| s.catalog.album(lightcraft_catalog::AlbumId(id)).unwrap().clone();
+    let good = serde_json::json!({"ruleSet": {"rules": [{"field": "rating", "op": "gte", "value": 4}]}});
+    let bad = serde_json::json!({"ruleSet": {"rules": [{"field": "captureDate", "op": "is", "value": "banana"}]}});
+    // refused rules: the name stays too
+    assert!(s.execute("album.setRules", &serde_json::json!({"id": id, "name": "New", "replace": true, "rules": bad})).is_err());
+    assert_eq!(album(&s).name, "Old");
+    let undo = s.undo.len();
+    s.execute("album.setRules", &serde_json::json!({"id": id, "name": "New", "replace": true, "rules": good})).unwrap();
+    assert_eq!((album(&s).name.as_str(), s.undo.len()), ("New", undo + 1), "one undo step");
+    assert!(album(&s).smart.unwrap().rule_set.is_some());
+    s.execute("edit.undo", &serde_json::json!({})).unwrap();
+    assert_eq!(album(&s).name, "Old");
+    assert!(album(&s).smart.unwrap().rule_set.is_none(), "undone together");
+    // a blank name keeps the album's
+    s.execute("album.setRules", &serde_json::json!({"id": id, "name": "  ", "rules": {"rating": 5}})).unwrap();
+    assert_eq!(album(&s).name, "Old");
+}
+
+/// albums.list says which smart albums have rules that no longer check, and why.
+#[test]
+fn album_list_reports_problems() {
+    let mut s = crate::Session::with_demo();
+    let trip = s.execute("album.create", &serde_json::json!({"name": "Trip", "addSelected": false})).unwrap()["id"].as_u64().unwrap();
+    let rules = serde_json::json!({"ruleSet": {"rules": [{"field": "album", "op": "is", "value": trip}]}});
+    let id = s.execute("album.createSmart", &serde_json::json!({"name": "In Trip", "rules": rules})).unwrap()["id"].as_u64().unwrap();
+    let find = |s: &mut crate::Session| {
+        let list = s.execute("albums.list", &serde_json::json!({})).unwrap();
+        list.as_array().unwrap().iter().find(|a| a["id"] == id).cloned().unwrap()
+    };
+    assert_eq!(find(&mut s)["problems"], serde_json::json!([]));
+    s.execute("album.delete", &serde_json::json!({"id": trip})).unwrap();
+    assert_eq!(find(&mut s)["problems"], serde_json::json!([format!("rule 1: no album {trip}")]));
+}
+
+/// "Travel" = keywords contain travel, but not in "Excluded Photos" (red or rejected): the counts
+/// follow, and Excluded Photos can't then test Travel back (a loop).
+#[test]
+fn smart_album_excluding_a_smart_album() {
+    let mut s = crate::Session::with_demo();
+    let excluded = s
+        .execute(
+            "album.createSmart",
+            &serde_json::json!({"name": "Excluded Photos", "rules": {"ruleSet": {"match": "any", "rules": [
+                {"field": "label", "op": "is", "value": "red"}, {"field": "flag", "op": "is", "value": "reject"}]}}}),
+        )
+        .unwrap()["id"]
+        .as_u64()
+        .unwrap();
+    let keyword = s.catalog.photos().flat_map(|p| p.meta.keywords.clone()).next().expect("a demo keyword");
+    let travel = s
+        .execute(
+            "album.createSmart",
+            &serde_json::json!({"name": "Travel", "rules": {"ruleSet": {"rules": [
+                {"field": "keywords", "op": "contains", "value": keyword}, {"field": "album", "op": "isNot", "value": excluded}]}}}),
+        )
+        .unwrap()["id"]
+        .as_u64()
+        .unwrap();
+    let count = |s: &crate::Session| s.catalog.album_count(lightcraft_catalog::AlbumId(travel));
+    let want = |s: &crate::Session| {
+        s.catalog
+            .photos()
+            .filter(|p| !p.deleted && p.meta.keywords.iter().any(|k| k.to_lowercase().contains(&keyword.to_lowercase())))
+            .filter(|p| p.label != Some(lightcraft_catalog::ColorLabel::Red) && p.flag != lightcraft_catalog::Flag::Reject)
+            .count()
+    };
+    assert_eq!(count(&s), want(&s));
+    // reject one of Travel's photos: it leaves Travel
+    let before = count(&s);
+    let id = s.catalog.photos().find(|p| s.catalog.album_contains(lightcraft_catalog::AlbumId(travel), p)).map(|p| p.id).expect("a travel photo");
+    s.execute("photo.flag", &serde_json::json!({"ids": [id.0], "flag": "reject"})).unwrap();
+    assert_eq!(count(&s), before - 1);
+    // Excluded Photos testing Travel back would include itself
+    let looped = s.execute(
+        "album.setRules",
+        &serde_json::json!({"id": excluded, "rules": {"ruleSet": {"rules": [{"field": "album", "op": "is", "value": travel}]}}, "replace": true}),
+    );
+    assert!(looped.is_err_and(|e| e.to_string().contains("would make this album include itself")), "a loop is refused");
+    // agents read the album by name in the summary
+    let list = s.execute("albums.list", &serde_json::json!({})).unwrap();
+    let travel_json = list.as_array().unwrap().iter().find(|a| a["id"] == travel).cloned().unwrap();
+    assert!(travel_json["rulesText"].as_str().unwrap_or("").contains("album isn't “Excluded Photos”"), "{travel_json}");
+}
+
+/// "Update Rules from Current Filter" refuses a loop too: showing A ("Album isn't B") and
+/// updating B from that view would make B test itself.
+#[test]
+fn rules_from_the_view_cant_loop() {
+    let mut s = crate::Session::with_demo();
+    let b = s.execute("album.createSmart", &serde_json::json!({"name": "B", "rules": {"rating": 2}})).unwrap()["id"].as_u64().unwrap();
+    let rules = serde_json::json!({"ruleSet": {"rules": [{"field": "album", "op": "isNot", "value": b}]}});
+    let a = s.execute("album.createSmart", &serde_json::json!({"name": "A", "rules": rules})).unwrap()["id"].as_u64().unwrap();
+    s.execute("library.source", &serde_json::json!({"kind": "album", "id": a})).unwrap();
+    let before = s.catalog.album(lightcraft_catalog::AlbumId(b)).unwrap().smart.clone();
+    let r = s.execute("album.setRules", &serde_json::json!({"id": b, "fromView": true}));
+    assert!(r.is_err_and(|e| e.to_string().contains("would make this album include itself")), "refused");
+    assert_eq!(s.catalog.album(lightcraft_catalog::AlbumId(b)).unwrap().smart, before, "B unchanged");
+    assert!(s.catalog.smart_album_problems(lightcraft_catalog::AlbumId(b)).is_empty());
+}
+
+/// A rule that stops checking later (the album it tests is deleted) doesn't lock up what doesn't
+/// touch it: the filter bar keeps working, and an album's other settings can still be edited. A
+/// change to the rules themselves is still checked.
+#[test]
+fn a_stale_rule_doesnt_block_other_changes() {
+    let mut s = crate::Session::with_demo();
+    let trip = s.execute("album.create", &serde_json::json!({"name": "Trip", "addSelected": false})).unwrap()["id"].as_u64().unwrap();
+    let rules = serde_json::json!({"rules": [{"field": "album", "op": "isNot", "value": trip}]});
+    s.execute("library.filter", &serde_json::json!({"ruleSet": rules})).unwrap();
+    let smart =
+        s.execute("album.createSmart", &serde_json::json!({"name": "Not Trip", "rules": {"ruleSet": rules}})).unwrap()["id"].as_u64().unwrap();
+    s.execute("album.delete", &serde_json::json!({"id": trip})).unwrap();
+    // the filter bar: a rating still applies on top of the stale rule
+    s.execute("library.filter", &serde_json::json!({"rating": 3})).unwrap();
+    assert_eq!(s.filter.rating, 3);
+    // the album: a partial edit that leaves its rules alone
+    s.execute("album.setRules", &serde_json::json!({"id": smart, "rules": {"rating": 2}})).unwrap();
+    // changing the rules is still checked
+    let bad = serde_json::json!({"ruleSet": {"rules": [{"field": "rating", "op": "gte", "value": 9}]}});
+    assert!(s.execute("library.filter", &bad).is_err());
+    assert!(s.execute("album.setRules", &serde_json::json!({"id": smart, "rules": bad})).is_err());
+}
+
+/// album.setRules refuses a loop through the album filter as well as through the rules.
+#[test]
+fn an_album_filter_loop_is_refused() {
+    let mut s = crate::Session::with_demo();
+    let a = s.execute("album.createSmart", &serde_json::json!({"name": "A", "rules": {"rating": 2}})).unwrap()["id"].as_u64().unwrap();
+    let r = s.execute("album.setRules", &serde_json::json!({"id": a, "rules": {"album": a}}));
+    assert!(r.is_err_and(|e| e.to_string().contains("include itself")), "refused");
+    assert_eq!(s.catalog.album(lightcraft_catalog::AlbumId(a)).unwrap().smart.as_ref().and_then(|f| f.album), None);
+}
diff --git a/crates/engine/src/tests_organize.rs b/crates/engine/src/tests_organize.rs
index 7fb24806..80d1ae54 100644
--- a/crates/engine/src/tests_organize.rs
+++ b/crates/engine/src/tests_organize.rs
@@ -79,6 +79,22 @@ fn smart_album_from_smart_album_view_keeps_its_rules() {
     assert_eq!(s.source, LibrarySource::Album(lightcraft_catalog::AlbumId(id)));
 }
 
+/// Saving the view of a smart album keeps the filter bar's settings even when the album holds a
+/// rule that no longer checks (it tests an album that has since been deleted).
+#[test]
+fn smart_album_view_keeps_the_filter_bar_over_a_stale_rule() {
+    let mut s = Session::with_demo();
+    let gone = s.execute("album.create", &json!({"name": "Gone", "addSelected": false})).unwrap()["id"].as_u64().unwrap();
+    let rules = json!({"ruleSet": {"rules": [{"field": "album", "op": "isNot", "value": gone}]}});
+    let id = s.execute("album.createSmart", &json!({"name": "Not in Gone", "rules": rules})).unwrap()["id"].as_u64().unwrap();
+    s.execute("album.delete", &json!({"id": gone})).unwrap();
+    s.execute("library.source", &json!({"kind": "album", "id": id})).unwrap();
+    s.execute("library.filter", &json!({"rating": 3})).unwrap();
+    let r = s.view_rules();
+    assert_eq!(r.rating, 3, "the filter bar's rating survives");
+    assert!(r.rule_set.is_some(), "and so do the album's own rules");
+}
+
 #[test]
 fn virtual_copies_are_independent_and_persist() {
     let dir = temp_dir("vc");
@@ -256,3 +272,44 @@ fn random_sort_persists_with_the_view() {
     assert_eq!(s2.sort.seed, 123_456_789);
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// Issue #501: deleting a populated folder is one reversible, durable catalog edit.
+#[test]
+fn deleting_an_album_folder_preserves_photos_and_restores_its_subtree() {
+    use lightcraft_catalog::AlbumId;
+    let dir = temp_dir("delete-folder");
+    let mut s = open(&dir);
+    let make = |s: &mut Session, p| s.execute("album.create", &p).unwrap()["id"].as_u64().unwrap();
+    let outer = make(&mut s, json!({"name": "Trips", "folder": true}));
+    let nested = make(&mut s, json!({"name": "Europe", "folder": true, "parent": outer}));
+    let album = make(&mut s, json!({"name": "Best", "parent": nested, "addSelected": true}));
+    let sibling = make(&mut s, json!({"name": "Kept", "addSelected": true}));
+    let smart = s.execute("album.createSmart", &json!({"name": "Rated", "parent": outer, "rules": {"rating": 4}})).unwrap()["id"].as_u64().unwrap();
+    s.execute("album.reorder", &json!({"id": album, "parent": nested})).unwrap();
+    s.execute("library.source", &json!({"kind": "album", "id": album})).unwrap();
+    let before = s.catalog.to_snapshot();
+    let photos = serde_json::to_value(s.catalog.photos().collect::<Vec<_>>()).unwrap();
+    let undo_before = s.undo.len();
+    s.execute("album.delete", &json!({"id": outer})).unwrap();
+    for id in [outer, nested, album, smart] {
+        assert!(s.catalog.album(AlbumId(id)).is_none());
+    }
+    assert!(s.catalog.album(AlbumId(sibling)).is_some());
+    assert_eq!(serde_json::to_value(s.catalog.photos().collect::<Vec<_>>()).unwrap(), photos);
+    assert_eq!(s.source, LibrarySource::All, "a deleted descendant cannot remain the source");
+    assert_eq!(s.undo.len(), undo_before + 1);
+    let deleted = s.catalog.to_snapshot();
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.catalog.to_snapshot(), before, "all album fields and memberships restored");
+    s.execute("edit.redo", &json!({})).unwrap();
+    assert_eq!(s.catalog.to_snapshot(), deleted);
+    let undo_after = s.undo.len();
+    assert!(s.execute("album.delete", &json!({"id": outer})).is_err());
+    assert_eq!(s.catalog.to_snapshot(), deleted, "missing id leaves the catalog unchanged");
+    assert_eq!(s.undo.len(), undo_after);
+    drop(s);
+    let reopened = open(&dir);
+    assert_eq!(reopened.catalog.to_snapshot(), deleted, "journal replay preserves the deletion");
+    drop(reopened);
+    let _ = std::fs::remove_dir_all(dir);
+}
diff --git a/crates/engine/src/tests_process.rs b/crates/engine/src/tests_process.rs
new file mode 100644
index 00000000..d101073e
--- /dev/null
+++ b/crates/engine/src/tests_process.rs
@@ -0,0 +1,264 @@
+//! Process versions through the commands (`docs/process-versions.md`): new photos and Reset get
+//! the latest process, Update to Current Process is one undo step, copies inherit, copy / paste /
+//! sync / presets / Auto Sync keep each photo's own, and numbers this build doesn't know survive a
+//! save and a sidecar round trip.
+
+use std::sync::Arc;
+
+use lightcraft_catalog::{Photo, PhotoId, Source};
+use lightcraft_develop::{DevelopSettings, ProcessVersion};
+use serde_json::json;
+
+use crate::{EngineError, Session};
+
+/// No process is older than V1 yet: 0 (which no LightCraft writes) stands in for one.
+const OLDER: ProcessVersion = ProcessVersion(0);
+/// A number from a newer LightCraft.
+const NEWER: ProcessVersion = ProcessVersion(ProcessVersion::LATEST.0 + 6);
+
+fn process(s: &Session, id: PhotoId) -> ProcessVersion {
+    s.develop_of(id).unwrap().process
+}
+
+/// Put photo `id` on process `p` (with exposure `ev`) without going through a command.
+fn put(s: &mut Session, id: PhotoId, p: ProcessVersion, ev: f64) {
+    let mut d = (*s.develop_of(id).unwrap()).clone();
+    d.process = p;
+    d.light.exposure = ev;
+    s.set_develop(id, d, "test").unwrap();
+}
+
+fn select(s: &mut Session, ids: &[PhotoId]) {
+    s.execute("library.select", &json!({"ids": ids.iter().map(|i| i.0).collect::<Vec<_>>()})).unwrap();
+}
+
+fn update_info(s: &Session) -> crate::CommandInfo {
+    s.commands().into_iter().find(|c| c.id == "develop.updateProcess").unwrap()
+}
+
+#[test]
+fn new_photos_and_reset_get_the_latest_process() {
+    let mut s = Session::with_demo();
+    assert!(s.catalog.photos().all(|p| p.develop.process == ProcessVersion::LATEST));
+    let ids: Vec<PhotoId> = s.visible_cloned().into_iter().take(2).collect();
+    put(&mut s, ids[0], OLDER, 0.7);
+    put(&mut s, ids[1], NEWER, -0.3);
+    // a section or a slider reset leaves the process alone
+    select(&mut s, &ids[1..]);
+    s.execute("develop.resetSection", &json!({"section": "light"})).unwrap();
+    s.execute("develop.set", &json!({"control": "light.exposure", "value": 0.2})).unwrap();
+    s.execute("develop.resetControl", &json!({"control": "light.exposure"})).unwrap();
+    let d = s.develop_of(ids[1]).unwrap();
+    assert_eq!((d.process, d.light.exposure), (NEWER, 0.0));
+    // a full reset is a fresh start on the latest process, also from a newer one
+    select(&mut s, &ids);
+    s.execute("develop.reset", &json!({})).unwrap();
+    for id in &ids {
+        assert_eq!(process(&s, *id), ProcessVersion::LATEST);
+        assert!(!s.catalog.photo(*id).unwrap().is_edited());
+    }
+    // a photo whose default preset's look was recorded on an older process
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(process(&s, ids[0]), OLDER);
+    let mut p = (**s.catalog.photo(ids[0]).unwrap()).clone();
+    let mut look = p.camera_defaults();
+    look.light.contrast = 20.0;
+    look.process = OLDER;
+    p.import_look = Some(Arc::new(look));
+    s.catalog.apply(lightcraft_catalog::Op::RemovePhoto { id: p.id }).unwrap();
+    s.catalog.apply(lightcraft_catalog::Op::AddPhoto { photo: Box::new(p) }).unwrap();
+    s.execute("develop.reset", &json!({"ids": [ids[0].0]})).unwrap();
+    let d = s.develop_of(ids[0]).unwrap();
+    assert_eq!((d.process, d.light.contrast), (ProcessVersion::LATEST, 20.0));
+}
+
+#[test]
+fn update_to_current_process_is_one_undo_step_and_only_when_needed() {
+    let mut s = Session::with_demo();
+    let ids: Vec<PhotoId> = s.visible_cloned().into_iter().take(3).collect();
+    select(&mut s, &ids);
+    // everything is current: disabled, with the reason
+    let info = update_info(&s);
+    assert!(!info.enabled && info.disabled_reason.as_deref().is_some_and(|r| r.contains("already on the current process")), "{info:?}");
+    assert!(matches!(s.execute("develop.updateProcess", &json!({})), Err(EngineError::Disabled(..))));
+    // in the Photo menu
+    assert_eq!(info.menu, vec!["Photo"]);
+
+    put(&mut s, ids[0], OLDER, 0.5);
+    put(&mut s, ids[1], OLDER, -0.5);
+    put(&mut s, ids[2], NEWER, 0.25);
+    select(&mut s, &ids);
+    assert!(update_info(&s).enabled);
+    let undo = s.undo.len();
+    let r = s.execute("develop.updateProcess", &json!({})).unwrap();
+    assert_eq!(r, json!({"changed": 2, "process": ProcessVersion::LATEST.0}));
+    assert_eq!(s.undo.len(), undo + 1, "one undo step");
+    assert_eq!(s.undo.last().unwrap().label, "Update to Current Process");
+    assert_eq!([process(&s, ids[0]), process(&s, ids[1])], [ProcessVersion::LATEST; 2]);
+    assert_eq!(process(&s, ids[2]), NEWER, "a newer process is never downgraded");
+    assert_eq!(s.develop_of(ids[0]).unwrap().light.exposure, 0.5, "the sliders keep their values");
+    assert_eq!(s.catalog.photo(ids[1]).unwrap().history.last().unwrap().label, "Update to Current Process");
+    assert!(!update_info(&s).enabled, "nothing left to update");
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!([process(&s, ids[0]), process(&s, ids[1])], [OLDER; 2]);
+    s.execute("edit.redo", &json!({})).unwrap();
+    assert_eq!([process(&s, ids[0]), process(&s, ids[1])], [ProcessVersion::LATEST; 2]);
+    // a photo on a newer process alone: nothing to update
+    select(&mut s, &ids[2..]);
+    assert!(!update_info(&s).enabled);
+    // the active photo when nothing else is selected
+    put(&mut s, ids[0], OLDER, 0.5);
+    s.selection = crate::Selection { ids: Vec::new(), active: Some(ids[0]) };
+    assert!(update_info(&s).enabled);
+    assert_eq!(s.execute("develop.updateProcess", &json!({})).unwrap()["changed"], 1);
+}
+
+#[test]
+fn virtual_copies_inherit_the_process() {
+    let mut s = Session::with_demo();
+    let src = s.visible_cloned()[0];
+    put(&mut s, src, NEWER, 0.4);
+    select(&mut s, &[src]);
+    let r = s.execute("photo.virtualCopy", &json!({})).unwrap();
+    let copy = PhotoId(r["ids"][0].as_u64().unwrap());
+    assert_eq!(process(&s, copy), NEWER);
+    assert!(s.develop_of(copy).unwrap() == s.develop_of(src).unwrap());
+}
+
+#[test]
+fn copy_paste_sync_presets_and_auto_sync_keep_each_photos_process() {
+    let mut s = Session::with_demo();
+    let ids: Vec<PhotoId> = s.visible_cloned().into_iter().take(3).collect();
+    let (src, a, b) = (ids[0], ids[1], ids[2]);
+    put(&mut s, src, NEWER, 1.0);
+    put(&mut s, b, OLDER, 0.0);
+    select(&mut s, &[src]);
+    s.execute("develop.copy", &json!({"groups": lightcraft_develop::SettingsGroup::ALL})).unwrap();
+    select(&mut s, &[a, b]);
+    s.execute("develop.paste", &json!({})).unwrap();
+    assert_eq!([process(&s, a), process(&s, b)], [ProcessVersion::LATEST, OLDER]);
+    assert_eq!(s.develop_of(b).unwrap().light.exposure, 1.0, "the values are pasted");
+    // sync from the active photo
+    put(&mut s, src, NEWER, -1.0);
+    s.selection = crate::Selection { ids: vec![src, a, b], active: Some(src) };
+    s.execute("develop.sync", &json!({})).unwrap();
+    assert_eq!([process(&s, a), process(&s, b)], [ProcessVersion::LATEST, OLDER]);
+    assert_eq!(s.develop_of(a).unwrap().light.exposure, -1.0);
+    // a preset made from the photo
+    select(&mut s, &[src]);
+    // (not Grain: its integer seed doesn't survive scaling, a separate issue)
+    let groups: Vec<_> = lightcraft_develop::SettingsGroup::ALL.into_iter().filter(|g| *g != lightcraft_develop::SettingsGroup::Grain).collect();
+    let pid = s.execute("preset.create", &json!({"name": "Everything", "groups": groups})).unwrap()["id"].clone();
+    put(&mut s, b, OLDER, 0.0);
+    select(&mut s, &[b]);
+    s.execute("preset.apply", &json!({"id": pid, "amount": 50})).unwrap();
+    assert_eq!(process(&s, b), OLDER);
+    assert_eq!(s.develop_of(b).unwrap().light.exposure, -0.5, "the preset applied (at 50 %)");
+    // Auto Sync carries an edit of the active photo, not its process
+    s.selection = crate::Selection { ids: vec![src, a], active: Some(src) };
+    s.execute("develop.autoSync", &json!({"on": true})).unwrap();
+    s.execute("develop.merge", &json!({"settings": {"process": OLDER.0, "light": {"contrast": 15}}})).unwrap();
+    assert_eq!(process(&s, src), OLDER, "Apply Settings JSON sets what it names");
+    let d = s.develop_of(a).unwrap();
+    assert_eq!((d.process, d.light.contrast), (ProcessVersion::LATEST, 15.0));
+}
+
+#[test]
+fn process_numbers_survive_a_reopen_and_develop_get_reports_them() {
+    let dir = std::env::temp_dir().join(format!("lc-process-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let mut s = Session::new();
+    s.open_library(&dir, true).unwrap();
+    let ids: Vec<PhotoId> = s.visible_cloned().into_iter().take(2).collect();
+    select(&mut s, &ids[..1]);
+    s.execute("develop.merge", &json!({"settings": {"process": NEWER.0, "light": {"exposure": 0.5}}})).unwrap();
+    assert_eq!(s.execute("develop.get", &json!({"id": ids[0].0})).unwrap()["process"], json!(NEWER.0));
+    assert_eq!(s.execute("develop.get", &json!({"id": ids[1].0})).unwrap()["process"], json!(ProcessVersion::LATEST.0));
+    // it renders (with the newest process this build has)
+    assert!(s.render_now(ids[0], 48, 48).is_ok());
+    let expect = s.catalog.to_snapshot();
+    drop(s);
+    let mut s = Session::new();
+    s.open_library(&dir, false).unwrap();
+    assert_eq!(s.catalog.to_snapshot(), expect);
+    assert_eq!(process(&s, ids[0]), NEWER);
+    assert_eq!(process(&s, ids[1]), ProcessVersion::LATEST);
+    drop(s);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn sidecars_keep_the_process_and_interchange_edits_get_the_latest() {
+    use crate::sidecar::{DevelopPatch, merge_into, parse_sidecar, sidecar_packet};
+    let mut s = Session::with_demo();
+    let id = s.visible_cloned()[0];
+    // our own settings round-trip with their process; V1 settings say nothing (as before process
+    // versions, so sidecars written then read as V1)
+    put(&mut s, id, NEWER, 0.3);
+    let p = s.catalog.photo(id).unwrap().clone();
+    let back = parse_sidecar(&sidecar_packet(&p, &s.catalog), crate::crs::Target::Rendered).unwrap();
+    let Some(DevelopPatch::Full(d)) = &back.develop else { panic!("no lc:settings") };
+    assert_eq!((d.process, d.light.exposure), (NEWER, 0.3));
+    put(&mut s, id, ProcessVersion::V1, 0.3);
+    let packet = sidecar_packet(s.catalog.photo(id).unwrap(), &s.catalog);
+    assert!(!packet.contains("process"), "{packet}");
+    let Some(DevelopPatch::Full(d)) = parse_sidecar(&packet, crate::crs::Target::Rendered).unwrap().develop else { panic!("no lc:settings") };
+    assert_eq!(d.process, ProcessVersion::V1);
+    // a damaged process value reads as V1 and costs nothing else: the sidecar's edits still come back
+    for bad in ["-1", "1.5", "\"two\"", "null", "4294967296"] {
+        let json = format!(r#"{{"process": {bad}, "light": {{"exposure": 0.5}}}}"#);
+        let packet = lightcraft_meta::write_xmp(&lightcraft_meta::Metadata::default(), Some(&json));
+        let Some(DevelopPatch::Full(d)) = parse_sidecar(&packet, crate::crs::Target::Rendered).unwrap().develop else {
+            panic!("{bad}: the edit was dropped")
+        };
+        assert_eq!((d.process, d.light.exposure), (ProcessVersion::V1, 0.5), "{bad}");
+    }
+    // `crs:` edits (other raw developers, Lightroom): their ProcessVersion numbers another
+    // renderer and is ignored; mapped like a preset, they leave the photo's process as it is,
+    // which for a newly imported photo is the latest
+    let xmp = r#"<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
+  <rdf:Description rdf:about="" xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/"
+    crs:ProcessVersion="11.0" crs:Exposure2012="+1.10" crs:Contrast2012="+20"/></rdf:RDF></x:xmpmeta>"#;
+    let sc = parse_sidecar(xmp, crate::crs::Target::RawAbsolute).unwrap();
+    let Some(DevelopPatch::Partial(partial)) = &sc.develop else { panic!("no crs: edit") };
+    assert!(partial.get("process").is_none(), "{partial}");
+    let mut fresh = Photo::new(PhotoId(999), Source::Demo { scene: 1 }, "a.jpg", "JPEG", 10, 10, "2026-10-09T00:00:00");
+    assert!(merge_into(&mut fresh, &sc, "2026-10-09T00:00:00"));
+    assert_eq!((fresh.develop.process, fresh.develop.light.exposure), (ProcessVersion::LATEST, 1.1));
+    let mut older = fresh.clone();
+    older.develop = Arc::new(DevelopSettings { process: OLDER, ..Default::default() });
+    assert!(merge_into(&mut older, &sc, "2026-10-09T00:00:00"));
+    assert_eq!(older.develop.process, OLDER);
+}
+
+#[test]
+fn update_to_current_process_checks_named_photos_not_the_selection() {
+    let mut s = Session::with_demo();
+    let ids: Vec<PhotoId> = s.visible_cloned().into_iter().take(3).collect();
+    let (old, current, other) = (ids[0], ids[1], ids[2]);
+    put(&mut s, old, OLDER, 0.5);
+    // a different, current photo is selected: the menu item is off, but naming the photo works
+    select(&mut s, &[current]);
+    assert!(!update_info(&s).enabled);
+    let undo = s.undo.len();
+    assert_eq!(s.execute("develop.updateProcess", &json!({"ids": [old.0]})).unwrap()["changed"], 1);
+    assert_eq!(s.undo.len(), undo + 1);
+    assert_eq!(process(&s, old), ProcessVersion::LATEST);
+    assert_eq!(s.develop_of(old).unwrap().light.exposure, 0.5);
+    // with nothing selected at all, by `ids` or `id`
+    put(&mut s, old, OLDER, 0.5);
+    put(&mut s, other, OLDER, 0.0);
+    s.selection = crate::Selection { ids: Vec::new(), active: None };
+    assert!(!update_info(&s).enabled, "no selection");
+    assert_eq!(s.execute("develop.updateProcess", &json!({"ids": [old.0, current.0]})).unwrap()["changed"], 1);
+    assert_eq!(s.execute("develop.updateProcess", &json!({"id": other.0})).unwrap()["changed"], 1);
+    assert_eq!([process(&s, old), process(&s, other)], [ProcessVersion::LATEST; 2]);
+    // named photos are validated: all current, unknown, malformed or none
+    let err = s.execute("develop.updateProcess", &json!({"ids": [current.0]})).unwrap_err();
+    assert!(matches!(&err, EngineError::Disabled(_, why) if why.contains("already on the current process")), "{err}");
+    for bad in [json!({"ids": [99_999]}), json!({"ids": ["x"]}), json!({"ids": "x"}), json!({"ids": []}), json!({"id": -1})] {
+        assert!(matches!(s.execute("develop.updateProcess", &bad), Err(EngineError::BadParams { .. })), "{bad}");
+    }
+    // `ids: null` names nothing: the selection decides (and there is none)
+    assert!(matches!(s.execute("develop.updateProcess", &json!({"ids": null})), Err(EngineError::Disabled(..))));
+}
diff --git a/crates/engine/src/tests_sync.rs b/crates/engine/src/tests_sync.rs
new file mode 100644
index 00000000..22dce0af
--- /dev/null
+++ b/crates/engine/src/tests_sync.rs
@@ -0,0 +1,623 @@
+//! Synchronize Folder: bring a library folder up to date with what is on disk (see
+//! [`crate::sync`]).
+//!
+//! Scenarios, in the words of someone whose folder changed outside LightCraft:
+//!
+//! * Given a folder of the library, when files were added to it (or to a folder inside it), the
+//!   scan lists them as new; files the library already has, by path or by content, are not new.
+//! * When a photo's file was deleted or moved away, the scan lists the photo as missing.
+//! * When another app saved a photo's XMP sidecar after the photo came into the library, and the
+//!   sidecar says something the library doesn't, the scan lists a metadata update; a sidecar older
+//!   than that, or one that agrees with the library, is not an update.
+//! * Scanning changes nothing.
+//! * Synchronizing imports the new files; it removes missing photos (to Recently Deleted) and
+//!   reads metadata updates only when asked. Whatever it does is one undo step.
+//! * Only a folder of the library can be synchronized, never the whole startup disk.
+
+use std::path::{Path, PathBuf};
+use std::time::{Duration, SystemTime};
+
+use serde_json::{Value, json};
+
+use crate::Session;
+
+/// A scratch folder that goes away with the test, however it ends.
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new(tag: &str) -> Scratch {
+        let dir = std::env::temp_dir().join(format!("lc-sync-{tag}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        Scratch(dir)
+    }
+    fn path(&self, rel: &str) -> String {
+        self.0.join(rel).to_string_lossy().to_string()
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// A small procedural PNG (distinct per seed).
+fn write_png(path: &str, seed: u8) {
+    let (w, h) = (24usize, 16usize);
+    let data: Vec<[u8; 4]> = (0..w * h).map(|i| [(i % w * 9) as u8, (i / w * 13) as u8, seed, 255]).collect();
+    let img = lightcraft_raster::Rgba8 { width: w, height: h, data };
+    let bytes = lightcraft_codecs::encode_png(&lightcraft_codecs::EncodeImage::rgba8(&img), &lightcraft_codecs::EncodeMeta::default()).unwrap();
+    std::fs::create_dir_all(Path::new(path).parent().unwrap()).unwrap();
+    std::fs::write(path, bytes).unwrap();
+}
+
+fn sidecar(rating: u8) -> String {
+    format!(
+        r#"<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
+  <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmp:Rating="{rating}"/>
+</rdf:RDF></x:xmpmeta>"#
+    )
+}
+
+/// Write `a.xmp` beside `a.png`, dated `age` before now.
+fn write_sidecar(png: &str, rating: u8, age: Duration) {
+    let xmp = Path::new(png).with_extension("xmp");
+    std::fs::write(&xmp, sidecar(rating)).unwrap();
+    let f = std::fs::File::options().write(true).open(&xmp).unwrap();
+    f.set_modified(SystemTime::now() - age).unwrap();
+}
+
+/// A library holding `trip/a.png` and `trip/day1/b.png`, the session clock at a fixed past time.
+fn library(dir: &Scratch) -> Session {
+    write_png(&dir.path("trip/a.png"), 1);
+    write_png(&dir.path("trip/day1/b.png"), 2);
+    let mut s = Session::new().with_fs();
+    s.execute("library.import", &json!({"paths": [dir.path("trip")]})).unwrap();
+    assert_eq!(s.catalog.len(), 2);
+    s
+}
+
+fn paths(v: &Value, key: &str) -> Vec<String> {
+    let mut out: Vec<String> = v[key].as_array().unwrap().iter().map(|c| c["path"].as_str().unwrap().to_string()).collect();
+    out.sort();
+    out
+}
+
+/// What the library holds: each photo's file, whether it is in the library, and its rating.
+fn holdings(s: &Session) -> Vec<(String, bool, u8)> {
+    let mut v: Vec<(String, bool, u8)> = s.catalog.photos().map(|p| (p.file_name.clone(), p.in_library(), p.rating)).collect();
+    v.sort();
+    v
+}
+
+fn scan(s: &mut Session, path: &str) -> Value {
+    s.execute("folder.scanChanges", &json!({"path": path})).unwrap()
+}
+
+#[test]
+fn an_unchanged_folder_has_no_changes() {
+    let dir = Scratch::new("none");
+    let mut s = library(&dir);
+    let r = scan(&mut s, &dir.path("trip"));
+    assert!(paths(&r, "new").is_empty() && paths(&r, "missing").is_empty() && paths(&r, "metadata").is_empty(), "{r}");
+}
+
+#[test]
+fn files_added_to_the_folder_or_a_folder_inside_it_are_new() {
+    let dir = Scratch::new("new");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    write_png(&dir.path("trip/day2/d.png"), 4);
+    // the same bytes as a photo the library has: not new
+    std::fs::copy(dir.path("trip/a.png"), dir.path("trip/a-copy.png")).unwrap();
+    let before = s.catalog.to_snapshot();
+    let r = scan(&mut s, &dir.path("trip"));
+    assert_eq!(paths(&r, "new"), vec![dir.path("trip/c.png"), dir.path("trip/day2/d.png")], "{r}");
+    assert_eq!(r["duplicates"], 1, "{r}");
+    assert_eq!(s.catalog.to_snapshot(), before, "scanning changes nothing");
+}
+
+#[test]
+fn a_photo_whose_file_is_gone_is_missing() {
+    let dir = Scratch::new("missing");
+    let mut s = library(&dir);
+    std::fs::remove_file(dir.path("trip/day1/b.png")).unwrap();
+    let r = scan(&mut s, &dir.path("trip"));
+    assert_eq!(paths(&r, "missing"), vec![dir.path("trip/day1/b.png")], "{r}");
+    assert!(r["missing"][0]["id"].is_u64());
+}
+
+#[test]
+fn a_sidecar_saved_by_another_app_is_a_metadata_update() {
+    let dir = Scratch::new("meta");
+    let mut s = library(&dir);
+    // saved now: after the photo came in (the session clock says 2026-09-30)
+    write_sidecar(&dir.path("trip/a.png"), 4, Duration::ZERO);
+    let r = scan(&mut s, &dir.path("trip"));
+    assert_eq!(paths(&r, "metadata"), vec![dir.path("trip/a.png")], "{r}");
+}
+
+#[test]
+fn an_old_sidecar_or_one_that_agrees_is_no_update() {
+    let dir = Scratch::new("meta-old");
+    let mut s = library(&dir);
+    // older than the import: whatever it says, the library has had its say since
+    write_sidecar(&dir.path("trip/a.png"), 4, Duration::from_secs(400 * 24 * 3600));
+    // new, but says what the library already knows
+    write_sidecar(&dir.path("trip/day1/b.png"), 0, Duration::ZERO);
+    let r = scan(&mut s, &dir.path("trip"));
+    assert!(paths(&r, "metadata").is_empty(), "{r}");
+}
+
+#[test]
+fn synchronizing_imports_new_files_and_leaves_the_rest_unless_asked() {
+    let dir = Scratch::new("sync");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    std::fs::remove_file(dir.path("trip/day1/b.png")).unwrap();
+    write_sidecar(&dir.path("trip/a.png"), 5, Duration::ZERO);
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip")})).unwrap();
+    assert_eq!((r["imported"].as_u64(), r["removed"].as_u64(), r["read"].as_u64()), (Some(1), Some(0), Some(0)), "{r}");
+    assert_eq!(s.catalog.photos().filter(|p| p.in_library()).count(), 3, "the missing photo stays");
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap();
+    assert_eq!(a.rating, 0, "metadata is read only when asked");
+}
+
+#[test]
+fn synchronizing_everything_is_one_undo_step() {
+    let dir = Scratch::new("sync-all");
+    let mut s = library(&dir);
+    let before = holdings(&s);
+    write_png(&dir.path("trip/c.png"), 3);
+    std::fs::remove_file(dir.path("trip/day1/b.png")).unwrap();
+    write_sidecar(&dir.path("trip/a.png"), 5, Duration::ZERO);
+    let r =
+        s.execute("folder.synchronize", &json!({"path": dir.path("trip"), "importNew": true, "removeMissing": true, "readMetadata": true})).unwrap();
+    assert_eq!((r["imported"].as_u64(), r["removed"].as_u64(), r["read"].as_u64()), (Some(1), Some(1), Some(1)), "{r}");
+    let library: Vec<String> = s.catalog.photos().filter(|p| p.in_library()).map(|p| p.file_name.clone()).collect();
+    assert_eq!(library.len(), 2, "b went to Recently Deleted: {library:?}");
+    assert_eq!(s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().rating, 5, "the sidecar was read");
+    let undo = s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(undo["undone"], "Synchronize Folder");
+    assert_eq!(holdings(&s), before, "one undo step puts everything back");
+}
+
+#[test]
+fn a_folder_with_no_changes_synchronizes_without_an_undo_step() {
+    let dir = Scratch::new("sync-none");
+    let mut s = library(&dir);
+    let steps = s.undo.len();
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip"), "removeMissing": true, "readMetadata": true})).unwrap();
+    assert_eq!((r["imported"].as_u64(), r["removed"].as_u64(), r["read"].as_u64()), (Some(0), Some(0), Some(0)), "{r}");
+    assert_eq!(s.undo.len(), steps);
+}
+
+#[test]
+fn only_a_folder_of_the_library_is_synchronized() {
+    let dir = Scratch::new("refused");
+    let mut s = library(&dir);
+    std::fs::create_dir_all(dir.0.join("elsewhere")).unwrap();
+    for (cmd, p, why) in [
+        ("folder.scanChanges", json!({}), "missing path"),
+        ("folder.scanChanges", json!({"path": "  "}), "blank path"),
+        ("folder.scanChanges", json!({"path": dir.path("elsewhere")}), "no photo was imported from it"),
+        ("folder.scanChanges", json!({"path": "/"}), "the startup disk"),
+        ("folder.synchronize", json!({"path": dir.path("elsewhere")}), "no photo was imported from it"),
+        ("folder.synchronize", json!({"path": "/"}), "the startup disk"),
+    ] {
+        assert!(s.execute(cmd, &p).is_err(), "{cmd}: {why}");
+    }
+}
+
+#[test]
+fn synchronizing_acts_on_the_changes_just_scanned() {
+    let dir = Scratch::new("cached");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    let r = scan(&mut s, &dir.path("trip"));
+    assert_eq!(paths(&r, "new").len(), 1);
+    // arrived after the scan the person was shown: not part of what they agreed to
+    write_png(&dir.path("trip/d.png"), 4);
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip")})).unwrap();
+    assert_eq!(r["imported"], 1, "{r}");
+    // the scan is used once; the next synchronize looks again
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip")})).unwrap();
+    assert_eq!(r["imported"], 1, "d.png now: {r}");
+}
+
+#[test]
+fn a_scan_is_stale_once_the_library_changed() {
+    let dir = Scratch::new("stale");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    scan(&mut s, &dir.path("trip"));
+    // c.png comes in some other way between the scan and the synchronize
+    s.execute("library.import", &json!({"paths": [dir.path("trip/c.png")]})).unwrap();
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip")})).unwrap();
+    assert_eq!(r["imported"], 0, "the library changed: it looked again: {r}");
+}
+
+#[test]
+fn a_cancelled_scan_stops_checking_files() {
+    let dir = Scratch::new("cancel");
+    let mut s = library(&dir);
+    std::fs::remove_file(dir.path("trip/day1/b.png")).unwrap();
+    let input = crate::sync::SyncInput::new(&mut s, &dir.path("trip"), false).unwrap();
+    let progress = crate::sync::SyncProgress::default();
+    progress.files.cancel.store(true, std::sync::atomic::Ordering::Relaxed);
+    let c = crate::sync::scan_with(input, &progress);
+    assert!(c.missing.is_empty() && c.metadata.is_empty(), "{c:?}");
+}
+
+#[test]
+fn many_photos_are_checked_in_parallel_with_the_same_answer() {
+    let dir = Scratch::new("many");
+    for i in 0..40u8 {
+        write_png(&dir.path(&format!("big/{i:02}.png")), i);
+    }
+    let mut s = Session::new().with_fs();
+    s.execute("library.import", &json!({"paths": [dir.path("big")]})).unwrap();
+    for i in (0..40u8).step_by(3) {
+        std::fs::remove_file(dir.path(&format!("big/{i:02}.png"))).unwrap();
+    }
+    for i in (1..40u8).step_by(5) {
+        write_sidecar(&dir.path(&format!("big/{i:02}.png")), 2, Duration::ZERO);
+    }
+    let r = scan(&mut s, &dir.path("big"));
+    let expect_missing: Vec<String> = (0..40u8).step_by(3).map(|i| dir.path(&format!("big/{i:02}.png"))).collect();
+    let expect_meta: Vec<String> = (1..40u8).step_by(5).filter(|i| i % 3 != 0).map(|i| dir.path(&format!("big/{i:02}.png"))).collect();
+    assert_eq!(paths(&r, "missing"), expect_missing);
+    assert_eq!(paths(&r, "metadata"), expect_meta);
+}
+
+#[test]
+fn a_folder_that_is_not_there_is_not_scanned_as_if_everything_went_missing() {
+    let dir = Scratch::new("offline");
+    let mut s = library(&dir);
+    // an unplugged disk, or a folder moved away whole
+    std::fs::rename(dir.0.join("trip"), dir.0.join("trip-elsewhere")).unwrap();
+    for cmd in ["folder.scanChanges", "folder.synchronize"] {
+        let e = s.execute(cmd, &json!({"path": dir.path("trip"), "removeMissing": true})).unwrap_err().to_string();
+        assert!(e.contains("not there"), "{cmd}: {e}");
+    }
+    assert_eq!(s.catalog.photos().filter(|p| p.in_library()).count(), 2, "nothing was removed");
+}
+
+#[test]
+fn a_whole_disk_or_a_folder_holding_disks_is_synchronized_only_on_request() {
+    let dir = Scratch::new("disks");
+    let mut s = library(&dir);
+    // a library photo on another disk makes the scratch folder's root look like it holds disks
+    let id = s.catalog.alloc_photo_id();
+    let p = lightcraft_catalog::Photo::new(
+        id,
+        lightcraft_catalog::Source::File { path: "/Volumes/nas/x.jpg".into() },
+        "x.jpg",
+        "JPEG",
+        6,
+        4,
+        "2026-01-01",
+    );
+    s.catalog.apply(lightcraft_catalog::Op::AddPhoto { photo: Box::new(p) }).unwrap();
+    if std::path::Path::new("/Volumes").is_dir() {
+        let e = s.execute("folder.scanChanges", &json!({"path": "/Volumes"})).unwrap_err().to_string();
+        assert!(e.contains("disk: true"), "{e}");
+    }
+    // a folder inside one disk needs nothing more
+    assert!(s.execute("folder.scanChanges", &json!({"path": dir.path("trip")})).is_ok());
+}
+
+#[test]
+fn a_file_only_browsed_in_local_is_new_and_joins_the_library() {
+    let dir = Scratch::new("local");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    // looking at the folder in Local catalogues c.png as a browse record, not a library photo
+    s.execute("library.browse", &json!({"path": dir.path("trip")})).unwrap();
+    assert!(s.catalog.photos().any(|p| p.file_name == "c.png" && p.local));
+    let r = scan(&mut s, &dir.path("trip"));
+    assert_eq!(paths(&r, "new"), vec![dir.path("trip/c.png")], "{r}");
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip")})).unwrap();
+    assert_eq!(r["imported"], 1, "{r}");
+    assert!(s.catalog.photos().any(|p| p.file_name == "c.png" && p.in_library()));
+}
+
+#[test]
+fn a_file_renamed_or_moved_inside_the_folder_is_relinked_not_lost() {
+    let dir = Scratch::new("moved");
+    let mut s = library(&dir);
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    s.execute("photo.rate", &json!({"ids": [a.0], "rating": 4})).unwrap();
+    std::fs::rename(dir.path("trip/a.png"), dir.path("trip/day1/a-renamed.png")).unwrap();
+    let r = scan(&mut s, &dir.path("trip"));
+    assert!(paths(&r, "missing").is_empty() && paths(&r, "new").is_empty(), "{r}");
+    assert_eq!(r["moved"][0]["id"], a.0, "{r}");
+    assert_eq!(r["moved"][0]["to"], dir.path("trip/day1/a-renamed.png"), "{r}");
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip"), "removeMissing": true})).unwrap();
+    assert_eq!((r["relinked"].as_u64(), r["removed"].as_u64(), r["imported"].as_u64()), (Some(1), Some(0), Some(0)), "{r}");
+    let p = s.catalog.photo(a).unwrap();
+    assert!(p.in_library() && p.rating == 4, "the same photo, edits and all");
+    assert_eq!(p.source, lightcraft_catalog::Source::File { path: dir.path("trip/day1/a-renamed.png") });
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.catalog.photo(a).unwrap().source, lightcraft_catalog::Source::File { path: dir.path("trip/a.png") });
+}
+
+#[test]
+fn synchronizing_is_one_undo_step_even_with_a_full_undo_history() {
+    let dir = Scratch::new("full-undo");
+    let mut s = library(&dir);
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    // a long session: the history is at its limit and drops its oldest steps
+    for i in 0..1005u32 {
+        s.execute("photo.rate", &json!({"ids": [a.0], "rating": i % 5})).unwrap();
+    }
+    let before = holdings(&s);
+    write_png(&dir.path("trip/c.png"), 3);
+    std::fs::remove_file(dir.path("trip/day1/b.png")).unwrap();
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip"), "removeMissing": true})).unwrap();
+    assert_eq!((r["imported"].as_u64(), r["removed"].as_u64()), (Some(1), Some(1)), "{r}");
+    let undo = s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(undo["undone"], "Synchronize Folder");
+    assert_eq!(holdings(&s), before, "one step undoes the import and the removal");
+}
+
+#[test]
+fn a_scan_stays_current_while_only_other_folders_change() {
+    let dir = Scratch::new("current");
+    let mut s = library(&dir);
+    write_png(&dir.path("other/x.png"), 9);
+    s.execute("library.import", &json!({"paths": [dir.path("other")]})).unwrap();
+    write_png(&dir.path("trip/c.png"), 3);
+    scan(&mut s, &dir.path("trip"));
+    // something elsewhere in the library changes while the dialog is open (a background import…)
+    let x = s.catalog.photos().find(|p| p.file_name == "x.png").unwrap().id;
+    s.execute("photo.rate", &json!({"ids": [x.0], "rating": 3})).unwrap();
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip"), "scanned": true})).unwrap();
+    assert_eq!(r["imported"], 1, "{r}");
+}
+
+#[test]
+fn a_change_to_the_folders_photos_makes_the_scan_stale() {
+    let dir = Scratch::new("stale-folder");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    scan(&mut s, &dir.path("trip"));
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    s.execute("photo.rate", &json!({"ids": [a.0], "rating": 2})).unwrap();
+    // the dialog asks for exactly what it showed: refused, never redone on the spot
+    let e = s.execute("folder.synchronize", &json!({"path": dir.path("trip"), "scanned": true})).unwrap_err().to_string();
+    assert!(e.contains("scan again"), "{e}");
+    assert_eq!(s.catalog.photos().filter(|p| p.in_library()).count(), 2, "nothing was done");
+    // an agent that just asks to synchronize gets a fresh scan
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip")})).unwrap();
+    assert_eq!(r["imported"], 1, "{r}");
+}
+
+#[test]
+fn the_progress_counts_the_photos_checked_too() {
+    use std::sync::atomic::Ordering::Relaxed;
+    let dir = Scratch::new("progress");
+    let mut s = library(&dir);
+    let input = crate::sync::SyncInput::new(&mut s, &dir.path("trip"), false).unwrap();
+    let progress = crate::sync::SyncProgress::default();
+    crate::sync::scan_with(input, &progress);
+    assert_eq!((progress.checked.load(Relaxed), progress.to_check.load(Relaxed)), (2, 2));
+    let (done, total) = progress.counts();
+    assert!(done == total && total >= 2, "{done}/{total}");
+}
+
+#[test]
+fn a_sidecar_the_library_wrote_itself_is_no_update() {
+    let dir = Scratch::new("autowrite");
+    let mut s = library(&dir);
+    s.execute("library.xmpPreferences", &json!({"autoWrite": true})).unwrap();
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    s.execute("photo.rate", &json!({"ids": [a.0], "rating": 3})).unwrap();
+    s.execute("photo.label", &json!({"ids": [a.0], "label": "green"})).unwrap();
+    assert!(Path::new(&dir.path("trip/a.xmp")).exists(), "auto-write wrote the sidecar");
+    let r = scan(&mut s, &dir.path("trip"));
+    assert!(paths(&r, "metadata").is_empty(), "{r}");
+}
+
+#[test]
+fn a_renamed_photo_with_no_content_hash_is_relinked_when_its_file_is_unmistakable() {
+    // as photos taken over from a Lightroom catalog are: no hash on record
+    let dir = Scratch::new("nohash");
+    let mut s = library(&dir);
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    let mut p = (**s.catalog.photo(a).unwrap()).clone();
+    p.content_hash = None;
+    s.catalog.apply(lightcraft_catalog::Op::RemovePhoto { id: a }).unwrap();
+    s.catalog.apply(lightcraft_catalog::Op::AddPhoto { photo: Box::new(p) }).unwrap();
+    std::fs::rename(dir.path("trip/a.png"), dir.path("trip/a-renamed.png")).unwrap();
+    let r = scan(&mut s, &dir.path("trip"));
+    assert_eq!(r["moved"][0]["to"], dir.path("trip/a-renamed.png"), "{r}");
+    assert!(paths(&r, "missing").is_empty() && paths(&r, "new").is_empty(), "{r}");
+}
+
+#[test]
+fn renamed_duplicates_are_each_relinked() {
+    let dir = Scratch::new("dups");
+    let mut s = library(&dir);
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    s.execute("photo.duplicate", &json!({"ids": [a.0]})).unwrap();
+    assert!(Path::new(&dir.path("trip/a-copy.png")).exists());
+    std::fs::rename(dir.path("trip/a.png"), dir.path("trip/one.png")).unwrap();
+    std::fs::rename(dir.path("trip/a-copy.png"), dir.path("trip/two.png")).unwrap();
+    let r = scan(&mut s, &dir.path("trip"));
+    assert_eq!(r["moved"].as_array().map(Vec::len), Some(2), "{r}");
+    assert!(paths(&r, "missing").is_empty(), "{r}");
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip")})).unwrap();
+    assert_eq!(r["relinked"], 2, "{r}");
+}
+
+#[test]
+fn face_regions_found_meanwhile_leave_the_scan_current() {
+    let dir = Scratch::new("faces");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    scan(&mut s, &dir.path("trip"));
+    // background face search adds a region to a photo of the folder
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    let mut meta = s.catalog.photo(a).unwrap().meta.clone();
+    meta.regions.push(lightcraft_meta::Region { rect: Default::default(), kind: lightcraft_meta::RegionKind::Face, name: None, description: None });
+    s.catalog.apply(lightcraft_catalog::Op::SetMeta { id: a, meta: Box::new(meta) }).unwrap();
+    let r = s.execute("folder.synchronize", &json!({"path": dir.path("trip"), "scanned": true})).unwrap();
+    assert_eq!(r["imported"], 1, "{r}");
+}
+
+/// Synchronizing in halves, as the app does it: readied on the UI thread without touching the
+/// disk, the work (every file read) on a worker, each step committed back on the UI thread.
+fn sync_in_halves(s: &mut Session, path: &str, choice: crate::sync::SyncChoice) -> crate::sync::SyncReport {
+    let changes = crate::sync::scan(s, path, false).unwrap();
+    let (work, mut commit) = crate::sync::SyncJob::start(s, changes, choice).unwrap();
+    let progress = crate::sync::SyncProgress::default();
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || work.run(&progress, |step| tx.send(step).is_ok())).join().unwrap();
+    for step in rx {
+        commit.apply(s, step);
+    }
+    commit.finish(s)
+}
+
+#[test]
+fn the_work_of_synchronizing_runs_apart_from_its_commits() {
+    let dir = Scratch::new("halves");
+    let mut s = library(&dir);
+    let before = holdings(&s);
+    write_png(&dir.path("trip/c.png"), 3);
+    std::fs::remove_file(dir.path("trip/day1/b.png")).unwrap();
+    write_sidecar(&dir.path("trip/a.png"), 5, Duration::ZERO);
+    let choice = crate::sync::SyncChoice { import_new: true, relink_moved: true, remove_missing: true, read_metadata: true };
+    let r = sync_in_halves(&mut s, &dir.path("trip"), choice);
+    assert_eq!((r.imported, r.removed, r.read), (1, 1, 1), "{r:?}");
+    assert_eq!(s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().rating, 5);
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(holdings(&s), before, "still one undo step");
+}
+
+#[test]
+fn the_work_checks_again_that_a_new_file_is_still_there() {
+    let dir = Scratch::new("ready");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    let changes = crate::sync::scan(&mut s, &dir.path("trip"), false).unwrap();
+    // the file goes away between readying (UI thread) and the work (worker): the work finds out
+    let (work, mut commit) = crate::sync::SyncJob::start(&mut s, changes, crate::sync::SyncChoice::default()).unwrap();
+    std::fs::remove_file(dir.path("trip/c.png")).unwrap();
+    let mut steps = Vec::new();
+    work.run(&crate::sync::SyncProgress::default(), |step| {
+        steps.push(step);
+        true
+    });
+    for step in steps {
+        commit.apply(&mut s, step);
+    }
+    let r = commit.finish(&mut s);
+    assert_eq!(r.imported, 0, "{r:?}");
+    assert_eq!(r.failed.len(), 1, "{r:?}");
+}
+
+#[test]
+fn a_cancelled_synchronize_does_nothing_more() {
+    let dir = Scratch::new("cancel-run");
+    let mut s = library(&dir);
+    let steps_before = s.undo.len();
+    write_png(&dir.path("trip/c.png"), 3);
+    let changes = crate::sync::scan(&mut s, &dir.path("trip"), false).unwrap();
+    let (work, commit) = crate::sync::SyncJob::start(&mut s, changes, crate::sync::SyncChoice::default()).unwrap();
+    let progress = crate::sync::SyncProgress::default();
+    progress.files.cancel.store(true, std::sync::atomic::Ordering::Relaxed);
+    let mut sent = 0;
+    work.run(&progress, |_| {
+        sent += 1;
+        true
+    });
+    assert_eq!(sent, 0);
+    let r = commit.finish(&mut s);
+    assert_eq!((r.imported, s.undo.len()), (0, steps_before));
+}
+
+/// Ready a synchronize of the trip folder and do its work, keeping the steps for the test to
+/// commit when it likes.
+fn readied(s: &mut Session, dir: &Scratch, choice: crate::sync::SyncChoice) -> (Vec<crate::sync::SyncStep>, crate::sync::SyncCommit) {
+    let changes = crate::sync::scan(s, &dir.path("trip"), false).unwrap();
+    let (work, commit) = crate::sync::SyncJob::start(s, changes, choice).unwrap();
+    let mut steps = Vec::new();
+    work.run(&crate::sync::SyncProgress::default(), |step| {
+        steps.push(step);
+        true
+    });
+    (steps, commit)
+}
+
+#[test]
+fn steps_for_a_library_that_was_closed_meanwhile_are_not_applied() {
+    let dir = Scratch::new("switched");
+    let mut s = library(&dir);
+    write_png(&dir.path("trip/c.png"), 3);
+    std::fs::remove_file(dir.path("trip/day1/b.png")).unwrap();
+    let choice = crate::sync::SyncChoice { remove_missing: true, ..Default::default() };
+    let (steps, mut commit) = readied(&mut s, &dir, choice);
+    // File › Open Library while the work runs: another catalog, whose photo ids mean other photos
+    s.library_identity = std::sync::Arc::new(());
+    let before = holdings(&s);
+    let undo = s.undo.len();
+    for step in steps {
+        commit.apply(&mut s, step);
+    }
+    let r = commit.finish(&mut s);
+    assert_eq!(holdings(&s), before, "nothing landed in the other library");
+    assert_eq!(s.undo.len(), undo);
+    assert_eq!((r.imported, r.removed), (0, 0), "{r:?}");
+    assert!(!r.failed.is_empty(), "and the report says why: {r:?}");
+}
+
+#[test]
+fn an_undo_pressed_while_synchronizing_is_not_folded_into_it() {
+    let dir = Scratch::new("undo-mid");
+    let mut s = library(&dir);
+    let a = s.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    s.execute("photo.rate", &json!({"ids": [a.0], "rating": 4})).unwrap();
+    write_png(&dir.path("trip/c.png"), 3);
+    std::fs::remove_file(dir.path("trip/day1/b.png")).unwrap();
+    let choice = crate::sync::SyncChoice { remove_missing: true, ..Default::default() };
+    let (mut steps, mut commit) = readied(&mut s, &dir, choice);
+    assert!(steps.len() >= 2, "an import step and a remove step");
+    let first = steps.remove(0);
+    commit.apply(&mut s, first);
+    // the person presses Undo between two steps of the run
+    s.execute("edit.undo", &json!({})).unwrap();
+    for step in steps {
+        commit.apply(&mut s, step);
+    }
+    commit.finish(&mut s);
+    // undoing the run's last step never takes the rating with it
+    s.execute("edit.undo", &json!({})).unwrap();
+    assert_eq!(s.catalog.photo(a).unwrap().rating, 4, "the earlier, unrelated step stays");
+}
+
+#[test]
+fn sidecar_namings_for_many_photos_agree_with_one_at_a_time() {
+    let dir = Scratch::new("namings");
+    let mut s = library(&dir);
+    // a raw beside its JPEG: the raw owns IMG_1.xmp, the JPEG's is IMG_1.JPG.xmp
+    for name in ["IMG_1.CR3", "IMG_1.JPG", "IMG_2.JPG"] {
+        let id = s.catalog.alloc_photo_id();
+        let p = lightcraft_catalog::Photo::new(
+            id,
+            lightcraft_catalog::Source::File { path: dir.path(&format!("trip/{name}")) },
+            name,
+            "X",
+            6,
+            4,
+            "2026-01-01",
+        );
+        s.catalog.apply(lightcraft_catalog::Op::AddPhoto { photo: Box::new(p) }).unwrap();
+    }
+    let ids: Vec<lightcraft_catalog::PhotoId> = s.catalog.photos().map(|p| p.id).collect();
+    let one_by_one: Vec<_> = ids.iter().map(|id| s.sidecar_naming(*id)).collect();
+    assert_eq!(s.sidecar_namings(&ids), one_by_one);
+    assert!(one_by_one.contains(&crate::sidecar::SidecarNaming::Full), "the case that matters is there");
+}
diff --git a/crates/engine/src/tests_xmp.rs b/crates/engine/src/tests_xmp.rs
index ab801e23..e3137da0 100644
--- a/crates/engine/src/tests_xmp.rs
+++ b/crates/engine/src/tests_xmp.rs
@@ -94,7 +94,8 @@ fn auto_write_and_naming_preference() {
     // a slider drag writes once, at the end
     s.execute("develop.beginInteraction", &json!({"label": "Exposure"})).unwrap();
     s.execute("develop.set", &json!({"control": "light.exposure", "value": 1.5})).unwrap();
-    let exposure = |p: &Path| match crate::sidecar::parse_sidecar(&std::fs::read_to_string(p).unwrap(), false).unwrap().develop {
+    let exposure = |p: &Path| match crate::sidecar::parse_sidecar(&std::fs::read_to_string(p).unwrap(), crate::crs::Target::Rendered).unwrap().develop
+    {
         Some(crate::sidecar::DevelopPatch::Full(d)) => d.light.exposure,
         other => panic!("{other:?}"),
     };
diff --git a/crates/engine/src/view.rs b/crates/engine/src/view.rs
index 16c9f8a0..5b32999b 100644
--- a/crates/engine/src/view.rs
+++ b/crates/engine/src/view.rs
@@ -212,7 +212,7 @@ pub fn filter_chips(f: &Filter, cat: &Catalog) -> Vec<FilterChip> {
         _ => {}
     }
     if let Some(rs) = f.rule_set.as_ref().filter(|r| !r.rules.is_empty()) {
-        add(format!("Rules: {}", rs.describe()), json!({"ruleSet": Null}));
+        add(format!("Rules: {}", rs.describe_with(cat)), json!({"ruleSet": Null}));
     }
     if !f.only.is_empty() {
         add(format!("Only {} photos", f.only.len()), json!({"only": []}));
diff --git a/crates/gpu/Cargo.toml b/crates/gpu/Cargo.toml
index b19acf54..dc348ee8 100644
--- a/crates/gpu/Cargo.toml
+++ b/crates/gpu/Cargo.toml
@@ -30,3 +30,4 @@ denoise = ["dep:lightcraft-denoise", "lightcraft-denoise/runtime"]
 
 [dev-dependencies]
 lightcraft-scenes = { workspace = true }
+lightcraft-raw = { workspace = true }
diff --git a/crates/gpu/src/backend.rs b/crates/gpu/src/backend.rs
index fcdea55f..041f5773 100644
--- a/crates/gpu/src/backend.rs
+++ b/crates/gpu/src/backend.rs
@@ -121,6 +121,30 @@ pub fn window_backends() -> Backends {
     resolve(choice, default, wgpu::Instance::enabled_backend_features()).unwrap_or(default)
 }
 
+/// The DX12 shader compiler: FXC (`d3dcompiler_47.dll`, part of Windows) unless
+/// `WGPU_DX12_COMPILER` (`wgpu`, wgpu's own variable: `fxc`, `dxc`, `auto`…) names another.
+///
+/// Issue #471: wgpu's default (`Auto`) loads whichever `dxcompiler.dll` the DLL search path finds
+/// first — LightCraft ships none, so it is some other program's (an SDK's, a folder on `PATH`). A
+/// copy without its `dxil.dll` beside it warns that the DXIL is unsigned; wgpu takes the warning for
+/// a compile error, its own validation pipelines fail, the device is lost and the window never
+/// opens. FXC is always there and compiles everything LightCraft's shaders need.
+pub fn dx12_compiler(env: Option<&str>) -> wgpu::Dx12Compiler {
+    let Some(v) = env else { return wgpu::Dx12Compiler::Fxc };
+    v.parse().unwrap_or_else(|e| {
+        log::warn!("gpu: WGPU_DX12_COMPILER={v} ignored: {e}");
+        wgpu::Dx12Compiler::Fxc
+    })
+}
+
+/// wgpu's backend options for every instance LightCraft creates — the window's and the compute
+/// devices': wgpu's environment variables, with the DX12 compiler from [`dx12_compiler`].
+pub fn backend_options() -> wgpu::BackendOptions {
+    let mut o = wgpu::BackendOptions::from_env_or_default();
+    o.dx12.shader_compiler = dx12_compiler(std::env::var("WGPU_DX12_COMPILER").ok().as_deref());
+    o
+}
+
 /// `LIGHTCRAFT_GPU_BACKEND=off`.
 pub(crate) fn env_off() -> bool {
     env_choice() == BackendChoice::Off
@@ -211,6 +235,20 @@ mod tests {
         assert!(default_window_backends("linux").contains(Backends::VULKAN | Backends::GL));
     }
 
+    /// Issue #471: DX12 shaders compile with FXC, never a `dxcompiler.dll` found on the search path,
+    /// unless `WGPU_DX12_COMPILER` asks for it.
+    #[test]
+    fn dx12_compiles_with_fxc_unless_asked() {
+        assert!(matches!(dx12_compiler(None), wgpu::Dx12Compiler::Fxc));
+        assert!(matches!(dx12_compiler(Some("bogus")), wgpu::Dx12Compiler::Fxc));
+        assert!(matches!(dx12_compiler(Some("FXC")), wgpu::Dx12Compiler::Fxc));
+        assert!(matches!(dx12_compiler(Some("dxc")), wgpu::Dx12Compiler::DynamicDxc { .. }));
+        assert!(matches!(dx12_compiler(Some("auto")), wgpu::Dx12Compiler::Auto));
+        if std::env::var_os("WGPU_DX12_COMPILER").is_none() {
+            assert!(matches!(backend_options().dx12.shader_compiler, wgpu::Dx12Compiler::Fxc));
+        }
+    }
+
     #[test]
     fn resolves_against_the_build() {
         let compiled = Backends::DX12 | Backends::VULKAN;
diff --git a/crates/gpu/src/ctx.rs b/crates/gpu/src/ctx.rs
index 0f826bf4..2f4abd4d 100644
--- a/crates/gpu/src/ctx.rs
+++ b/crates/gpu/src/ctx.rs
@@ -282,6 +282,8 @@ impl Gpu {
         let mut desc = wgpu::InstanceDescriptor::new_without_display_handle();
         // only these drivers are loaded (`crate::backend`: never Vulkan on Windows unless asked)
         desc.backends = backends;
+        // DX12 shaders compile with FXC (issue #471)
+        desc.backend_options = crate::backend::backend_options();
         let instance = wgpu::Instance::new(desc);
         let adapter = pollster::block_on(
             instance.request_adapter(&wgpu::RequestAdapterOptions { power_preference: wgpu::PowerPreference::HighPerformance, ..Default::default() }),
diff --git a/crates/gpu/src/exit.rs b/crates/gpu/src/exit.rs
new file mode 100644
index 00000000..79f114ef
--- /dev/null
+++ b/crates/gpu/src/exit.rs
@@ -0,0 +1,132 @@
+//! Leaving: no GPU work may be in flight when the process ends (issue #620).
+//!
+//! The devices are statics that are never dropped, and the threads that render (preview workers,
+//! export, denoise, the device warm-up) are not the one that ends the process. Exiting runs the
+//! driver's own teardown while those threads keep running: a render that is inside the driver at
+//! that moment crashes there (seen as a SIGSEGV in the NVIDIA Vulkan driver), where neither the
+//! panic hook nor `catch_unwind` can help.
+//!
+//! So every entry into a device goes through [`enter`], and the host ends the process with
+//! [`crate::begin_shutdown`] (nothing new enters) and [`crate::wait_idle`] (what is in flight
+//! finishes, up to a deadline).
+
+use std::sync::{Condvar, Mutex, MutexGuard};
+use std::time::{Duration, Instant};
+
+struct State {
+    closed: bool,
+    /// [`Work`] in flight, on any thread.
+    busy: usize,
+}
+
+pub(crate) struct Gate {
+    state: Mutex<State>,
+    idle: Condvar,
+}
+
+/// GPU work in flight (until dropped).
+pub(crate) struct Work<'a>(&'a Gate);
+
+static GATE: Gate = Gate::new();
+
+/// Start GPU work, or `None` when the process is ending: the caller then does without the GPU.
+/// Work may nest (a render that creates the device).
+pub(crate) fn enter() -> Option<Work<'static>> {
+    GATE.enter()
+}
+
+pub(crate) fn begin_shutdown() {
+    GATE.close();
+}
+
+pub(crate) fn shutting_down() -> bool {
+    GATE.lock().closed
+}
+
+pub(crate) fn wait_idle(timeout: Duration) -> bool {
+    GATE.wait_idle(timeout)
+}
+
+impl Gate {
+    pub const fn new() -> Gate {
+        Gate { state: Mutex::new(State { closed: false, busy: 0 }), idle: Condvar::new() }
+    }
+
+    fn lock(&self) -> MutexGuard<'_, State> {
+        self.state.lock().unwrap_or_else(|e| e.into_inner())
+    }
+
+    pub fn enter(&self) -> Option<Work<'_>> {
+        let mut s = self.lock();
+        if s.closed {
+            return None;
+        }
+        s.busy = s.busy.saturating_add(1);
+        Some(Work(self))
+    }
+
+    /// Nothing enters from now on.
+    pub fn close(&self) {
+        self.lock().closed = true;
+    }
+
+    /// Wait up to `timeout` until no work is in flight; `false` when some still is.
+    pub fn wait_idle(&self, timeout: Duration) -> bool {
+        let t0 = Instant::now();
+        let mut s = self.lock();
+        while s.busy > 0 {
+            let Some(left) = timeout.checked_sub(t0.elapsed()).filter(|d| !d.is_zero()) else { return false };
+            s = self.idle.wait_timeout(s, left).unwrap_or_else(|e| e.into_inner()).0;
+        }
+        true
+    }
+}
+
+impl Drop for Work<'_> {
+    fn drop(&mut self) {
+        let mut s = self.0.lock();
+        s.busy = s.busy.saturating_sub(1);
+        if s.busy == 0 {
+            drop(s);
+            self.0.idle.notify_all();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn closed_gate_lets_nothing_in_and_waits_for_what_is_inside() {
+        let gate = Gate::new();
+        assert!(gate.wait_idle(Duration::ZERO), "idle: no wait");
+        let outer = gate.enter().unwrap();
+        let inner = gate.enter().unwrap();
+        gate.close();
+        assert!(gate.enter().is_none(), "nothing new once closed");
+        drop(inner);
+        let t0 = Instant::now();
+        assert!(!gate.wait_idle(Duration::from_millis(50)), "the outer work is still in flight");
+        assert!(t0.elapsed() >= Duration::from_millis(50));
+        std::thread::scope(|s| {
+            s.spawn(move || {
+                std::thread::sleep(Duration::from_millis(100));
+                drop(outer);
+            });
+            assert!(gate.wait_idle(Duration::from_secs(30)), "woken when the work ends");
+        });
+        assert!(gate.enter().is_none());
+    }
+
+    #[test]
+    fn work_that_panics_still_leaves() {
+        let gate = Gate::new();
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            let _work = gate.enter();
+            panic!("a render panics (expected in this test)");
+        }));
+        assert!(r.is_err());
+        assert!(gate.wait_idle(Duration::ZERO));
+    }
+}
diff --git a/crates/gpu/src/lib.rs b/crates/gpu/src/lib.rs
index 9c234964..1eae995a 100644
--- a/crates/gpu/src/lib.rs
+++ b/crates/gpu/src/lib.rs
@@ -15,6 +15,8 @@
 //! and [`last_fallback`] say why (`ui.inspect` → `perf.gpuReason` / `perf.gpuFallback`).
 //! The browser build has no GPU path yet (WebGPU device creation is asynchronous): everything here
 //! compiles to the CPU fallback on wasm32.
+//!
+//! Before the process ends: [`begin_shutdown`], then [`wait_idle`] (issue #620, see `exit.rs`).
 #![forbid(unsafe_code)]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
@@ -29,6 +31,8 @@ use lightcraft_raster::Rgb32f;
 pub mod backend;
 #[cfg(not(target_arch = "wasm32"))]
 mod ctx;
+#[cfg(not(target_arch = "wasm32"))]
+mod exit;
 #[cfg(all(feature = "denoise", not(target_arch = "wasm32")))]
 pub mod nn;
 #[cfg(not(target_arch = "wasm32"))]
@@ -77,6 +81,9 @@ pub fn unavailable_reason() -> Option<String> {
     if !ENABLED.load(Ordering::Relaxed) {
         return Some("disabled by the GPU rendering preference (app.gpu)".into());
     }
+    if shutting_down() {
+        return Some("LightCraft is closing".into());
+    }
     if BROKEN.load(Ordering::Relaxed) {
         let r = BROKEN_REASON.lock().unwrap_or_else(|e| e.into_inner()).clone().unwrap_or_else(|| "device error".into());
         return Some(format!("stopped after a GPU failure: {r}"));
@@ -147,6 +154,41 @@ pub fn enabled() -> bool {
     ENABLED.load(Ordering::Relaxed) && !BROKEN.load(Ordering::Relaxed) && !env_disabled()
 }
 
+/// The process is about to end: no GPU work starts from now on, on any thread. [`render`] returns
+/// `None` (callers render on the CPU), the devices are not created and denoise tiles fail over to
+/// the CPU. There is no way back. Follow it with [`wait_idle`].
+pub fn begin_shutdown() {
+    #[cfg(not(target_arch = "wasm32"))]
+    exit::begin_shutdown();
+}
+
+/// Whether [`begin_shutdown`] was called.
+pub fn shutting_down() -> bool {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        exit::shutting_down()
+    }
+    #[cfg(target_arch = "wasm32")]
+    {
+        false
+    }
+}
+
+/// Wait up to `timeout` for the GPU work in flight on every thread to end. `true`: none is left,
+/// and after [`begin_shutdown`] none can start, so the process may end; `false`: the deadline
+/// passed with a render (or a device being created) still inside the driver.
+pub fn wait_idle(timeout: std::time::Duration) -> bool {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        exit::wait_idle(timeout)
+    }
+    #[cfg(target_arch = "wasm32")]
+    {
+        let _ = timeout;
+        true
+    }
+}
+
 /// Why GPU compute that has a device of its own (denoise) is switched off by the user's settings, or `None`: the
 /// environment switches and the rendering preference, but not a render-device failure (the devices are separate).
 #[cfg(all(feature = "denoise", not(target_arch = "wasm32")))]
@@ -177,6 +219,11 @@ pub(crate) fn device() -> Option<&'static ctx::Gpu> {
     if env_disabled() || !ENABLED.load(Ordering::Relaxed) {
         return existing_device();
     }
+    if let Some(g) = GPU.get() {
+        return g.as_ref().ok();
+    }
+    // creating the device is a long call into the driver: not once the process is ending
+    let _work = exit::enter()?;
     GPU.get_or_init(|| {
         let Some(backends) = backend::compute_backends() else { return Err("disabled by LIGHTCRAFT_GPU_BACKEND=off".into()) };
         backend::with_init_marker(backends, || {
@@ -281,7 +328,9 @@ pub fn set_pool_limit(bytes: u64) {
 /// Free recycled buffers until at most `keep` bytes stay pooled (e.g. when the app goes idle).
 pub fn trim_pool(keep: u64) {
     #[cfg(not(target_arch = "wasm32"))]
-    if let Some(g) = existing_device() {
+    if let Some(g) = existing_device()
+        && let Some(_work) = exit::enter()
+    {
         if keep == 0 {
             render::release_shared_source();
         }
@@ -337,9 +386,17 @@ pub fn render(src: &Arc<Rgb32f>, info: &SourceInfo, s: &DevelopSettings, req: &R
         let effective = s.effective();
         let s: &DevelopSettings = &effective;
         // the kernel writes 8-bit output: high-bit-depth exports (and soft proofs) render on the CPU
-        if !enabled() || req.depth != lightcraft_pipeline::OutputDepth::U8 || req.proof.is_some() {
+        // Visualize HDR needs the float HDR render: CPU too
+        if !enabled()
+            || req.depth != lightcraft_pipeline::OutputDepth::U8
+            || req.proof.is_some()
+            || req.overlay == lightcraft_pipeline::Overlay::HdrRange
+        {
             return None;
         }
+        let s = &*lightcraft_pipeline::settings_for(s, req);
+        // in flight until this returns; `None` once the process is ending (issue #620)
+        let _work = exit::enter()?;
         let gpu = device()?;
         let ext = stages.map(|c| c.extension::<GpuStages>());
         let fault = take_fault();
diff --git a/crates/gpu/src/nn.rs b/crates/gpu/src/nn.rs
index 4231dae8..689aecbe 100644
--- a/crates/gpu/src/nn.rs
+++ b/crates/gpu/src/nn.rs
@@ -63,9 +63,17 @@ fn dev() -> Result<&'static Dev, String> {
     if let Some(why) = crate::switched_off() {
         return Err(why);
     }
+    // creating the device is GPU work too: not once the process is ending (issue #620)
+    let _work = match DEV.get() {
+        Some(_) => None,
+        None => Some(crate::exit::enter().ok_or(CLOSING)?),
+    };
     DEV.get_or_init(create_device).as_ref().map_err(|e| e.clone())
 }
 
+/// Why nothing runs on the GPU once [`crate::begin_shutdown`] was called.
+const CLOSING: &str = "LightCraft is closing";
+
 fn create_device() -> Result<Dev, String> {
     let Some(backends) = crate::backend::compute_backends() else { return Err("disabled by LIGHTCRAFT_GPU_BACKEND=off".into()) };
     crate::backend::with_init_marker(backends, || {
@@ -76,6 +84,8 @@ fn create_device() -> Result<Dev, String> {
 fn make_device(backends: wgpu::Backends) -> Result<Dev, String> {
     let mut desc = wgpu::InstanceDescriptor::new_without_display_handle();
     desc.backends = backends;
+    // DX12 shaders compile with FXC (issue #471)
+    desc.backend_options = crate::backend::backend_options();
     let instance = wgpu::Instance::new(desc);
     let wanted = std::env::var("LIGHTCRAFT_GPU_ADAPTER").ok().map(|s| s.trim().to_lowercase()).filter(|s| !s.is_empty());
     let adapter = match &wanted {
@@ -509,7 +519,6 @@ fn conv_source(bm: u32, bn: u32, bk: u32) -> String {
         .replace("{{BM}}", &bm.to_string())
         .replace("{{BN}}", &bn.to_string())
         .replace("{{BK}}", &bk.to_string())
-        .replace("{{A_VECS}}", &(bk * bm / 4).to_string())
         .replace("{{B_VECS}}", &(bk * bn / 4).to_string())
 }
 
@@ -652,6 +661,7 @@ pub struct NetRunner {
 /// Put `net` on the GPU for `tile × tile` input cells, or say why it cannot be (no GPU, a layer or a size the kernels
 /// do not do, the device refusing the buffers). Creates the device on first use and compiles the kernels.
 pub fn runner(net: &Net, tile: usize) -> Result<NetRunner, String> {
+    let _work = crate::exit::enter().ok_or(CLOSING)?;
     let d = dev()?;
     let max_binding = d.limits.max_storage_buffer_binding_size.min(d.limits.max_buffer_size).min(MAX_BUFFER);
     let (layout, layers) = plan(net, tile, max_binding)?;
@@ -838,6 +848,8 @@ impl TileRunner for NetRunner {
         if input.len() != self.shared.layout.in_floats {
             return Err(Error::Input("the tile is not the size the model wants".into()));
         }
+        // one tile is one piece of GPU work: a photo's worth would outlast any wait at exit
+        let Some(_work) = crate::exit::enter() else { return Err(Error::Runtime(CLOSING.into())) };
         let w = self.take()?;
         let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| self.execute(&w, input)));
         match r {
@@ -900,6 +912,7 @@ mod tests {
 
     fn worst(a: &[f32], b: &[f32]) -> f32 {
         assert_eq!(a.len(), b.len());
+        assert!(a.iter().chain(b).all(|v| v.is_finite()), "non-finite denoise output");
         let scale = b.iter().fold(1e-3f32, |m, v| m.max(v.abs()));
         a.iter().zip(b).fold(0f32, |m, (x, y)| m.max((x - y).abs())) / scale
     }
@@ -923,6 +936,21 @@ mod tests {
         }
     }
 
+    // Issue #479: several pixels loaded by different invocations shared a vec4,
+    // so lane writes raced on Metal. Exercise a partial block repeatedly with new
+    // inputs; stale shared-memory values must never leak into the next dispatch.
+    #[test]
+    fn partial_tiles_remain_correct_when_reusing_a_runner() {
+        let n = net(3, 4, 0, 8);
+        let Some(g) = gpu(&n, 3) else { return };
+        for seed in 100..112 {
+            let x = picture(4 * 3 * 3, seed);
+            let want = reference::run(&n, 3, &x).unwrap();
+            let e = worst(&g.run(&x).unwrap(), &want);
+            assert!(e < 2e-4, "seed {seed}: off by {e:e}");
+        }
+    }
+
     #[test]
     fn a_runner_serves_many_tiles_from_many_threads() {
         let n = net(32, 8, 2, 7);
@@ -1020,7 +1048,6 @@ mod tests {
             .replace("{{BM}}", &bm.to_string())
             .replace("{{BN}}", &bn.to_string())
             .replace("{{BK}}", &bk.to_string())
-            .replace("{{A_VECS}}", &(bk * bm / 4).to_string())
             .replace("{{B_VECS}}", &(bk * bn / 4).to_string());
         let d = dev().unwrap();
         let layout = conv_bgl(d);
diff --git a/crates/gpu/src/render.rs b/crates/gpu/src/render.rs
index 7e7ac8a3..45a5a5f6 100644
--- a/crates/gpu/src/render.rs
+++ b/crates/gpu/src/render.rs
@@ -639,7 +639,10 @@ pub fn render(
     lap("masks", &mut t, &mut cx);
 
     // 5. per-pixel stage
-    let fp = FinishParams::new(s, &plan.frame, info, w, h, plan.px_per_long, prep.air, req.space);
+    let mut fp = FinishParams::new(s, &plan.frame, info, w, h, plan.px_per_long, prep.air, req.space);
+    if let Some(d) = &req.display {
+        fp.for_display(d, None);
+    }
     let present = Present {
         clarity: prep.clarity.is_some(),
         texture: prep.texture.is_some(),
@@ -738,8 +741,8 @@ fn linear(cx: &mut Cx<'_>, sampled: &Buf, info: &SourceInfo, plan: &Plan<'_>, ho
     let (w, h) = (plan.w, plan.h);
     let n = w * h;
     let s = &*plan.settings;
-    let img = if lightcraft_pipeline::lin_needs_cpu(s) {
-        // defringe / spot removal: CPU
+    let img = if lightcraft_pipeline::lin_needs_cpu(s, info) {
+        // defringe / spot removal / local tone mapping: CPU
         let mut img = match host.sampled.take() {
             Some(i) => i,
             None => cx.read_rgb(sampled, w, h),
diff --git a/crates/gpu/src/wgsl/nn_conv.wgsl b/crates/gpu/src/wgsl/nn_conv.wgsl
index d991e9e7..20a0ce99 100644
--- a/crates/gpu/src/wgsl/nn_conv.wgsl
+++ b/crates/gpu/src/wgsl/nn_conv.wgsl
@@ -44,8 +44,11 @@ const TX: u32 = BN / 4u;
 const A_ITEMS: u32 = BM * (BK / 4u);
 const B_ITEMS: u32 = BK * (BN / 4u);
 
-// A[k][m] four pixels to a vec4, B[k][n] four channels to a vec4
-var<workgroup> As: array<vec4<f32>, {{A_VECS}}>;
+// A[k][m] has one scalar per pixel; B[k][n] packs four channels per vec4.
+// Different invocations must not write lanes of the same shared vector: WGSL permits
+// a component write to access the entire vector. A later barrier cannot undo that race.
+// Each scalar below has one writer; gather four pixels only after the barrier.
+var<workgroup> As: array<f32, BK * BM>;
 var<workgroup> Bs: array<vec4<f32>, {{B_VECS}}>;
 
 @compute @workgroup_size(256)
@@ -88,12 +91,11 @@ fn main(@builtin(workgroup_id) wg: vec3<u32>, @builtin(local_invocation_index) t
                         }
                     }
                 }
-                let base = (q * 4u) * (BM / 4u) + ml / 4u;
-                let lane = ml % 4u;
-                As[base][lane] = v.x;
-                As[base + BM / 4u][lane] = v.y;
-                As[base + 2u * (BM / 4u)][lane] = v.z;
-                As[base + 3u * (BM / 4u)][lane] = v.w;
+                let base = q * 4u * BM + ml;
+                As[base] = v.x;
+                As[base + BM] = v.y;
+                As[base + 2u * BM] = v.z;
+                As[base + 3u * BM] = v.w;
             }
             for (var item = tid; item < B_ITEMS; item += 256u) {
                 let r = item / (BN / 4u);
@@ -103,7 +105,8 @@ fn main(@builtin(workgroup_id) wg: vec3<u32>, @builtin(local_invocation_index) t
             }
             workgroupBarrier();
             for (var kk = 0u; kk < BK; kk++) {
-                let a = As[kk * (BM / 4u) + ty];
+                let ai = kk * BM + ty * 4u;
+                let a = vec4<f32>(As[ai], As[ai + 1u], As[ai + 2u], As[ai + 3u]);
                 let b = Bs[kk * TX + tx];
                 acc0 += a.x * b;
                 acc1 += a.y * b;
diff --git a/crates/gpu/tests/equivalence.rs b/crates/gpu/tests/equivalence.rs
index cb6e7c02..b10836c3 100644
--- a/crates/gpu/tests/equivalence.rs
+++ b/crates/gpu/tests/equivalence.rs
@@ -406,6 +406,59 @@ fn gpu_matches_cpu() {
     eprintln!("worst: mean {:.4} LSB, max {} LSB", worst.0, worst.1);
 }
 
+/// Issue #523: a raw's clipped highlights rebuilt as the raw decode does it (fully clipped ones to the neutral of
+/// the colour model applied after them, here a look whose rows don't sum to one) stay neutral when darkened, on
+/// the GPU as on the CPU, and the two renders agree.
+#[test]
+fn clipped_highlights_stay_neutral_on_both() {
+    if !gpu() {
+        return;
+    }
+    let wb = [2.4f32, 1.0, 1.6];
+    let look = lightcraft_color::Mat3([[0.42, 0.548, 0.04], [0.246, 0.728, 0.033], [-0.247, 0.679, 0.447]]);
+    let luma = |c: [f64; 3]| (0..3).map(|i| c[i] * f64::from(lightcraft_color::LUMA_2020[i])).sum::<f64>();
+    let n = look.inverse().unwrap().apply([1.0; 3]);
+    let white = n.map(|v| (v * luma(look.apply([1.0; 3])) / luma(look.apply(n))) as f32);
+    // a grey wall with a fully clipped light, a light clipped in green only, and a dark bar with a purple fringe
+    // in front of the second
+    let mut cam = Rgb32f::from_fn(320, 240, |x, y| {
+        let d = |cx: f32| ((x as f32 - cx).powi(2) + (y as f32 - 120.0).powi(2)).sqrt();
+        if d(90.0) < 50.0 {
+            [1.0; 3]
+        } else if (226..232).contains(&x) && (70..170).contains(&y) {
+            [0.02, 0.03, 0.02]
+        } else if (x == 225 || x == 232) && (70..170).contains(&y) {
+            [0.3, 0.25, 0.6]
+        } else if d(228.0) < 50.0 {
+            [0.6 / wb[0], 1.0, 0.7 / wb[2]]
+        } else {
+            [0.3 / wb[0], 0.3, 0.3 / wb[2]]
+        }
+    });
+    lightcraft_raw::highlight::reconstruct_with(&mut cam, wb, 0.99, white);
+    let m = look.to_f32();
+    let src = Arc::new(cam.map(|p| {
+        let c = [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]];
+        std::array::from_fn(|i| (m[i][0] * c[0] + m[i][1] * c[1] + m[i][2] * c[2]).max(0.0))
+    }));
+    let info = SourceInfo { raw: true, ..Default::default() };
+    let req = RenderRequest::fit(320, 240);
+    let mut h100 = DevelopSettings::default();
+    h100.light.highlights = -100.0;
+    let mut issue = DevelopSettings::default();
+    let l = &mut issue.light;
+    (l.exposure, l.contrast, l.highlights, l.shadows, l.whites, l.blacks) = (-0.88, 5.0, -75.0, 52.0, 6.0, -37.0);
+    for (name, s) in [("clipped highlights -100", h100), ("clipped highlights #523", issue)] {
+        check(name, &src, &info, &s, &req);
+        let cpu = render(&src, &info, &s, &req).image;
+        let gpu = lightcraft_gpu::render(&src, &info, &s, &req, None).expect("gpu render").image;
+        for (who, img) in [("CPU", &cpu), ("GPU", &gpu)] {
+            let p = img.get(90, 120);
+            assert!(p[1] < 250 && p[0].max(p[1]).max(p[2]) - p[0].min(p[1]).min(p[2]) <= 1, "{name} {who}: clipped light {p:?}");
+        }
+    }
+}
+
 #[test]
 fn rendered_sources_and_other_scenes() {
     if !gpu() {
diff --git a/crates/gpu/tests/shutdown.rs b/crates/gpu/tests/shutdown.rs
new file mode 100644
index 00000000..b827a071
--- /dev/null
+++ b/crates/gpu/tests/shutdown.rs
@@ -0,0 +1,58 @@
+//! Issue #620: a render still inside the GPU driver while the process exits crashes there (a
+//! SIGSEGV no panic hook catches). Once `begin_shutdown` is called nothing starts on the GPU, and
+//! `wait_idle` returns when the renders in flight on other threads have ended.
+//! One test: the shutdown holds for the whole process. Without a GPU adapter only the CPU side of
+//! the contract is checked.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::time::Duration;
+
+use lightcraft_develop::DevelopSettings;
+use lightcraft_pipeline::{RenderRequest, SourceInfo};
+
+#[test]
+fn nothing_renders_on_the_gpu_once_the_process_is_ending() {
+    let (w, h) = (600, 400);
+    let src = Arc::new(lightcraft_scenes::demo_library()[0].render(w, h));
+    let info = SourceInfo { raw: true, ..Default::default() };
+    let mut s = DevelopSettings::default();
+    s.light.exposure = 0.3;
+    let req = RenderRequest::fit(w, h);
+    let has_gpu = lightcraft_gpu::available();
+    if !has_gpu {
+        eprintln!("no GPU adapter ({:?}): only the CPU side is checked", lightcraft_gpu::unavailable_reason());
+    }
+    assert!(!lightcraft_gpu::shutting_down());
+    assert!(lightcraft_gpu::wait_idle(Duration::ZERO), "nothing is in flight yet");
+
+    // a worker that renders until the GPU refuses, as the preview workers do while the app quits
+    let (rendered, refused) = (Arc::new(AtomicUsize::new(0)), Arc::new(AtomicBool::new(false)));
+    let worker = {
+        let (src, info, s) = (src.clone(), info.clone(), s.clone());
+        let (rendered, refused) = (rendered.clone(), refused.clone());
+        std::thread::spawn(move || {
+            while lightcraft_gpu::render(&src, &info, &s, &req, None).is_some() {
+                rendered.fetch_add(1, Ordering::SeqCst);
+            }
+            refused.store(true, Ordering::SeqCst);
+        })
+    };
+    if has_gpu {
+        while rendered.load(Ordering::SeqCst) == 0 && !refused.load(Ordering::SeqCst) {
+            std::thread::yield_now();
+        }
+        assert!(rendered.load(Ordering::SeqCst) > 0, "the GPU renders before the shutdown ({:?})", lightcraft_gpu::last_fallback());
+    }
+
+    lightcraft_gpu::begin_shutdown();
+    assert!(lightcraft_gpu::shutting_down());
+    assert!(lightcraft_gpu::wait_idle(Duration::from_secs(60)), "the render in flight ends");
+    worker.join().unwrap();
+    assert!(refused.load(Ordering::SeqCst));
+    assert!(lightcraft_gpu::render(&src, &info, &s, &req, None).is_none(), "no GPU render once the process is ending");
+    assert!(lightcraft_gpu::wait_idle(Duration::ZERO));
+    if has_gpu {
+        assert_eq!(lightcraft_gpu::unavailable_reason().as_deref(), Some("LightCraft is closing"));
+    }
+}
diff --git a/crates/gpu/tests/shutdown_first.rs b/crates/gpu/tests/shutdown_first.rs
new file mode 100644
index 00000000..3810762e
--- /dev/null
+++ b/crates/gpu/tests/shutdown_first.rs
@@ -0,0 +1,25 @@
+//! Issue #620: quitting right after the start must not leave the device being created (a long
+//! call into the driver, on the `lc-gpu-init` thread) while the process exits. Once
+//! `begin_shutdown` is called the device is not created at all.
+//! One test in its own process: the shutdown comes before the first use of the GPU.
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use lightcraft_develop::DevelopSettings;
+use lightcraft_pipeline::{RenderRequest, SourceInfo};
+
+#[test]
+fn the_device_is_not_created_once_the_process_is_ending() {
+    lightcraft_gpu::begin_shutdown();
+    lightcraft_gpu::warm_up();
+    assert!(!lightcraft_gpu::available());
+    assert_eq!(lightcraft_gpu::adapter_name(), None);
+    let src = Arc::new(lightcraft_scenes::demo_library()[0].render(300, 200));
+    let rendered = lightcraft_gpu::render(&src, &SourceInfo::default(), &DevelopSettings::default(), &RenderRequest::fit(300, 200), None);
+    assert!(rendered.is_none());
+    assert!(lightcraft_gpu::wait_idle(Duration::from_secs(60)), "the warm-up thread found the gate closed");
+    // `ready()` is "device creation finished" (or the GPU is switched off by the environment)
+    let switched_off = lightcraft_gpu::unavailable_reason().is_some_and(|r| r.starts_with("disabled by LIGHTCRAFT_GPU"));
+    assert!(switched_off || !lightcraft_gpu::ready(), "no device was created");
+}
diff --git a/crates/heif/Cargo.toml b/crates/heif/Cargo.toml
index 9a12bb2e..b3bc69d6 100644
--- a/crates/heif/Cargo.toml
+++ b/crates/heif/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "lightcraft-heif"
-description = "Optional HEIF/HEIC still-image decoder for LightCraft (a thin, panic-guarded wrapper around heic-rs)"
+description = "Optional HEIF/HEIC still-image decoder for LightCraft (heic-rs for the container and HEVC, libheif-matching colour conversion, panic-guarded)"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -9,12 +9,18 @@ license.workspace = true
 # Pure Rust, no unsafe. Pinned exactly: a young, single-owner crate that parses untrusted files;
 # moving the pin is a reviewed change (re-run the heif tests and the codecs corpus tests).
 # Mirrors PhotoCraft's photocraft-heif (same team, same decision): heic-rs was chosen over the
-# other permissive candidates (heif-oxide lacks 4:2:2; heifer was published the same week).
+# other permissive candidates (heif-oxide's HEVC decoder, rust_h265, follows FFmpeg's (LGPL)
+# code structure; gamut-heic has no HEVC decoder of its own).
 heic-rs = { version = "=0.1.1", default-features = false, features = ["std"] }
 
 # The tiles of a HEIC photo decode in parallel on native; wasm stays single-threaded.
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 heic-rs = { version = "=0.1.1", default-features = false, features = ["std", "parallel"] }
+rayon = { workspace = true }
+
+[features]
+# `lightcraft_heif::testdata`: lossless synthetic HEIF files, for the tests of the crates above.
+testdata = []
 
 [lints]
 workspace = true
diff --git a/crates/heif/README.md b/crates/heif/README.md
index e008a01c..75db814b 100644
--- a/crates/heif/README.md
+++ b/crates/heif/README.md
@@ -1,33 +1,47 @@
 # lightcraft-heif
 
-The optional HEIF / HEIC decoder of LightCraft: iPhone and Mac photos. A thin, panic-guarded wrapper
-around [`heic-rs`](https://github.com/tbraun96/heic-rs), a pure-Rust HEVC still-picture decoder
-(no `unsafe`, MIT OR Apache-2.0): single pictures and grid-tiled photos, 8- and 10-bit (10-bit
-decodes to 16-bit), alpha auxiliary images, the container's rotation/mirror/crop, ICC, EXIF and XMP.
-Read-only: writing would need an HEVC encoder.
+The optional HEIF / HEIC decoder of LightCraft: iPhone and Mac photos. [`heic-rs`](https://github.com/tbraun96/heic-rs)
+(pure Rust, no `unsafe`, MIT OR Apache-2.0, written from the H.265 / HEIF specifications) reads the
+container and reconstructs the HEVC pictures; this crate turns them into 16-bit RGB itself so the
+result matches libheif to within one code value:
+
+- the colour description is the item's `colr nclx` (or its first tile's), else the HEVC VUI
+  (iPhones: full range), else the H.265 defaults; an unspecified matrix is BT.601. heic-rs alone
+  assumes BT.709 limited range, about 8 code values off on every iPhone photo;
+- chroma is upsampled by nearest neighbour, or centred bilinear when a `clap` starts on an odd
+  pixel, as libheif does;
+- `imir` axis 0 flips top and bottom, as libheif writes and reads it (heic-rs names it the other way);
+- a grid's ICC profile may sit on its tiles.
+
+Single pictures and grid-tiled photos, 4:2:0 and monochrome, 8- to 10-bit, alpha auxiliary images
+(other auxiliary images — HDR gain maps, depth — are ignored), the container's rotation/mirror/crop,
+ICC, EXIF and XMP, and the file's thumbnail item. 4:2:2 and 4:4:4 (Canon/Sony "HIF") are refused
+with `Error::Unsupported`: heic-rs 0.1.1 loses sync on them. Read-only.
 
 ```rust
 let info = lightcraft_heif::probe(&bytes)?;           // size, depth, alpha: check limits first
 let img = lightcraft_heif::decode(&bytes, &lightcraft_heif::Options::default())?;
-// img.width, img.height, img.has_alpha, img.sixteen_bit, img.data (RGB/RGBA), img.icc, img.exif, img.xmp
+// img.width, img.height, img.has_alpha, img.bit_depth, img.data (RGB/RGBA u16), img.colour, img.icc, img.exif, img.xmp
+let thumb = lightcraft_heif::decode_thumbnail(&bytes, 256, &Default::default())?; // Option<Decoded>
 ```
 
-Errors are `Error::Unsupported` (image sequences, overlays, …), `Error::Limit` or
+Errors are `Error::Unsupported` (image sequences, overlays, 4:2:2/4:4:4, …), `Error::Limit` or
 `Error::Malformed`. It never panics: every call into heic-rs runs under `catch_unwind`, and a panic
-inside it (PhotoCraft's fuzzing found two in 0.1.1) becomes `Error::Malformed`. The crate is a port
-of PhotoCraft's `photocraft-heif` — the sibling apps deliberately share one decoder, one pin and
-one set of regression fixtures.
+inside it (PhotoCraft's fuzzing found two in 0.1.1) becomes `Error::Malformed`.
+
+Feature `testdata` exposes `lightcraft_heif::testdata`: lossless synthetic HEIF files (PCM-coded
+32 × 32 HEVC pictures, grids, every property above) for the tests of the crates above.
 
 ## Why it is a separate, optional crate
 
 - **A young decoder.** heic-rs is new and has a single maintainer. It is pinned exactly
   (`=0.1.1`); moving the pin is a reviewed change (re-run the crate tests and
-  `cargo test -p lightcraft-codecs --features heif`).
-- **HEVC patents are a distributor's call.** HEVC is patent-encumbered in some jurisdictions, so
-  whether a build includes an HEVC decoder is a build-time choice. `lightcraft-codecs` uses this
-  crate only behind its non-default `heif` feature; the apps forward it
-  (`cargo build -p lightcraft --features heif`). Without it, HEIC files are still recognised and
-  opening one is a clear "HEIC/HEIF support isn't included in this build" error — the same policy
-  as PhotoCraft.
+  `cargo test -p lightcraft-codecs --features heif`). The other permissive candidates were
+  rejected: heif-oxide's HEVC decoder (rust_h265) follows FFmpeg's (LGPL) code structure, and
+  gamut-heic has no HEVC decoder of its own.
+- **HEVC patents are a distributor's call.** `lightcraft-codecs` uses this crate only behind its
+  non-default `heif` feature; the apps forward it and the release packages enable it. Without it,
+  HEIC files are still recognised and opening one is a clear "HEIC/HEIF support isn't included in
+  this build" error — the same policy as PhotoCraft.
 
 The crate depends on no other LightCraft crate; `codecs` → `heif` is the only edge between them.
diff --git a/crates/heif/src/lib.rs b/crates/heif/src/lib.rs
index 7b19b9b9..8292024b 100644
--- a/crates/heif/src/lib.rs
+++ b/crates/heif/src/lib.rs
@@ -1,14 +1,17 @@
 //! `lightcraft-heif`: the optional HEIF / HEIC (iPhone and Mac photo) decoder.
 //!
-//! A thin wrapper around `heic-rs`, a pure-Rust HEVC still-picture decoder: single pictures and
-//! grid-tiled photos, 8- and 10-bit (10-bit decodes to 16-bit), alpha auxiliary images, ICC,
-//! EXIF and XMP. Its API is plain data ([`Info`], [`Decoded`], [`Error`]) so the crate knows
-//! nothing about the rest of LightCraft; `lightcraft-codecs` adapts it behind its `heif` feature.
-//! A port of PhotoCraft's `photocraft-heif` (same team, same licence) so the sibling apps share
-//! one decision, one dependency pin and one set of regression fixtures.
+//! `heic-rs`, a pure-Rust HEIF container and HEVC still-picture decoder, reads the container and
+//! reconstructs the coded pictures (bit-exact against libde265 on iPhone photos); this crate turns
+//! them into RGB itself ([`ycc`]) so the colours match libheif: it honours the HEVC VUI's range
+//! and matrix ([`vui`]) where heic-rs assumes BT.709 limited range, and upsamples chroma like
+//! libheif. Single pictures and grid-tiled photos, 8- to 16-bit, monochrome, alpha auxiliary
+//! images, ICC, EXIF and XMP. The API is plain data ([`Info`], [`Decoded`], [`Error`]) so the
+//! crate knows nothing about the rest of LightCraft; `lightcraft-codecs` adapts it behind its
+//! `heif` feature. Shares heic-rs and its regression fixtures with PhotoCraft's `photocraft-heif`.
 //!
 //! HEIF records orientation in the container (`irot`/`imir`, plus a `clap` crop), not in EXIF.
 //! [`Options::apply_transforms`] applies them; with it off, the pixels come back as coded.
+//! Auxiliary images other than alpha (HDR gain maps, depth maps) are ignored.
 //!
 //! Never panics: heic-rs is young, so every call into it runs under `catch_unwind` and a panic
 //! inside it becomes [`Error::Malformed`].
@@ -16,9 +19,20 @@
 #![forbid(unsafe_code)]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+mod orient;
+/// Lossless synthetic HEIF files for tests, here and in the crates above (feature `testdata`).
+#[cfg(any(test, feature = "testdata"))]
+#[doc(hidden)]
+pub mod testdata;
+mod vui;
+mod ycc;
+
 use std::borrow::Cow;
 
-use heic_rs::PixelLayout;
+use heic_rs::context::Context;
+use heic_rs::hevc::Frame;
+use heic_rs::props::ItemProps;
+use heic_rs::props::colr::Range;
 
 /// What a HEIF file declares, read from the container alone (no pixel is decoded).
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -31,8 +45,8 @@ pub struct Info {
     pub coded_height: u32,
     /// The primary image has an alpha auxiliary image.
     pub has_alpha: bool,
-    /// More than 8 bits per sample: it decodes to 16-bit.
-    pub sixteen_bit: bool,
+    /// Bits per sample as coded (8 for most photos, 10 for HDR-capable ones).
+    pub bit_depth: u8,
 }
 
 /// Decode settings.
@@ -50,17 +64,28 @@ impl Default for Options {
     }
 }
 
-/// A decoded image: interleaved RGB or RGBA samples, row-major, no padding. 16-bit samples are
-/// native-endian `u16`s.
+/// How the file describes its colour: the code points of ITU-T H.273, from the `colr` `nclx`
+/// box, else the HEVC VUI, else the standard defaults (2 = unspecified, limited range).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Colour {
+    pub primaries: u16,
+    pub transfer: u16,
+    pub matrix: u16,
+    pub full_range: bool,
+}
+
+/// A decoded image: interleaved RGB or RGBA, 16 bits per sample whatever the coded depth,
+/// row-major, no padding.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Decoded {
     pub width: u32,
     pub height: u32,
     /// Four channels (RGBA) instead of three (RGB).
     pub has_alpha: bool,
-    /// Two bytes per sample instead of one.
-    pub sixteen_bit: bool,
-    pub data: Vec<u8>,
+    /// Bits per sample as coded.
+    pub bit_depth: u8,
+    pub data: Vec<u16>,
+    pub colour: Colour,
     /// The primary image's ICC profile.
     pub icc: Option<Vec<u8>>,
     /// EXIF as a TIFF structure (without HEIF's offset header). Its Orientation tag only mirrors
@@ -74,7 +99,7 @@ pub struct Decoded {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum Error {
     /// A valid file using something this decoder does not handle (image sequences, overlays…).
-    Unsupported(String),
+    Unsupported(&'static str),
     /// The image is larger than [`Options::max_pixels`] or holds an oversized box.
     Limit(String),
     /// Broken or truncated data (or a decoder bug, reported the same way).
@@ -95,11 +120,15 @@ impl std::error::Error for Error {}
 
 const SEQUENCE: &str = "this file holds an image sequence; only HEIF still images can be opened";
 
-fn err(e: heic_rs::Error) -> Error {
+/// heic-rs 0.1.1 reconstructs 4:2:0 and monochrome pictures exactly but fails on the 4:2:2 and
+/// 4:4:4 ones some cameras write (Canon and Sony "HIF"); those failures are reported as this.
+const CHROMA_422_444: &str = "4:2:2 and 4:4:4 HEIF images (as some Canon and Sony cameras write) can't be decoded yet";
+
+pub(crate) fn err(e: heic_rs::Error) -> Error {
     match e {
-        heic_rs::Error::Unsupported(what) => Error::Unsupported(what.to_string()),
+        heic_rs::Error::Unsupported(what) => Error::Unsupported(what),
         // The primary item is neither an HEVC picture nor a grid of them.
-        heic_rs::Error::MissingBox("hvcC") => Error::Unsupported("the image is an overlay, an identity derivation or not HEVC-coded".into()),
+        heic_rs::Error::MissingBox("hvcC") => Error::Unsupported("the image is an overlay, an identity derivation or not HEVC-coded"),
         heic_rs::Error::PixelLimit { .. } | heic_rs::Error::BoxTooLarge { .. } => Error::Limit(e.to_string()),
         e => Error::Malformed(e.to_string()),
     }
@@ -113,7 +142,8 @@ fn guarded<T>(f: impl FnOnce() -> Result<T, Error>) -> Result<T, Error> {
 }
 
 /// Reads the container's declared size, depth and alpha without decoding pixels, so callers can
-/// check their limits first.
+/// check their limits first. Also refuses a file cut short: every coded picture of the primary
+/// image must lie within `bytes`.
 pub fn probe(bytes: &[u8]) -> Result<Info, Error> {
     guarded(|| probe_unguarded(bytes))
 }
@@ -121,16 +151,26 @@ pub fn probe(bytes: &[u8]) -> Result<Info, Error> {
 fn probe_unguarded(bytes: &[u8]) -> Result<Info, Error> {
     let info = heic_rs::probe(bytes).map_err(|e| match e {
         // No `meta` box: no still image, only a `moov` image sequence (a video track).
-        heic_rs::Error::MissingBox("meta") => Error::Unsupported(SEQUENCE.into()),
+        heic_rs::Error::MissingBox("meta") => Error::Unsupported(SEQUENCE),
         e => err(e),
     })?;
+    let ctx = Context::open(bytes).map_err(err)?;
+    let id = ctx.meta.primary;
+    let coded = match ctx.grid(id).map_err(err)? {
+        Some((_, tiles)) => tiles,
+        None => vec![id],
+    };
+    for item in coded {
+        // Borrowed from `bytes` unless split across extents: cheap.
+        ctx.item_data(item).map_err(err)?;
+    }
     Ok(Info {
         width: info.width,
         height: info.height,
         coded_width: info.coded_width,
         coded_height: info.coded_height,
         has_alpha: info.has_alpha,
-        sixteen_bit: info.bit_depth > 8,
+        bit_depth: info.bit_depth,
     })
 }
 
@@ -139,49 +179,186 @@ pub fn decode(bytes: &[u8], options: &Options) -> Result<Decoded, Error> {
     guarded(|| decode_unguarded(bytes, options))
 }
 
-fn decode_unguarded(bytes: &[u8], options: &Options) -> Result<Decoded, Error> {
-    let info = probe_unguarded(bytes)?;
-    let pixel_layout = match (info.has_alpha, info.sixteen_bit) {
-        (true, true) => PixelLayout::Rgba16,
-        (true, false) => PixelLayout::Rgba8,
-        (false, true) => PixelLayout::Rgb16,
-        (false, false) => PixelLayout::Rgb8,
-    };
-    let raw = heic_rs::DecodeOptions::default()
-        .with_layout(pixel_layout)
-        .with_max_pixels(Some(options.max_pixels))
-        .with_transforms(options.apply_transforms)
-        .with_alpha(info.has_alpha);
-    let decoded = heic_rs::decode(bytes, &raw).map_err(err)?;
-    let (icc, exif, xmp) = metadata(bytes);
-    Ok(Decoded {
-        width: decoded.width,
-        height: decoded.height,
-        has_alpha: info.has_alpha,
-        sixteen_bit: info.sixteen_bit,
-        data: decoded.data,
-        icc,
-        exif,
-        xmp,
+/// Decodes the smallest thumbnail image the file carries whose long edge is at least
+/// `min_edge`, if any (iPhones store one of about 320 × 240). Transforms are applied as for the
+/// primary image; the metadata (and, when the thumbnail has no profile of its own, the ICC
+/// profile) are the primary image's.
+pub fn decode_thumbnail(bytes: &[u8], min_edge: u32, options: &Options) -> Result<Option<Decoded>, Error> {
+    guarded(|| {
+        let ctx = Context::open(bytes).map_err(err)?;
+        let primary = ctx.meta.primary;
+        let mut best: Option<(u32, u32)> = None;
+        for r in ctx.meta.refs.iter().filter(|r| r.kind == heic_rs::meta::iref::RefKind::Thmb && r.to.contains(&primary)) {
+            let Ok(p) = ctx.props(r.from) else { continue };
+            let Ok((w, h)) = ctx.coded_size(r.from, &p) else { continue };
+            let edge = w.max(h);
+            if edge >= min_edge && best.is_none_or(|(_, e)| edge < e) {
+                best = Some((r.from, edge));
+            }
+        }
+        let Some((id, _)) = best else { return Ok(None) };
+        let mut decoded = decode_item(&ctx, id, options, false)?;
+        if decoded.icc.is_none() {
+            decoded.icc = item_icc(&ctx, primary);
+        }
+        (decoded.exif, decoded.xmp) = metadata(&ctx);
+        Ok(Some(decoded))
     })
 }
 
-/// The primary image's ICC profile, EXIF (TIFF structure) and XMP packet. Metadata is a
-/// courtesy: a broken metadata item never fails a decode whose pixels came out fine.
-fn metadata(bytes: &[u8]) -> (Option<Vec<u8>>, Option<Vec<u8>>, Option<String>) {
-    let Ok(ctx) = heic_rs::context::Context::open(bytes) else {
-        return (None, None, None);
-    };
+/// An item's ICC profile; a grid whose own properties carry none takes its first tile's (as on
+/// some iPhones).
+fn item_icc(ctx: &Context<'_>, id: u32) -> Option<Vec<u8>> {
+    let p = ctx.props(id).ok()?;
+    let icc = p.icc.or_else(|| {
+        let (_, tiles) = ctx.grid(id).ok()??;
+        ctx.props(*tiles.first()?).ok()?.icc
+    });
+    icc.map(<[u8]>::to_vec)
+}
+
+fn decode_unguarded(bytes: &[u8], options: &Options) -> Result<Decoded, Error> {
+    // Refuses sequences with a clear message before anything else is read.
+    probe_unguarded(bytes)?;
+    let ctx = Context::open(bytes).map_err(err)?;
+    let mut decoded = decode_item(&ctx, ctx.meta.primary, options, true)?;
+    let (exif, xmp) = metadata(&ctx);
+    decoded.exif = exif;
+    decoded.xmp = xmp;
+    Ok(decoded)
+}
+
+/// Decodes one image item (a coded picture or a grid of them) to RGB(A), alpha included when
+/// `with_alpha` and the item has an alpha auxiliary image.
+fn decode_item(ctx: &Context<'_>, id: u32, options: &Options, with_alpha: bool) -> Result<Decoded, Error> {
+    let p = ctx.props(id).map_err(err)?;
+    let limit = options.max_pixels;
+    // The declared sizes are refused before anything is decoded or allocated.
+    let (cw, ch) = ctx.coded_size(id, &p).map_err(err)?;
+    heic_rs::image::check_pixels(cw, ch, limit).map_err(err)?;
+    let (tw, th) = heic_rs::transform::transformed_size(cw, ch, &p.transforms).map_err(err)?;
+    heic_rs::image::check_pixels(tw, th, limit).map_err(err)?;
+
+    let coded = Coded::decode(ctx, id, &p, limit)?;
+    let planes = coded.planes()?;
+    let colour = colour(&p, &coded.first_props);
+    let signal = ycc::Signal { matrix: colour.matrix, full_range: colour.full_range };
+    let alpha_id = if with_alpha { ctx.alpha_item(id).map_err(err)? } else { None };
+    let (w, h) = planes.size();
+    let mode = if options.apply_transforms && orient::odd_crop(w, h, &p.transforms)? { ycc::Upsampling::Bilinear } else { ycc::Upsampling::Nearest };
+    let mut data = ycc::to_rgb16(&planes, signal, alpha_id.is_some(), mode)
+        .ok_or_else(|| Error::Malformed("the decoded pictures don't cover the image".into()))?;
+    if let Some(aux) = alpha_id {
+        let ap = ctx.props(aux).map_err(err)?;
+        let alpha = Coded::decode(ctx, aux, &ap, limit)?;
+        let alpha_planes = alpha.planes()?;
+        if alpha_planes.size() != (w, h) {
+            return Err(Error::Unsupported("an alpha image of a different size than the picture"));
+        }
+        ycc::put_alpha(&alpha_planes, &mut data).ok_or_else(|| Error::Malformed("the alpha image is incomplete".into()))?;
+    }
+    let bit_depth = planes.bit_depth();
+    let has_alpha = alpha_id.is_some();
+    let mut img = orient::Pixels { width: w, height: h, ch: if has_alpha { 4 } else { 3 }, data };
+    if options.apply_transforms {
+        img = orient::apply(img, &p.transforms)?;
+    }
+    Ok(Decoded {
+        width: u32::try_from(img.width).map_err(|_| Error::Limit("image too wide".into()))?,
+        height: u32::try_from(img.height).map_err(|_| Error::Limit("image too tall".into()))?,
+        has_alpha,
+        bit_depth,
+        data: img.data,
+        colour,
+        // A grid whose own properties carry no profile takes its tiles' (as on some iPhones).
+        icc: p.icc.or(coded.first_props.icc).map(<[u8]>::to_vec),
+        exif: None,
+        xmp: None,
+    })
+}
+
+/// The decoded pictures of an item: one, or a grid's tiles in `dimg` order.
+struct Coded<'a> {
+    frames: Vec<Frame>,
+    grid: Option<heic_rs::grid::Grid>,
+    /// The properties of the first coded picture (the item itself, or the first tile): where the
+    /// HEVC configuration and its VUI live.
+    first_props: ItemProps<'a>,
+    /// A failed 4:2:2 / 4:4:4 picture, for the error message.
+    chroma_format: u8,
+}
+
+impl<'a> Coded<'a> {
+    fn decode(ctx: &Context<'a>, id: u32, p: &ItemProps<'a>, limit: u64) -> Result<Coded<'a>, Error> {
+        let (grid, ids) = match ctx.grid(id).map_err(err)? {
+            Some((g, tiles)) => (Some(g), tiles),
+            None => (None, vec![id]),
+        };
+        let first = *ids.first().ok_or_else(|| Error::Malformed("grid lists no tiles".into()))?;
+        let first_props = if first == id { p.clone() } else { ctx.props(first).map_err(err)? };
+        let chroma_format = first_props.hvcc.as_ref().map_or(1, |c| c.chroma_format);
+        let decode_one = |t: &u32| -> Result<Frame, Error> {
+            let tp = ctx.props(*t).map_err(err)?;
+            let hvcc = tp.hvcc.as_ref().ok_or(heic_rs::Error::MissingBox("hvcC")).map_err(err)?;
+            let data = ctx.item_data(*t).map_err(err)?;
+            let nals = hvcc.split_nals(&data).map_err(err)?;
+            let params = hvcc.parameter_sets();
+            if params.is_empty() {
+                return Err(Error::Malformed("hvcC carries no parameter sets".into()));
+            }
+            let frame = heic_rs::hevc::decode_still(&params, &nals).map_err(err)?;
+            frame.validate().map_err(err)?;
+            heic_rs::image::check_pixels(frame.width, frame.height, limit).map_err(err)?;
+            Ok(frame)
+        };
+        #[cfg(not(target_arch = "wasm32"))]
+        let frames: Result<Vec<Frame>, Error> = {
+            use rayon::prelude::*;
+            ids.par_iter().map(decode_one).collect()
+        };
+        #[cfg(target_arch = "wasm32")]
+        let frames: Result<Vec<Frame>, Error> = ids.iter().map(decode_one).collect();
+        let frames = frames.map_err(|e| match e {
+            Error::Malformed(_) if chroma_format >= 2 => Error::Unsupported(CHROMA_422_444),
+            e => e,
+        })?;
+        Ok(Coded { frames, grid, first_props, chroma_format })
+    }
+
+    fn planes(&self) -> Result<ycc::Planes<'_>, Error> {
+        match (&self.grid, self.frames.as_slice()) {
+            (Some(g), tiles) => heic_rs::grid::Mosaic::new(g, tiles).map(ycc::Planes::Grid).map_err(err),
+            (None, [frame]) => Ok(ycc::Planes::Picture(frame)),
+            (None, _) => Err(Error::Malformed(format!("expected one coded picture (chroma format {})", self.chroma_format))),
+        }
+    }
+}
+
+/// The colour description in force: `nclx` on the item (or, for a grid without one, on its
+/// first tile), else the VUI of its (first) coded picture, else the H.265 defaults.
+fn colour(p: &ItemProps<'_>, coded: &ItemProps<'_>) -> Colour {
+    if let Some(n) = p.nclx.or(coded.nclx) {
+        return Colour { primaries: n.primaries, transfer: n.transfer, matrix: n.matrix_code, full_range: n.range == Range::Full };
+    }
+    let s = coded.hvcc.as_ref().and_then(|c| vui::signal(&c.parameter_sets())).unwrap_or_default();
+    Colour { primaries: s.primaries.into(), transfer: s.transfer.into(), matrix: s.matrix.into(), full_range: s.full_range }
+}
+
+/// The primary image's EXIF (TIFF structure) and XMP packet. Metadata is a courtesy: a broken
+/// metadata item never fails a decode whose pixels came out fine.
+fn metadata(ctx: &Context<'_>) -> (Option<Vec<u8>>, Option<String>) {
     let id = ctx.meta.primary;
-    let icc = ctx.props(id).ok().and_then(|p| ctx.icc(&p).map(<[u8]>::to_vec));
     let exif = ctx.exif(id).ok().flatten().map(<[u8]>::to_vec);
     let xmp = ctx.xmp_item(id).and_then(|x| ctx.item_data(x).ok()).and_then(|d| match d {
         Cow::Borrowed(b) => String::from_utf8(b.to_vec()).ok(),
         Cow::Owned(b) => String::from_utf8(b).ok(),
     });
-    (icc, exif, xmp.map(|x| x.trim_end_matches('\0').to_string()))
+    (exif, xmp.map(|x| x.trim_end_matches('\0').to_string()))
 }
 
+#[cfg(test)]
+mod tests_synthetic;
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -217,12 +394,13 @@ mod tests {
         for bytes in [&b""[..], b"\0\0\0\x18ftypheic\0\0\0\0mif1heic", &[0xFF; 64]] {
             assert!(probe(bytes).is_err());
             assert!(decode(bytes, &Options::default()).is_err());
+            assert!(decode_thumbnail(bytes, 1, &Options::default()).is_err());
         }
     }
 
     #[test]
     fn errors_display_their_kind() {
-        assert!(Error::Unsupported("x".into()).to_string().contains("unsupported"));
+        assert!(Error::Unsupported("x").to_string().contains("unsupported"));
         assert!(Error::Limit("x".into()).to_string().contains("limit"));
         assert!(Error::Malformed("x".into()).to_string().contains("malformed"));
     }
diff --git a/crates/heif/src/orient.rs b/crates/heif/src/orient.rs
new file mode 100644
index 00000000..487eb7e2
--- /dev/null
+++ b/crates/heif/src/orient.rs
@@ -0,0 +1,178 @@
+//! The container's transformative properties (`clap` crop, `irot` rotation, `imir` mirror),
+//! applied to interleaved 16-bit pixels in the order the file associates them.
+//!
+//! `imir` follows libheif, which writes and reads `axis = 0` as a flip about the horizontal axis
+//! (top and bottom exchanged) and `axis = 1` as a left-right flip. heic-rs 0.1.1 names the coded
+//! values the other way round (`Mirror::LeftRight` is `axis = 0`), so they are swapped here.
+
+use heic_rs::props::Transform;
+use heic_rs::props::simple::{Clap, Mirror, Rotation};
+
+use crate::Error;
+
+/// Interleaved samples, `ch` per pixel, row-major.
+pub struct Pixels {
+    pub width: usize,
+    pub height: usize,
+    pub ch: usize,
+    pub data: Vec<u16>,
+}
+
+impl Pixels {
+    fn remap(&self, width: usize, height: usize, src: impl Fn(usize, usize) -> (usize, usize)) -> Pixels {
+        let ch = self.ch;
+        let mut data = vec![0u16; width * height * ch];
+        for (y, row) in data.chunks_exact_mut(width * ch).enumerate() {
+            for (x, px) in row.chunks_exact_mut(ch).enumerate() {
+                let (sx, sy) = src(x, y);
+                let i = (sy * self.width + sx) * ch;
+                if let Some(s) = self.data.get(i..i + ch) {
+                    px.copy_from_slice(s);
+                }
+            }
+        }
+        Pixels { width, height, ch, data }
+    }
+}
+
+/// The rectangle `(left, top, width, height)` a `clap` selects from a `w` × `h` image. Its centre
+/// is `((w - 1) / 2 + horizOff, (h - 1) / 2 + vertOff)`; a corner that falls between two pixels
+/// is rounded as libheif does: left down, top up.
+pub fn crop_rect(w: usize, h: usize, c: Clap) -> Result<(usize, usize, usize, usize), Error> {
+    let bad = || Error::Malformed("clap selects an impossible rectangle".into());
+    let size = |(n, d): (u32, u32)| (d != 0).then(|| n / d).ok_or_else(bad);
+    let (cw, ch) = (size(c.width)? as usize, size(c.height)? as usize);
+    if cw == 0 || ch == 0 || cw > w || ch > h {
+        return Err(bad());
+    }
+    // Twice the corner, so the half pixels of odd sizes stay exact.
+    let twice = |full: usize, cropped: usize, (n, d): (i32, u32)| -> Result<i64, Error> {
+        if d == 0 {
+            return Err(bad());
+        }
+        Ok((full - cropped) as i64 + (2 * i64::from(n)).div_euclid(i64::from(d)))
+    };
+    let left = twice(w, cw, c.horiz_off)?.div_euclid(2);
+    let top = (twice(h, ch, c.vert_off)? + 1).div_euclid(2);
+    let left = usize::try_from(left).map_err(|_| bad())?;
+    let top = usize::try_from(top).map_err(|_| bad())?;
+    if left + cw > w || top + ch > h {
+        return Err(bad());
+    }
+    Ok((left, top, cw, ch))
+}
+
+/// Whether a `clap` among `transforms` (applied to a `w` × `h` image) starts at an odd column
+/// or row. libheif crops such images after upsampling their chroma bilinearly instead of with
+/// its default nearest neighbour; [`crate::ycc`] follows it so the pixels match.
+pub fn odd_crop(mut w: usize, mut h: usize, transforms: &[Transform]) -> Result<bool, Error> {
+    for t in transforms {
+        match *t {
+            Transform::Crop(c) => {
+                let (left, top, cw, ch) = crop_rect(w, h, c)?;
+                if left % 2 == 1 || top % 2 == 1 {
+                    return Ok(true);
+                }
+                (w, h) = (cw, ch);
+            }
+            Transform::Rotate(Rotation::Ccw90 | Rotation::Ccw270) => (w, h) = (h, w),
+            _ => {}
+        }
+    }
+    Ok(false)
+}
+
+pub fn apply(mut img: Pixels, transforms: &[Transform]) -> Result<Pixels, Error> {
+    for t in transforms {
+        let (w, h) = (img.width, img.height);
+        img = match *t {
+            Transform::Crop(c) => {
+                let (left, top, cw, ch) = crop_rect(w, h, c)?;
+                img.remap(cw, ch, |x, y| (x + left, y + top))
+            }
+            // Counter-clockwise: the right column becomes the top row.
+            Transform::Rotate(Rotation::Ccw90) => img.remap(h, w, |x, y| (w - 1 - y, x)),
+            Transform::Rotate(Rotation::Ccw180) => img.remap(w, h, |x, y| (w - 1 - x, h - 1 - y)),
+            Transform::Rotate(Rotation::Ccw270) => img.remap(h, w, |x, y| (y, h - 1 - x)),
+            Transform::Rotate(Rotation::None) => img,
+            // `axis = 0` (heic-rs's `LeftRight`): top and bottom exchanged, as libheif reads it.
+            Transform::Mirror(Mirror::LeftRight) => img.remap(w, h, |x, y| (x, h - 1 - y)),
+            // `axis = 1`: left and right exchanged.
+            Transform::Mirror(Mirror::TopBottom) => img.remap(w, h, |x, y| (w - 1 - x, y)),
+        };
+    }
+    Ok(img)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// 3×2, one channel: 1 2 3 / 4 5 6.
+    fn img() -> Pixels {
+        Pixels { width: 3, height: 2, ch: 1, data: vec![1, 2, 3, 4, 5, 6] }
+    }
+
+    fn run(t: Transform) -> (usize, usize, Vec<u16>) {
+        let p = apply(img(), &[t]).unwrap();
+        (p.width, p.height, p.data)
+    }
+
+    #[test]
+    fn rotations_are_counter_clockwise() {
+        assert_eq!(run(Transform::Rotate(Rotation::Ccw90)), (2, 3, vec![3, 6, 2, 5, 1, 4]));
+        assert_eq!(run(Transform::Rotate(Rotation::Ccw180)), (3, 2, vec![6, 5, 4, 3, 2, 1]));
+        assert_eq!(run(Transform::Rotate(Rotation::Ccw270)), (2, 3, vec![4, 1, 5, 2, 6, 3]));
+        assert_eq!(run(Transform::Rotate(Rotation::None)), (3, 2, vec![1, 2, 3, 4, 5, 6]));
+    }
+
+    #[test]
+    fn mirrors_follow_libheif() {
+        // axis 0 (heic-rs `LeftRight`) exchanges top and bottom; axis 1 left and right.
+        assert_eq!(run(Transform::Mirror(Mirror::LeftRight)), (3, 2, vec![4, 5, 6, 1, 2, 3]));
+        assert_eq!(run(Transform::Mirror(Mirror::TopBottom)), (3, 2, vec![3, 2, 1, 6, 5, 4]));
+    }
+
+    fn clap(w: u32, h: u32, ho: i32, vo: i32) -> Clap {
+        Clap { width: (w, 1), height: (h, 1), horiz_off: (ho, 1), vert_off: (vo, 1) }
+    }
+
+    #[test]
+    fn clap_corners_round_like_libheif() {
+        // Measured against libheif 1.23 on a 512 × 512 picture.
+        assert_eq!(crop_rect(512, 512, clap(301, 201, 0, 0)).unwrap(), (105, 156, 301, 201));
+        assert_eq!(crop_rect(512, 512, clap(300, 200, 0, 0)).unwrap(), (106, 156, 300, 200));
+        assert_eq!(crop_rect(512, 512, clap(301, 201, 37, -21)).unwrap(), (142, 135, 301, 201));
+        assert_eq!(crop_rect(512, 512, clap(301, 201, -3, 5)).unwrap(), (102, 161, 301, 201));
+        assert_eq!(crop_rect(512, 512, clap(300, 201, 0, 0)).unwrap(), (106, 156, 300, 201));
+        assert_eq!(crop_rect(1500, 1000, clap(1001, 701, 37, -21)).unwrap(), (286, 129, 1001, 701));
+        let p = apply(img(), &[Transform::Crop(clap(2, 1, 1, 0))]).unwrap();
+        // The half-pixel top rounds down a row.
+        assert_eq!((p.width, p.height, p.data), (2, 1, vec![5, 6]));
+    }
+
+    #[test]
+    fn impossible_claps_are_errors() {
+        for c in [
+            clap(0, 1, 0, 0),
+            clap(4, 1, 0, 0),
+            clap(3, 2, 1, 0),
+            clap(3, 2, 0, -1),
+            Clap { width: (1, 0), ..clap(1, 1, 0, 0) },
+            Clap { horiz_off: (0, 0), ..clap(1, 1, 0, 0) },
+        ] {
+            assert!(crop_rect(3, 2, c).is_err(), "{c:?}");
+        }
+        assert!(apply(img(), &[Transform::Crop(clap(9, 9, 0, 0))]).is_err());
+    }
+
+    #[test]
+    fn odd_crops_are_detected_through_rotations() {
+        assert!(!odd_crop(512, 512, &[Transform::Crop(clap(300, 200, 0, 0))]).unwrap());
+        assert!(odd_crop(512, 512, &[Transform::Crop(clap(301, 200, 0, 0))]).unwrap());
+        // After a quarter turn the crop applies to a 200 × 300 image.
+        let t = [Transform::Crop(clap(300, 200, 0, 0)), Transform::Rotate(Rotation::Ccw90), Transform::Crop(clap(197, 300, 0, 0))];
+        assert!(odd_crop(512, 512, &t).unwrap());
+        assert!(!odd_crop(512, 512, &[Transform::Rotate(Rotation::Ccw90)]).unwrap());
+    }
+}
diff --git a/crates/heif/src/testdata.rs b/crates/heif/src/testdata.rs
new file mode 100644
index 00000000..595cfa33
--- /dev/null
+++ b/crates/heif/src/testdata.rs
@@ -0,0 +1,542 @@
+//! Synthetic HEIF files for tests (feature `testdata`): lossless, so every decoded sample is known.
+//!
+//! Each coded picture is one 32 × 32 coding tree unit stored as PCM samples (H.265 7.3.8.7):
+//! the bitstream carries the YCbCr values verbatim, so the decoder's HEVC stage reproduces them
+//! exactly and a test checks everything after it (grid composition, colour, transforms,
+//! metadata) against values it chose. The few CABAC bins around the PCM data are written with a
+//! minimal arithmetic encoder (9.3.4.4). Larger images are grids of such pictures, which is how
+//! iPhones store photos too (with 512 × 512 tiles).
+//!
+//! Not a general HEIF or HEVC writer: 4:2:0 or monochrome, 8 or 10 bits, a CTU per picture.
+
+/// Side of every coded picture.
+pub const TILE: u32 = 32;
+
+/// YCbCr samples at a luma position (chroma is taken at even positions, 4:2:0).
+pub type Sampler<'a> = &'a dyn Fn(u32, u32) -> [u16; 3];
+
+/// A property of the primary image.
+#[derive(Debug, Clone, PartialEq)]
+pub enum Prop {
+    /// `colr` of type `prof`.
+    Icc(Vec<u8>),
+    /// `colr` of type `nclx`: primaries, transfer, matrix, full range.
+    Nclx(u16, u16, u16, bool),
+    /// `irot`: quarter turns counter-clockwise.
+    Irot(u8),
+    /// `imir` with this axis.
+    Imir(u8),
+    /// `clap`: width, height, horizontal and vertical offset (whole pixels).
+    Clap(u32, u32, i32, i32),
+}
+
+/// What [`build`] writes.
+pub struct Spec<'a> {
+    /// Displayed (grid output) size, before transforms.
+    pub width: u32,
+    pub height: u32,
+    pub bit_depth: u8,
+    pub sample: Sampler<'a>,
+    /// Properties of the primary image, in association order.
+    pub props: Vec<Prop>,
+    /// EXIF as a TIFF structure (written with HEIF's 4-byte offset header).
+    pub exif: Option<Vec<u8>>,
+    /// An alpha auxiliary image (monochrome, full range).
+    pub alpha: Option<&'a dyn Fn(u32, u32) -> u16>,
+    /// A thumbnail item of half the size with these samples (in its own coordinates).
+    pub thumbnail: Option<Sampler<'a>>,
+    /// Auxiliary images of these types the decoder must ignore (HDR gain map, depth…).
+    pub ignored_aux: Vec<&'static str>,
+}
+
+impl<'a> Spec<'a> {
+    pub fn new(width: u32, height: u32, sample: Sampler<'a>) -> Spec<'a> {
+        Spec { width, height, bit_depth: 8, sample, props: Vec::new(), exif: None, alpha: None, thumbnail: None, ignored_aux: Vec::new() }
+    }
+}
+
+#[derive(Default)]
+struct Bits {
+    bytes: Vec<u8>,
+    n: usize,
+}
+
+impl Bits {
+    fn put(&mut self, v: u32, len: u32) {
+        for i in (0..len).rev() {
+            if self.n.is_multiple_of(8) {
+                self.bytes.push(0);
+            }
+            if (v >> i) & 1 == 1
+                && let Some(b) = self.bytes.last_mut()
+            {
+                *b |= 0x80 >> (self.n % 8);
+            }
+            self.n += 1;
+        }
+    }
+
+    fn ue(&mut self, v: u32) {
+        let x = u64::from(v) + 1;
+        let len = 64 - x.leading_zeros();
+        self.put(0, len - 1);
+        self.put((x & 0xffff_ffff) as u32, len);
+    }
+
+    fn align_zero(&mut self) {
+        while !self.n.is_multiple_of(8) {
+            self.put(0, 1);
+        }
+    }
+
+    fn trailing(&mut self) {
+        self.put(1, 1);
+        self.align_zero();
+    }
+}
+
+/// The CABAC arithmetic encoder of H.265 9.3.4.4, for the bins these pictures need.
+struct Cabac {
+    low: u32,
+    range: u32,
+    first: bool,
+    outstanding: u32,
+}
+
+impl Cabac {
+    fn new() -> Cabac {
+        Cabac { low: 0, range: 510, first: true, outstanding: 0 }
+    }
+
+    fn put_bit(&mut self, out: &mut Bits, b: u32) {
+        if self.first {
+            self.first = false;
+        } else {
+            out.put(b, 1);
+        }
+        while self.outstanding > 0 {
+            out.put(1 - b, 1);
+            self.outstanding -= 1;
+        }
+    }
+
+    fn renorm(&mut self, out: &mut Bits) {
+        while self.range < 256 {
+            if self.low < 256 {
+                self.put_bit(out, 0);
+            } else if self.low >= 512 {
+                self.low -= 512;
+                self.put_bit(out, 1);
+            } else {
+                self.low -= 256;
+                self.outstanding += 1;
+            }
+            self.range <<= 1;
+            self.low <<= 1;
+        }
+    }
+
+    /// `part_mode` = PART_2Nx2N: the most probable symbol of a fresh context (initValue 184 at
+    /// QP 26 gives pStateIdx 0, valMps 1), so the LPS range is `rangeTabLps[0][3]` = 240.
+    fn part_mode_2nx2n(&mut self, out: &mut Bits) {
+        let lps = [128, 176, 208, 240][((self.range >> 6) & 3) as usize];
+        self.range -= lps;
+        self.renorm(out);
+    }
+
+    /// A terminating bin equal to 1 (`pcm_flag`, `end_of_slice_segment_flag`), with the flush.
+    fn terminate_one(&mut self, out: &mut Bits) {
+        self.range -= 2;
+        self.low += self.range;
+        self.range = 2;
+        self.renorm(out);
+        self.put_bit(out, (self.low >> 9) & 1);
+        out.put(((self.low >> 7) & 3) | 1, 2);
+    }
+}
+
+fn nal(kind: u8, rbsp: &[u8]) -> Vec<u8> {
+    let mut out = vec![kind << 1, 1];
+    let mut zeros = 0;
+    for &b in rbsp {
+        if zeros >= 2 && b <= 3 {
+            out.push(3);
+            zeros = 0;
+        }
+        zeros = if b == 0 { zeros + 1 } else { 0 };
+        out.push(b);
+    }
+    out
+}
+
+fn profile_idc(bit_depth: u8, mono: bool) -> u32 {
+    match (bit_depth, mono) {
+        (_, true) => 4, // range extensions
+        (8, false) => 1,
+        _ => 2,
+    }
+}
+
+fn ptl(w: &mut Bits, idc: u32) {
+    w.put(0, 2);
+    w.put(0, 1);
+    w.put(idc, 5);
+    w.put(1 << (31 - idc), 32); // compatible with itself
+    w.put(0b1001, 4); // progressive, frame only
+    w.put(0, 22);
+    w.put(0, 21);
+    w.put(0, 1);
+    w.put(93, 8); // level 3.1
+}
+
+fn parameter_sets(bit_depth: u8, mono: bool) -> [Vec<u8>; 3] {
+    let idc = profile_idc(bit_depth, mono);
+    let bd = u32::from(bit_depth);
+    let mut v = Bits::default();
+    v.put(0, 4);
+    v.put(3, 2);
+    v.put(0, 6);
+    v.put(0, 3);
+    v.put(1, 1);
+    v.put(0xffff, 16);
+    ptl(&mut v, idc);
+    v.put(0, 1); // vps_sub_layer_ordering_info_present_flag
+    v.ue(0);
+    v.ue(0);
+    v.ue(0);
+    v.put(0, 6); // vps_max_layer_id
+    v.ue(0); // vps_num_layer_sets_minus1
+    v.put(0, 1); // vps_timing_info_present_flag
+    v.put(0, 1); // vps_extension_flag
+    v.trailing();
+
+    let mut s = Bits::default();
+    s.put(0, 4);
+    s.put(0, 3);
+    s.put(1, 1);
+    ptl(&mut s, idc);
+    s.ue(0);
+    s.ue(if mono { 0 } else { 1 });
+    s.ue(TILE);
+    s.ue(TILE);
+    s.put(0, 1); // conformance_window_flag
+    s.ue(bd - 8);
+    s.ue(bd - 8);
+    s.ue(4);
+    s.put(1, 1);
+    s.ue(0);
+    s.ue(0);
+    s.ue(0);
+    s.ue(2); // log2_min_luma_coding_block_size_minus3: 32
+    s.ue(0); // log2_diff_max_min_luma_coding_block_size: CTB 32
+    s.ue(0); // log2_min_luma_transform_block_size_minus2: 4
+    s.ue(3); // log2_diff_max_min_luma_transform_block_size: 32
+    s.ue(0);
+    s.ue(0);
+    s.put(0, 1); // scaling_list_enabled_flag
+    s.put(0, 1); // amp_enabled_flag
+    s.put(0, 1); // sample_adaptive_offset_enabled_flag
+    s.put(1, 1); // pcm_enabled_flag
+    s.put(bd - 1, 4); // pcm_sample_bit_depth_luma_minus1
+    s.put(bd - 1, 4); // pcm_sample_bit_depth_chroma_minus1
+    s.ue(2); // log2_min_pcm_luma_coding_block_size_minus3: 32
+    s.ue(0); // log2_diff_max_min_pcm_luma_coding_block_size
+    s.put(1, 1); // pcm_loop_filter_disabled_flag
+    s.ue(0); // num_short_term_ref_pic_sets
+    s.put(0, 1); // long_term_ref_pics_present_flag
+    s.put(0, 1); // sps_temporal_mvp_enabled_flag
+    s.put(0, 1); // strong_intra_smoothing_enabled_flag
+    s.put(0, 1); // vui_parameters_present_flag
+    s.put(0, 1); // sps_extension_present_flag
+    s.trailing();
+
+    let mut p = Bits::default();
+    p.ue(0);
+    p.ue(0);
+    p.put(0, 6); // dependent slices, output flag, 3 extra header bits, sign hiding
+    p.put(0, 1); // cabac_init_present_flag
+    p.ue(0);
+    p.ue(0);
+    p.ue(0); // init_qp_minus26 (se(0) is the same bits)
+    p.put(0, 3); // constrained intra, transform skip, cu_qp_delta
+    p.ue(0);
+    p.ue(0);
+    p.put(0, 1);
+    p.put(0, 2);
+    p.put(0, 1); // transquant_bypass_enabled_flag
+    p.put(0, 1); // tiles_enabled_flag
+    p.put(0, 1); // entropy_coding_sync_enabled_flag
+    p.put(0, 1); // pps_loop_filter_across_slices_enabled_flag
+    p.put(1, 1); // deblocking_filter_control_present_flag
+    p.put(0, 1); // deblocking_filter_override_enabled_flag
+    p.put(1, 1); // pps_deblocking_filter_disabled_flag
+    p.put(0, 1);
+    p.put(0, 1);
+    p.ue(0);
+    p.put(0, 1);
+    p.put(0, 1);
+    p.trailing();
+    [nal(32, &v.bytes), nal(33, &s.bytes), nal(34, &p.bytes)]
+}
+
+/// One coded 32 × 32 picture: the `hvcC` payload and the item data (length-prefixed NAL).
+struct Coded {
+    hvcc: Vec<u8>,
+    data: Vec<u8>,
+}
+
+fn picture(bit_depth: u8, mono: bool, sample: &dyn Fn(u32, u32) -> [u16; 3]) -> Coded {
+    let bd = u32::from(bit_depth);
+    let mut w = Bits::default();
+    w.put(1, 1); // first_slice_segment_in_pic_flag
+    w.put(0, 1); // no_output_of_prior_pics_flag
+    w.ue(0);
+    w.ue(2); // I slice
+    w.ue(0); // slice_qp_delta, se(0)
+    w.trailing(); // byte_alignment()
+    let mut c = Cabac::new();
+    c.part_mode_2nx2n(&mut w);
+    c.terminate_one(&mut w); // pcm_flag
+    w.align_zero(); // pcm_alignment_zero_bit
+    for y in 0..TILE {
+        for x in 0..TILE {
+            w.put(u32::from(sample(x, y)[0]), bd);
+        }
+    }
+    if !mono {
+        for k in 1..3 {
+            for y in 0..TILE / 2 {
+                for x in 0..TILE / 2 {
+                    w.put(u32::from(sample(2 * x, 2 * y)[k]), bd);
+                }
+            }
+        }
+    }
+    let mut c = Cabac::new();
+    c.terminate_one(&mut w); // end_of_slice_segment_flag (its flush ends in the stop bit)
+    w.align_zero();
+    let slice = nal(19, &w.bytes);
+
+    let sets = parameter_sets(bit_depth, mono);
+    let mut h = vec![1u8, profile_idc(bit_depth, mono) as u8];
+    h.extend_from_slice(&(1u32 << (31 - profile_idc(bit_depth, mono))).to_be_bytes());
+    h.extend_from_slice(&[
+        0x90,
+        0,
+        0,
+        0,
+        0,
+        0,
+        93,
+        0xf0,
+        0,
+        0xfc,
+        0xfc | u8::from(!mono),
+        0xf8 | (bit_depth - 8),
+        0xf8 | (bit_depth - 8),
+        0,
+        0,
+        0x0f,
+        3,
+    ]);
+    for (kind, set) in [32u8, 33, 34].into_iter().zip(&sets) {
+        h.push(0x80 | kind);
+        h.extend_from_slice(&1u16.to_be_bytes());
+        h.extend_from_slice(&(set.len() as u16).to_be_bytes());
+        h.extend_from_slice(set);
+    }
+    let mut data = (slice.len() as u32).to_be_bytes().to_vec();
+    data.extend_from_slice(&slice);
+    Coded { hvcc: h, data }
+}
+
+fn bx(kind: &[u8; 4], payload: &[u8]) -> Vec<u8> {
+    let mut v = ((payload.len() + 8) as u32).to_be_bytes().to_vec();
+    v.extend_from_slice(kind);
+    v.extend_from_slice(payload);
+    v
+}
+
+fn full_box(kind: &[u8; 4], version: u8, payload: &[u8]) -> Vec<u8> {
+    let mut p = vec![version, 0, 0, 0];
+    p.extend_from_slice(payload);
+    bx(kind, &p)
+}
+
+struct Item {
+    id: u16,
+    kind: &'static [u8; 4],
+    data: Vec<u8>,
+    /// Indices (1-based) into the property list, with the essential flag.
+    props: Vec<(u8, bool)>,
+    /// Not an image of its own (a grid tile).
+    hidden: bool,
+}
+
+#[derive(Default)]
+struct File {
+    items: Vec<Item>,
+    props: Vec<Vec<u8>>,
+    refs: Vec<(&'static [u8; 4], u16, Vec<u16>)>,
+}
+
+impl File {
+    fn prop(&mut self, b: Vec<u8>) -> u8 {
+        self.props.push(b);
+        self.props.len() as u8
+    }
+
+    fn add(&mut self, kind: &'static [u8; 4], data: Vec<u8>, props: Vec<(u8, bool)>) -> u16 {
+        let id = self.items.len() as u16 + 1;
+        self.items.push(Item { id, kind, data, props, hidden: false });
+        id
+    }
+
+    /// A coded image of `w` × `h` (a grid when larger than a tile); returns its item id.
+    fn image(&mut self, w: u32, h: u32, bit_depth: u8, mono: bool, sample: &dyn Fn(u32, u32) -> [u16; 3]) -> u16 {
+        let (cols, rows) = (w.div_ceil(TILE), h.div_ceil(TILE));
+        let ispe = |w: u32, h: u32| {
+            let mut p = w.to_be_bytes().to_vec();
+            p.extend_from_slice(&h.to_be_bytes());
+            full_box(b"ispe", 0, &p)
+        };
+        let mut hvcc_prop = None;
+        let tile_ispe = self.prop(ispe(TILE, TILE));
+        let mut tiles = Vec::new();
+        for r in 0..rows {
+            for c in 0..cols {
+                let coded = picture(bit_depth, mono, &|x, y| sample((c * TILE + x).min(w - 1), (r * TILE + y).min(h - 1)));
+                let hv = *hvcc_prop.get_or_insert_with(|| self.prop(bx(b"hvcC", &coded.hvcc)));
+                tiles.push(self.add(b"hvc1", coded.data, vec![(hv, true), (tile_ispe, false)]));
+            }
+        }
+        if let ([only], true) = (tiles.as_slice(), w == TILE && h == TILE) {
+            return *only;
+        }
+        for it in self.items.iter_mut().filter(|i| tiles.contains(&i.id)) {
+            it.hidden = true;
+        }
+        let mut g = vec![0u8, 0, (rows - 1) as u8, (cols - 1) as u8];
+        g.extend_from_slice(&(w as u16).to_be_bytes());
+        g.extend_from_slice(&(h as u16).to_be_bytes());
+        let grid_ispe = self.prop(ispe(w, h));
+        let id = self.add(b"grid", g, vec![(grid_ispe, false)]);
+        self.refs.push((b"dimg", id, tiles));
+        id
+    }
+
+    fn write(self, primary: u16) -> Vec<u8> {
+        let ftyp = bx(b"ftyp", b"heic\0\0\0\0mif1heic");
+        let mut hdlr = vec![0u8; 4];
+        hdlr.extend_from_slice(b"pict");
+        hdlr.extend_from_slice(&[0; 13]);
+        let hdlr = full_box(b"hdlr", 0, &hdlr);
+        let pitm = full_box(b"pitm", 0, &primary.to_be_bytes());
+        let mut iinf = (self.items.len() as u16).to_be_bytes().to_vec();
+        for it in &self.items {
+            let mut e = vec![2, 0, 0, u8::from(it.hidden)]; // version 2, flags
+            e.extend_from_slice(&it.id.to_be_bytes());
+            e.extend_from_slice(&[0, 0]);
+            e.extend_from_slice(it.kind);
+            e.push(0);
+            iinf.extend_from_slice(&bx(b"infe", &e));
+        }
+        let iinf = full_box(b"iinf", 0, &iinf);
+        let mut iref = Vec::new();
+        for (kind, from, to) in &self.refs {
+            let mut r = from.to_be_bytes().to_vec();
+            r.extend_from_slice(&(to.len() as u16).to_be_bytes());
+            for t in to {
+                r.extend_from_slice(&t.to_be_bytes());
+            }
+            iref.extend_from_slice(&bx(kind, &r));
+        }
+        let iref = full_box(b"iref", 0, &iref);
+        let ipco = bx(b"ipco", &self.props.concat());
+        let mut ipma = (self.items.iter().filter(|i| !i.props.is_empty()).count() as u32).to_be_bytes().to_vec();
+        for it in self.items.iter().filter(|i| !i.props.is_empty()) {
+            ipma.extend_from_slice(&it.id.to_be_bytes());
+            ipma.push(it.props.len() as u8);
+            ipma.extend(it.props.iter().map(|&(i, essential)| i | if essential { 0x80 } else { 0 }));
+        }
+        let iprp = bx(b"iprp", &[ipco, full_box(b"ipma", 0, &ipma)].concat());
+        let iloc = |base: u32| {
+            let mut l = vec![0x44, 0x00];
+            l.extend_from_slice(&(self.items.len() as u16).to_be_bytes());
+            let mut offset = base;
+            for it in &self.items {
+                l.extend_from_slice(&it.id.to_be_bytes());
+                l.extend_from_slice(&[0, 0, 0, 0, 0, 1]); // construction method 0, data ref 0, one extent
+                l.extend_from_slice(&offset.to_be_bytes());
+                l.extend_from_slice(&(it.data.len() as u32).to_be_bytes());
+                offset += it.data.len() as u32;
+            }
+            full_box(b"iloc", 1, &l)
+        };
+        let meta = |base| full_box(b"meta", 0, &[hdlr.clone(), pitm.clone(), iloc(base), iinf.clone(), iref.clone(), iprp.clone()].concat());
+        let start = (ftyp.len() + meta(0).len() + 8) as u32;
+        let mdat = bx(b"mdat", &self.items.iter().flat_map(|i| i.data.iter().copied()).collect::<Vec<u8>>());
+        [ftyp, meta(start), mdat].concat()
+    }
+}
+
+/// Writes the HEIF file `spec` describes.
+pub fn build(spec: &Spec<'_>) -> Vec<u8> {
+    let mut f = File::default();
+    let primary = f.image(spec.width, spec.height, spec.bit_depth, false, spec.sample);
+    let mut assoc = Vec::new();
+    for p in &spec.props {
+        let b = match p {
+            Prop::Icc(icc) => bx(b"colr", &[b"prof".as_slice(), icc].concat()),
+            Prop::Nclx(pr, tc, mc, full) => {
+                let mut c = b"nclx".to_vec();
+                for v in [pr, tc, mc] {
+                    c.extend_from_slice(&v.to_be_bytes());
+                }
+                c.push(if *full { 0x80 } else { 0 });
+                bx(b"colr", &c)
+            }
+            Prop::Irot(a) => bx(b"irot", &[a & 3]),
+            Prop::Imir(a) => bx(b"imir", &[a & 1]),
+            Prop::Clap(w, h, ho, vo) => {
+                let mut c = Vec::new();
+                for v in [*w as i32, 1, *h as i32, 1, *ho, 1, *vo, 1] {
+                    c.extend_from_slice(&v.to_be_bytes());
+                }
+                bx(b"clap", &c)
+            }
+        };
+        assoc.push((f.prop(b), true, matches!(p, Prop::Clap(..))));
+    }
+    if let Some(it) = f.items.iter_mut().find(|i| i.id == primary) {
+        it.props.extend(assoc.iter().map(|&(i, e, _)| (i, e)));
+    }
+    if let Some(exif) = &spec.exif {
+        let id = f.add(b"Exif", [&[0u8, 0, 0, 0][..], exif].concat(), Vec::new());
+        f.refs.push((b"cdsc", id, vec![primary]));
+    }
+    let bd = spec.bit_depth;
+    let aux = |f: &mut File, urn: &str, sample: &dyn Fn(u32, u32) -> [u16; 3]| {
+        let id = f.image(spec.width, spec.height, bd, true, sample);
+        let auxc = f.prop(full_box(b"auxC", 0, &[urn.as_bytes(), &[0]].concat()));
+        if let Some(it) = f.items.iter_mut().find(|i| i.id == id) {
+            it.props.push((auxc, true));
+        }
+        f.refs.push((b"auxl", id, vec![primary]));
+    };
+    if let Some(alpha) = spec.alpha {
+        aux(&mut f, "urn:mpeg:hevc:2015:auxid:1", &|x, y| [alpha(x, y), 0, 0]);
+    }
+    for urn in &spec.ignored_aux {
+        aux(&mut f, urn, &|x, y| [((x + y) % 256) as u16, 0, 0]);
+    }
+    if let Some(sample) = spec.thumbnail {
+        // Half the size, with the primary image's colour and orientation (not its crop).
+        let id = f.image(spec.width / 2, spec.height / 2, spec.bit_depth, false, sample);
+        if let Some(it) = f.items.iter_mut().find(|i| i.id == id) {
+            it.props.extend(assoc.iter().filter(|a| !a.2).map(|&(i, e, _)| (i, e)));
+        }
+        f.refs.push((b"thmb", id, vec![primary]));
+    }
+    f.write(primary)
+}
diff --git a/crates/heif/src/tests_synthetic.rs b/crates/heif/src/tests_synthetic.rs
new file mode 100644
index 00000000..e229af92
--- /dev/null
+++ b/crates/heif/src/tests_synthetic.rs
@@ -0,0 +1,176 @@
+//! Decoding lossless synthetic HEIF files ([`crate::testdata`]): every expected sample is known.
+
+use crate::testdata::{Prop, Spec, build};
+use crate::{Error, Options, decode, decode_thumbnail, probe};
+
+/// A luma value unique enough to identify its position; chroma neutral.
+fn luma(x: u32, y: u32) -> u16 {
+    ((x * 7 + y * 13) % 220 + 20) as u16
+}
+
+fn grey(x: u32, y: u32) -> [u16; 3] {
+    [luma(x, y), 128, 128]
+}
+
+const FULL_601: Prop = Prop::Nclx(1, 13, 6, true);
+
+/// Decoded red channel at `(x, y)`, back in 8-bit code values.
+fn at(d: &crate::Decoded, x: u32, y: u32) -> u16 {
+    let ch = if d.has_alpha { 4 } else { 3 };
+    d.data[((y * d.width + x) as usize) * ch] / 257
+}
+
+fn decoded(spec: &Spec) -> crate::Decoded {
+    decode(&build(spec), &Options::default()).unwrap()
+}
+
+#[test]
+fn a_grid_reassembles_exactly() {
+    // 4 × 3 tiles of 32, cropped by the grid to 100 × 70.
+    let d = decoded(&Spec { props: vec![FULL_601], ..Spec::new(100, 70, &grey) });
+    assert_eq!((d.width, d.height, d.bit_depth, d.has_alpha), (100, 70, 8, false));
+    for y in 0..70 {
+        for x in 0..100 {
+            let px = &d.data[((y * 100 + x) * 3) as usize..][..3];
+            assert_eq!(px, [luma(x, y) * 257; 3], "({x}, {y})");
+        }
+    }
+    let info = probe(&build(&Spec::new(100, 70, &grey))).unwrap();
+    assert_eq!((info.width, info.height, info.coded_width, info.coded_height, info.bit_depth), (100, 70, 100, 70, 8));
+}
+
+#[test]
+fn colour_follows_the_matrix_and_range() {
+    // BT.601 full range, a saturated orange: within one code value of the exact conversion.
+    let (y, cb, cr) = (150.0f32, 80.0, 190.0);
+    let s = |_: u32, _: u32| [y as u16, cb as u16, cr as u16];
+    let d = decoded(&Spec { props: vec![FULL_601], ..Spec::new(32, 32, &s) });
+    let (u, v) = (cb - 128.0, cr - 128.0);
+    let expected = [y + 1.402 * v, y - 0.344_136 * u - 0.714_136 * v, y + 1.772 * u].map(|c| c.clamp(0.0, 255.0));
+    for (got, want) in d.data[..3].iter().zip(expected) {
+        assert!((f32::from(*got) / 257.0 - want).abs() <= 1.0, "{:?} vs {expected:?}", &d.data[..3]);
+    }
+    assert_eq!(d.colour, crate::Colour { primaries: 1, transfer: 13, matrix: 6, full_range: true });
+
+    // No nclx and no VUI: the H.265 defaults, limited range (16 → black, 235 → white).
+    let ends = |x: u32, _: u32| [if x < 16 { 16 } else { 235 }, 128, 128];
+    let d = decoded(&Spec::new(32, 32, &ends));
+    assert!(!d.colour.full_range);
+    assert_eq!((d.data[0], d.data[20 * 3]), (0, 65535));
+}
+
+#[test]
+fn ten_bit_samples_keep_their_precision() {
+    let s = |x: u32, y: u32| [(x * 31 + y) as u16 % 1024, 512, 512];
+    let d = decoded(&Spec { bit_depth: 10, props: vec![FULL_601], ..Spec::new(64, 32, &s) });
+    assert_eq!(d.bit_depth, 10);
+    for x in [0, 1, 5, 33, 63] {
+        let want = ((x * 31) % 1024) as f64 / 1023.0 * 65535.0;
+        assert!((f64::from(d.data[(x * 3) as usize]) - want).abs() <= 1.0, "x {x}");
+    }
+}
+
+#[test]
+fn container_transforms_are_applied_like_libheif() {
+    let (w, h) = (70u32, 40u32);
+    let spec = |props: Vec<Prop>| Spec { props: [vec![FULL_601], props].concat(), ..Spec::new(w, h, &grey) };
+    // irot: counter-clockwise quarter turns.
+    let d = decoded(&spec(vec![Prop::Irot(1)]));
+    assert_eq!((d.width, d.height), (h, w));
+    assert_eq!(at(&d, 0, 0), luma(w - 1, 0)); // the right column becomes the top row
+    assert_eq!(at(&d, h - 1, w - 1), luma(0, h - 1));
+    let d = decoded(&spec(vec![Prop::Irot(2)]));
+    assert_eq!(at(&d, 0, 0), luma(w - 1, h - 1));
+    let d = decoded(&spec(vec![Prop::Irot(3)]));
+    assert_eq!(at(&d, 0, 0), luma(0, h - 1));
+    // imir: axis 0 exchanges top and bottom, axis 1 left and right (libheif's reading).
+    let d = decoded(&spec(vec![Prop::Imir(0)]));
+    assert_eq!((at(&d, 0, 0), at(&d, 5, 0)), (luma(0, h - 1), luma(5, h - 1)));
+    let d = decoded(&spec(vec![Prop::Imir(1)]));
+    assert_eq!((at(&d, 0, 0), at(&d, 0, 5)), (luma(w - 1, 0), luma(w - 1, 5)));
+    // clap: centred crop moved by its offsets; a half-pixel corner goes left and down.
+    let d = decoded(&spec(vec![Prop::Clap(31, 21, 3, -2)]));
+    assert_eq!((d.width, d.height), (31, 21));
+    // left = (70 - 31 + 6) / 2 = 22.5 → 22, top = (40 - 21 - 4) / 2 = 7.5 → 8
+    assert_eq!(at(&d, 0, 0), luma(22, 8));
+    // In association order: crop, then turn, then mirror.
+    let d = decoded(&spec(vec![Prop::Clap(30, 20, 0, 0), Prop::Irot(1), Prop::Imir(1)]));
+    assert_eq!((d.width, d.height), (20, 30));
+    // The crop is (20, 10) to (49, 29); the turn brings its bottom-right corner to the top-right,
+    // the left-right mirror to the top-left.
+    assert_eq!(at(&d, 0, 0), luma(49, 29));
+    let info = probe(&build(&spec(vec![Prop::Irot(1)]))).unwrap();
+    assert_eq!((info.width, info.height, info.coded_width, info.coded_height), (h, w, w, h));
+    // Transforms off: as coded.
+    let d = decode(&build(&spec(vec![Prop::Irot(1)])), &Options { apply_transforms: false, ..Default::default() }).unwrap();
+    assert_eq!((d.width, d.height, at(&d, 3, 2)), (w, h, luma(3, 2)));
+}
+
+#[test]
+fn metadata_aux_images_and_thumbnails() {
+    let icc = b"not parsed here: carried verbatim".to_vec();
+    let exif = b"MM\0\x2a\0\0\0\x08\0\0".to_vec();
+    let spec = Spec {
+        props: vec![Prop::Icc(icc.clone()), FULL_601],
+        exif: Some(exif.clone()),
+        thumbnail: Some(&|_, _| [77, 128, 128]),
+        ignored_aux: vec!["urn:com:apple:photo:2020:aux:hdrgainmap", "urn:mpeg:hevc:2015:auxid:2"],
+        ..Spec::new(64, 64, &grey)
+    };
+    let bytes = build(&spec);
+    let d = decode(&bytes, &Options::default()).unwrap();
+    assert_eq!((d.width, d.height, d.has_alpha), (64, 64, false));
+    assert_eq!(d.icc.as_deref(), Some(icc.as_slice()));
+    assert_eq!(d.exif.as_deref(), Some(exif.as_slice()));
+    let t = decode_thumbnail(&bytes, 32, &Options::default()).unwrap().unwrap();
+    assert_eq!((t.width, t.height, t.data[0]), (32, 32, 77 * 257));
+    assert_eq!(t.exif.as_deref(), Some(exif.as_slice()));
+    assert_eq!(t.icc.as_deref(), Some(icc.as_slice()));
+    assert!(decode_thumbnail(&bytes, 33, &Options::default()).unwrap().is_none());
+}
+
+#[test]
+fn alpha_comes_from_its_auxiliary_image() {
+    let alpha = |x: u32, _: u32| (x * 4) as u16;
+    let d = decoded(&Spec { props: vec![FULL_601], alpha: Some(&alpha), ..Spec::new(64, 32, &grey) });
+    assert!(d.has_alpha);
+    assert_eq!(d.data.len(), 64 * 32 * 4);
+    assert_eq!((d.data[3], d.data[10 * 4 + 3]), (0, 40 * 257));
+    assert_eq!(d.data[..3], [luma(0, 0) * 257; 3]);
+}
+
+#[test]
+fn limits_are_checked_before_decoding() {
+    let bytes = build(&Spec::new(96, 64, &grey));
+    let r = decode(&bytes, &Options { max_pixels: 96 * 64 - 1, ..Default::default() });
+    assert!(matches!(r, Err(Error::Limit(_))), "{r:?}");
+}
+
+#[test]
+fn truncated_and_corrupted_files_are_errors_not_panics() {
+    let bytes = build(&Spec { props: vec![FULL_601, Prop::Irot(1)], thumbnail: Some(&grey), ..Spec::new(64, 64, &grey) });
+    let full = decode(&bytes, &Options::default()).unwrap();
+    for cut in (0..bytes.len()).step_by(7) {
+        let b = &bytes[..cut];
+        // Cut inside the photo: an error. Cut in the trailing thumbnail: the whole photo.
+        if let (Ok(_), Ok(d)) = (probe(b), decode(b, &Options::default())) {
+            assert_eq!(d.data, full.data, "cut at {cut} of {}", bytes.len());
+        }
+        let _ = decode_thumbnail(b, 1, &Options::default());
+    }
+    // Flip bits all over the file: any outcome but a panic.
+    let mut state = 0x2545_f491_u32;
+    for _ in 0..400 {
+        let mut b = bytes.clone();
+        for _ in 0..3 {
+            state ^= state << 13;
+            state ^= state >> 17;
+            state ^= state << 5;
+            let i = state as usize % b.len();
+            b[i] ^= 1 << (state % 8);
+        }
+        let _ = probe(&b);
+        let _ = decode(&b, &Options::default());
+        let _ = decode_thumbnail(&b, 1, &Options::default());
+    }
+}
diff --git a/crates/heif/src/vui.rs b/crates/heif/src/vui.rs
new file mode 100644
index 00000000..d732f286
--- /dev/null
+++ b/crates/heif/src/vui.rs
@@ -0,0 +1,427 @@
+//! The colour description in an HEVC sequence parameter set's VUI (Rec. ITU-T H.265, 7.3.2.2 and
+//! Annex E): the fallback a HEIF reader uses when the item carries no `colr` box of type `nclx`.
+//! iPhone photos are the common case: they label their colour with an ICC profile only and say in
+//! the VUI that their YCbCr is full range.
+//!
+//! Only the syntax up to `matrix_coeffs` is read. Anything this parser can't follow returns `None`
+//! and the caller falls back to the H.265 defaults; it never fails a decode.
+
+/// What the VUI's `video_signal_type` says (H.265 E.3.1). Absent fields keep the defaults the
+/// standard infers: limited range, every code point 2 ("unspecified").
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Signal {
+    pub full_range: bool,
+    pub primaries: u8,
+    pub transfer: u8,
+    pub matrix: u8,
+}
+
+impl Default for Signal {
+    fn default() -> Self {
+        Signal { full_range: false, primaries: 2, transfer: 2, matrix: 2 }
+    }
+}
+
+/// NAL unit type of a sequence parameter set.
+const SPS_NUT: u8 = 33;
+
+/// Reads the signal description from the SPS among `parameter_sets` (NAL units with their
+/// two-byte header, as an `hvcC` record stores them). `None`: no SPS, or one this reader can't
+/// follow; `Some(Signal::default())`: an SPS without VUI colour fields.
+pub fn signal(parameter_sets: &[&[u8]]) -> Option<Signal> {
+    let sps = parameter_sets.iter().find(|n| n.first().is_some_and(|b| (b >> 1) & 0x3f == SPS_NUT))?;
+    parse_sps(&unescape(sps.get(2..)?))
+}
+
+/// Removes emulation prevention bytes (`00 00 03` → `00 00`).
+fn unescape(nal: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(nal.len());
+    let mut zeros = 0usize;
+    for &b in nal {
+        if zeros >= 2 && b == 3 {
+            zeros = 0;
+            continue;
+        }
+        zeros = if b == 0 { zeros + 1 } else { 0 };
+        out.push(b);
+    }
+    out
+}
+
+struct Bits<'a> {
+    data: &'a [u8],
+    pos: usize,
+}
+
+impl Bits<'_> {
+    fn u(&mut self, n: u32) -> Option<u32> {
+        let mut v = 0u32;
+        for _ in 0..n {
+            let byte = *self.data.get(self.pos / 8)?;
+            v = (v << 1) | u32::from((byte >> (7 - self.pos % 8)) & 1);
+            self.pos += 1;
+        }
+        Some(v)
+    }
+
+    fn flag(&mut self) -> Option<bool> {
+        self.u(1).map(|b| b == 1)
+    }
+
+    fn skip(&mut self, n: usize) -> Option<()> {
+        self.pos = self.pos.checked_add(n)?;
+        (self.pos <= self.data.len().saturating_mul(8)).then_some(())
+    }
+
+    /// `ue(v)`; values past 32 bits are refused (no valid field here needs them).
+    fn ue(&mut self) -> Option<u32> {
+        let mut zeros = 0u32;
+        while !self.flag()? {
+            zeros += 1;
+            if zeros > 31 {
+                return None;
+            }
+        }
+        let rest = self.u(zeros)?;
+        ((1u64 << zeros) - 1 + u64::from(rest)).try_into().ok()
+    }
+
+    fn se(&mut self) -> Option<()> {
+        self.ue().map(|_| ())
+    }
+}
+
+/// `profile_tier_level(1, max_sub_layers_minus1)` (7.3.3): only skipped.
+fn profile_tier_level(r: &mut Bits, max_sub_layers_minus1: u32) -> Option<()> {
+    r.skip(88)?; // general profile space .. general_inbld/reserved flag
+    r.skip(8)?; // general_level_idc
+    let mut present = [(false, false); 8];
+    for p in present.iter_mut().take(max_sub_layers_minus1 as usize) {
+        *p = (r.flag()?, r.flag()?);
+    }
+    if max_sub_layers_minus1 > 0 {
+        r.skip(2 * (8 - max_sub_layers_minus1 as usize))?; // reserved_zero_2bits
+    }
+    for &(profile, level) in present.iter().take(max_sub_layers_minus1 as usize) {
+        if profile {
+            r.skip(88)?;
+        }
+        if level {
+            r.skip(8)?;
+        }
+    }
+    Some(())
+}
+
+/// `scaling_list_data()` (7.3.4): only skipped.
+fn scaling_list_data(r: &mut Bits) -> Option<()> {
+    for size_id in 0..4u32 {
+        let step = if size_id == 3 { 3 } else { 1 };
+        for _ in (0..6).step_by(step) {
+            if !r.flag()? {
+                r.ue()?; // scaling_list_pred_matrix_id_delta
+            } else {
+                let coefs = 64.min(1 << (4 + (size_id << 1)));
+                if size_id > 1 {
+                    r.se()?; // scaling_list_dc_coef_minus8
+                }
+                for _ in 0..coefs {
+                    r.se()?; // scaling_list_delta_coef
+                }
+            }
+        }
+    }
+    Some(())
+}
+
+/// `st_ref_pic_set(idx)` (7.3.7) as it appears in an SPS; returns `NumDeltaPocs[idx]`.
+fn st_ref_pic_set(r: &mut Bits, idx: usize, num_delta_pocs: &[u32]) -> Option<u32> {
+    if idx != 0 && r.flag()? {
+        // inter_ref_pic_set_prediction_flag: predicted from the previous set (in an SPS,
+        // delta_idx_minus1 is absent and RefRpsIdx = idx - 1).
+        r.skip(1)?; // delta_rps_sign
+        r.ue()?; // abs_delta_rps_minus1
+        let reference = *num_delta_pocs.get(idx - 1)?;
+        let mut count = 0u32;
+        for _ in 0..=reference {
+            let used = r.flag()?;
+            let kept = used || r.flag()?; // use_delta_flag when not used_by_curr_pic_flag
+            count += u32::from(kept);
+        }
+        return Some(count);
+    }
+    let negative = r.ue()?;
+    let positive = r.ue()?;
+    let total = negative.checked_add(positive)?;
+    if total > 32 {
+        return None; // at most 16 + 16 for any level
+    }
+    for _ in 0..total {
+        r.ue()?; // delta_poc_s*_minus1
+        r.skip(1)?; // used_by_curr_pic_s*_flag
+    }
+    Some(total)
+}
+
+fn parse_sps(rbsp: &[u8]) -> Option<Signal> {
+    let r = &mut Bits { data: rbsp, pos: 0 };
+    r.skip(4)?; // sps_video_parameter_set_id
+    let max_sub_layers_minus1 = r.u(3)?;
+    if max_sub_layers_minus1 > 6 {
+        return None;
+    }
+    r.skip(1)?; // sps_temporal_id_nesting_flag
+    profile_tier_level(r, max_sub_layers_minus1)?;
+    r.ue()?; // sps_seq_parameter_set_id
+    if r.ue()? == 3 {
+        r.skip(1)?; // separate_colour_plane_flag
+    }
+    r.ue()?; // pic_width_in_luma_samples
+    r.ue()?; // pic_height_in_luma_samples
+    if r.flag()? {
+        for _ in 0..4 {
+            r.ue()?; // conf_win_*_offset
+        }
+    }
+    r.ue()?; // bit_depth_luma_minus8
+    r.ue()?; // bit_depth_chroma_minus8
+    let log2_max_poc_lsb = r.ue()?.checked_add(4)?;
+    if log2_max_poc_lsb > 16 {
+        return None;
+    }
+    let first = if r.flag()? { 0 } else { max_sub_layers_minus1 };
+    for _ in first..=max_sub_layers_minus1 {
+        r.ue()?; // sps_max_dec_pic_buffering_minus1
+        r.ue()?; // sps_max_num_reorder_pics
+        r.ue()?; // sps_max_latency_increase_plus1
+    }
+    for _ in 0..6 {
+        r.ue()?; // coding/transform block sizes, transform hierarchy depths
+    }
+    if r.flag()? && r.flag()? {
+        // scaling_list_enabled_flag, sps_scaling_list_data_present_flag
+        scaling_list_data(r)?;
+    }
+    r.skip(2)?; // amp_enabled_flag, sample_adaptive_offset_enabled_flag
+    if r.flag()? {
+        // pcm_enabled_flag
+        r.skip(8)?; // pcm sample bit depths
+        r.ue()?;
+        r.ue()?;
+        r.skip(1)?; // pcm_loop_filter_disabled_flag
+    }
+    let sets = r.ue()? as usize;
+    if sets > 64 {
+        return None;
+    }
+    let mut num_delta_pocs = Vec::with_capacity(sets);
+    for idx in 0..sets {
+        let n = st_ref_pic_set(r, idx, &num_delta_pocs)?;
+        num_delta_pocs.push(n);
+    }
+    if r.flag()? {
+        // long_term_ref_pics_present_flag
+        let n = r.ue()?;
+        if n > 32 {
+            return None;
+        }
+        for _ in 0..n {
+            r.skip(log2_max_poc_lsb as usize + 1)?; // lt_ref_pic_poc_lsb_sps, used_by_curr_pic_lt_sps_flag
+        }
+    }
+    r.skip(2)?; // sps_temporal_mvp_enabled_flag, strong_intra_smoothing_enabled_flag
+    let mut signal = Signal::default();
+    if !r.flag()? {
+        return Some(signal); // no VUI
+    }
+    if r.flag()? && r.u(8)? == 255 {
+        // aspect_ratio_info_present_flag, aspect_ratio_idc == EXTENDED_SAR
+        r.skip(32)?;
+    }
+    if r.flag()? {
+        r.skip(1)?; // overscan_appropriate_flag
+    }
+    if r.flag()? {
+        // video_signal_type_present_flag
+        r.skip(3)?; // video_format
+        signal.full_range = r.flag()?;
+        if r.flag()? {
+            signal.primaries = r.u(8)? as u8;
+            signal.transfer = r.u(8)? as u8;
+            signal.matrix = r.u(8)? as u8;
+        }
+    }
+    Some(signal)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A bit writer for building parameter sets in tests.
+    #[derive(Default)]
+    pub(crate) struct Writer {
+        pub bits: Vec<bool>,
+    }
+
+    impl Writer {
+        pub fn u(&mut self, v: u32, n: u32) {
+            for i in (0..n).rev() {
+                self.bits.push(i < 32 && (v >> i) & 1 == 1);
+            }
+        }
+        pub fn ue(&mut self, v: u32) {
+            let x = u64::from(v) + 1;
+            let len = 64 - x.leading_zeros();
+            self.u(0, len - 1);
+            for i in (0..len).rev() {
+                self.bits.push((x >> i) & 1 == 1);
+            }
+        }
+        pub fn bytes(mut self) -> Vec<u8> {
+            self.bits.push(true); // rbsp_stop_one_bit
+            while !self.bits.len().is_multiple_of(8) {
+                self.bits.push(false);
+            }
+            self.bits.chunks(8).map(|c| c.iter().fold(0u8, |a, &b| (a << 1) | u8::from(b))).collect()
+        }
+    }
+
+    fn sps(vui: impl FnOnce(&mut Writer), st_sets: impl FnOnce(&mut Writer)) -> Vec<u8> {
+        let mut w = Writer::default();
+        w.u(0, 4);
+        w.u(1, 3); // one sub-layer above the base
+        w.u(1, 1);
+        w.u(0, 88);
+        w.u(93, 8);
+        w.u(0b11, 2); // sub-layer profile and level present
+        w.u(0, 2 * 7);
+        w.u(0, 88);
+        w.u(0, 8);
+        w.ue(0);
+        w.ue(1); // 4:2:0
+        w.ue(4032);
+        w.ue(3024);
+        w.u(1, 1); // conformance window
+        for _ in 0..4 {
+            w.ue(3);
+        }
+        w.ue(0);
+        w.ue(0);
+        w.ue(4);
+        w.u(1, 1);
+        for _ in 0..2 {
+            w.ue(1);
+            w.ue(0);
+            w.ue(0);
+        }
+        for v in [0, 3, 0, 3, 0, 0] {
+            w.ue(v);
+        }
+        w.u(1, 1); // scaling lists, with data
+        w.u(1, 1);
+        for size_id in 0..4u32 {
+            for _ in (0..6).step_by(if size_id == 3 { 3 } else { 1 }) {
+                w.u(1, 1);
+                if size_id > 1 {
+                    w.ue(0);
+                }
+                for _ in 0..64.min(1 << (4 + (size_id << 1))) {
+                    w.ue(0);
+                }
+            }
+        }
+        w.u(0, 2);
+        w.u(1, 1); // pcm
+        w.u(0x77, 8);
+        w.ue(0);
+        w.ue(1);
+        w.u(1, 1);
+        st_sets(&mut w);
+        w.u(1, 1); // long-term pictures
+        w.ue(1);
+        w.u(0, 8 + 1);
+        w.u(0, 2);
+        vui(&mut w);
+        let mut nal = vec![SPS_NUT << 1, 1];
+        // escape like a real NAL so `signal` has to unescape
+        let mut zeros = 0;
+        for b in w.bytes() {
+            if zeros >= 2 && b <= 3 {
+                nal.push(3);
+                zeros = 0;
+            }
+            zeros = if b == 0 { zeros + 1 } else { 0 };
+            nal.push(b);
+        }
+        nal
+    }
+
+    fn two_rps(w: &mut Writer) {
+        w.ue(2);
+        w.ue(1); // set 0: one negative picture
+        w.ue(0);
+        w.ue(0);
+        w.u(1, 1);
+        w.u(1, 1); // set 1: predicted from set 0
+        w.u(0, 1);
+        w.ue(0);
+        w.u(0, 1); // not used ...
+        w.u(1, 1); // ... but kept
+        w.u(1, 1);
+    }
+
+    #[test]
+    fn reads_full_range_and_matrix_from_the_vui() {
+        let nal = sps(
+            |w| {
+                w.u(1, 1); // vui present
+                w.u(1, 1);
+                w.u(255, 8);
+                w.u(0x0001_0001, 32);
+                w.u(1, 1);
+                w.u(0, 1);
+                w.u(1, 1); // video_signal_type_present_flag
+                w.u(5, 3);
+                w.u(1, 1); // full range
+                w.u(1, 1);
+                w.u(12, 8);
+                w.u(13, 8);
+                w.u(6, 8);
+            },
+            two_rps,
+        );
+        let s = signal(&[&[0x40, 1, 0xc], &nal, &[0x44, 1]]);
+        assert_eq!(s, Some(Signal { full_range: true, primaries: 12, transfer: 13, matrix: 6 }));
+    }
+
+    #[test]
+    fn absent_fields_take_the_standard_defaults() {
+        let no_vui = sps(|w| w.u(0, 1), |w| w.ue(0));
+        assert_eq!(signal(&[&no_vui]), Some(Signal::default()));
+        let range_only = sps(
+            |w| {
+                w.u(1, 1);
+                w.u(0, 2);
+                w.u(1, 1);
+                w.u(5, 3);
+                w.u(1, 1);
+                w.u(0, 1); // no colour description
+            },
+            |w| w.ue(0),
+        );
+        assert_eq!(signal(&[&range_only]), Some(Signal { full_range: true, ..Signal::default() }));
+    }
+
+    #[test]
+    fn missing_or_truncated_sps_is_none() {
+        assert_eq!(signal(&[]), None);
+        assert_eq!(signal(&[&[0x40, 1, 2, 3]]), None);
+        let nal = sps(|w| w.u(0, 1), |w| w.ue(0));
+        for cut in 2..nal.len() - 2 {
+            // never panics; most cuts are None
+            let _ = signal(&[nal.get(..cut).unwrap_or_default()]);
+        }
+        assert_eq!(signal(&[&[SPS_NUT << 1, 1, 0xff, 0xff, 0xff]]), None);
+    }
+}
diff --git a/crates/heif/src/ycc.rs b/crates/heif/src/ycc.rs
new file mode 100644
index 00000000..a0429b45
--- /dev/null
+++ b/crates/heif/src/ycc.rs
@@ -0,0 +1,326 @@
+//! YCbCr → RGB for decoded HEVC pictures, done here rather than in heic-rs so the result matches
+//! libheif (the reference every HEIF tool is checked against) to within one code value:
+//!
+//! - **Which matrix and range.** The item's `colr` `nclx` box when there is one; otherwise the
+//!   HEVC VUI ([`crate::vui`]); otherwise the H.265 defaults (limited range). An unspecified matrix
+//!   is BT.601, as libheif reads it. heic-rs 0.1.1 ignores the VUI and assumes BT.709 limited
+//!   range for every file without `nclx`, which shifts every iPhone photo (full range, ICC only)
+//!   by about 8 code values.
+//! - **Chroma upsampling.** Nearest neighbour (each chroma sample covers its 2×2 or 2×1 luma
+//!   block), as libheif does by default. libheif switches to a centred bilinear filter (weights
+//!   9/3/3/1 sixteenths, in integers) when a `clap` crop starts at an odd column or row; so does
+//!   [`Upsampling::Bilinear`].
+//!
+//! The arithmetic is floating point and the result 16-bit, whatever the coded depth, so the
+//! develop pipeline gets every bit the conversion produces.
+
+use heic_rs::grid::Mosaic;
+use heic_rs::hevc::{ChromaFormat, Frame};
+
+/// The coded pictures one image is made of.
+pub enum Planes<'a> {
+    Picture(&'a Frame),
+    Grid(Mosaic<'a>),
+}
+
+impl Planes<'_> {
+    pub fn size(&self) -> (usize, usize) {
+        match self {
+            Planes::Picture(f) => (f.width as usize, f.height as usize),
+            Planes::Grid(m) => (m.width() as usize, m.height() as usize),
+        }
+    }
+
+    pub fn bit_depth(&self) -> u8 {
+        match self {
+            Planes::Picture(f) => f.bit_depth,
+            Planes::Grid(m) => m.bit_depth(),
+        }
+    }
+
+    pub fn chroma(&self) -> ChromaFormat {
+        match self {
+            Planes::Picture(f) => f.chroma,
+            Planes::Grid(m) => m.chroma(),
+        }
+    }
+
+    fn chroma_width(&self) -> usize {
+        let (w, h) = self.size();
+        self.chroma().chroma_size(w as u32, h as u32).0 as usize
+    }
+
+    fn luma_row(&self, y: usize, dst: &mut [u16]) -> Option<()> {
+        match self {
+            Planes::Picture(f) => copy_row(&f.y, f.y_stride as usize, y, dst),
+            Planes::Grid(m) => m.luma_row(y, dst),
+        }
+    }
+
+    fn chroma_row(&self, cr: bool, r: usize, dst: &mut [u16]) -> Option<()> {
+        match self {
+            Planes::Picture(f) => copy_row(if cr { &f.cr } else { &f.cb }, f.c_stride as usize, r, dst),
+            Planes::Grid(m) => m.chroma_row(cr, r, dst),
+        }
+    }
+}
+
+fn copy_row(plane: &[u16], stride: usize, y: usize, dst: &mut [u16]) -> Option<()> {
+    let start = y.checked_mul(stride)?;
+    dst.copy_from_slice(plane.get(start..start.checked_add(dst.len())?)?);
+    Some(())
+}
+
+/// How the three coded channels map to R, G, B (H.273 `MatrixCoefficients`).
+#[derive(Debug, Clone, Copy, PartialEq)]
+enum Matrix {
+    /// 0: the channels are G, B, R.
+    Identity,
+    /// 8: YCgCo.
+    YCgCo,
+    /// Every Kr/Kb matrix: R = Y + `cr_r`·Cr, G = Y − `cb_g`·Cb − `cr_g`·Cr, B = Y + `cb_b`·Cb.
+    Kr { cr_r: f32, cb_g: f32, cr_g: f32, cb_b: f32 },
+}
+
+impl Matrix {
+    /// Unknown, reserved and unspecified codes are BT.601, like libheif.
+    fn from_code(code: u16) -> Matrix {
+        let (kr, kb) = match code {
+            0 => return Matrix::Identity,
+            8 => return Matrix::YCgCo,
+            1 => (0.2126, 0.0722),
+            4 => (0.30, 0.11),
+            7 => (0.212, 0.087),
+            // 10 (BT.2020 constant luminance) is approximated by its non-constant matrix.
+            9 | 10 => (0.2627, 0.0593),
+            _ => (0.299, 0.114),
+        };
+        let kg = 1.0 - kr - kb;
+        Matrix::Kr { cr_r: 2.0 * (1.0 - kr), cb_g: 2.0 * kb * (1.0 - kb) / kg, cr_g: 2.0 * kr * (1.0 - kr) / kg, cb_b: 2.0 * (1.0 - kb) }
+    }
+}
+
+/// How the samples are to be read: the matrix and the range.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Signal {
+    pub matrix: u16,
+    pub full_range: bool,
+}
+
+/// How subsampled chroma is brought to the luma resolution.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Upsampling {
+    Nearest,
+    /// Centred bilinear: chroma sits between its two luma columns (and rows for 4:2:0).
+    Bilinear,
+}
+
+/// One chroma row brought to the full width `w` of luma row `y`.
+fn chroma_at(planes: &Planes<'_>, cr: bool, y: usize, w: usize, mode: Upsampling, buf: &mut [u16], next: &mut [u16]) -> Option<Vec<u16>> {
+    let chroma = planes.chroma();
+    let (xs, ys) = (chroma.x_shift(), chroma.y_shift());
+    let (wf, hf) = planes.size();
+    let rows = chroma.chroma_size(wf as u32, hf as u32).1 as usize;
+    let cy = y >> ys;
+    planes.chroma_row(cr, cy, buf)?;
+    let last = buf.len().checked_sub(1)?;
+    if mode == Upsampling::Nearest || xs == 0 {
+        return (0..w).map(|x| buf.get(x >> xs).copied()).collect();
+    }
+    // The nearer neighbour on each axis takes a quarter of the weight.
+    let ny = if ys == 0 {
+        cy
+    } else if y.is_multiple_of(2) {
+        cy.saturating_sub(1)
+    } else {
+        (cy + 1).min(rows.checked_sub(1)?)
+    };
+    planes.chroma_row(cr, ny, next)?;
+    (0..w)
+        .map(|x| {
+            let cx = x >> 1;
+            let nx = if x % 2 == 0 { cx.saturating_sub(1) } else { (cx + 1).min(last) };
+            let (a, an) = (u32::from(*buf.get(cx)?), u32::from(*buf.get(nx)?));
+            let v = if ys == 0 {
+                (3 * a + an + 2) >> 2
+            } else {
+                let (b, bn) = (u32::from(*next.get(cx)?), u32::from(*next.get(nx)?));
+                (9 * a + 3 * b + 3 * an + bn + 8) >> 4
+            };
+            u16::try_from(v).ok()
+        })
+        .collect()
+}
+
+/// Converts `planes` to interleaved 16-bit RGB, or RGBA with room left for alpha (filled with
+/// 65535 here). `None` when the planes can't supply a row they promised (a malformed grid).
+pub fn to_rgb16(planes: &Planes<'_>, signal: Signal, alpha: bool, mode: Upsampling) -> Option<Vec<u16>> {
+    let (w, h) = planes.size();
+    let ch = if alpha { 4 } else { 3 };
+    let bd = u32::from(planes.bit_depth());
+    if !(8..=16).contains(&bd) || w == 0 || h == 0 {
+        return None;
+    }
+    let max = ((1u32 << bd) - 1) as f32;
+    let half = (1u32 << (bd - 1)) as f32;
+    let scale = (1u32 << (bd - 8)) as f32;
+    // Normalised Y = (v − y_off)·y_mul, Cb/Cr = (v − half)·c_mul.
+    let (y_off, y_mul, c_mul) =
+        if signal.full_range { (0.0, 1.0 / max, 1.0 / max) } else { (16.0 * scale, 1.0 / (219.0 * scale), 1.0 / (224.0 * scale)) };
+    let matrix = Matrix::from_code(signal.matrix);
+    let mono = planes.chroma() == ChromaFormat::Monochrome;
+    let cw = planes.chroma_width();
+
+    let mut out = vec![0u16; w.checked_mul(h)?.checked_mul(ch)?];
+    let row = |y: usize, dst: &mut [u16]| -> Option<()> {
+        let mut luma = vec![0u16; w];
+        planes.luma_row(y, &mut luma)?;
+        let (cb, cr) = if mono {
+            (Vec::new(), Vec::new())
+        } else {
+            let (mut buf, mut next) = (vec![0u16; cw], vec![0u16; cw]);
+            (chroma_at(planes, false, y, w, mode, &mut buf, &mut next)?, chroma_at(planes, true, y, w, mode, &mut buf, &mut next)?)
+        };
+        for (x, (px, &yv)) in dst.chunks_exact_mut(ch).zip(&luma).enumerate() {
+            let rgb = if mono {
+                let v = (f32::from(yv) - y_off) * y_mul;
+                [v, v, v]
+            } else {
+                let (u, v) = (f32::from(*cb.get(x)?), f32::from(*cr.get(x)?));
+                match matrix {
+                    // G, B, R all read like luma.
+                    Matrix::Identity => [(v - y_off) * y_mul, (f32::from(yv) - y_off) * y_mul, (u - y_off) * y_mul],
+                    Matrix::YCgCo => {
+                        let (yn, cg, co) = ((f32::from(yv) - y_off) * y_mul, (u - half) * c_mul, (v - half) * c_mul);
+                        let t = yn - cg;
+                        [t + co, yn + cg, t - co]
+                    }
+                    Matrix::Kr { cr_r, cb_g, cr_g, cb_b } => {
+                        let (yn, u, v) = ((f32::from(yv) - y_off) * y_mul, (u - half) * c_mul, (v - half) * c_mul);
+                        [yn + cr_r * v, yn - cb_g * u - cr_g * v, yn + cb_b * u]
+                    }
+                }
+            };
+            for (o, c) in px.iter_mut().zip(rgb) {
+                *o = (c.clamp(0.0, 1.0) * 65535.0 + 0.5) as u16;
+            }
+            if alpha && let Some(a) = px.get_mut(3) {
+                *a = u16::MAX;
+            }
+        }
+        Some(())
+    };
+    let row_len = w * ch;
+    #[cfg(not(target_arch = "wasm32"))]
+    let ok = {
+        use rayon::prelude::*;
+        out.par_chunks_mut(row_len).enumerate().all(|(y, dst)| row(y, dst).is_some())
+    };
+    #[cfg(target_arch = "wasm32")]
+    let ok = out.chunks_mut(row_len).enumerate().all(|(y, dst)| row(y, dst).is_some());
+    ok.then_some(out)
+}
+
+/// Writes an alpha picture's luma, full range, into channel 3 of `rgba`.
+pub fn put_alpha(planes: &Planes<'_>, rgba: &mut [u16]) -> Option<()> {
+    let (w, h) = planes.size();
+    let max = ((1u32 << u32::from(planes.bit_depth()).clamp(1, 16)) - 1) as f32;
+    let mut luma = vec![0u16; w];
+    for (y, row) in rgba.chunks_exact_mut(w * 4).enumerate().take(h) {
+        planes.luma_row(y, &mut luma)?;
+        for (px, &a) in row.as_chunks_mut::<4>().0.iter_mut().zip(&luma) {
+            let v = (f32::from(a) / max).clamp(0.0, 1.0);
+            px[3] = (v * 65535.0 + 0.5) as u16;
+        }
+    }
+    Some(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn frame(w: u32, h: u32, bd: u8, chroma: ChromaFormat, y: u16, cb: u16, cr: u16) -> Frame {
+        let (cw, chh) = chroma.chroma_size(w, h);
+        let n = (cw * chh) as usize;
+        Frame {
+            width: w,
+            height: h,
+            bit_depth: bd,
+            chroma,
+            y: vec![y; (w * h) as usize],
+            cb: vec![cb; n],
+            cr: vec![cr; n],
+            y_stride: w,
+            c_stride: cw,
+        }
+    }
+
+    fn rgb(f: &Frame, matrix: u16, full_range: bool) -> [u16; 3] {
+        let v = to_rgb16(&Planes::Picture(f), Signal { matrix, full_range }, false, Upsampling::Nearest).unwrap();
+        [v[0], v[1], v[2]]
+    }
+
+    #[test]
+    fn neutral_and_primaries_convert_exactly() {
+        // Full-range grey stays grey; limited-range black and white reach the ends.
+        assert_eq!(rgb(&frame(4, 4, 8, ChromaFormat::Yuv420, 128, 128, 128), 6, true), [128 * 257; 3]);
+        assert_eq!(rgb(&frame(4, 4, 8, ChromaFormat::Yuv420, 16, 128, 128), 1, false), [0; 3]);
+        assert_eq!(rgb(&frame(4, 4, 8, ChromaFormat::Yuv420, 235, 128, 128), 1, false), [65535; 3]);
+        assert_eq!(rgb(&frame(4, 4, 10, ChromaFormat::Yuv420, 940, 512, 512), 9, false), [65535; 3]);
+        // BT.601 full-range pure red: Y = 76.245, Cb = 84.97, Cr = 255.5 → (255, 0, 0) within rounding.
+        let red = rgb(&frame(2, 2, 8, ChromaFormat::Yuv444, 76, 85, 255), 6, true);
+        assert!(red[0] > 65000 && red[1] < 300 && red[2] < 300, "{red:?}");
+        // Identity: the channels are G, B, R.
+        assert_eq!(rgb(&frame(2, 2, 8, ChromaFormat::Yuv444, 10, 20, 30), 0, true), [30 * 257, 10 * 257, 20 * 257]);
+        // Monochrome.
+        assert_eq!(rgb(&frame(2, 2, 8, ChromaFormat::Monochrome, 51, 0, 0), 6, true), [51 * 257; 3]);
+    }
+
+    #[test]
+    fn chroma_is_nearest_neighbour() {
+        // 4:2:0, 4×2 luma, chroma 2×1: the left chroma sample covers columns 0–1 only.
+        let mut f = frame(4, 2, 8, ChromaFormat::Yuv420, 128, 128, 128);
+        f.cr = vec![200, 128];
+        let v = to_rgb16(&Planes::Picture(&f), Signal { matrix: 6, full_range: true }, false, Upsampling::Nearest).unwrap();
+        let red: Vec<u16> = v.chunks(3).map(|p| p[0]).collect();
+        assert!(red[0] == red[1] && red[1] == red[4] && red[0] > red[2] && red[2] == 128 * 257, "{red:?}");
+    }
+
+    #[test]
+    fn bilinear_chroma_is_centred_9_3_3_1() {
+        // 4:2:0, 4×4 luma, chroma 2×2 with one bright corner sample.
+        let mut f = frame(4, 4, 8, ChromaFormat::Yuv420, 128, 128, 128);
+        f.cr = vec![200, 128, 128, 128];
+        let p = Planes::Picture(&f);
+        let (mut buf, mut next) = (vec![0; 2], vec![0; 2]);
+        let rows: Vec<Vec<u16>> = (0..4).map(|y| chroma_at(&p, true, y, 4, Upsampling::Bilinear, &mut buf, &mut next).unwrap()).collect();
+        // Row 0 sits nearest chroma row 0 (and clamps upward); row 1 blends a quarter of row 1.
+        assert_eq!(rows[0], [200, 182, 146, 128]);
+        assert_eq!(rows[1], [182, 169, 142, 128]);
+        assert_eq!(rows[2], [146, 142, 133, 128]);
+        assert_eq!(rows[3], [128; 4]);
+        assert_eq!(chroma_at(&p, true, 1, 4, Upsampling::Nearest, &mut buf, &mut next).unwrap(), [200, 200, 128, 128]);
+    }
+
+    #[test]
+    fn alpha_and_bad_planes() {
+        let f = frame(2, 2, 8, ChromaFormat::Yuv420, 128, 128, 128);
+        let mut v = to_rgb16(&Planes::Picture(&f), Signal { matrix: 6, full_range: true }, true, Upsampling::Nearest).unwrap();
+        assert_eq!(v[3], 65535);
+        put_alpha(&Planes::Picture(&frame(2, 2, 8, ChromaFormat::Monochrome, 51, 0, 0)), &mut v).unwrap();
+        assert_eq!(v[3], 51 * 257);
+        let mut short = frame(4, 4, 8, ChromaFormat::Yuv420, 128, 128, 128);
+        short.y.truncate(5);
+        assert!(to_rgb16(&Planes::Picture(&short), Signal { matrix: 6, full_range: true }, false, Upsampling::Bilinear).is_none());
+        assert!(
+            to_rgb16(
+                &Planes::Picture(&frame(2, 2, 7, ChromaFormat::Yuv420, 0, 0, 0)),
+                Signal { matrix: 6, full_range: true },
+                false,
+                Upsampling::Nearest
+            )
+            .is_none()
+        );
+    }
+}
diff --git a/crates/mcp/src/backend.rs b/crates/mcp/src/backend.rs
index 5db2aaaa..4772363b 100644
--- a/crates/mcp/src/backend.rs
+++ b/crates/mcp/src/backend.rs
@@ -15,8 +15,13 @@ pub trait Backend {
     fn has_ui(&self) -> bool;
     /// Short human description ("headless", "remote 127.0.0.1:7980").
     fn describe(&self) -> String;
+    /// Progress/cancellation for the next headless batch export. Other backends ignore it.
+    fn set_progress(&mut self, _hook: Option<ProgressHook>) {}
 }
 
+/// `(completed photos, total photos, next filename)`; false stops before the next photo.
+pub type ProgressHook = Box<dyn FnMut(usize, usize, &str) -> bool + Send>;
+
 /// A running LightCraft app, reached through its loopback control port.
 pub struct Remote {
     addr: String,
diff --git a/crates/mcp/src/headless.rs b/crates/mcp/src/headless.rs
index 837302d6..acbecb60 100644
--- a/crates/mcp/src/headless.rs
+++ b/crates/mcp/src/headless.rs
@@ -8,18 +8,19 @@ use lightcraft_engine::catalog::PhotoId;
 use lightcraft_raster::Rgba8;
 use serde_json::{Value, json};
 
-use crate::backend::Backend;
+use crate::backend::{Backend, ProgressHook};
 
 /// File extensions recognised as photos when expanding folders.
 pub const PHOTO_EXTENSIONS: &[&str] = &[
-    "jpg", "jpeg", "png", "tif", "tiff", "webp", "dng", "cr2", "cr3", "nef", "arw", "raf", "orf", "rw2", "rwl", "raw", "pef", "psd", "jxl", "gif",
-    "bmp", "avif", // containers LightCraft cannot decode but imports as preview only (their embedded JPEG)
-    "iiq", "crw", "mrw", "x3f", "kdc", "mos", "erf",
+    "jpg", "jpeg", "png", "tif", "tiff", "webp", "dng", "cr2", "cr3", "nef", "arw", "raf", "orf", "rw2", "rwl", "raw", "pef", "srw", "psd", "jxl",
+    "gif", "bmp", "avif", // containers LightCraft cannot decode but imports as preview only (their embedded JPEG)
+    "iiq", "crw", "mrw", "x3f", "kdc", "mos", "erf", "3fr", "fff",
 ];
 
 /// Headless backend: a [`Session`] with filesystem hooks.
 pub struct Headless {
     pub session: Session,
+    progress: Option<ProgressHook>,
 }
 
 impl Drop for Headless {
@@ -31,18 +32,18 @@ impl Drop for Headless {
 
 impl Default for Headless {
     fn default() -> Self {
-        Self::new(Session::new().with_fs().with_default_denoise_models().with_default_face_models())
+        Self::new(Session::new().with_fs().with_default_denoise_models().with_system_clock().with_default_face_models())
     }
 }
 
 impl Headless {
     pub fn new(session: Session) -> Self {
-        Self { session }
+        Self { session, progress: None }
     }
 
     /// A headless session with the procedurally generated demo library.
     pub fn demo() -> Self {
-        Self::new(Session::with_demo().with_fs().with_default_denoise_models().with_default_face_models())
+        Self::new(Session::with_demo().with_fs().with_default_denoise_models().with_system_clock().with_default_face_models())
     }
 
     fn photo_or_active(&self, p: &Value) -> Result<PhotoId, String> {
@@ -60,7 +61,7 @@ impl Headless {
     /// (see `lightcraft_engine::export::ExportOptions::from_json`, plus `ids`, `dir`, `path`).
     /// With `path` and no `format`, the format follows the path's extension.
     fn export(&mut self, p: &Value) -> Result<Value, String> {
-        use lightcraft_engine::export::{Destination, ExportFormat, ExportOptions, Resize, export_batch};
+        use lightcraft_engine::export::{Destination, ExportFormat, ExportOptions, Resize, prepare_batch, run_batch};
         let p = &self.session.export_params(p)?;
         let mut opts = ExportOptions::from_params(p).map_err(|e| e.to_string())?;
         if !ExportOptions::has_size_param(p) {
@@ -82,10 +83,28 @@ impl Headless {
         };
         let dir = p.get("dir").and_then(Value::as_str).unwrap_or("");
         let write = &mut lightcraft_engine::export::write_file;
-        let files =
-            export_batch(&mut self.session, &ids, &opts, &Destination { dir: dir.to_string(), exact: exact.map(str::to_string) }, write, &|path| {
-                Path::new(path).exists()
-            })?;
+        let items = prepare_batch(&mut self.session, &ids, &opts)?;
+        let total = items.len();
+        let mut hook = self.progress.take();
+        let mut cancelled = false;
+        let files = run_batch(
+            items,
+            &opts,
+            &Destination { dir: dir.to_string(), exact: exact.map(str::to_string) },
+            write,
+            &|path| Path::new(path).exists(),
+            true,
+            &mut |done, name| {
+                cancelled = hook.as_mut().is_some_and(|h| !h(done, total, name));
+                !cancelled
+            },
+        )?;
+        if !cancelled && let Some(hook) = hook.as_mut() {
+            cancelled = !hook(total, total, "");
+        }
+        if cancelled {
+            return Err("cancelled".into());
+        }
         // Single-photo exports also report path/width/height at the top level (back-compat).
         let mut out = files.first().cloned().unwrap_or_else(|| json!({}));
         out["files"] = json!(files);
@@ -94,6 +113,10 @@ impl Headless {
 }
 
 impl Backend for Headless {
+    fn set_progress(&mut self, hook: Option<ProgressHook>) {
+        self.progress = hook;
+    }
+
     fn call(&mut self, method: &str, params: Value) -> Result<Value, String> {
         let p = if params.is_null() { json!({}) } else { params };
         match method {
@@ -108,7 +131,7 @@ impl Backend for Headless {
             "engine.commands" => {
                 let mut v: Vec<Value> = self.session.commands().into_iter().map(|c| serde_json::to_value(c).unwrap_or_default()).collect();
                 v.push(json!({"id": "app.export", "label": "Export Now", "menu": [], "shortcut": null,
-                    "params": "{path?: output file (.jpg/.png/.tif/.webp/.avif/.dng) | dir?, ids?, preset?, format?: jpeg|png|tiff|webp|avif|dng|original, longEdge?|shortEdge?|width?|height?|megapixels?|percent? (default longEdge 3000; longEdge 0 = full size), dontEnlarge?, ppi?, quality?: 1..100, limitKb?, colorSpace?: srgb|displayP3|adobeRgb|proPhoto|rec2020, bitDepth?: 8|10|16|32, sharpen?: none|screen|matte|glossy, sharpenAmount?: low|standard|high, metadata?: all|allExceptCamera|copyright|none, removeLocation?, naming?, startNumber?, subfolder?, conflict?: unique|overwrite|skip, tiffCompression?: none|lzw|zip, dngCompression?: lossless|deflate|uncompressed, watermark?: text | {text?, vertical? (upright columns, right to left), size? (text height, 0.005..0.5 of the short edge; default 0.035), opacity? (0..1; 0.7), anchor?: topLeft|top|topRight|left|center|right|bottomLeft|bottom|bottomRight, inset? (margin, 0..0.4 of the short edge; 0.025), color? [r,g,b] sRGB, shadow?, image? (graphic drawn instead of the text), imageWidth? (0.01..1 of the photo's width; 0.2)}} — an unknown parameter, an out-of-range watermark size or a value of the wrong kind is an error, not a default",
+                    "params": "{path?: output file (.jpg/.png/.tif/.webp/.avif/.dng) | dir?, ids?, preset?, format?: jpeg|png|tiff|webp|avif|dng|original, longEdge?|shortEdge?|width?|height?|megapixels?|percent? (default longEdge 3000; longEdge 0 = full size), dontEnlarge?, ppi?, quality?: 1..100, limitKb?, colorSpace?: srgb|displayP3|adobeRgb|proPhoto|rec2020, bitDepth?: 8|10|16|32, hdr? (HDR output for HDR edits: gain map JPEG, float TIFF), sharpen?: none|screen|matte|glossy, sharpenAmount?: low|standard|high, metadata?: all|allExceptCamera|copyright|none, removeLocation?, naming?, startNumber?, subfolder?, conflict?: unique|overwrite|skip, tiffCompression?: none|lzw|zip, dngCompression?: lossless|deflate|uncompressed, watermark?: text | {text?, vertical? (upright columns, right to left), size? (text height, 0.005..0.5 of the short edge; default 0.035), opacity? (0..1; 0.7), anchor?: topLeft|top|topRight|left|center|right|bottomLeft|bottom|bottomRight, inset? (margin, 0..0.4 of the short edge; 0.025), color? [r,g,b] sRGB, shadow?, image? (graphic drawn instead of the text), imageWidth? (0.01..1 of the photo's width; 0.2)}} — an unknown parameter, an out-of-range watermark size or a value of the wrong kind is an error, not a default",
                     "enabled": self.session.active().is_some()}));
                 Ok(Value::Array(v))
             }
@@ -178,6 +201,14 @@ pub fn write_image(path: &Path, img: &Rgba8, quality: u8) -> Result<(), String>
 mod tests {
     use super::*;
 
+    /// A headless session stamps imports and edits with the system clock, not the engine's fixed test clock.
+    #[test]
+    fn headless_uses_the_system_clock() {
+        const FIXED: &str = "2026-09-30T12:00:00";
+        assert_ne!((Headless::default().session.clock)(), FIXED);
+        assert_ne!((Headless::demo().session.clock)(), FIXED);
+    }
+
     /// `app.export` without `ids` exports the selection (as the desktop app does), else the active photo.
     #[test]
     fn export_follows_the_selection() {
diff --git a/crates/mcp/src/lib.rs b/crates/mcp/src/lib.rs
index a1fb5510..b2417fe0 100644
--- a/crates/mcp/src/lib.rs
+++ b/crates/mcp/src/lib.rs
@@ -21,7 +21,7 @@ mod headless;
 mod server;
 mod tools;
 
-pub use backend::{Backend, Remote};
+pub use backend::{Backend, ProgressHook, Remote};
 pub use base64::{base64_decode, base64_encode};
 pub use headless::{Headless, PHOTO_EXTENSIONS, encode_image, expand_paths, write_image};
 pub use server::{PROTOCOL_VERSION, Server};
diff --git a/crates/mcp/src/progress.rs b/crates/mcp/src/progress.rs
new file mode 100644
index 00000000..2043dfd9
--- /dev/null
+++ b/crates/mcp/src/progress.rs
@@ -0,0 +1,165 @@
+//! Stdio progress and cancellation between photos. The backend keeps its session on the
+//! serving thread; only stdin and stdout move to transport threads. Other calls wait in order.
+
+use std::collections::VecDeque;
+use std::io::{BufRead, Write};
+use std::sync::atomic::Ordering;
+use std::sync::mpsc::{Receiver, Sender, TryRecvError};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use serde_json::{Value, json};
+
+use super::{Server, response};
+use crate::backend::ProgressHook;
+
+type Input = Option<std::io::Result<String>>;
+
+#[derive(Clone)]
+pub(super) struct Wire {
+    inbox: Arc<Mutex<Receiver<Input>>>,
+    out: Sender<String>,
+    deferred: Arc<Mutex<VecDeque<Input>>>,
+}
+
+fn lock<T>(m: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
+    m.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
+}
+
+impl Server {
+    pub(super) fn serve_wire(&mut self, input: impl BufRead + Send, output: impl Write + Send) -> std::io::Result<()> {
+        std::thread::scope(|scope| {
+            let (in_tx, in_rx) = std::sync::mpsc::channel::<Input>();
+            let (out_tx, out_rx) = std::sync::mpsc::channel::<String>();
+            let wire = Wire { inbox: Arc::new(Mutex::new(in_rx)), out: out_tx, deferred: Arc::new(Mutex::new(VecDeque::new())) };
+            let writer = std::thread::Builder::new().name("mcp-output".into()).spawn_scoped(scope, move || -> std::io::Result<()> {
+                let mut output = output;
+                for line in out_rx {
+                    output.write_all(line.as_bytes())?;
+                    output.write_all(b"\n")?;
+                    output.flush()?;
+                }
+                Ok(())
+            })?;
+            let reader = match std::thread::Builder::new().name("mcp-input".into()).spawn_scoped(scope, move || {
+                for line in input.lines() {
+                    let failed = line.is_err();
+                    if in_tx.send(Some(line)).is_err() || failed {
+                        return;
+                    }
+                }
+                let _ = in_tx.send(None);
+            }) {
+                Ok(reader) => reader,
+                Err(error) => {
+                    drop(wire);
+                    let _ = writer.join();
+                    return Err(error);
+                }
+            };
+            self.wire = Some(wire.clone());
+            let served = (|| -> std::io::Result<()> {
+                loop {
+                    let queued = lock(&wire.deferred).pop_front();
+                    let line = match queued {
+                        Some(line) => line,
+                        None => lock(&wire.inbox).recv().ok().flatten(),
+                    };
+                    let Some(line) = line else { return Ok(()) };
+                    if let Some(reply) = self.handle_line(&line?) {
+                        wire.out.send(reply).map_err(|_| std::io::Error::new(std::io::ErrorKind::BrokenPipe, "MCP output closed"))?;
+                    }
+                }
+            })();
+            self.wire = None;
+            drop(wire);
+            let written = writer.join().map_err(|_| std::io::Error::other("MCP output thread panicked")).and_then(|r| r);
+            let read = reader.join().map_err(|_| std::io::Error::other("MCP input thread panicked"));
+            served.and(written).and(read)
+        })
+    }
+
+    /// Called at photo boundaries, including completion. EOF finishes the pending export;
+    /// cancellation stops before the next photo. No file scan or output deletion is needed:
+    /// the existing writer replaces each whole file atomically.
+    pub(super) fn progress_hook(&self) -> Option<ProgressHook> {
+        let wire = self.wire.clone()?;
+        let (id, token) = self.current.clone()?;
+        let suppress = self.suppress.clone();
+        let mut closed = false;
+        let mut last = None;
+        let mut reported: Option<Instant> = None;
+        Some(Box::new(move |done, total, name| {
+            while !closed {
+                let next = lock(&wire.inbox).try_recv();
+                let line = match next {
+                    Ok(Some(Ok(line))) => line,
+                    Ok(Some(Err(error))) => {
+                        lock(&wire.deferred).push_back(Some(Err(error)));
+                        closed = true;
+                        break;
+                    }
+                    Ok(None) | Err(TryRecvError::Disconnected) => {
+                        lock(&wire.deferred).push_back(None);
+                        closed = true;
+                        break;
+                    }
+                    Err(TryRecvError::Empty) => break,
+                };
+                let msg: Value = serde_json::from_str(&line).unwrap_or(Value::Null);
+                match msg.get("method").and_then(Value::as_str) {
+                    Some("notifications/cancelled") if msg.get("id").is_none() && msg["params"]["requestId"] == id => {
+                        suppress.store(true, Ordering::Relaxed);
+                    }
+                    Some("ping")
+                        if msg.get("id").is_some_and(|i| i.is_string() || i.is_number())
+                            && msg.get("params").is_none_or(|p| p.is_null() || p.is_object()) =>
+                    {
+                        let _ = wire.out.send(response(msg["id"].clone(), json!({})).to_string());
+                    }
+                    _ => lock(&wire.deferred).push_back(Some(Ok(line))),
+                }
+            }
+            if suppress.load(Ordering::Relaxed) {
+                return false;
+            }
+            if let Some(token) = &token
+                && total > 0
+                && last.is_none_or(|last| done > last)
+                && (done == total || reported.is_none_or(|at| at.elapsed() >= Duration::from_millis(100)))
+            {
+                last = Some(done);
+                reported = Some(Instant::now());
+                let message = if done < total {
+                    format!("Exporting {name} ({} of {total})", done.saturating_add(1))
+                } else {
+                    format!("Exported {total} photo(s)")
+                };
+                let notification = json!({"jsonrpc":"2.0","method":"notifications/progress",
+                    "params":{"progressToken":token,"progress":done,"total":total,"message":message}});
+                let _ = wire.out.send(notification.to_string());
+            }
+            true
+        }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn transport_lock_recovers_after_panic() {
+        let state = Arc::new(Mutex::new(VecDeque::new()));
+        let held = state.clone();
+        let _ = std::thread::spawn(move || {
+            held.lock().unwrap().push_back(7);
+            let _guard = held.lock().unwrap();
+            panic!("synthetic transport panic");
+        })
+        .join();
+        assert_eq!(lock(&state).pop_front(), Some(7));
+        lock(&state).push_back(8);
+        assert_eq!(lock(&state).pop_front(), Some(8));
+    }
+}
diff --git a/crates/mcp/src/server.rs b/crates/mcp/src/server.rs
index c3371be5..ba64ef45 100644
--- a/crates/mcp/src/server.rs
+++ b/crates/mcp/src/server.rs
@@ -1,11 +1,16 @@
 //! JSON-RPC 2.0 framing and the MCP lifecycle / tools / resources methods.
 
 use std::io::{BufRead, Write};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+#[path = "progress.rs"]
+mod progress;
 
 use serde_json::{Value, json};
 
 use crate::backend::Backend;
-use crate::tools::{call_tool, tool_definitions};
+use crate::tools::{ToolResult, call_tool, check_args, doc_inspect, tool_definitions};
 
 /// The MCP revision we implement.
 pub const PROTOCOL_VERSION: &str = "2025-06-18";
@@ -22,11 +27,13 @@ const RESOURCE_NOT_FOUND: i64 = -32002;
 const INSTRUCTIONS: &str = "LightCraft is a non-destructive photo library and raw developer (a Lightroom alternative). \
 Photos have integer ids; most editing acts on the *active* photo (tools that take `id` make that photo active first). \
 Typical loop: query_photos → select_photos (or pass id) → list_controls → set_develop {values: {\"light.exposure\": 0.5}} → \
-render_photo to look at the result → export. Positions (crop rects, mask points, brush strokes) are normalized image \
-coordinates 0..1 with the origin at the top-left. Every action is a command: list_commands shows ids and parameter \
-docs; run_command runs any of them. Edits are undoable (undo / redo).";
+render_preview to look at the result → export. Positions (crop rects, mask points, brush strokes) are normalized image \
+coordinates 0..1 with the origin at the top-left. Every action is a command: command_list shows ids and parameter \
+docs; command_run {id, params} runs any of them; command_batch runs steps in order. Inspect with doc_inspect. Edits are undoable (undo / redo).";
 
 /// Resource URIs.
+pub const DOCUMENT_URI: &str = "lightcraft://document";
+pub const COMMANDS_URI: &str = "lightcraft://commands";
 pub const LIBRARY_URI: &str = "lightcraft://library";
 pub const PHOTOS_URI: &str = "lightcraft://photos";
 pub const PHOTO_URI: &str = "lightcraft://photo/active";
@@ -38,6 +45,9 @@ pub struct Server {
     backend: Box<dyn Backend>,
     initialized: bool,
     command_tools: bool,
+    wire: Option<progress::Wire>,
+    current: Option<(Value, Option<Value>)>,
+    suppress: Arc<AtomicBool>,
 }
 
 fn response(id: Value, result: Value) -> Value {
@@ -54,7 +64,7 @@ fn resource(uri: &str, name: &str, title: &str, description: &str) -> Value {
 
 impl Server {
     pub fn new(backend: Box<dyn Backend>) -> Self {
-        Self { backend, initialized: false, command_tools: true }
+        Self { backend, initialized: false, command_tools: true, wire: None, current: None, suppress: Arc::new(AtomicBool::new(false)) }
     }
 
     /// Whether `tools/list` includes one `cmd_*` tool per registered command (default true).
@@ -75,16 +85,8 @@ impl Server {
 
     /// Serve newline-delimited JSON-RPC until `input` closes. Logs go to stderr only (stdout is
     /// the protocol stream).
-    pub fn serve(&mut self, input: impl BufRead, mut output: impl Write) -> std::io::Result<()> {
-        for line in input.lines() {
-            let line = line?;
-            if let Some(reply) = self.handle_line(&line) {
-                output.write_all(reply.as_bytes())?;
-                output.write_all(b"\n")?;
-                output.flush()?;
-            }
-        }
-        Ok(())
+    pub fn serve(&mut self, input: impl BufRead + Send, output: impl Write + Send) -> std::io::Result<()> {
+        self.serve_wire(input, output)
     }
 
     /// Handle one line; returns the reply line (None for notifications and blank lines).
@@ -131,8 +133,19 @@ impl Server {
         if !(params.is_object() || params.is_null()) {
             return Some(error(id, INVALID_PARAMS, "`params` must be an object"));
         }
-        Some(match self.request(method, &params) {
-            Ok(r) => response(id, r),
+        let token = params.get("_meta").and_then(|m| m.get("progressToken")).filter(|t| t.is_string() || t.is_number()).cloned();
+        self.current = Some((id.clone(), token));
+        self.suppress.store(false, Ordering::Relaxed);
+        let result = self.request(method, &params);
+        self.current = None;
+        if self.suppress.swap(false, Ordering::Relaxed) {
+            return None;
+        }
+        Some(match result {
+            Ok(mut r) => {
+                modern_result_fields(method, &params, &mut r);
+                response(id, r)
+            }
             Err((code, m)) => error(id, code, m),
         })
     }
@@ -158,13 +171,33 @@ impl Server {
                 }))
             }
             "ping" => Ok(json!({})),
-            "tools/list" => Ok(json!({"tools": tool_definitions(self.backend.as_mut(), self.command_tools)})),
+            "tools/list" => {
+                let command_tools = self.command_tools;
+                let tools = self.guarded(|b| tool_definitions(b, command_tools)).map_err(|e| (INTERNAL_ERROR, e))?;
+                Ok(json!({"tools": tools}))
+            }
             "tools/call" => {
                 let name = params.get("name").and_then(Value::as_str).ok_or((INVALID_PARAMS, "missing tool `name`".to_string()))?;
                 let args = params.get("arguments").cloned().unwrap_or(Value::Null);
-                Ok(call_tool(self.backend.as_mut(), name, &args).to_value())
+                check_args(name, &args).map_err(|e| (INVALID_PARAMS, e))?;
+                let long = matches!(name, "export" | "cmd_app_export")
+                    || (name == "command_run" && args["id"] == "app.export")
+                    || (name == "run_command" && args["command"] == "app.export");
+                let hook = if long && !self.backend.has_ui() { self.progress_hook() } else { None };
+                let result = self.guarded(|b| {
+                    b.set_progress(hook);
+                    call_tool(b, name, &args)
+                });
+                let clear = self.guarded(|b| b.set_progress(None));
+                let result = match (result, clear) {
+                    (Ok(result), Ok(())) => result,
+                    (Err(error), _) | (_, Err(error)) => ToolResult::error(error),
+                };
+                Ok(result.to_value())
             }
             "resources/list" => Ok(json!({"resources": [
+                resource(DOCUMENT_URI, "document", "Library document", "Library state and counts (same as doc_inspect)"),
+                resource(COMMANDS_URI, "commands", "Command catalog", "Every command (same as command_list)"),
                 resource(LIBRARY_URI, "library", "Library state", "Current source, filter, sort, selection, active photo/mask and undo/redo labels (library.state)"),
                 resource(PHOTOS_URI, "photos", "Photos in view", "The photos in the current view with ids, ratings, flags and metadata (catalog.query)"),
                 resource(PHOTO_URI, "active-photo", "Active photo", "Everything about the active photo: file, metadata, develop settings, albums, history (photo.inspect)"),
@@ -175,6 +208,7 @@ impl Server {
             "resources/read" => {
                 let uri = params.get("uri").and_then(Value::as_str).ok_or((INVALID_PARAMS, "missing `uri`".to_string()))?;
                 let cmd = match uri {
+                    DOCUMENT_URI | COMMANDS_URI => "",
                     LIBRARY_URI => "library.state",
                     PHOTOS_URI => "catalog.query",
                     PHOTO_URI => "photo.inspect",
@@ -182,10 +216,47 @@ impl Server {
                     CONTROLS_URI => "develop.controls",
                     _ => return Err((RESOURCE_NOT_FOUND, format!("resource not found: {uri}"))),
                 };
-                let v = self.backend.call("engine.execute", json!({"command": cmd, "params": {}})).map_err(|e| (INTERNAL_ERROR, e))?;
+                let v = self
+                    .guarded(|b| match uri {
+                        DOCUMENT_URI => doc_inspect(b),
+                        COMMANDS_URI => b.call("engine.commands", json!({})),
+                        _ => b.call("engine.execute", json!({"command": cmd, "params": {}})),
+                    })
+                    .and_then(|v| v)
+                    .map_err(|e| (INTERNAL_ERROR, e))?;
                 Ok(json!({"contents": [{"uri": uri, "mimeType": "application/json", "text": serde_json::to_string_pretty(&v).unwrap_or_default()}]}))
             }
             other => Err((METHOD_NOT_FOUND, format!("method not found: {other}"))),
         }
     }
 }
+
+impl Server {
+    /// Escaped backend panics become errors; subsequent requests can keep using the session.
+    fn guarded<T>(&mut self, f: impl FnOnce(&mut dyn Backend) -> T) -> Result<T, String> {
+        std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| f(self.backend.as_mut()))).map_err(|p| {
+            let message =
+                p.downcast_ref::<&str>().map(|s| s.to_string()).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_else(|| "panic".into());
+            format!("internal error: {message}")
+        })
+    }
+}
+
+/// Per-request protocol metadata leaves initialize-based clients' result shapes unchanged.
+fn modern_result_fields(method: &str, params: &Value, result: &mut Value) {
+    let modern = params.pointer("/_meta/io.modelcontextprotocol~1protocolVersion").and_then(Value::as_str).is_some_and(|v| v >= "2026-07-28");
+    let ttl = match method {
+        "tools/list" | "resources/list" | "resources/templates/list" => Some(600_000),
+        "resources/read" => Some(0),
+        "tools/call" => None,
+        _ => return,
+    };
+    let Some(obj) = result.as_object_mut().filter(|_| modern) else {
+        return;
+    };
+    obj.insert("resultType".into(), json!("complete"));
+    if let Some(ttl) = ttl {
+        obj.insert("ttlMs".into(), json!(ttl));
+        obj.insert("cacheScope".into(), json!("private"));
+    }
+}
diff --git a/crates/mcp/src/tests.rs b/crates/mcp/src/tests.rs
index ee17e1ad..e09c9d4c 100644
--- a/crates/mcp/src/tests.rs
+++ b/crates/mcp/src/tests.rs
@@ -139,6 +139,19 @@ fn export_refuses_unknown_params_and_bad_values() {
     assert!(e.contains("did you mean `quality`"), "{e}");
 }
 
+/// Every option the `export` tool advertises reaches `app.export` (they were accepted, then dropped).
+#[test]
+fn export_tool_forwards_its_advertised_options() {
+    let mut b = Headless::demo();
+    let base = std::env::temp_dir().join(format!("lc-mcp-export-fwd-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&base);
+    let r = call_tool(&mut b, "export", &json!({"dir": base.to_string_lossy(), "subfolder": "sub", "longEdge": 64, "format": "png"}));
+    assert!(!r.is_error, "{r:?}");
+    let files: Vec<_> = std::fs::read_dir(base.join("sub")).unwrap().collect();
+    assert_eq!(files.len(), 1, "written into the subfolder");
+    let _ = std::fs::remove_dir_all(&base);
+}
+
 /// The `import` helper moves: renamed into the folder template, the source removed.
 #[test]
 fn import_tool_moves_with_a_folder_template() {
@@ -215,7 +228,7 @@ fn resources() {
     let mut s = server();
     let r = rpc(&mut s, 1, "resources/list", json!({}));
     let list = r["result"]["resources"].as_array().unwrap();
-    assert_eq!(list.len(), 5);
+    assert_eq!(list.len(), 7);
     for (i, res) in list.iter().enumerate() {
         let uri = res["uri"].as_str().unwrap();
         let r = rpc(&mut s, 10 + i as u64, "resources/read", json!({"uri": uri}));
@@ -245,3 +258,144 @@ fn select_photos_rejects_unknown_ids_and_keeps_the_active_photo() {
     assert!(r.is_error, "{r:?}");
     assert_eq!(b.session.active(), Some(first));
 }
+
+#[test]
+fn core_tools_have_hints_and_reject_unknown_keys() {
+    for compact in [false, true] {
+        let mut s = server().with_command_tools(!compact);
+        let list = rpc(&mut s, 1, "tools/list", json!({}));
+        let tools = list["result"]["tools"].as_array().unwrap();
+        for name in ["command_list", "command_run", "command_batch", "doc_inspect", "render_preview", "list_commands", "run_command", "render_photo"]
+        {
+            assert!(tools.iter().any(|t| t["name"] == name), "missing {name}");
+        }
+        for t in tools {
+            assert!(!t["title"].as_str().unwrap().is_empty());
+            for hint in ["readOnlyHint", "destructiveHint", "idempotentHint", "openWorldHint"] {
+                assert!(t["annotations"][hint].is_boolean(), "{t}");
+            }
+        }
+        for name in ["command_list", "command_run", "command_batch", "doc_inspect", "render_preview", "query_photos", "run_command"] {
+            let r = rpc(&mut s, 2, "tools/call", json!({"name":name,"arguments":{"misspelled":true}}));
+            assert_eq!(r["error"]["code"], -32602, "{r}");
+            assert!(r["error"]["message"].as_str().unwrap().contains("misspelled"), "{r}");
+        }
+        let preview = tools.iter().find(|t| t["name"] == "render_preview").unwrap();
+        assert_eq!(preview["annotations"]["readOnlyHint"], true);
+        assert!(preview["inputSchema"]["properties"].get("path").is_none());
+        let writer = tools.iter().find(|t| t["name"] == "render_photo").unwrap();
+        assert_eq!(writer["annotations"]["readOnlyHint"], false);
+        let export = tools.iter().find(|t| t["name"] == "export").unwrap();
+        for key in lightcraft_engine::export::OPTION_PARAMS.iter().chain(lightcraft_engine::export::TARGET_PARAMS) {
+            assert!(export["inputSchema"]["properties"].get(*key).is_some(), "missing export argument {key}");
+        }
+        let before = rpc(&mut s, 2, "resources/read", json!({"uri":"lightcraft://library"}));
+        let image = rpc(&mut s, 2, "tools/call", json!({"name":"render_preview","arguments":{"max_side":64}}));
+        assert_eq!(image["result"]["isError"], false, "{image}");
+        assert!(image["result"]["content"].as_array().unwrap().iter().any(|c| c["type"] == "image"));
+        assert_eq!(before, rpc(&mut s, 2, "resources/read", json!({"uri":"lightcraft://library"})));
+        let batch = json!({"steps":[{"id":"catalog.stats"},{"id":"no.such"},{"id":"catalog.stats"}],"stop_on_error":false});
+        let r = rpc(&mut s, 3, "tools/call", json!({"name":"command_batch","arguments":batch}));
+        assert_eq!(r["result"]["isError"], true);
+        assert_eq!(r["result"]["structuredContent"]["completed"], 2);
+        assert_eq!(r["result"]["structuredContent"]["failed"], 1);
+        let r = rpc(&mut s, 4, "tools/call", json!({"name":"command_batch","arguments":{"steps":[{"id":"no.such"},{"id":"catalog.stats"}]}}));
+        assert_eq!(r["result"]["structuredContent"]["completed"], 0);
+        assert_eq!(r["result"]["structuredContent"]["results"].as_array().unwrap().len(), 1);
+    }
+}
+
+#[test]
+fn core_resources_match_tools_after_parse_error() {
+    let mut s = server();
+    let bad: Value = serde_json::from_str(&s.handle_line("{bad").unwrap()).unwrap();
+    assert_eq!(bad["error"]["code"], -32700);
+    assert!(bad["id"].is_null());
+    let list = rpc(&mut s, 1, "resources/list", json!({}));
+    for (uri, tool) in [("lightcraft://document", "doc_inspect"), ("lightcraft://commands", "command_list")] {
+        assert!(list["result"]["resources"].as_array().unwrap().iter().any(|r| r["uri"] == uri));
+        let resource = rpc(&mut s, 2, "resources/read", json!({"uri":uri}));
+        let call = rpc(&mut s, 3, "tools/call", json!({"name":tool,"arguments":{}}));
+        let a: Value = serde_json::from_str(resource["result"]["contents"][0]["text"].as_str().unwrap()).unwrap();
+        let b: Value = serde_json::from_str(call["result"]["content"][0]["text"].as_str().unwrap()).unwrap();
+        assert_eq!(a, b);
+    }
+    let old = rpc(&mut s, 4, "resources/read", json!({"uri":"lightcraft://library"}));
+    assert!(old["result"]["contents"].is_array(), "{old}");
+}
+
+#[test]
+fn escaped_tool_panic_is_an_error_and_session_survives() {
+    struct Faulty {
+        inner: Headless,
+        fail: bool,
+    }
+    impl Backend for Faulty {
+        fn call(&mut self, method: &str, params: Value) -> Result<Value, String> {
+            if method == "engine.execute" && params["command"] == "catalog.stats" && std::mem::take(&mut self.fail) {
+                panic!("synthetic backend panic");
+            }
+            self.inner.call(method, params)
+        }
+        fn has_ui(&self) -> bool {
+            false
+        }
+        fn describe(&self) -> String {
+            "test".into()
+        }
+    }
+    let mut s = Server::new(Box::new(Faulty { inner: Headless::demo(), fail: true }));
+    let params = json!({"name":"run_command","arguments":{"command":"catalog.stats"}});
+    let r = rpc(&mut s, 1, "tools/call", params.clone());
+    assert_eq!(r["result"]["isError"], true, "{r}");
+    assert!(r.to_string().contains("synthetic backend panic"));
+    assert_eq!(rpc(&mut s, 2, "tools/call", params)["result"]["isError"], false);
+    assert!(rpc(&mut s, 3, "ping", json!({}))["result"].is_object());
+}
+
+#[test]
+fn modern_requests_receive_result_and_cache_fields() {
+    let mut s = server();
+    let meta = json!({"io.modelcontextprotocol/protocolVersion":"2026-07-28"});
+    for (method, mut params) in [
+        ("tools/list", json!({})),
+        ("resources/list", json!({})),
+        ("resources/templates/list", json!({})),
+        ("resources/read", json!({"uri":"lightcraft://library"})),
+    ] {
+        params["_meta"] = meta.clone();
+        let r = rpc(&mut s, 1, method, params);
+        assert_eq!(r["result"]["resultType"], "complete", "{r}");
+        assert_eq!(r["result"]["cacheScope"], "private");
+        assert_eq!(r["result"]["ttlMs"], if method == "resources/read" { 0 } else { 600_000 });
+    }
+    assert!(rpc(&mut s, 2, "tools/list", json!({}))["result"].get("resultType").is_none());
+}
+
+/// A running app's control channel, as far as the MCP server can tell: it records each call.
+struct Recorder(Vec<(String, Value)>);
+
+impl Backend for Recorder {
+    fn call(&mut self, method: &str, params: Value) -> Result<Value, String> {
+        self.0.push((method.to_string(), params));
+        Ok(Value::Null)
+    }
+    fn has_ui(&self) -> bool {
+        true
+    }
+    fn describe(&self) -> String {
+        "recorder".into()
+    }
+}
+
+/// With the app attached, agents cut, copy and paste in its text fields (`clipboard`).
+#[test]
+fn the_clipboard_tool_cuts_copies_and_pastes_in_the_app() {
+    let names: Vec<String> = crate::tools::helper_tools(true).iter().filter_map(|t| t["name"].as_str().map(str::to_string)).collect();
+    assert!(names.iter().any(|n| n == "clipboard"), "{names:?}");
+    assert!(!crate::tools::helper_tools(false).iter().any(|t| t["name"] == "clipboard"), "not without the app");
+    let mut b = Recorder(vec![]);
+    let r = call_tool(&mut b, "clipboard", &json!({"action": "paste", "text": "travel"}));
+    assert!(!r.is_error, "{r:?}");
+    assert_eq!(b.0, vec![("ui.clipboard".to_string(), json!({"action": "paste", "text": "travel"}))]);
+}
diff --git a/crates/mcp/src/tools.rs b/crates/mcp/src/tools.rs
index 1b41d86a..dd52da40 100644
--- a/crates/mcp/src/tools.rs
+++ b/crates/mcp/src/tools.rs
@@ -66,7 +66,7 @@ fn tool(name: &str, title: &str, description: &str, properties: Value, required:
         "name": name,
         "title": title,
         "description": description,
-        "inputSchema": {"type": "object", "properties": properties, "required": required},
+        "inputSchema": {"type": "object", "properties": properties, "required": required, "additionalProperties": false},
     })
 }
 
@@ -78,6 +78,51 @@ fn ids_schema(what: &str) -> Value {
 pub fn helper_tools(has_ui: bool) -> Vec<Value> {
     let photo_id = json!({"type": "integer", "description": "Photo id (default: the active photo). Makes that photo active first."});
     let mut v = vec![
+        tool(
+            "command_list",
+            "List commands",
+            "Every command (engine + UI when connected) with id, label, menu, shortcut, parameter doc and whether it is enabled now. Each id is also callable as tool `cmd_<id with . replaced by _>` or via command_run.",
+            json!({
+                "filter": {"type": "string", "description": "Only commands whose id or label contains this text (case-insensitive)"},
+                "enabled_only": {"type": "boolean", "description": "Only commands that are enabled now"}
+            }),
+            &[],
+        ),
+        tool(
+            "command_run",
+            "Run command",
+            "Run any LightCraft command by id with JSON params (see command_list for ids and parameter docs), e.g. {id: \"photo.rate\", params: {rating: 4}}.",
+            json!({"id": {"type": "string", "description": "Command id"}, "params": {"type": "object", "description": "Command parameters", "additionalProperties": true}}),
+            &["id"],
+        ),
+        tool(
+            "command_batch",
+            "Run commands",
+            "Run several commands in order: {steps: [{id, params?}], stop_on_error?: true}. Returns {completed, failed, results: [{ok, result | error}]}.",
+            json!({
+                "steps": {"type": "array", "items": {"type": "object", "properties": {"id": {"type": "string"}, "params": {"type": "object", "additionalProperties": true}}, "required": ["id"], "additionalProperties": false}},
+                "stop_on_error": {"type": "boolean", "description": "Stop at the first failing step (default true)"}
+            }),
+            &["steps"],
+        ),
+        tool(
+            "doc_inspect",
+            "Inspect library",
+            "The library as JSON: current source, filter, sort, selection, active photo and undo/redo labels (library.state) plus counts (catalog.stats).",
+            json!({}),
+            &[],
+        ),
+        tool(
+            "render_preview",
+            "Render preview",
+            "Render a photo with its current develop settings (cropped) and return it as an image (`max_side` is the long edge; does not change selection or save a file).",
+            json!({
+                "id": {"type": "integer", "description": "Photo id (default: the active photo); selection is unchanged"},
+                "max_side": {"type": "integer", "description": "Long edge in pixels (default 1024, max 4096)"},
+                "format": {"type": "string", "enum": ["png", "jpeg"], "description": "Image encoding (default png; jpeg is smaller)"},
+            }),
+            &[],
+        ),
         tool(
             "list_commands",
             "List commands",
@@ -187,6 +232,13 @@ pub fn helper_tools(has_ui: bool) -> Vec<Value> {
                 "ids": {"type": "array", "items": {"type": "integer"}, "description": "Photos to export (default: the given/active photo)"},
                 "path": {"type": "string"},
                 "dir": {"type": "string"},
+                "preset": {"type": "string", "description": "Export preset id or name"},
+                "background": {"type": "boolean", "description": "Desktop background export (headless exports remain blocking)"},
+                "resize": {"type": "object", "description": "Full Resize options; alternatively use the size helpers below"},
+                "subfolder": {"type": "string"},
+                "conflict": {"type": "string", "enum": ["unique", "overwrite", "skip"]},
+                "tiffCompression": {"type": "string", "enum": ["none", "lzw", "zip"]},
+                "dngCompression": {"type": "string", "enum": ["lossless", "deflate", "uncompressed"]},
                 "format": {"type": "string", "enum": ["jpeg", "png", "tiff", "webp", "avif", "original", "dng"], "description": "original = the file as is + an XMP sidecar with the edits; dng = raw photos as DNG with the edits embedded"},
                 "longEdge": {"type": "integer", "description": "Output long edge in px. When no size param is given: 3000; 0 = full size (cropped, native resolution)"},
                 "shortEdge": {"type": "integer", "description": "Output short edge in px"},
@@ -206,6 +258,7 @@ pub fn helper_tools(has_ui: bool) -> Vec<Value> {
                 "removeLocation": {"type": "boolean"},
                 "colorSpace": {"type": "string", "enum": ["srgb", "displayP3", "adobeRgb", "proPhoto", "rec2020"], "description": "Output colour space (default sRGB; AVIF is always sRGB). adobeRgb = Adobe RGB (1998) compatible; the embedded ICC profile is generated from the published primaries"},
                 "bitDepth": {"type": "integer", "enum": [8, 10, 16, 32], "description": "Bits per channel: PNG 8|16 (default 8), TIFF 8|16|32 (default 16; 32 = linear float with a linear profile), AVIF 8|10; JPEG/WebP are 8-bit"},
+                "hdr": {"type": "boolean", "description": "HDR output for photos edited in HDR (develop.hdr): JPEG as an ISO 21496-1 gain map JPEG, AVIF as 10-bit Rec. 2020 PQ, 32-bit TIFF with highlights above 1; other formats and SDR edits export as usual"},
                 "watermark": {"description": "Text, or {text, vertical (boolean; defaults to false: upright columns right to left), size (text height as a fraction of the short edge, 0.005..0.5; default 0.035), opacity (0..1; default 0.7), anchor (topLeft|top|topRight|left|center|right|bottomLeft|bottom|bottomRight), inset (margin as a fraction of the short edge, 0..0.4; default 0.025), color [r,g,b] (sRGB 0..255), shadow (boolean), image (path of a graphic drawn instead of the text), imageWidth (fraction of the photo's width, 0.01..1; default 0.2)}. Unknown keys and out-of-range sizes are errors"}
             }),
             &[],
@@ -213,6 +266,9 @@ pub fn helper_tools(has_ui: bool) -> Vec<Value> {
     ];
     if has_ui {
         v.extend([
+            tool("ui_inspect", "Inspect UI", "UI state and selection (same as inspect_ui).", json!({}), &[]),
+            tool("ui_screenshot", "Screenshot", "Return the window as an image without saving a file.",
+                json!({"maxSize": {"type": "integer"}, "format": {"type": "string", "enum": ["png", "jpeg"]}}), &[]),
             tool(
                 "screenshot",
                 "Screenshot",
@@ -250,6 +306,13 @@ pub fn helper_tools(has_ui: bool) -> Vec<Value> {
                 &["key"],
             ),
             tool("type_text", "Type text", "Type text into the focused field.", json!({"text": {"type": "string"}}), &["text"]),
+            tool(
+                "clipboard",
+                "Cut, copy or paste",
+                "Cut, copy or paste in the focused text field (click one first), as ⌘X / ⌘C / ⌘V do; cut and copy write the system clipboard. `paste` pastes `text`, or what the system clipboard holds without it. inspect_ui → `copied` is the text the app last copied.",
+                json!({"action": {"type": "string", "enum": ["cut", "copy", "paste"]}, "text": {"type": "string"}}),
+                &["action"],
+            ),
             tool(
                 "pointer_gesture",
                 "Pointer gesture",
@@ -298,12 +361,60 @@ pub fn command_tools(backend: &mut dyn Backend) -> Vec<Value> {
         .collect()
 }
 
+/// Conservative hints: generated command tools may edit; optional output paths make a helper a writer.
+fn annotations(name: &str, title: &str) -> Value {
+    let read_only = matches!(
+        name,
+        "command_list"
+            | "list_commands"
+            | "doc_inspect"
+            | "render_preview"
+            | "query_photos"
+            | "list_controls"
+            | "get_develop"
+            | "inspect_ui"
+            | "list_widgets"
+            | "ui_inspect"
+            | "ui_screenshot"
+    );
+    let files = matches!(name, "export" | "render_photo" | "screenshot");
+    json!({"title": title, "readOnlyHint": read_only, "destructiveHint": !read_only && !files,
+        "idempotentHint": read_only || matches!(name, "render_photo" | "screenshot"), "openWorldHint": false})
+}
+
+/// Helpers have fixed keys; generated command tools retain the registry's free-form params.
+pub(crate) fn check_args(name: &str, args: &Value) -> Result<(), String> {
+    if args.is_null() {
+        return Ok(());
+    }
+    let Some(m) = args.as_object() else {
+        return Err("tool arguments must be an object".into());
+    };
+    let defs = helper_tools(true);
+    let Some(def) = defs.iter().find(|t| t["name"] == name) else {
+        return Ok(());
+    };
+    let Some(props) = def["inputSchema"]["properties"].as_object() else {
+        return Ok(());
+    };
+    if let Some(bad) = m.keys().find(|k| !props.contains_key(*k)) {
+        let accepted: Vec<&str> = props.keys().map(String::as_str).collect();
+        return Err(format!("unknown argument \"{bad}\" for {name}; expected: {}", accepted.join(", ")));
+    }
+    Ok(())
+}
+
 /// All tools: helpers, plus the generated command tools when `with_commands`.
 pub fn tool_definitions(backend: &mut dyn Backend, with_commands: bool) -> Vec<Value> {
     let mut v = helper_tools(backend.has_ui());
     if with_commands {
         v.extend(command_tools(backend));
     }
+    for t in &mut v {
+        let name = t["name"].as_str().unwrap_or_default().to_string();
+        let title = t["title"].as_str().unwrap_or(&name).to_string();
+        t["annotations"] = annotations(&name, &title);
+    }
     v
 }
 
@@ -445,22 +556,67 @@ pub fn call_tool(b: &mut dyn Backend, name: &str, args: &Value) -> ToolResult {
         return ToolResult::from(exec(b, &rest.replace('_', "."), args.clone()));
     }
     match name {
-        "list_commands" => {
+        "list_commands" | "command_list" => {
             let filter = s("filter").unwrap_or("").to_lowercase();
+            let enabled_only = args.get("enabled_only").and_then(Value::as_bool).unwrap_or(false);
             ToolResult::from(b.call("engine.commands", json!({})).map(|v| {
                 match v {
-                    Value::Array(a) if !filter.is_empty() => Value::Array(
+                    Value::Array(a) => Value::Array(
                         a.into_iter()
                             .filter(|c| {
-                                c["id"].as_str().unwrap_or("").to_lowercase().contains(&filter)
+                                filter.is_empty()
+                                    || c["id"].as_str().unwrap_or("").to_lowercase().contains(&filter)
                                     || c["label"].as_str().unwrap_or("").to_lowercase().contains(&filter)
                             })
+                            .filter(|c| !enabled_only || c["enabled"].as_bool() != Some(false))
                             .collect(),
                     ),
                     v => v,
                 }
             }))
         }
+        "command_run" => match s("id") {
+            Some(c) => ToolResult::from(exec(b, c, args.get("params").cloned().filter(|p| !p.is_null()).unwrap_or(json!({})))),
+            None => ToolResult::error("missing `id`"),
+        },
+        "command_batch" => {
+            let Some(steps) = args.get("steps").and_then(Value::as_array) else { return ToolResult::error("missing `steps`") };
+            let stop = args.get("stop_on_error").and_then(Value::as_bool).unwrap_or(true);
+            let (mut completed, mut failed, mut results) = (0, 0, Vec::new());
+            for st in steps {
+                let Some(id) = st["id"].as_str() else {
+                    failed += 1;
+                    results.push(json!({"ok": false, "error": "step without `id`"}));
+                    if stop {
+                        break;
+                    }
+                    continue;
+                };
+                match exec(b, id, st.get("params").cloned().filter(|p| !p.is_null()).unwrap_or(json!({}))) {
+                    Ok(r) => {
+                        completed += 1;
+                        results.push(json!({"ok": true, "result": r}));
+                    }
+                    Err(e) => {
+                        failed += 1;
+                        results.push(json!({"ok": false, "error": e}));
+                        if stop {
+                            break;
+                        }
+                    }
+                }
+            }
+            let r = json!({"completed": completed, "failed": failed, "results": results});
+            if failed > 0 { ToolResult { is_error: true, ..ToolResult::json(r) } } else { ToolResult::json(r) }
+        }
+        "doc_inspect" => ToolResult::from(doc_inspect(b)),
+        "render_preview" => {
+            let mut a = obj(args, &["id", "format"]);
+            if let Some(m) = args.get("max_side") {
+                a["size"] = m.clone();
+            }
+            render_photo(b, &a)
+        }
         "run_command" => match s("command") {
             Some(c) => ToolResult::from(exec(b, c, args.get("params").cloned().filter(|p| !p.is_null()).unwrap_or(json!({})))),
             None => ToolResult::error("missing `command`"),
@@ -581,12 +737,20 @@ pub fn call_tool(b: &mut dyn Backend, name: &str, args: &Value) -> ToolResult {
                         "watermark",
                         "colorSpace",
                         "bitDepth",
+                        "hdr",
+                        "preset",
+                        "background",
+                        "resize",
+                        "subfolder",
+                        "conflict",
+                        "tiffCompression",
+                        "dngCompression",
                     ],
                 ),
             )
         })),
-        "screenshot" => screenshot(b, args),
-        "inspect_ui" => ToolResult::from(b.call("ui.inspect", json!({}))),
+        "screenshot" | "ui_screenshot" => screenshot(b, args),
+        "inspect_ui" | "ui_inspect" => ToolResult::from(b.call("ui.inspect", json!({}))),
         "set_ui" => ToolResult::from(b.call("ui.set", args.get("state").cloned().unwrap_or(json!({})))),
         "list_widgets" => ToolResult::from(b.call("ui.widgets", obj(args, &["filter"]))),
         "click" => {
@@ -602,7 +766,15 @@ pub fn call_tool(b: &mut dyn Backend, name: &str, args: &Value) -> ToolResult {
         }
         "press_key" => ToolResult::from(b.call("ui.key", obj(args, &["key", "cmd", "shift", "alt", "ctrl"]))),
         "type_text" => ToolResult::from(b.call("ui.text", obj(args, &["text"]))),
+        "clipboard" => ToolResult::from(b.call("ui.clipboard", obj(args, &["action", "text"]))),
         "pointer_gesture" => ToolResult::from(b.call("ui.pointer", obj(args, &["events", "alt", "shift", "cmd"]))),
         other => ToolResult::error(format!("unknown tool `{other}` (see tools/list)")),
     }
 }
+
+/// The canonical document resource and tool share the same snapshot.
+pub(crate) fn doc_inspect(b: &mut dyn Backend) -> Result<Value, String> {
+    let library = exec(b, "library.state", json!({}))?;
+    let stats = exec(b, "catalog.stats", json!({}))?;
+    Ok(json!({"library": library, "stats": stats}))
+}
diff --git a/crates/mcp/tests/e2e.rs b/crates/mcp/tests/e2e.rs
index ea27919c..ef2e49b6 100644
--- a/crates/mcp/tests/e2e.rs
+++ b/crates/mcp/tests/e2e.rs
@@ -153,3 +153,115 @@ fn remote_unreachable_is_a_tool_error() {
     assert_eq!(r[0]["result"]["isError"], true);
     assert!(r[0]["result"]["content"][0]["text"].as_str().unwrap().contains("not reachable"));
 }
+
+/// Real stdio framing and real atomic exports: progress, ping during a batch, cancellation
+/// between complete photos, unrelated output preservation, and a usable session afterwards.
+#[test]
+fn export_progress_and_cancel() {
+    let dir = std::env::temp_dir().join(format!("lc-mcp-progress-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let (input, mut send) = std::io::pipe().unwrap();
+    let (output, write) = std::io::pipe().unwrap();
+    let server = std::thread::spawn(move || Server::new(Box::new(Headless::demo())).serve(BufReader::new(input), write).unwrap());
+    let (tx, rx) = std::sync::mpsc::channel();
+    let reader = std::thread::spawn(move || {
+        for line in BufReader::new(output).lines() {
+            let value: Value = serde_json::from_str(&line.unwrap()).unwrap();
+            if tx.send(value).is_err() {
+                break;
+            }
+        }
+    });
+    let next = || rx.recv_timeout(std::time::Duration::from_secs(30)).expect("MCP reply/progress");
+    writeln!(send, "{}", call(1, "query_photos", json!({"limit":8}))).unwrap();
+    let query = next();
+    let ids: Vec<_> = query["result"]["structuredContent"]["photos"].as_array().unwrap().iter().map(|p| p["id"].clone()).collect();
+    assert_eq!(ids.len(), 8);
+    let mut request = call(2, "export", json!({"ids":ids,"dir":dir.join("complete"),"longEdge":1200,"format":"png"}));
+    request["params"]["_meta"] = json!({"progressToken":"photos","io.modelcontextprotocol/protocolVersion":"2026-07-28"});
+    writeln!(send, "{request}").unwrap();
+    let (mut last, mut notes, mut asked, mut answered) = (-1.0, 0, false, false);
+    loop {
+        let value = next();
+        if value["method"] == "notifications/progress" {
+            assert_eq!(value["params"]["progressToken"], "photos");
+            let progress = value["params"]["progress"].as_f64().unwrap();
+            assert!(progress > last && progress <= 8.0, "{value}");
+            assert_eq!(value["params"]["total"], 8);
+            last = progress;
+            notes += 1;
+            if !asked {
+                writeln!(send, "{}", json!({"jsonrpc":"2.0","id":3,"method":"ping"})).unwrap();
+                asked = true;
+            }
+        } else if value["id"] == 3 {
+            answered = true;
+        } else {
+            assert_eq!(value["id"], 2, "{value}");
+            assert_eq!(value["result"]["isError"], false, "{value}");
+            assert_eq!(value["result"]["resultType"], "complete");
+            break;
+        }
+    }
+    assert!(notes >= 2 && answered, "{notes} progress messages; ping answered {answered}");
+    assert_eq!(last, 8.0);
+    let out = dir.join("cancelled");
+    std::fs::create_dir_all(&out).unwrap();
+    let decoy = out.join("photo999.png");
+    std::fs::write(&decoy, b"unrelated existing output").unwrap();
+    let mut request = call(4, "command_run", json!({"id":"app.export","params":{"ids":ids,"dir":out,"longEdge":1200,"format":"png"}}));
+    request["params"]["_meta"] = json!({"progressToken":44});
+    writeln!(send, "{request}").unwrap();
+    loop {
+        let value = next();
+        assert_ne!(value["id"], 4, "must be cancellable before completion: {value}");
+        assert_eq!(value["params"]["progressToken"], 44, "{value}");
+        if value["params"]["progress"].as_f64().unwrap() > 0.0 {
+            break;
+        }
+    }
+    writeln!(send, "{}", json!({"jsonrpc":"2.0","method":"notifications/cancelled","params":{"requestId":4}})).unwrap();
+    writeln!(send, "{}", call(5, "doc_inspect", json!({}))).unwrap();
+    loop {
+        let value = next();
+        if value["method"] == "notifications/progress" {
+            continue;
+        }
+        assert_eq!(value["id"], 5, "cancelled request must not reply: {value}");
+        assert_eq!(value["result"]["isError"], false);
+        break;
+    }
+    assert_eq!(std::fs::read(&decoy).unwrap(), b"unrelated existing output");
+    let photos: Vec<_> = std::fs::read_dir(&out).unwrap().map(|e| e.unwrap().path()).filter(|p| *p != decoy).collect();
+    assert!(!photos.is_empty() && photos.len() < ids.len(), "only completed photos remain: {photos:?}");
+    for path in &photos {
+        lightcraft_codecs::decode(&std::fs::read(path).unwrap(), Default::default()).expect("complete image, no partial/temp file");
+    }
+    assert_eq!(std::fs::read_dir(dir.join("complete")).unwrap().count(), 8, "earlier export retained");
+    drop(send);
+    server.join().unwrap();
+    reader.join().unwrap();
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn export_without_token_finishes_after_eof() {
+    let dir = std::env::temp_dir().join(format!("lc-mcp-eof-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let mut headless = Headless::demo();
+    let ids: Vec<_> = headless.session.visible_cloned().iter().take(2).map(|id| id.0).collect();
+    let request = call(1, "cmd_app_export", json!({"ids":ids,"dir":dir,"longEdge":64,"format":"png"}));
+    // Headless sessions remain movable to a worker after installing progress support.
+    let replies = std::thread::spawn(move || {
+        let mut s = Server::new(Box::new(headless));
+        session(&mut s, &[request, call(2, "doc_inspect", json!({}))])
+    })
+    .join()
+    .unwrap();
+    assert_eq!(replies.len(), 2, "no token means no notifications");
+    assert_eq!(replies[0]["result"]["isError"], false, "{replies:?}");
+    assert_eq!(replies[1]["id"], 2, "queued request survives EOF");
+    assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 2);
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/pipeline/src/auto.rs b/crates/pipeline/src/auto.rs
index 3455fff2..f3259b5d 100644
--- a/crates/pipeline/src/auto.rs
+++ b/crates/pipeline/src/auto.rs
@@ -1,4 +1,5 @@
-//! Auto tone and auto white balance (histogram / grey-world statistics on a proxy).
+//! Auto tone (a Lightroom-like recipe, see [`auto_tone`]) and auto white balance (grey-world
+//! statistics on a proxy).
 
 use lightcraft_color::cct::xy_to_temp_tint;
 use lightcraft_color::{REC2020, Xy, bradford, luminance_2020};
@@ -21,40 +22,83 @@ pub struct AutoTone {
     pub saturation: f64,
 }
 
-fn percentile(sorted: &[f32], q: f32) -> f32 {
-    if sorted.is_empty() {
-        return 0.0;
+/// Exposure in EV that Auto adds per EV of the scene's log-average luminance (the slope is negative:
+/// darker scenes get more). The slope is Lightroom's: regressing the Exposure its Auto chose on 24
+/// raw photos against our own [`scene_log_mean`] of each gives -0.41 EV/EV (r = -0.92).
+const EXPOSURE_SLOPE: f64 = -0.41;
+/// Exposure for a scene whose log-average luminance is middle grey: fitted, with [`CONTRAST`] and
+/// [`VIBRANCE`], so our renders match Lightroom's Auto results on those photos (see [`auto_tone`]).
+const EXPOSURE_AT_GREY: f64 = -0.58;
+/// Highlights and Shadows are Lightroom's own: the average its Auto chose on the 24 photos (our
+/// sliders aim at the same as its). Freeing them as well matched no better on held-out photos and
+/// left them poorly determined.
+const HIGHLIGHTS: f64 = -66.0;
+const SHADOWS: f64 = 52.0;
+/// Contrast and Vibrance are fitted: our slider scales differ from Lightroom's, and our base tone is
+/// flatter, so Contrast is far above its +6. Whites, Blacks and Saturation stay at 0 (Whites and
+/// Blacks made no difference to the match; Lightroom leaves Saturation at about 0).
+const CONTRAST: f64 = 68.0;
+const VIBRANCE: f64 = 30.0;
+
+/// The scene's log-average luminance under the current white balance, in EV relative to middle grey
+/// (the mean of log2(Y / 0.18) over a 512 px proxy, scene-linear, before any tone curve). Pixels that
+/// aren't finite (a damaged decode) are left out: they get no weight when the proxy is made, and
+/// proxy pixels made only of them are skipped. `None` when no pixel is valid.
+pub fn scene_log_mean(src: &Rgb32f, info: &SourceInfo, s: &DevelopSettings) -> Option<f64> {
+    let (mut clean, mut weight) = (src.clone(), Rgb32f::new(src.width, src.height));
+    let mut any = false;
+    for (p, w) in clean.data.iter_mut().zip(weight.data.iter_mut()) {
+        if p.iter().all(|v| v.is_finite()) {
+            *w = [1.0; 3];
+            any = true;
+        } else {
+            *p = [0.0; 3];
+        }
     }
-    sorted[((sorted.len() - 1) as f32 * q.clamp(0.0, 1.0)) as usize]
+    if !any {
+        return None;
+    }
+    let fit = |img: &Rgb32f| lightcraft_raster::resample::fit(img, 512, 512, lightcraft_raster::resample::Filter::Box);
+    let (img, weight) = (fit(&clean), fit(&weight));
+    // the mean of the valid pixels under each proxy pixel
+    let kept: Vec<[f32; 3]> = img.data.iter().zip(&weight.data).filter(|(_, w)| w[0] > 1e-6).map(|(p, w)| p.map(|v| v / w[0])).collect();
+    let mut kept = Rgb32f { width: kept.len(), height: 1, data: kept };
+    let base = DevelopSettings { wb: s.wb, process: s.process, ..DevelopSettings::default() };
+    // (white balance is per pixel: the valid pixels can be balanced in a row of their own)
+    crate::local::scene_linear_pre(&mut kept, info, &base);
+    let (mut sum, mut n) = (0f64, 0usize);
+    for c in &kept.data {
+        let ev = (luminance_2020(*c).max(1e-6) / 0.18).log2();
+        if ev.is_finite() {
+            sum += ev as f64;
+            n += 1;
+        }
+    }
+    (n > 0).then(|| sum / n as f64)
 }
 
-/// Compute auto tone values for `src` under the current white balance (ignores current tone values).
+/// Auto settings for `src` under the current white balance (ignores current tone values), aiming at
+/// what Lightroom's Auto does: the Exposure a scene needs follows its log-average luminance
+/// ([`scene_log_mean`], scene-linear, so the rule doesn't depend on the base tone curve), and the
+/// other sliders are one fixed recipe. Calibrated black-box against Lightroom's observed behaviour
+/// (the values its Auto chose and its exported results) on 24 Sony raw photos, of which 16 have a
+/// starting look that Sony's in-camera DRO doesn't brighten. Held out one photo at a time, those 16
+/// come out at a median dE76 of 6.4 from Lightroom's Auto results (8.3 unedited; 18.8 with the
+/// previous percentile rule, which ended about 16 L* too bright); all 24 at 7.7 (7.9 unedited).
+/// Rendered sources (JPEGs) are already toned, so their log-average reads brighter and Auto changes
+/// their exposure less. A source without a single valid pixel gets Exposure 0 (and the rest of the
+/// recipe).
 pub fn auto_tone(src: &Rgb32f, info: &SourceInfo, s: &DevelopSettings) -> AutoTone {
-    let mut img = lightcraft_raster::resample::fit(src, 512, 512, lightcraft_raster::resample::Filter::Box);
-    let mut base = DevelopSettings { wb: s.wb, ..DevelopSettings::default() };
-    base.light.exposure = 0.0;
-    crate::local::scene_linear_pre(&mut img, info, &base);
-    let mut ev: Vec<f32> = img.data.iter().map(|c| (luminance_2020(*c).max(1e-6) / 0.18).log2()).collect();
-    ev.sort_by(|a, b| a.total_cmp(b));
-    let median = percentile(&ev, 0.5);
-    let exposure = (-median * 0.85 - 0.1).clamp(-4.0, 4.0);
-    let (p01, p05, p95, p995) =
-        (percentile(&ev, 0.01) + exposure, percentile(&ev, 0.05) + exposure, percentile(&ev, 0.95) + exposure, percentile(&ev, 0.995) + exposure);
-    let highlights = if p995 > 2.2 { -((p995 - 2.2) * 38.0).min(90.0) } else { 0.0 };
-    let shadows = if p05 < -4.0 { ((-4.0 - p05) * 22.0).min(70.0) } else { 0.0 };
-    let spread = p95 - p05;
-    let contrast = ((6.5 - spread) * 6.0).clamp(-20.0, 30.0);
-    let whites = if p995 < 1.8 { ((1.8 - p995) * 25.0).min(40.0) } else { -((p995 - 3.5).max(0.0) * 10.0).min(30.0) };
-    let blacks = if p01 > -5.0 { -((p01 + 5.0) * 10.0).min(35.0) } else { ((-7.0 - p01).max(0.0) * 8.0).min(20.0) };
+    let exposure = scene_log_mean(src, info, s).map_or(0.0, |m| (EXPOSURE_AT_GREY + EXPOSURE_SLOPE * m).clamp(-2.0, 3.0));
     AutoTone {
-        exposure: (exposure as f64 * 100.0).round() / 100.0,
-        contrast: contrast.round() as f64,
-        highlights: highlights.round() as f64,
-        shadows: shadows.round() as f64,
-        whites: whites.round() as f64,
-        blacks: blacks.round() as f64,
-        vibrance: 12.0,
-        saturation: 3.0,
+        exposure: (exposure * 100.0).round() / 100.0,
+        contrast: CONTRAST,
+        highlights: HIGHLIGHTS,
+        shadows: SHADOWS,
+        whites: 0.0,
+        blacks: 0.0,
+        vibrance: VIBRANCE,
+        saturation: 0.0,
     }
 }
 
@@ -65,7 +109,7 @@ pub fn auto_tone(src: &Rgb32f, info: &SourceInfo, s: &DevelopSettings) -> AutoTo
 pub fn auto_bw_mix(src: &Rgb32f, info: &SourceInfo, s: &DevelopSettings) -> [f64; 8] {
     use lightcraft_color::perceptual::{lab_to_lch, oklab_from_2020};
     let mut img = lightcraft_raster::resample::fit(src, 512, 512, lightcraft_raster::resample::Filter::Box);
-    let base = DevelopSettings { wb: s.wb, light: s.light, ..DevelopSettings::default() };
+    let base = DevelopSettings { wb: s.wb, light: s.light, process: s.process, ..DevelopSettings::default() };
     crate::local::scene_linear_pre(&mut img, info, &base);
     let gain = 2f32.powf(base.light.exposure as f32);
     let (mut mass, mut sum_l) = ([0f64; 8], [0f64; 8]);
@@ -144,13 +188,47 @@ mod tests {
     use super::*;
 
     #[test]
-    fn dark_image_gets_positive_exposure() {
-        let img = Rgb32f::from_fn(64, 64, |x, _| [0.01 + x as f32 * 0.0003; 3]);
-        let a = auto_tone(&img, &SourceInfo::default(), &DevelopSettings::default());
-        assert!(a.exposure > 1.5, "{a:?}");
-        let bright = Rgb32f::from_fn(64, 64, |x, _| [0.8 + x as f32 * 0.01; 3]);
-        let b = auto_tone(&bright, &SourceInfo::default(), &DevelopSettings::default());
-        assert!(b.exposure < -1.0, "{b:?}");
+    fn exposure_follows_the_log_average_luminance() {
+        let flat = |y: f32| Rgb32f::filled(64, 64, [y; 3]);
+        let auto = |img: &Rgb32f| auto_tone(img, &SourceInfo::default(), &DevelopSettings::default());
+        let log_mean = |img: &Rgb32f| scene_log_mean(img, &SourceInfo::default(), &DevelopSettings::default()).unwrap();
+        // a scene at middle grey gets the exposure at grey; each EV darker adds 0.41 EV
+        assert!(log_mean(&flat(0.18)).abs() < 1e-3);
+        assert_eq!(auto(&flat(0.18)).exposure, -0.58);
+        assert!((auto(&flat(0.18 / 8.0)).exposure - (-0.58 + 3.0 * 0.41)).abs() < 1e-9);
+        // darker scenes get more, brighter ones less, within -2..3 EV
+        let ramp = |lo: f32, step: f32| Rgb32f::from_fn(64, 64, |x, _| [lo + x as f32 * step; 3]);
+        let (dark, bright) = (auto(&ramp(0.01, 0.0003)), auto(&ramp(0.8, 0.01)));
+        assert!(dark.exposure > 0.5 && bright.exposure < -1.0, "{dark:?} {bright:?}");
+        assert_eq!(auto(&flat(1e-9)).exposure, 3.0);
+        assert_eq!(auto(&flat(1e6)).exposure, -2.0);
+        // the rest is one recipe
+        assert_eq!(
+            (dark.contrast, dark.highlights, dark.shadows, dark.whites, dark.blacks, dark.vibrance, dark.saturation),
+            (68.0, -66.0, 52.0, 0.0, 0.0, 30.0, 0.0)
+        );
+        assert_eq!((dark.contrast, dark.shadows), (bright.contrast, bright.shadows));
+    }
+
+    #[test]
+    fn pixels_that_are_not_finite_are_left_out() {
+        let auto = |img: &Rgb32f| auto_tone(img, &SourceInfo::default(), &DevelopSettings::default());
+        // half middle grey, half NaN (or infinite): the grey half alone decides, as if the rest weren't there
+        for bad in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+            let half = Rgb32f::from_fn(64, 64, |x, _| if x < 32 { [0.18; 3] } else { [bad; 3] });
+            assert_eq!(auto(&half).exposure, -0.58, "{bad}");
+            // also through the resampling of a source larger than the proxy (proxy pixels on the border mix both halves)
+            let big = Rgb32f::from_fn(1030, 700, |x, _| if x < 515 { [0.045; 3] } else { [bad; 3] });
+            assert!((auto(&big).exposure - (-0.58 + 2.0 * 0.41)).abs() < 1e-9, "{bad}");
+            // a few broken pixels scattered over a grey image change nothing
+            let speckled = Rgb32f::from_fn(1030, 700, |x, y| if (x * 7 + y * 13) % 97 == 0 { [bad; 3] } else { [0.18; 3] });
+            assert_eq!(auto(&speckled).exposure, -0.58, "{bad}");
+        }
+        // with no valid pixel at all (or none at all) there is nothing to measure: Exposure 0, the recipe as usual
+        for img in [Rgb32f::filled(8, 8, [f32::NAN; 3]), Rgb32f::filled(600, 600, [f32::INFINITY; 3]), Rgb32f::new(0, 0)] {
+            let a = auto(&img);
+            assert_eq!((a.exposure, a.contrast, a.vibrance), (0.0, 68.0, 30.0));
+        }
     }
 
     #[test]
diff --git a/crates/pipeline/src/finish.rs b/crates/pipeline/src/finish.rs
index 6b422ee9..fce3b832 100644
--- a/crates/pipeline/src/finish.rs
+++ b/crates/pipeline/src/finish.rs
@@ -3,7 +3,7 @@
 use lightcraft_color::luminance_2020;
 use lightcraft_color::spline::{Lut1, MonotoneCurve};
 use lightcraft_color::transfer::linear_to_srgb;
-use lightcraft_develop::{DevelopSettings, LocalAdjustments, ToneCurve, VignetteStyle};
+use lightcraft_develop::{DevelopSettings, LocalAdjustments, Process, ToneCurve, VignetteStyle};
 use lightcraft_geom::Point;
 use lightcraft_raster::Rgba8;
 
@@ -192,6 +192,9 @@ pub struct FinishParams {
     pub px_per_long: f64,
     /// The window's offset and the whole output's size (pixels): `(0, 0, w, h)` unless windowed.
     pub view: [f32; 4],
+    /// Peak linear output relative to SDR white: 1 for SDR renders; `2^max_ev` for an HDR render
+    /// ([`OutputDepth::F32Hdr`] with HDR on), which keeps values above 1 instead of clipping them.
+    pub peak: f32,
 }
 
 impl FinishParams {
@@ -220,16 +223,12 @@ impl FinishParams {
             ((s.grain.amount / 100.0) as f32 * 0.13, cell.max(0.6), (s.grain.roughness / 100.0) as f32, s.grain.seed)
         });
         let calibration = s.section_enabled("calibration");
+        let peak = s.hdr.peak();
         FinishParams {
+            peak,
             calib: if calibration { crate::colorops::calibration_matrix(&s.calibration) } else { None },
             shadow_tint: if calibration { (s.calibration.shadows_tint / 100.0) as f32 } else { 0.0 },
-            tone: if let Some(curve) = info.camera_tone.as_ref().filter(|_| info.raw) {
-                ToneMap::camera(curve, s.light.contrast, s.light.whites, s.light.blacks)
-            } else if info.raw {
-                ToneMap::new(s.light.contrast, s.light.whites, s.light.blacks)
-            } else {
-                ToneMap::display(s.light.contrast, s.light.whites, s.light.blacks)
-            },
+            tone: base_tone(s, info, peak),
             lut: crate::lut::get(&s.profile.id).map(|l| (l, (s.profile.amount / 100.0).clamp(0.0, 2.0) as f32)),
             ops: ColorOps::new(s),
             curves: curve_luts(&s.curve),
@@ -260,12 +259,49 @@ impl FinishParams {
             view: frame.view.map_or([0.0, 0.0, w as f32, h as f32], |v| [v.x as f32, v.y as f32, v.full_w as f32, v.full_h as f32]),
         }
     }
+
+    /// Render into a display's primaries (sRGB curve) instead of the output space, soft proof
+    /// included (see [`crate::DisplaySpace`]).
+    pub fn for_display(&mut self, d: &crate::DisplaySpace, proof: Option<crate::Proof>) {
+        self.to_out = d.from_working;
+        self.out_luma = d.luma;
+        self.out_trc = OutputTrc::Srgb;
+        self.proof = proof.map(|pr| pr.params_display(d));
+    }
 }
 
-pub(crate) fn finish(p: &Prepared, s: &DevelopSettings, frame: &Frame, info: &SourceInfo, space: OutputSpace, proof: Option<crate::Proof>) -> Rgba8 {
+/// The base tone map (scene → display luminance, with Contrast, Whites and Blacks) of `s`'s
+/// rendering process. This is where a new tone model branches: a retuned default tone curve (issue
+/// #146) is a new [`Process`] with its own arm here, and V1's arm stays as it is, so photos edited
+/// under V1 keep their look (`docs/process-versions.md`). CPU and GPU both take it from here.
+/// `peak` is the HDR render's peak relative to SDR white ([`lightcraft_develop::Hdr::peak`]); at 1.0 (SDR)
+/// every arm is the SDR tone map. The camera's look is bounded at white, so HDR renders use the HDR tone map.
+pub fn base_tone(s: &DevelopSettings, info: &SourceInfo, peak: f32) -> ToneMap {
+    let l = &s.light;
+    match s.process.process() {
+        Process::V1 => match info.camera_tone.as_ref().filter(|_| info.raw && peak <= 1.0) {
+            Some(curve) => ToneMap::camera(curve, l.contrast, l.whites, l.blacks),
+            None if info.raw => ToneMap::hdr(l.contrast, l.whites, l.blacks, peak),
+            None => ToneMap::display_hdr(l.contrast, l.whites, l.blacks, peak),
+        },
+    }
+}
+
+pub(crate) fn finish(
+    p: &Prepared,
+    s: &DevelopSettings,
+    frame: &Frame,
+    info: &SourceInfo,
+    space: OutputSpace,
+    display: Option<&crate::DisplaySpace>,
+    proof: Option<crate::Proof>,
+) -> Rgba8 {
     let (w, h) = (p.img.width, p.img.height);
     let mut fp = FinishParams::new(s, frame, info, w, h, p.px_per_long, p.air, space);
     fp.proof = proof.map(|pr| pr.params(space));
+    if let Some(d) = display {
+        fp.for_display(d, proof);
+    }
     let trc = fp.out_trc;
     let data = finish_with(p, &fp, false, |e| match trc {
         OutputTrc::Srgb => [enc(e[0]), enc(e[1]), enc(e[2]), 255],
@@ -298,6 +334,12 @@ pub(crate) fn finish_deep(
             let v = finish_with(p, &fp, true, |e| e.map(|v| srgb_to_linear(v.clamp(0.0, 1.0))));
             DeepSamples::F32(v.into_flattened())
         }
+        OutputDepth::F32Hdr => {
+            // the sRGB curve extended past 1 (it is unbounded), so values up to `peak` survive
+            let peak = fp.peak;
+            let v = finish_with(p, &fp, true, |e| e.map(|v| srgb_to_linear(v.max(0.0)).clamp(0.0, peak)));
+            DeepSamples::F32(v.into_flattened())
+        }
         _ => {
             let q = |v: f32| (v.clamp(0.0, 1.0) * 65535.0 + 0.5) as u16;
             let v = finish_with(p, &fp, true, |e| match trc {
@@ -352,6 +394,8 @@ pub(crate) fn finish_with<T: Copy + Default + Send>(
     let aspect = vw / vh;
 
     let srgb = srgb_lut();
+    let peak = fp.peak;
+    let hdr = peak > 1.0;
     let mut out = vec![T::default(); w * h];
     for_rows(&mut out, w, |y, row| {
         for (x, px) in row.iter_mut().enumerate() {
@@ -493,8 +537,8 @@ pub(crate) fn finish_with<T: Copy + Default + Send>(
                 d = d.map(|v| o + (v - o) * k);
             }
             let mx = d[0].max(d[1]).max(d[2]);
-            if mx > 1.0 {
-                let t = ((mx - 1.0) / (mx - o).max(1e-6)).clamp(0.0, 1.0);
+            if mx > peak {
+                let t = ((mx - peak) / (mx - o).max(1e-6)).clamp(0.0, 1.0);
                 d = d.map(|v| v + (o - v) * t);
             }
 
@@ -526,6 +570,9 @@ pub(crate) fn finish_with<T: Copy + Default + Send>(
                         } else {
                             d = d.map(|c| c * f);
                         }
+                    } else if hdr {
+                        // lighten towards SDR white; never pull HDR highlights down to it
+                        d = d.map(|c| c + (1.0 - c).max(0.0) * v.amount * t * 0.85);
                     } else {
                         d = d.map(|c| c + (1.0 - c) * v.amount * t * 0.85);
                     }
@@ -538,7 +585,7 @@ pub(crate) fn finish_with<T: Copy + Default + Send>(
             let mut r = match &fp.proof {
                 Some(pp) => {
                     let q0 = mul3(&pp.to_proof, d);
-                    let (q, t) = gamut_map(q0, pp.luma);
+                    let (q, t) = gamut_map_to(q0, pp.luma, peak);
                     if pp.dest_warning && out_of_gamut(q0, t) {
                         warn = Some(crate::output::PROOF_DEST_WARNING);
                     }
@@ -546,17 +593,37 @@ pub(crate) fn finish_with<T: Copy + Default + Send>(
                 }
                 None => mul3(to_out, d),
             };
-            let (mapped, t) = gamut_map(r, *out_luma);
+            let (mapped, t) = gamut_map_to(r, *out_luma, peak);
             if fp.proof.is_some_and(|pp| pp.display_warning) && warn.is_none() && out_of_gamut(r, t) {
                 warn = Some(crate::output::PROOF_DISPLAY_WARNING);
             }
             r = mapped;
 
             // --- encode, curves, grain
-            let mut e = if exact { r.map(|v| linear_to_srgb(v.clamp(0.0, 1.0))) } else { r.map(|v| encode_srgb(srgb, v)) };
+            let mut e = if hdr {
+                // HDR: the (unbounded) sRGB curve, so values above SDR white encode above 1
+                r.map(|v| {
+                    if v > 1.0 {
+                        linear_to_srgb(v)
+                    } else if exact {
+                        linear_to_srgb(v.max(0.0))
+                    } else {
+                        encode_srgb(srgb, v)
+                    }
+                })
+            } else if exact {
+                r.map(|v| linear_to_srgb(v.clamp(0.0, 1.0)))
+            } else {
+                r.map(|v| encode_srgb(srgb, v))
+            };
             if let Some(l) = curves {
                 let e0 = e;
-                e = [l[0].eval(e[0]), l[1].eval(e[1]), l[2].eval(e[2])];
+                e = if hdr {
+                    // above SDR white the curves continue with slope 1 from their end point
+                    std::array::from_fn(|k| if e[k] > 1.0 { l[k].eval(1.0) + (e[k] - 1.0) } else { l[k].eval(e[k]) })
+                } else {
+                    [l[0].eval(e[0]), l[1].eval(e[1]), l[2].eval(e[2])]
+                };
                 if fp.refine_sat < 1.0 {
                     e = refine_saturation(e0, e, fp.refine_sat);
                 }
@@ -567,11 +634,20 @@ pub(crate) fn finish_with<T: Copy + Default + Send>(
                 let sc = fp.px_per_long as f32 / cell;
                 let mut g = grain_noise(gx * sc, gy * sc, seed);
                 g = g * (1.0 - rough * 0.5) + grain_noise(gx * sc * 2.3, gy * sc * 2.3, seed ^ 0x55) * rough * 0.7;
-                let lum = 0.2126 * e[0] + 0.7152 * e[1] + 0.0722 * e[2];
+                let mut lum = 0.2126 * e[0] + 0.7152 * e[1] + 0.0722 * e[2];
+                if hdr {
+                    lum = lum.clamp(0.0, 1.0);
+                }
                 let k = amt * g * (0.35 + 2.6 * lum * (1.0 - lum));
                 e = e.map(|v| v + k);
             }
             let e = match &p_lut {
+                Some((l, k)) if hdr => {
+                    // the LUT sees SDR values; the part above SDR white is carried over
+                    let c = e.map(|v| v.clamp(0.0, 1.0));
+                    let m = l.apply(c);
+                    [e[0] + (m[0] - c[0]) * k, e[1] + (m[1] - c[1]) * k, e[2] + (m[2] - c[2]) * k]
+                }
                 Some((l, k)) => {
                     let m = l.apply(e.map(|v| v.clamp(0.0, 1.0)));
                     [e[0] + (m[0] - e[0]) * k, e[1] + (m[1] - e[1]) * k, e[2] + (m[2] - e[2]) * k]
@@ -609,13 +685,19 @@ fn mul3(m: &[[f32; 3]; 3], d: [f32; 3]) -> [f32; 3] {
 /// returns the mapped colour and the chroma scale used (1 = already in gamut).
 #[inline]
 pub fn gamut_map(r: [f32; 3], luma: [f32; 3]) -> ([f32; 3], f32) {
-    let yy = (luma[0] * r[0] + luma[1] * r[1] + luma[2] * r[2]).clamp(0.0, 1.0);
+    gamut_map_to(r, luma, 1.0)
+}
+
+/// [`gamut_map`] into `0..peak` (an HDR render's range; `peak` = 1 is [`gamut_map`]).
+#[inline]
+pub fn gamut_map_to(r: [f32; 3], luma: [f32; 3], peak: f32) -> ([f32; 3], f32) {
+    let yy = (luma[0] * r[0] + luma[1] * r[1] + luma[2] * r[2]).clamp(0.0, peak);
     let mut t = 1.0f32;
     for c in r {
         if c < 0.0 {
             t = t.min(yy / (yy - c).max(1e-9));
-        } else if c > 1.0 {
-            t = t.min((1.0 - yy) / (c - yy).max(1e-9));
+        } else if c > peak {
+            t = t.min((peak - yy) / (c - yy).max(1e-9));
         }
     }
     if t < 1.0 { (r.map(|c| yy + (c - yy) * t), t) } else { (r, 1.0) }
diff --git a/crates/pipeline/src/lib.rs b/crates/pipeline/src/lib.rs
index 84f5bd98..f7c33ee9 100644
--- a/crates/pipeline/src/lib.rs
+++ b/crates/pipeline/src/lib.rs
@@ -30,6 +30,7 @@ pub mod dust;
 pub mod finish;
 pub mod geometry;
 pub mod local;
+pub mod local_tone;
 pub mod lut;
 pub mod masks;
 pub mod optics;
@@ -42,7 +43,7 @@ pub mod transform;
 pub mod upright;
 pub mod visualize;
 
-pub use output::{DeepImage, DeepSamples, OutputDepth, OutputSpace, OutputTrc, Proof};
+pub use output::{DeepImage, DeepSamples, DisplaySpace, OutputDepth, OutputSpace, OutputTrc, Proof};
 pub use visualize::{MaskView, Overlay};
 
 use lightcraft_develop::{DevelopSettings, Treatment};
@@ -83,6 +84,9 @@ pub struct SourceInfo {
     pub camera_tone: Option<tone::CameraTone>,
     /// Segmentation mattes stored in the file (DNG semantic masks): AI masks use them.
     pub mattes: Option<Arc<masks::Mattes>>,
+    /// The raw's own local tone mapping (DNG `ProfileGainTableMap`), rendered only when the
+    /// photo's Profile option asks for it ([`local_tone`]).
+    pub local_tone: Option<Arc<local_tone::LocalTone>>,
 }
 
 impl Default for SourceInfo {
@@ -96,6 +100,7 @@ impl Default for SourceInfo {
             camera_color: None,
             camera_tone: None,
             mattes: None,
+            local_tone: None,
         }
     }
 }
@@ -127,6 +132,9 @@ pub struct RenderRequest {
     /// Render only this window of the output that `max_w × max_h` describes (a zoomed view):
     /// the result is that window's pixels, as in the whole render. See [`PixelWindow`].
     pub window: Option<PixelWindow>,
+    /// Previews for a monitor with a display profile: render 8-bit into its primaries instead of
+    /// `space` (see [`DisplaySpace`]; ignored by deep renders).
+    pub display: Option<DisplaySpace>,
 }
 
 /// A window of the (virtual) full output, in its pixels: what a zoomed view needs, rendered
@@ -163,6 +171,7 @@ impl RenderRequest {
             depth: OutputDepth::U8,
             proof: None,
             window: None,
+            display: None,
         }
     }
 }
@@ -416,6 +425,8 @@ pub fn plan<'a>(src: &Rgb32f, info: &SourceInfo, s: &'a DevelopSettings, req: &R
         format!("{eyes:?}"),
         // defringe runs in this stage
         format!("{:?}", s.optics),
+        // and the local tone mapping
+        local_tone::enabled(info, s),
         [d.nr_luminance, d.nr_detail, d.nr_color, d.nr_color_detail, d.nr_color_smoothness].map(f64::to_bits),
         src_long,
     ));
@@ -423,22 +434,31 @@ pub fn plan<'a>(src: &Rgb32f, info: &SourceInfo, s: &'a DevelopSettings, req: &R
 }
 
 /// Whether the scene-linear stage needs work only the CPU does (defringe, spot removal).
-pub fn lin_needs_cpu(s: &DevelopSettings) -> bool {
+pub fn lin_needs_cpu(s: &DevelopSettings, info: &SourceInfo) -> bool {
     let o = &s.optics;
     let defringe = s.section_enabled("optics") && (o.defringe_purple_amount > 0.0 || o.defringe_green_amount > 0.0);
-    defringe || !s.spots.is_empty()
+    defringe || !s.spots.is_empty() || local_tone::enabled(info, s)
 }
 
 /// The white-balanced, defringed, retouched image (before noise reduction): the CPU part of the
 /// scene-linear stage, in place.
 pub fn lin_cpu(img: &mut Rgb32f, info: &SourceInfo, p: &Plan<'_>) {
     let s = &*p.settings;
+    // (before the white balance: the gain's input is the as-shot development, as in the file)
+    local_tone::apply(img, info, p);
     local::white_balance(img, info, s);
     optics::defringe(img, s, p.px_per_long / optics::DEFRINGE_REF_LONG);
     spots::apply(img, &s.spots, &p.frame, p.px_per_long);
     redeye::apply(img, &p.eyes);
 }
 
+/// The settings a render of `s` for `req` uses: the HDR edit for an [`OutputDepth::F32Hdr`]
+/// render, otherwise its SDR rendition (see [`DevelopSettings::sdr_rendition`]). Every renderer
+/// (CPU and GPU) goes through this, so an SDR render of an HDR edit looks the same everywhere.
+pub fn settings_for<'a>(s: &'a DevelopSettings, req: &RenderRequest) -> std::borrow::Cow<'a, DevelopSettings> {
+    if req.depth == OutputDepth::F32Hdr { std::borrow::Cow::Borrowed(s) } else { s.sdr_rendition() }
+}
+
 /// Render `src` with settings `s`.
 pub fn render(src: &Rgb32f, info: &SourceInfo, s: &DevelopSettings, req: &RenderRequest) -> Rendered {
     render_impl(Src::Borrowed(src), info, s, req, None)
@@ -458,7 +478,9 @@ enum Src<'a> {
 fn render_impl(src: Src<'_>, info: &SourceInfo, s: &DevelopSettings, req: &RenderRequest, cache: Option<&StageCache>) -> Rendered {
     // sections switched off with their eye render as if at their defaults (issue #316)
     let effective = s.effective();
-    let s: &DevelopSettings = &effective;
+    let edit: &DevelopSettings = &effective;
+    let rendition = settings_for(edit, req);
+    let s: &DevelopSettings = &rendition;
     // `Instant::now()` panics on wasm32-unknown-unknown: only read the clock when profiling.
     let lap = |what: &str, t: &mut Option<std::time::Instant>| {
         if let Some(t) = t {
@@ -516,7 +538,7 @@ fn render_impl(src: Src<'_>, info: &SourceInfo, s: &DevelopSettings, req: &Rende
         lap("finish (deep)", &mut t);
         return Rendered { image, histogram, deep: Some(deep) };
     }
-    let image = finish::finish(&prep, s, frame, info, req.space, req.proof);
+    let image = finish::finish(&prep, s, frame, info, req.space, req.display.as_ref(), req.proof);
     lap("finish", &mut t);
     let cut = |i: &Rgba8| match plan.keep {
         Some(k) => i.crop(k.x, k.y, k.w, k.h),
@@ -530,7 +552,15 @@ fn render_impl(src: Src<'_>, info: &SourceInfo, s: &DevelopSettings, req: &Rende
     let mut image = image;
     let mask = overlay_alpha(req.overlay, &plan, &prep);
     visualize::apply(&mut image, req.overlay, &plan, mask.as_ref());
-    let image = if plan.keep.is_some() { cut(&image) } else { image };
+    let mut image = if plan.keep.is_some() { cut(&image) } else { image };
+    if req.overlay == Overlay::HdrRange && edit.hdr.enabled {
+        // the HDR rendition of the same request says how far above SDR white each pixel goes
+        let hreq = RenderRequest { depth: OutputDepth::F32Hdr, overlay: Overlay::None, proof: None, ..*req };
+        if let Some(hdr) = render(src_img, info, edit, &hreq).deep {
+            visualize::hdr_range(&mut image, &hdr, req.space.luma());
+        }
+        lap("visualize hdr", &mut t);
+    }
     Rendered { image, histogram, deep: None }
 }
 
@@ -574,9 +604,9 @@ fn overlay_alpha(o: Overlay, plan: &Plan<'_>, prep: &Prepared) -> Option<Plane>
 }
 
 /// Convenience: render a before/after pair side by side is up to the UI; this renders "before"
-/// (default look, keeping the crop so framing matches).
+/// (default look, keeping the crop so framing matches, under the photo's own rendering process).
 pub fn before_settings(s: &DevelopSettings) -> DevelopSettings {
-    let mut b = DevelopSettings { crop: s.crop, orientation: s.orientation, ..DevelopSettings::default() };
+    let mut b = DevelopSettings { crop: s.crop, orientation: s.orientation, process: s.process, ..DevelopSettings::default() };
     b.wb = lightcraft_develop::WhiteBalance { mode: lightcraft_develop::WbMode::AsShot, ..b.wb };
     b
 }
@@ -611,6 +641,8 @@ mod tests;
 #[cfg(test)]
 mod tests_geometry;
 #[cfg(test)]
+mod tests_hdr;
+#[cfg(test)]
 mod tests_local;
 #[cfg(test)]
 mod tests_window;
diff --git a/crates/pipeline/src/local_tone.rs b/crates/pipeline/src/local_tone.rs
new file mode 100644
index 00000000..c38a25c9
--- /dev/null
+++ b/crates/pipeline/src/local_tone.rs
@@ -0,0 +1,62 @@
+//! The camera's local tone mapping: a raw's DNG `ProfileGainTableMap` (Apple ProRAW), rendered
+//! when the photo's Profile option "Camera local tone mapping" is on. Off by default: Lightroom
+//! Classic renders ProRAW without it (see `lightcraft_raw::gaintable`).
+//!
+//! The map is a per-pixel gain that depends on the pixel's position in the raw's active area and
+//! on its colour after the baseline exposure (linear ProPhoto). The source the pipeline gets is
+//! exactly that colour (scene-linear Rec.2020 after the baseline exposure), so the gain is
+//! evaluated here, on the resampled source at output resolution: a preview colours only the pixels
+//! it shows. A gain multiplies R, G and B alike, so it commutes with the white balance (a matrix)
+//! that follows. Files that also carry a `ProfileLookTable` get the gain after the table instead of
+//! before it (DNG 1.7.1); Apple ProRAW has none.
+
+use lightcraft_color::{D50, D65, PROPHOTO, REC2020, bradford};
+use lightcraft_geom::Point;
+use lightcraft_raster::Rgb32f;
+use lightcraft_raw::gaintable::{GainTableMap, SourcePlacement};
+
+use crate::{Plan, SourceInfo};
+use lightcraft_develop::DevelopSettings;
+
+/// A raw's gain table map and where its developed source sits in the active area.
+#[derive(Clone, Debug, PartialEq)]
+pub struct LocalTone {
+    pub map: GainTableMap,
+    pub placement: SourcePlacement,
+}
+
+/// Whether the render applies the source's local tone mapping.
+pub fn enabled(info: &SourceInfo, s: &DevelopSettings) -> bool {
+    s.profile.camera_local_tone && info.raw && info.local_tone.is_some()
+}
+
+/// Multiply the resampled, not yet white-balanced source `img` (the output frame of `p`) by the
+/// local tone gain at each pixel. Blank canvas (outside a lens / perspective warp) is left alone.
+pub fn apply(img: &mut Rgb32f, info: &SourceInfo, p: &Plan<'_>) {
+    let Some(lt) = info.local_tone.as_deref().filter(|_| enabled(info, &p.settings)) else { return };
+    let Some(eval) = lt.map.evaluator() else { return };
+    let (w, h) = (img.width, img.height);
+    let frame = &p.frame;
+    let (ow, oh) = (frame.ow.max(1e-9), frame.oh.max(1e-9));
+    let o2t = frame.out_to_oriented(w, h);
+    let user = frame.orient.inverse();
+    let to_prophoto = PROPHOTO.from_xyz().mul(&bradford(D65, D50)).mul(&REC2020.to_xyz()).to_f32();
+    crate::for_rows(&mut img.data, w, |y, row| {
+        for (x, px) in row.iter_mut().enumerate() {
+            // output pixel → user-oriented source px → EXIF-oriented source (0..1) → active area
+            let s = match &frame.warp {
+                Some(wp) => match wp.frame(&o2t, x, y) {
+                    Some((_, s)) => s,
+                    None => continue,
+                },
+                None => o2t.apply(Point::new(x as f64 + 0.5, y as f64 + 0.5)),
+            };
+            let (u, v) = user.map(s.x / ow, s.y / oh, 1.0, 1.0);
+            let (ax, ay) = lt.placement.active(u, v);
+            let m = &to_prophoto;
+            let q: [f32; 3] = std::array::from_fn(|i| m[i][0] * px[0] + m[i][1] * px[1] + m[i][2] * px[2]);
+            let g = eval.gain(q, ax, ay);
+            *px = px.map(|c| c * g);
+        }
+    });
+}
diff --git a/crates/pipeline/src/output.rs b/crates/pipeline/src/output.rs
index 5272b54d..5acae092 100644
--- a/crates/pipeline/src/output.rs
+++ b/crates/pipeline/src/output.rs
@@ -1,13 +1,14 @@
 //! Output encoding: the colour space (primaries + transfer curve) and sample format a render is
-//! delivered in. Previews are always 8-bit sRGB; exports may ask for a wide-gamut space and/or
-//! 16-bit or linear float samples.
+//! delivered in. Previews are 8-bit sRGB, or 8-bit in a monitor's own primaries when the frontend
+//! has a display profile ([`DisplaySpace`]); exports may ask for a wide-gamut space and/or 16-bit or
+//! linear float samples.
 //!
 //! The per-pixel stage works in scene-linear Rec.2020 and ends by converting to the target's
 //! primaries, gamut mapping into the *target* gamut, and encoding. Tone curves and grain operate on
 //! sRGB-curve-encoded values of the target primaries (identical to the sRGB path when the target is
 //! sRGB); afterwards the values are re-encoded with the target's own curve.
 
-use lightcraft_color::{ADOBE_RGB, DISPLAY_P3, PROPHOTO, REC2020, RgbSpace, SRGB};
+use lightcraft_color::{ADOBE_RGB, DISPLAY_P3, Mat3, PROPHOTO, REC2020, RgbSpace, SRGB};
 use serde::{Deserialize, Serialize};
 
 /// The RGB space an image is rendered into.
@@ -138,6 +139,48 @@ impl OutputSpace {
     }
 }
 
+/// A monitor's RGB as a preview target (from its ICC display profile): previews render into the
+/// display's own primaries, gamut mapped into the display's gamut, encoded with the sRGB curve.
+/// The frontend then takes that encoding to the display's real device values
+/// (`lightcraft_codecs::display`). Exports never use it.
+#[derive(Clone, Copy, Debug)]
+pub struct DisplaySpace {
+    /// Linear Rec.2020 → linear display RGB, and back.
+    pub from_working: [[f32; 3]; 3],
+    pub to_working: [[f32; 3]; 3],
+    /// Luminance weights of the display's linear RGB (gamut mapping).
+    pub luma: [f32; 3],
+    /// Identifies the display profile (part of render keys).
+    pub id: u64,
+}
+
+impl DisplaySpace {
+    /// From the display's linear RGB → linear Rec.2020 matrix (display white → (1, 1, 1)).
+    /// `None` for a singular or non-finite matrix.
+    pub fn new(to_working: Mat3, id: u64) -> Option<DisplaySpace> {
+        let from = to_working.inverse()?;
+        let luma = REC2020.to_xyz().mul(&to_working).0[1];
+        let all = to_working.0.iter().chain(from.0.iter()).flatten().chain(luma.iter());
+        if all.clone().any(|v| !v.is_finite()) || (luma.iter().sum::<f64>() - 1.0).abs() > 1e-3 {
+            return None;
+        }
+        Some(DisplaySpace { from_working: from.to_f32(), to_working: to_working.to_f32(), luma: luma.map(|v| v as f32), id })
+    }
+
+    /// A display that is exactly `space`'s primaries (tests, and the sRGB identity).
+    pub fn of(space: OutputSpace, id: u64) -> Option<DisplaySpace> {
+        DisplaySpace::new(space.rgb_space().to_space(&REC2020), id)
+    }
+}
+
+impl PartialEq for DisplaySpace {
+    fn eq(&self, o: &Self) -> bool {
+        self.id == o.id
+    }
+}
+
+impl Eq for DisplaySpace {}
+
 /// Soft proofing: render as if the result were converted to `space` (colours outside its gamut
 /// are mapped into it, then shown in the render's own space), optionally painting what the
 /// destination can't hold (`dest_warning`, red) and what the display can't show
@@ -179,6 +222,17 @@ impl Proof {
             display_warning: self.display_warning,
         }
     }
+
+    /// [`Self::params`] for a render into a display's primaries: the display warning then shows
+    /// what *this* display can't show.
+    pub fn params_display(self, d: &DisplaySpace) -> ProofParams {
+        let proof_to_working = self.space.rgb_space().to_space(&REC2020).to_f32();
+        ProofParams { proof_to_out: mul33(&d.from_working, &proof_to_working), ..self.params(OutputSpace::Srgb) }
+    }
+}
+
+fn mul33(a: &[[f32; 3]; 3], b: &[[f32; 3]; 3]) -> [[f32; 3]; 3] {
+    std::array::from_fn(|i| std::array::from_fn(|j| (0..3).map(|k| a[i][k] * b[k][j]).sum()))
 }
 
 /// Sample format of a render.
@@ -192,6 +246,9 @@ pub enum OutputDepth {
     U16,
     /// 32-bit float *linear* RGB (target primaries, 0..1) in [`crate::Rendered::deep`].
     F32Linear,
+    /// 32-bit float linear RGB (target primaries) of the HDR render: SDR white = 1, highlights up
+    /// to [`lightcraft_develop::Hdr::peak`]. With HDR off this is [`OutputDepth::F32Linear`].
+    F32Hdr,
 }
 
 /// High-bit-depth RGB samples (3 per pixel, interleaved, row-major).
diff --git a/crates/pipeline/src/tests.rs b/crates/pipeline/src/tests.rs
index f572b21d..185d96b3 100644
--- a/crates/pipeline/src/tests.rs
+++ b/crates/pipeline/src/tests.rs
@@ -360,6 +360,46 @@ fn soft_proof_maps_into_the_proof_gamut_and_flags_what_does_not_fit() {
     assert!(red(&pro) < n, "ProPhoto holds more than sRGB");
 }
 
+/// A preview for a monitor with a display profile renders into the display's primaries: for a
+/// display that *is* a standard space, exactly what an 8-bit render into that space gives.
+#[test]
+fn display_space_renders_like_the_matching_output_space() {
+    use crate::{DisplaySpace, OutputSpace, Proof};
+    let src = scene();
+    let mut s = DevelopSettings::default();
+    s.color.saturation = 100.0;
+    s.color.vibrance = 100.0;
+    let info = SourceInfo { raw: true, ..Default::default() };
+    let req = |space, display, proof| RenderRequest { space, display, proof, ..RenderRequest::fit(120, 120) };
+    for space in [OutputSpace::Srgb, OutputSpace::DisplayP3] {
+        let d = DisplaySpace::of(space, 7).unwrap();
+        let want = render(&src, &info, &s, &req(space, None, None)).image;
+        let got = render(&src, &info, &s, &req(OutputSpace::Srgb, Some(d), None)).image;
+        assert!(max_diff(&got, &want) <= 1, "{space:?}: {}", max_diff(&got, &want));
+    }
+    // a wide display shows the saturated colours sRGB clips
+    let srgb = render(&src, &info, &s, &req(OutputSpace::Srgb, None, None)).image;
+    let p3 = render(&src, &info, &s, &req(OutputSpace::Srgb, Some(DisplaySpace::of(OutputSpace::DisplayP3, 1).unwrap()), None)).image;
+    assert!(max_diff(&srgb, &p3) > 4);
+
+    // soft proofing on a display: the display gamut warning is about *this* display
+    let blue = |img: &lightcraft_raster::Rgba8| img.data.iter().filter(|p| p[2] == 255 && p[0] == 0 && p[1] < 80).count();
+    let pro = Some(Proof { space: OutputSpace::ProPhoto, dest_warning: false, display_warning: true });
+    let on_srgb = blue(&render(&src, &info, &s, &req(OutputSpace::Srgb, Some(DisplaySpace::of(OutputSpace::Srgb, 2).unwrap()), pro)).image);
+    let on_wide = blue(&render(&src, &info, &s, &req(OutputSpace::Srgb, Some(DisplaySpace::of(OutputSpace::Rec2020, 3).unwrap()), pro)).image);
+    assert!(on_srgb > 0 && on_wide < on_srgb, "{on_srgb} {on_wide}");
+    let plain = blue(&render(&src, &info, &s, &req(OutputSpace::Srgb, None, pro)).image);
+    assert_eq!(plain, on_srgb, "an sRGB display warns like no display profile");
+}
+
+#[test]
+fn display_space_rejects_degenerate_matrices() {
+    use crate::DisplaySpace;
+    assert!(DisplaySpace::new(lightcraft_color::Mat3([[1.0, 1.0, 0.0], [1.0, 1.0, 0.0], [0.0, 0.0, 1.0]]), 1).is_none());
+    assert!(DisplaySpace::new(lightcraft_color::Mat3([[f64::NAN, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]]), 1).is_none());
+    assert!(DisplaySpace::new(lightcraft_color::Mat3::IDENTITY, 1).is_some());
+}
+
 #[test]
 fn tint_negative_is_green_and_positive_is_magenta() {
     use lightcraft_develop::WbMode;
@@ -435,3 +475,49 @@ fn custom_white_balance_redevelops_in_camera_space() {
     s.wb.mode = WbMode::AsShot;
     assert!(wb_matrix_for(&info, &s).is_none());
 }
+
+/// Every stored process number renders with a process this build knows: settings saved before
+/// process versions existed exactly as V1, and a number from a newer LightCraft exactly as the
+/// latest process here (`docs/process-versions.md`). Raw (base tone curve), camera-tone and
+/// rendered sources, plain and edited, 8-bit and 16-bit.
+#[test]
+fn stored_process_numbers_render_with_a_known_process() {
+    use lightcraft_develop::{Process, ProcessVersion};
+    let src = scene();
+    let curve = crate::tone::CameraTone::new(std::array::from_fn(|i| {
+        let x = 0.004 * 1.18f32.powi(i as i32);
+        [x, 1.0 - (-2.0 * x).exp()]
+    }))
+    .unwrap();
+    let infos = [
+        SourceInfo::default(),
+        SourceInfo { raw: true, as_shot_temp: 5200.0, as_shot_tint: 4.0, ..Default::default() },
+        SourceInfo { raw: true, relative_wb: true, camera_tone: Some(curve), ..Default::default() },
+    ];
+    let mut edited = DevelopSettings::for_raw(5200.0, 4.0);
+    for (id, v) in [("light.exposure", 0.4), ("light.contrast", 30.0), ("light.highlights", -60.0), ("light.whites", 15.0), ("light.blacks", -20.0)] {
+        controls::set(&mut edited, id, v);
+    }
+    let legacy = |s: &DevelopSettings| {
+        let mut v = s.to_json();
+        v.as_object_mut().unwrap().remove("process");
+        DevelopSettings::from_json(&v).unwrap()
+    };
+    let with = |s: &DevelopSettings, p: ProcessVersion| DevelopSettings { process: p, ..s.clone() };
+    let deep = RenderRequest { depth: crate::OutputDepth::U16, ..RenderRequest::fit(96, 96) };
+    for info in &infos {
+        for s in [DevelopSettings::default(), edited.clone()] {
+            for req in [RenderRequest::fit(96, 96), deep] {
+                let out = |s: &DevelopSettings| {
+                    let r = render(&src, info, s, &req);
+                    (r.image.data, r.deep)
+                };
+                let v1 = out(&with(&s, ProcessVersion::V1));
+                assert_eq!(legacy(&s).process, ProcessVersion::V1);
+                assert!(out(&legacy(&s)) == v1, "saved before process versions: rendered as V1");
+                let latest = out(&with(&s, Process::LATEST.version()));
+                assert!(out(&with(&s, ProcessVersion(Process::LATEST.version().0 + 7))) == latest, "newer than this build: as the latest");
+            }
+        }
+    }
+}
diff --git a/crates/pipeline/src/tests_hdr.rs b/crates/pipeline/src/tests_hdr.rs
new file mode 100644
index 00000000..bacc0eaa
--- /dev/null
+++ b/crates/pipeline/src/tests_hdr.rs
@@ -0,0 +1,107 @@
+//! HDR editing: the HDR render ([`OutputDepth::F32Hdr`]) and the SDR rendition every other render uses.
+
+use lightcraft_develop::DevelopSettings;
+use lightcraft_raster::Rgb32f;
+
+use crate::{DeepSamples, OutputDepth, RenderRequest, SourceInfo, render};
+
+fn sunset() -> Rgb32f {
+    let lib = lightcraft_scenes::demo_library();
+    let s = lib.iter().find(|s| s.kind == lightcraft_scenes::Kind::OceanSunset).map(|s| s.render(240, 160));
+    s.unwrap_or_else(|| lib[0].render(240, 160))
+}
+
+fn raw() -> SourceInfo {
+    SourceInfo { raw: true, ..Default::default() }
+}
+
+fn hdr_on(max_ev: f64) -> DevelopSettings {
+    let mut s = DevelopSettings::default();
+    s.hdr.enabled = true;
+    s.hdr.max_ev = max_ev;
+    s
+}
+
+fn deep(src: &Rgb32f, s: &DevelopSettings, depth: OutputDepth) -> Vec<f32> {
+    let req = RenderRequest { depth, ..RenderRequest::fit(240, 240) };
+    match render(src, &raw(), s, &req).deep.map(|d| d.samples) {
+        Some(DeepSamples::F32(v)) => v,
+        other => panic!("expected float samples, got {other:?}"),
+    }
+}
+
+#[test]
+fn hdr_render_keeps_highlights_up_to_the_peak() {
+    let src = sunset();
+    let v = deep(&src, &hdr_on(3.0), OutputDepth::F32Hdr);
+    assert!(v.iter().all(|x| x.is_finite() && (0.0..=8.0 + 1e-4).contains(x)));
+    let max = v.iter().copied().fold(0.0f32, f32::max);
+    assert!(max > 1.5, "the sun should rise above SDR white, max {max}");
+    // a smaller headroom limit caps lower
+    let v1 = deep(&src, &hdr_on(1.0), OutputDepth::F32Hdr);
+    assert!(v1.iter().all(|x| *x <= 2.0 + 1e-4));
+}
+
+#[test]
+fn hdr_midtones_match_the_sdr_render() {
+    let src = sunset();
+    let hdr = deep(&src, &hdr_on(3.0), OutputDepth::F32Hdr);
+    let sdr = deep(&src, &DevelopSettings::default(), OutputDepth::F32Linear);
+    // pixels whose brightest channel is a midtone (bright saturated colours legitimately differ:
+    // SDR desaturates them at white, HDR keeps their colour)
+    let mut n = 0;
+    for (h, s) in hdr.as_chunks::<3>().0.iter().zip(sdr.as_chunks::<3>().0) {
+        if s.iter().all(|v| *v < 0.15) {
+            for (a, b) in h.iter().zip(s) {
+                assert!((a - b).abs() < 2e-3, "{h:?} vs {s:?}");
+            }
+            n += 1;
+        }
+    }
+    assert!(n > 100, "the scene should have midtones and shadows ({n})");
+}
+
+#[test]
+fn f32hdr_without_hdr_is_the_sdr_float_render() {
+    let src = sunset();
+    let s = DevelopSettings::default();
+    assert_eq!(deep(&src, &s, OutputDepth::F32Hdr), deep(&src, &s, OutputDepth::F32Linear));
+}
+
+#[test]
+fn sdr_renders_of_an_hdr_edit_use_the_sdr_rendition() {
+    let src = sunset();
+    let req = RenderRequest::fit(240, 240);
+    // neutral offsets: identical to the edit with HDR off
+    let plain = render(&src, &raw(), &DevelopSettings::default(), &req);
+    let on = render(&src, &raw(), &hdr_on(3.0), &req);
+    assert_eq!(plain.image.data, on.image.data);
+    // offsets apply to every SDR render
+    let mut s = hdr_on(3.0);
+    s.hdr.sdr_brightness = 50.0;
+    s.hdr.sdr_highlights = -40.0;
+    let brighter = render(&src, &raw(), &s, &req);
+    let expect = render(&src, &raw(), &s.sdr_rendition(), &req);
+    assert_eq!(brighter.image.data, expect.image.data);
+    assert_ne!(brighter.image.data, plain.image.data);
+    let r = s.sdr_rendition();
+    assert!(!r.hdr.enabled && (r.light.exposure - 0.5).abs() < 1e-9 && r.light.highlights == -40.0);
+}
+
+#[test]
+fn visualize_hdr_paints_only_what_rises_above_white() {
+    use crate::Overlay;
+    use crate::visualize::HDR_BANDS;
+    let src = sunset();
+    let req = RenderRequest { overlay: Overlay::HdrRange, ..RenderRequest::fit(240, 240) };
+    let banded = |p: &[u8; 4]| HDR_BANDS.iter().any(|b| (0..3).all(|k| (p[k] as i32 - b[k] as i32).abs() < 70) && p[0] > p[2] + 40);
+    let on = render(&src, &raw(), &hdr_on(3.0), &req);
+    let n = on.image.data.iter().filter(|p| banded(p)).count();
+    assert!(n > 0 && n < on.image.data.len() / 3, "{n} banded pixels");
+    // the rest is grey
+    assert!(on.image.data.iter().filter(|p| !banded(p)).all(|p| p[0] == p[1] && p[1] == p[2]));
+    // HDR off: the overlay draws nothing
+    let off = render(&src, &raw(), &DevelopSettings::default(), &req);
+    let plain = render(&src, &raw(), &DevelopSettings::default(), &RenderRequest::fit(240, 240));
+    assert_eq!(off.image.data, plain.image.data);
+}
diff --git a/crates/pipeline/src/tone.rs b/crates/pipeline/src/tone.rs
index 1a1fcc20..f9602e99 100644
--- a/crates/pipeline/src/tone.rs
+++ b/crates/pipeline/src/tone.rs
@@ -67,6 +67,11 @@ impl CameraTone {
         &self.chroma
     }
 
+    /// The (scene, display) luminance knots, in increasing order.
+    pub fn knots(&self) -> &[[f32; 2]; 32] {
+        &self.knots
+    }
+
     pub fn apply(&self, y: f32) -> f32 {
         if !y.is_finite() || y <= 0.0 {
             return 0.0;
@@ -87,6 +92,9 @@ impl CameraTone {
     }
 }
 
+/// Scene EV over grey where [`ToneMap::hdr`] starts lifting highlights above the SDR curve.
+const HDR_FROM_EV: f32 = 1.5;
+
 #[derive(Clone, Debug)]
 pub struct ToneMap {
     lut: Vec<f32>,
@@ -108,6 +116,16 @@ impl ToneMap {
     }
     /// `contrast`, `whites`, `blacks` in −100..100 (Lightroom slider units).
     pub fn new(contrast: f64, whites: f64, blacks: f64) -> ToneMap {
+        ToneMap::hdr(contrast, whites, blacks, 1.0)
+    }
+
+    /// [`ToneMap::new`] for an HDR render reaching `peak` (linear, SDR white = 1; 1 = SDR exactly).
+    /// Below about half of SDR white the curve is the SDR one; above, the highlights gain up to
+    /// `peak − 1` more along a smoothstep in scene EV, from 1.5 EV over grey to one stop past the
+    /// white point moved up by the headroom, so the result stays monotone, never exceeds `peak`,
+    /// and reaches it there (within the table's range).
+    pub fn hdr(contrast: f64, whites: f64, blacks: f64, peak: f32) -> ToneMap {
+        let peak = if peak.is_finite() { peak.max(1.0) } else { 1.0 };
         let c = (contrast / 100.0) as f32;
         let slope = if c >= 0.0 { 1.0 + 0.55 * c } else { 1.0 + 0.4 * c };
         // White point: scene luminance (after contrast) that maps to display 1.0.
@@ -133,7 +151,11 @@ impl ToneMap {
                     let k = b * 0.03;
                     o = k + (1.0 - k) * o;
                 }
-                o.clamp(0.0, 1.0)
+                if peak > 1.0 {
+                    let top = (white_ev + peak.log2() + 1.0).max(HDR_FROM_EV + 0.5);
+                    o += (peak - 1.0) * smooth(HDR_FROM_EV, top, ev * slope);
+                }
+                o.clamp(0.0, peak)
             })
             .collect();
         ToneMap { lut, chroma: NO_CHROMA }
@@ -141,6 +163,14 @@ impl ToneMap {
 
     /// Tone map for display-referred sources: identity at neutral settings.
     pub fn display(contrast: f64, whites: f64, blacks: f64) -> ToneMap {
+        ToneMap::display_hdr(contrast, whites, blacks, 1.0)
+    }
+
+    /// [`ToneMap::display`] for an HDR render reaching `peak`: values above SDR white (an HDR
+    /// source, e.g. a decoded gain-map image) pass through and roll off softly towards `peak`
+    /// instead of clipping at 1; SDR sources (≤ 1) render as with [`ToneMap::display`].
+    pub fn display_hdr(contrast: f64, whites: f64, blacks: f64, peak: f32) -> ToneMap {
+        let peak = if peak.is_finite() { peak.max(1.0) } else { 1.0 };
         let c = (contrast / 100.0) as f32;
         let w = (whites / 100.0) as f32;
         let b = (blacks / 100.0) as f32;
@@ -163,11 +193,15 @@ impl ToneMap {
                 }
                 let mut o = p.max(0.0).powf(2.2);
                 // short shoulder: slope 1 at 0.95, reaching 1.0 at 1.05
-                if o > 0.95 {
+                if peak > 1.0 && o > 0.95 {
+                    // exponential shoulder: slope 1 at 0.95, asymptote at `peak`
+                    let r = peak - 0.95;
+                    o = 0.95 + r * (1.0 - (-(o - 0.95) / r).exp());
+                } else if o > 0.95 {
                     let d = (o - 0.95).min(0.1);
                     o = 0.95 + d - d * d / 0.2;
                 }
-                o.clamp(0.0, 1.0)
+                o.clamp(0.0, peak)
             })
             .collect();
         ToneMap { lut, chroma: NO_CHROMA }
@@ -291,6 +325,51 @@ mod tests {
         }
     }
 
+    #[test]
+    fn hdr_is_sdr_at_peak_one_and_reaches_peak() {
+        for (c, w, b) in [(0.0, 0.0, 0.0), (100.0, 100.0, -100.0), (-100.0, -100.0, 100.0), (50.0, -30.0, -40.0)] {
+            assert_eq!(ToneMap::hdr(c, w, b, 1.0).lut(), ToneMap::new(c, w, b).lut());
+            for peak in [2.0f32, 8.0, 32.0] {
+                let sdr = ToneMap::new(c, w, b);
+                let t = ToneMap::hdr(c, w, b, peak);
+                let mut prev = -1.0;
+                for i in 0..2400 {
+                    let y = 1e-5 * 1.01f32.powi(i);
+                    let o = t.apply(y);
+                    assert!((0.0..=peak).contains(&o), "{c} {w} {b} {peak} at {y}: {o}");
+                    assert!(o >= prev - 1e-6, "{c} {w} {b} {peak} at {y}: {o} < {prev}");
+                    prev = o;
+                    if y <= GREY * 2f32.powf(0.9) {
+                        assert!((o - sdr.apply(y)).abs() < 1e-6, "midtones differ at {y}");
+                    }
+                }
+                assert!(t.apply(4.0) > sdr.apply(4.0));
+                if (c, w, b) == (0.0, 0.0, 0.0) {
+                    assert!(t.apply(GREY * 2f32.powf(LUT_MAX_EV)) > peak * 0.99, "{peak}");
+                }
+            }
+        }
+        // a broken peak falls back to SDR
+        assert_eq!(ToneMap::hdr(0.0, 0.0, 0.0, f32::NAN).lut(), ToneMap::new(0.0, 0.0, 0.0).lut());
+    }
+
+    #[test]
+    fn display_hdr_passes_hdr_sources_and_keeps_sdr() {
+        assert_eq!(ToneMap::display_hdr(20.0, 10.0, -5.0, 1.0).lut(), ToneMap::display(20.0, 10.0, -5.0).lut());
+        let t = ToneMap::display_hdr(0.0, 0.0, 0.0, 8.0);
+        for i in 1..=90 {
+            let y = i as f32 / 100.0;
+            assert!((t.apply(y) - y).abs() < 2e-3, "{y} -> {}", t.apply(y));
+        }
+        let mut prev = 0.0;
+        for i in 1..2000 {
+            let o = t.apply(i as f32 / 100.0);
+            assert!(o >= prev - 1e-6 && o <= 8.0);
+            prev = o;
+        }
+        assert!(t.apply(3.0) > 2.0 && t.apply(3.0) < 3.0);
+    }
+
     #[test]
     fn display_identity_and_monotone() {
         let t = ToneMap::display(0.0, 0.0, 0.0);
diff --git a/crates/pipeline/src/visualize.rs b/crates/pipeline/src/visualize.rs
index 99e45449..fc3d8390 100644
--- a/crates/pipeline/src/visualize.rs
+++ b/crates/pipeline/src/visualize.rs
@@ -33,8 +33,14 @@ pub enum Overlay {
     /// The evaluated alpha of mask `id` (a [`lightcraft_develop::Mask`] id), drawn as `view` in
     /// `color` at `opacity` (0..100; the colour views only).
     Mask { id: u16, view: MaskView, color: [u8; 3], opacity: u8 },
+    /// Visualize HDR (photos edited in HDR): the SDR image dimmed to grey, with every pixel the HDR
+    /// rendition puts above SDR white painted by how far above it is ([`HDR_BANDS`]).
+    HdrRange,
 }
 
+/// [`Overlay::HdrRange`] colours (sRGB) for 0–1, 1–2, 2–3 and ≥ 3 stops above SDR white.
+pub const HDR_BANDS: [[u8; 3]; 4] = [[255, 214, 92], [255, 150, 40], [235, 64, 52], [214, 60, 210]];
+
 /// How [`Overlay::Mask`] draws the mask.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub enum MaskView {
@@ -114,6 +120,7 @@ impl Overlay {
             Overlay::PointColorRange(i) => (1, i as f64),
             Overlay::Spots(t) => (2, t as f64),
             Overlay::Mask { id, view, color, opacity } => (3, pack_mask(id, view, color, opacity) as f64),
+            Overlay::HdrRange => (4, 0.0),
         }
     }
 
@@ -123,6 +130,7 @@ impl Overlay {
             1 => Overlay::PointColorRange(v as u8),
             2 => Overlay::Spots(v.clamp(0.0, 100.0) as u8),
             3 if v.is_finite() && v >= 0.0 => unpack_mask(v as u64),
+            4 => Overlay::HdrRange,
             _ => Overlay::None,
         }
     }
@@ -134,6 +142,7 @@ impl Overlay {
             Overlay::PointColorRange(i) => 0x1000 + i as u64,
             Overlay::Spots(t) => 0x2000 + t as u64,
             Overlay::Mask { id, view, color, opacity } => 3 << 60 | pack_mask(id, view, color, opacity),
+            Overlay::HdrRange => 0x4000,
         }
     }
 
@@ -162,7 +171,8 @@ pub fn adjust_settings(o: Overlay, s: &mut Cow<'_, DevelopSettings>) {
 /// an [`Overlay::Mask`] shows, at the image's size (see [`Overlay::mask`]).
 pub fn apply(img: &mut Rgba8, o: Overlay, plan: &Plan<'_>, mask: Option<&Plane>) {
     match o {
-        Overlay::None => {}
+        // drawn by the renderer from the HDR rendition ([`hdr_range`])
+        Overlay::None | Overlay::HdrRange => {}
         Overlay::PointColorRange(i) => {
             if let Some(p) = plan.settings.point_colors.get(i as usize) {
                 point_color_range(img, &PointK::new(p));
@@ -245,6 +255,34 @@ fn point_color_range(img: &mut Rgba8, k: &PointK) {
     });
 }
 
+/// Draw [`Overlay::HdrRange`] on `img` (the SDR render) from `hdr` (the HDR render of the same
+/// request, float linear with luminance weights `luma`): grey below SDR white, band colours above.
+pub fn hdr_range(img: &mut Rgba8, hdr: &crate::DeepImage, luma: [f32; 3]) {
+    let crate::DeepSamples::F32(v) = &hdr.samples else { return };
+    if (hdr.width, hdr.height) != (img.width, img.height) {
+        return;
+    }
+    let w = img.width;
+    for_rows(&mut img.data, w, |y, row| {
+        for (x, p) in row.iter_mut().enumerate() {
+            let i = (y * w + x) * 3;
+            let Some(c) = v.get(i..i + 3) else { continue };
+            let lum = luma[0] * c[0] + luma[1] * c[1] + luma[2] * c[2];
+            let grey = (0.2126 * p[0] as f32 + 0.7152 * p[1] as f32 + 0.0722 * p[2] as f32) * 0.55;
+            if lum > 1.0 {
+                let stops = lum.log2();
+                let band = HDR_BANDS[(stops as usize).min(HDR_BANDS.len() - 1)];
+                for k in 0..3 {
+                    p[k] = (grey * 0.25 + band[k] as f32 * 0.75).round().clamp(0.0, 255.0) as u8;
+                }
+            } else {
+                let g = grey.round().clamp(0.0, 255.0) as u8;
+                (p[0], p[1], p[2]) = (g, g, g);
+            }
+        }
+    });
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/preview/src/pool.rs b/crates/preview/src/pool.rs
index a0ea185f..4dbd3566 100644
--- a/crates/preview/src/pool.rs
+++ b/crates/preview/src/pool.rs
@@ -7,11 +7,16 @@
 //!
 //! Native: a fixed set of worker threads, started on first use. wasm32 (no threads): the host
 //! calls [`JobPool::run_inline`] once per frame.
+//!
+//! No worker outlives its pool by more than a deadline (issue #620: a render still inside the GPU
+//! driver while the process exits crashes there): [`JobPool::shutdown`] and dropping the pool
+//! discard the queued jobs and wait, bounded, for the running ones.
 
 use std::hash::Hash;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::mpsc::{Receiver, Sender, channel};
 use std::sync::{Arc, Condvar, Mutex};
+use std::time::Duration;
 
 pub type Job<R> = Box<dyn FnOnce() -> R + Send>;
 
@@ -27,8 +32,16 @@ struct Shared<S, R> {
     queue: Mutex<Vec<Entry<S, R>>>,
     cv: Condvar,
     shutdown: AtomicBool,
+    /// The worker threads that have not ended yet, and the signal that one did.
+    #[cfg(not(target_arch = "wasm32"))]
+    live: Mutex<Vec<std::thread::ThreadId>>,
+    #[cfg(not(target_arch = "wasm32"))]
+    ended: Condvar,
 }
 
+/// How long dropping a pool waits for the jobs still running (see [`JobPool::shutdown`]).
+const DROP_WAIT: Duration = Duration::from_secs(2);
+
 /// A finished job.
 pub struct Done<S, R> {
     pub slot: S,
@@ -47,6 +60,10 @@ pub struct JobPool<S, R> {
     threads: usize,
     started: bool,
     seq: u64,
+    #[cfg(not(target_arch = "wasm32"))]
+    workers: Vec<std::thread::JoinHandle<()>>,
+    /// [`JobPool::shutdown`] ran: dropping the pool doesn't wait a second time.
+    stopped: bool,
 }
 
 impl<S: Copy + Eq + Hash + Send + 'static, R: Send + 'static> JobPool<S, R> {
@@ -54,12 +71,23 @@ impl<S: Copy + Eq + Hash + Send + 'static, R: Send + 'static> JobPool<S, R> {
     pub fn new(threads: usize) -> Self {
         let (tx, rx) = channel();
         JobPool {
-            shared: Arc::new(Shared { queue: Mutex::new(Vec::new()), cv: Condvar::new(), shutdown: AtomicBool::new(false) }),
+            shared: Arc::new(Shared {
+                queue: Mutex::new(Vec::new()),
+                cv: Condvar::new(),
+                shutdown: AtomicBool::new(false),
+                #[cfg(not(target_arch = "wasm32"))]
+                live: Mutex::new(Vec::new()),
+                #[cfg(not(target_arch = "wasm32"))]
+                ended: Condvar::new(),
+            }),
             tx,
             rx,
             threads,
             started: false,
             seq: 0,
+            #[cfg(not(target_arch = "wasm32"))]
+            workers: Vec::new(),
+            stopped: false,
         }
     }
 
@@ -81,24 +109,69 @@ impl<S: Copy + Eq + Hash + Send + 'static, R: Send + 'static> JobPool<S, R> {
         }
         self.started = true;
         #[cfg(not(target_arch = "wasm32"))]
-        for i in 0..self.threads {
-            let shared = self.shared.clone();
-            let tx = self.tx.clone();
-            let _ = std::thread::Builder::new().name(format!("lc-job-{i}")).spawn(move || {
-                while let Some(e) = take(&shared, true) {
-                    let t0 = std::time::Instant::now();
-                    let result = (e.job)();
-                    let done = Done { slot: e.slot, key: e.key, result, ms: t0.elapsed().as_secs_f64() * 1000.0 };
-                    if tx.send(done).is_err() {
-                        break;
+        {
+            // held while spawning: a worker that ends at once still finds its id listed
+            let mut live = self.shared.live.lock().unwrap_or_else(|e| e.into_inner());
+            for i in 0..self.threads {
+                let shared = self.shared.clone();
+                let tx = self.tx.clone();
+                let spawned = std::thread::Builder::new().name(format!("lc-job-{i}")).spawn(move || {
+                    let _ended = Ended(&shared);
+                    while let Some(e) = take(&shared, true) {
+                        let t0 = std::time::Instant::now();
+                        let result = (e.job)();
+                        let done = Done { slot: e.slot, key: e.key, result, ms: t0.elapsed().as_secs_f64() * 1000.0 };
+                        if tx.send(done).is_err() {
+                            break;
+                        }
                     }
+                });
+                match spawned {
+                    Ok(h) => {
+                        live.push(h.thread().id());
+                        self.workers.push(h);
+                    }
+                    Err(e) => log::error!("job pool: worker {i} could not start: {e}"),
                 }
-            });
+            }
+        }
+    }
+
+    /// Stop the pool: queued jobs are dropped, no new one starts, and the call waits up to
+    /// `timeout` for the jobs that are running. Returns whether every worker has ended; one that
+    /// hasn't is left to finish on its own. For owners that are about to end the process, where
+    /// dropping the pool may come too late or never (`std::process::exit`).
+    pub fn shutdown(&mut self, timeout: Duration) -> bool {
+        self.stopped = true;
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            stop(&self.shared, &mut self.workers, timeout)
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            let _ = timeout;
+            close(&self.shared);
+            true
+        }
+    }
+
+    /// Worker threads that have not ended (0 before the first job, and on wasm).
+    pub fn live_workers(&self) -> usize {
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            self.shared.live.lock().map(|l| l.len()).unwrap_or(0)
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            0
         }
     }
 
     /// Queue `job` for `slot`, replacing a queued (not yet running) job for the same slot.
     pub fn submit(&mut self, slot: S, key: u64, priority: u32, job: Job<R>) {
+        if self.stopped {
+            return; // nothing runs it any more
+        }
         self.start();
         self.seq += 1;
         let (lock, cv) = (&self.shared.queue, &self.shared.cv);
@@ -172,9 +245,66 @@ fn take<S, R>(shared: &Shared<S, R>, wait: bool) -> Option<Entry<S, R>> {
     }
 }
 
-impl<S, R> Drop for JobPool<S, R> {
+/// Takes a worker off the live list when its thread ends (also when a job panicked).
+#[cfg(not(target_arch = "wasm32"))]
+struct Ended<'a, S, R>(&'a Shared<S, R>);
+
+#[cfg(not(target_arch = "wasm32"))]
+impl<S, R> Drop for Ended<'_, S, R> {
     fn drop(&mut self) {
-        self.shared.shutdown.store(true, Ordering::Relaxed);
-        self.shared.cv.notify_all();
+        let me = std::thread::current().id();
+        self.0.live.lock().unwrap_or_else(|e| e.into_inner()).retain(|id| *id != me);
+        self.0.ended.notify_all();
+    }
+}
+
+/// Tell the workers to stop and take the queued jobs away from them.
+fn close<S, R>(shared: &Shared<S, R>) {
+    // the flag changes under the queue lock: a worker is either before its check or waiting
+    let queued = {
+        let mut q = shared.queue.lock().unwrap_or_else(|e| e.into_inner());
+        shared.shutdown.store(true, Ordering::Relaxed);
+        std::mem::take(&mut *q)
+    };
+    shared.cv.notify_all();
+    drop(queued); // outside the lock: a job may own a lot
+}
+
+/// [`JobPool::shutdown`]: wait up to `timeout` for the workers to end, without holding the queue
+/// lock, and never for the calling thread (a pool dropped by one of its own jobs).
+#[cfg(not(target_arch = "wasm32"))]
+fn stop<S, R>(shared: &Shared<S, R>, workers: &mut Vec<std::thread::JoinHandle<()>>, timeout: Duration) -> bool {
+    close(shared);
+    let me = std::thread::current().id();
+    let t0 = std::time::Instant::now();
+    let mut live = shared.live.lock().unwrap_or_else(|e| e.into_inner());
+    while live.iter().any(|id| *id != me) {
+        let Some(left) = timeout.checked_sub(t0.elapsed()).filter(|d| !d.is_zero()) else { break };
+        live = shared.ended.wait_timeout(live, left).unwrap_or_else(|e| e.into_inner()).0;
+    }
+    let running: Vec<std::thread::ThreadId> = live.iter().copied().filter(|id| *id != me).collect();
+    drop(live);
+    for h in workers.drain(..) {
+        let id = h.thread().id();
+        // a worker off the list is past its last job: joining it only waits for the thread to unwind
+        if id != me && !running.contains(&id) {
+            let _ = h.join();
+        }
+    }
+    if !running.is_empty() {
+        log::warn!("job pool: {} job(s) still running after {timeout:?}; not waiting for them", running.len());
+    }
+    running.is_empty()
+}
+
+impl<S, R> Drop for JobPool<S, R> {
+    fn drop(&mut self) {
+        if self.stopped {
+            return;
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        stop(&self.shared, &mut self.workers, DROP_WAIT);
+        #[cfg(target_arch = "wasm32")]
+        close(&self.shared);
     }
 }
diff --git a/crates/preview/src/tests.rs b/crates/preview/src/tests.rs
index 3d634003..d733ad82 100644
--- a/crates/preview/src/tests.rs
+++ b/crates/preview/src/tests.rs
@@ -201,6 +201,119 @@ fn pool_runs_inline() {
     assert_eq!(p.try_recv().map(|d| d.result), Some(1));
 }
 
+/// A pool with one worker that is inside a job until the returned sender is used or dropped.
+fn pool_with_a_running_job() -> (JobPool<u8, ()>, std::sync::mpsc::Sender<()>) {
+    let mut p: JobPool<u8, ()> = JobPool::new(1);
+    let (started, has_started) = std::sync::mpsc::channel();
+    let (release, released) = std::sync::mpsc::channel::<()>();
+    p.submit(
+        1,
+        0,
+        1,
+        Box::new(move || {
+            let _ = started.send(());
+            let _ = released.recv_timeout(std::time::Duration::from_secs(60));
+        }),
+    );
+    has_started.recv().unwrap();
+    (p, release)
+}
+
+#[test]
+fn pool_drop_waits_for_running_job() {
+    // issue #620: a job that outlives its pool can still be inside the GPU driver when the process exits
+    use std::sync::atomic::{AtomicBool, Ordering};
+    let mut p: JobPool<u8, ()> = JobPool::new(1);
+    let (started, has_started) = std::sync::mpsc::channel();
+    let (finished, queued_ran) = (Arc::new(AtomicBool::new(false)), Arc::new(AtomicBool::new(false)));
+    let f = finished.clone();
+    p.submit(
+        1,
+        0,
+        9,
+        Box::new(move || {
+            let _ = started.send(());
+            std::thread::sleep(std::time::Duration::from_millis(200));
+            f.store(true, Ordering::SeqCst);
+        }),
+    );
+    has_started.recv().unwrap();
+    let q = queued_ran.clone();
+    p.submit(2, 0, 1, Box::new(move || q.store(true, Ordering::SeqCst)));
+    drop(p);
+    assert!(finished.load(Ordering::SeqCst), "drop returned while the job was still running");
+    assert!(!queued_ran.load(Ordering::SeqCst), "a job that had not started is discarded");
+}
+
+#[test]
+fn pool_shutdown_reports_workers_and_drop_does_not_wait_again() {
+    let (mut p, release) = pool_with_a_running_job();
+    assert_eq!(p.live_workers(), 1);
+    let t0 = std::time::Instant::now();
+    assert!(!p.shutdown(std::time::Duration::from_millis(100)), "the job is still running");
+    let waited = t0.elapsed();
+    assert!(waited >= std::time::Duration::from_millis(100) && waited < std::time::Duration::from_secs(30), "{waited:?}");
+    assert_eq!(p.live_workers(), 1);
+    // stopped: nothing new is queued, and the job that ends is noticed
+    p.submit(2, 0, 1, Box::new(|| ()));
+    assert_eq!(p.queued(), 0);
+    drop(release);
+    assert!(p.shutdown(std::time::Duration::from_secs(30)));
+    assert_eq!(p.live_workers(), 0);
+
+    let (mut p, _release) = pool_with_a_running_job();
+    assert!(!p.shutdown(std::time::Duration::ZERO));
+    let t0 = std::time::Instant::now();
+    drop(p);
+    assert!(t0.elapsed() < std::time::Duration::from_secs(1), "dropped after a shutdown: no second wait");
+}
+
+#[test]
+fn pool_drop_is_bounded_when_a_job_never_ends() {
+    // a job blocked on something its owner holds must not hang the owner (it would hang quitting)
+    let (p, _release) = pool_with_a_running_job();
+    let t0 = std::time::Instant::now();
+    drop(p);
+    let waited = t0.elapsed();
+    assert!(waited >= std::time::Duration::from_secs(1) && waited < std::time::Duration::from_secs(30), "{waited:?}");
+}
+
+#[test]
+fn pool_stops_after_a_job_panicked_and_when_dropped_by_its_own_job() {
+    // a worker that unwound is not waited for
+    let mut p: JobPool<u8, ()> = JobPool::new(1);
+    p.submit(1, 0, 1, Box::new(|| panic!("a job panics (expected in this test)")));
+    while p.live_workers() > 0 {
+        std::thread::yield_now();
+    }
+    assert!(p.shutdown(std::time::Duration::from_secs(30)));
+
+    // the last owner of a pool is one of its jobs: the worker must not wait for (or join) itself
+    let slot: Arc<std::sync::Mutex<Option<JobPool<u8, ()>>>> = Arc::new(std::sync::Mutex::new(None));
+    let (dropped, has_dropped) = std::sync::mpsc::channel();
+    let mut p: JobPool<u8, ()> = JobPool::new(1);
+    let s = slot.clone();
+    p.submit(
+        1,
+        0,
+        1,
+        Box::new(move || {
+            let own = loop {
+                if let Some(p) = s.lock().unwrap().take() {
+                    break p;
+                }
+                std::thread::yield_now();
+            };
+            let t0 = std::time::Instant::now();
+            drop(own);
+            let _ = dropped.send(t0.elapsed());
+        }),
+    );
+    *slot.lock().unwrap() = Some(p);
+    let waited = has_dropped.recv_timeout(std::time::Duration::from_secs(30)).unwrap();
+    assert!(waited < std::time::Duration::from_secs(1), "{waited:?}");
+}
+
 #[test]
 fn disk_cache_never_touches_foreign_files() {
     // issue #98: a library opened on a folder that already has a `thumbs/` folder
diff --git a/crates/raw/src/dng.rs b/crates/raw/src/dng.rs
index 63ddf91a..27e30002 100644
--- a/crates/raw/src/dng.rs
+++ b/crates/raw/src/dng.rs
@@ -19,6 +19,76 @@ pub(crate) fn raw_ifd(tiff: &Tiff) -> Option<&Ifd> {
         .max_by_key(|i| i.u64(t::IMAGE_WIDTH).unwrap_or(0).saturating_mul(i.u64(t::IMAGE_LENGTH).unwrap_or(0)))
 }
 
+/// Undo the DNG 1.7 row/column interleave, which reorders the stored raster without changing its
+/// size: with `RowInterleaveFactor = n` the rows are stored as `n` consecutive fields, field `g`
+/// holding rows `g, g+n, g+2n, …` of the image (and likewise for columns).
+///
+/// The tag counts fields, not a divisor of the raster — see [`field_map`] — so a dimension the
+/// factor does not divide is decoded, with the trailing fields short, rather than refused.
+///
+/// Left alone, a file like this decodes as `n × m` scaled-down copies of the scene, one per
+/// field, with the CFA pattern then read across permuted samples — so it is not merely misplaced,
+/// it is the wrong colour as well (`RowInterleaveFactor = ColumnInterleaveFactor = 2` is what DNG
+/// 1.7 JPEG XL files from Adobe's converter carry).
+fn deinterleave(data: &mut RawData, w: usize, h: usize, cpp: usize, rows: usize, cols: usize) -> Result<()> {
+    if rows <= 1 && cols <= 1 {
+        return Ok(());
+    }
+    // The spec sets no bound on the value (it is only "the number of interleaved fields"); this
+    // caps the field table we build and the permutation, and rejects a hostile tag.
+    if !(1..=16).contains(&rows) || !(1..=16).contains(&cols) {
+        return Err(RawError::Unsupported(format!("interleave factors {rows} × {cols}")));
+    }
+    let (map_r, map_c) = (field_map(h, rows), field_map(w, cols));
+    let dest = |r: usize, c: usize| map_r[r] * w + map_c[c];
+    match data {
+        RawData::U16(v) => permute(v, w, h, cpp, dest),
+        RawData::F32(v) => permute(v, w, h, cpp, dest),
+    }
+}
+
+/// The stored-line → image-line map for one axis: a factor of `n` splits `len` lines into `n`
+/// interleaved fields, field `g` holding lines `g, g+n, g+2n, …`. The fields are stored
+/// consecutively, so field `g` starts at stored line `offs[g]` and its `k`-th line is image line
+/// `g + n*k`. Field sizes follow from the round-robin split — field `g` has `ceil((len - g) / n)`
+/// lines — so when `n` does not divide `len` the trailing fields are short, and when `n` exceeds
+/// `len` the trailing fields are empty.
+fn field_map(len: usize, n: usize) -> Vec<usize> {
+    let mut offs = Vec::with_capacity(n + 1);
+    let mut acc = 0usize;
+    for g in 0..=n {
+        offs.push(acc);
+        if g < n && g < len {
+            acc += (len - 1 - g) / n + 1;
+        }
+    }
+    let mut map = vec![0usize; len];
+    for g in 0..n {
+        for (k, i) in (offs[g]..offs[g + 1]).enumerate() {
+            map[i] = g + n * k;
+        }
+    }
+    map
+}
+
+/// Move every `cpp`-sample pixel of `v` from its stored position to `dest(r, c)`, the image
+/// position it belongs at. The permutation is not its own inverse, so it needs a destination.
+fn permute<T: Copy + Default, F: Fn(usize, usize) -> usize>(v: &mut Vec<T>, w: usize, h: usize, cpp: usize, dest: F) -> Result<()> {
+    let n = w.checked_mul(h).and_then(|n| n.checked_mul(cpp)).ok_or_else(|| RawError::Corrupt("image too large".into()))?;
+    if v.len() != n {
+        return Err(RawError::Corrupt("mosaic size does not match the image".into()));
+    }
+    let mut out = vec![T::default(); n];
+    for r in 0..h {
+        for c in 0..w {
+            let (from, to) = ((r * w + c) * cpp, dest(r, c) * cpp);
+            out[to..to + cpp].copy_from_slice(&v[from..from + cpp]);
+        }
+    }
+    *v = out;
+    Ok(())
+}
+
 fn mat3(v: Option<Vec<f64>>) -> Option<Mat3> {
     let v = v?;
     if v.len() != 9 || v.iter().any(|x| !x.is_finite()) {
@@ -89,9 +159,51 @@ fn gain_table_map(ifd0: &Ifd, raw: &Ifd, order: ByteOrder) -> Option<GainTableMa
 }
 
 pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
+    decode_as(bytes, mode, RawFormat::Dng)
+}
+
+/// Whether a TIFF that is not a DNG describes a raw image the way DNG does: a full-resolution CFA IFD
+/// and DNG's own statement of the white balance (`AsShotNeutral`, in IFD0 or the raw IFD), in a coding
+/// [`decode_as`] reads: uncompressed, or lossless JPEG whose scan header the lossless decoder accepts.
+/// Such files (Hasselblad 3FR and FFF) carry no DNG version tag, so they are not DNGs, but nothing else
+/// in them needs a maker-specific reader. Without the white-balance tag nothing in the file says how
+/// to read its colour, and the file stays an undecodable raw.
+pub(crate) fn is_plain_cfa_tiff(tiff: &Tiff, bytes: &[u8]) -> bool {
+    let Some(raw) = raw_ifd(tiff) else { return false };
+    if !raw.contains(t::AS_SHOT_NEUTRAL) && !tiff.ifds.first().is_some_and(|i| i.contains(t::AS_SHOT_NEUTRAL)) {
+        return false;
+    }
+    let Ok(info) = raw.image() else { return false };
+    if info.samples_per_pixel != 1 || !(1..=16).contains(&info.bits()) || info.sample_format == 3 {
+        return false;
+    }
+    match info.compression {
+        t::compression::NONE => true,
+        t::compression::JPEG => info
+            .chunks(bytes.len() as u64)
+            .first()
+            .and_then(|c| lightcraft_tiff::image::chunk_bytes(bytes, c))
+            .is_some_and(|src| crate::ljpeg::frame_info(src).is_ok()),
+        _ => false,
+    }
+}
+
+/// [`decode`] for the TIFF-based raws that follow the DNG layout without being DNGs (`format` says
+/// which). They differ in one respect: when the raw IFD states no `CFAPattern`, the layout is RGGB
+/// anchored at the sensor origin.
+pub(crate) fn decode_as(bytes: &[u8], mode: Mode, format: RawFormat) -> Result<RawImage> {
     let tiff = Tiff::parse(bytes)?;
     let ifd0 = &tiff.ifds[0];
     let raw = raw_ifd(&tiff).ok_or_else(|| RawError::Corrupt("DNG without a raw image IFD".into()))?;
+    // GoPro's GPR: a DNG whose raw data is VC-5 coded, which is not decoded (yet). Named here, before
+    // the generic "TIFF compression 9" of the chunk decoder. Header mode still describes the file
+    // (a GPR has no embedded preview, and a library keeps the photo with this reason shown, as it
+    // does for any file whose pixels fail to decode, rather than refusing to import it).
+    if mode == Mode::Full
+        && let Some(c) = raw.u16(t::COMPRESSION).filter(|&c| c == t::compression::VC5)
+    {
+        return Err(RawError::Unsupported(format!("DNG compression {c} (GoPro VC-5) is not decoded yet")));
+    }
     let info = raw.image()?;
     let (w, h, cpp) = (info.width as usize, info.height as usize, info.samples_per_pixel as usize);
     if !(1..=4).contains(&cpp) {
@@ -100,6 +212,13 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     let mut data = read_image_in(mode, bytes, &info, tiff.order, Packing::Msb)?;
     let bits = info.bits() as u32;
 
+    // DNG 1.7 interleaved storage: the raster is a permutation of the mosaic, so undo it before
+    // anything reads a sample as a pixel.
+    if mode == Mode::Full {
+        let factor = |tag| raw.u16(tag).map(usize::from).unwrap_or(1);
+        deinterleave(&mut data, w, h, cpp, factor(t::ROW_INTERLEAVE_FACTOR), factor(t::COLUMN_INTERLEAVE_FACTOR))?;
+    }
+
     // linearization table (integer data only)
     let mut linearized = false;
     if let (RawData::U16(v), Some(table)) = (&mut data, raw.u64s(t::LINEARIZATION_TABLE).filter(|t| !t.is_empty())) {
@@ -152,7 +271,13 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
             [r, c] if (1..=16).contains(r) && (1..=16).contains(c) => (*r as usize, *c as usize),
             _ => return Err(RawError::Corrupt("bad CFARepeatPatternDim".into())),
         };
-        let pat = raw.bytes(t::CFA_PATTERN_EP).ok_or_else(|| RawError::Corrupt("missing CFAPattern".into()))?;
+        // a TIFF that is not a DNG may leave the layout out: RGGB from the sensor origin
+        let assumed = [0u8, 1, 1, 2];
+        let pat = match raw.bytes(t::CFA_PATTERN_EP) {
+            Some(p) => p,
+            None if format != RawFormat::Dng && (rows, cols) == (2, 2) => &assumed,
+            None => return Err(RawError::Corrupt("missing CFAPattern".into())),
+        };
         if pat.len() != rows * cols {
             return Err(RawError::Corrupt("CFAPattern size mismatch".into()));
         }
@@ -178,7 +303,7 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     metadata.width = Some(crop.width as u32);
     metadata.height = Some(crop.height as u32);
     let img = RawImage {
-        format: RawFormat::Dng,
+        format,
         width: w,
         height: h,
         cpp,
@@ -199,3 +324,107 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     img.validate_for(mode)?;
     Ok(img)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Store `image` the way DNG 1.7 interleaves it: row `r` of the image is written to stored row
+    /// `(r % rows) * (h / rows) + r / rows`, and columns likewise. This is the inverse of
+    /// [`deinterleave`]'s destination map for a raster the factor divides, i.e. what a writer
+    /// produces (the short-trailing-field case is covered by the hand-written fixtures below).
+    fn interleave(image: &[u16], w: usize, h: usize, rows: usize, cols: usize) -> Vec<u16> {
+        let (gh, gw) = (h / rows, w / cols);
+        let mut out = vec![0u16; w * h];
+        for r in 0..h {
+            for c in 0..w {
+                out[((r % rows) * gh + r / rows) * w + (c % cols) * gw + c / cols] = image[r * w + c];
+            }
+        }
+        out
+    }
+
+    fn samples(d: &RawData) -> Vec<u16> {
+        match d {
+            RawData::U16(v) => v.clone(),
+            RawData::F32(_) => Vec::new(),
+        }
+    }
+
+    /// The image `image` laid out in stored order, given the image line each stored row and column
+    /// holds. Written out by hand from the tag's plain reading, so it does not share a formula with
+    /// the code under test.
+    fn store(image: &[u16], w: usize, rows_img: &[usize], cols_img: &[usize]) -> Vec<u16> {
+        let mut out = vec![0u16; image.len()];
+        for (sr, &ir) in rows_img.iter().enumerate() {
+            for (sc, &ic) in cols_img.iter().enumerate() {
+                out[sr * w + sc] = image[ir * w + ic];
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn deinterleaves_an_interleaved_raster() {
+        // 3×3 rather than 2×2 on purpose: the 2×2 permutation is its own inverse, so a 2×2 fixture
+        // would pass even with the direction of the permutation reversed. This is the shape a DNG
+        // 1.7 file caught in the wild carried (JPEG XL, `RowInterleaveFactor`/`ColumnInterleaveFactor`
+        // both 2) — its real-file ground truth is that it renders bit-identical to its
+        // non-interleaved twin.
+        let (w, h, rows, cols) = (12, 9, 3, 3);
+        let image: Vec<u16> = (0..w * h).map(|i| i as u16).collect();
+        let mut data = RawData::U16(interleave(&image, w, h, rows, cols));
+        assert_ne!(samples(&data), image, "the fixture has to actually be permuted");
+        deinterleave(&mut data, w, h, 1, rows, cols).unwrap();
+        assert_eq!(samples(&data), image);
+
+        // 2×2 as well, the shape Adobe's converter writes.
+        let (w2, h2) = (12, 8);
+        let image2: Vec<u16> = (0..w2 * h2).map(|i| i as u16).collect();
+        let mut two = RawData::U16(interleave(&image2, w2, h2, 2, 2));
+        deinterleave(&mut two, w2, h2, 1, 2, 2).unwrap();
+        assert_eq!(samples(&two), image2);
+    }
+
+    #[test]
+    fn deinterleave_pins_the_field_direction() {
+        // Hand-computed ground truth for the tag's plain reading ("field g holds lines g, g+n,
+        // g+2n, …"). The 3×3 test above round-trips against a helper written from the same reading
+        // of the tag, so it fixes consistency but not the direction; and a 2×2 fixture cannot tell
+        // the two directions apart, being its own inverse. These maps are written out literally so
+        // a reversed permutation fails here. 3 row fields of h = 9 start at stored rows 0, 3, 6 and
+        // hold image rows [0,3,6,1,4,7,2,5,8]; 2 column fields of w = 4 give [0,2,1,3].
+        let (w, h) = (4, 9);
+        let image: Vec<u16> = (0..(w * h) as u16).collect();
+        let mut data = RawData::U16(store(&image, w, &[0, 3, 6, 1, 4, 7, 2, 5, 8], &[0, 2, 1, 3]));
+        assert_ne!(samples(&data), image, "the fixture has to actually be permuted");
+        deinterleave(&mut data, w, h, 1, 3, 2).unwrap();
+        assert_eq!(samples(&data), image);
+    }
+
+    #[test]
+    fn deinterleaves_a_raster_the_factor_does_not_divide() {
+        // The spec fixes the number of fields, not that the size is a multiple of it: h = 7 over 3
+        // row fields is 3 + 2 + 2 (the round-robin split), so field 0 starts at stored row 0 holding
+        // image rows 0, 3, 6; field 1 at stored row 3 holding 1, 4; field 2 at stored row 5 holding
+        // 2, 5. Columns: w = 5 over 2 fields is 3 + 2 → image columns [0,2,4,1,3].
+        let (w, h) = (5, 7);
+        let image: Vec<u16> = (0..(w * h) as u16).collect();
+        let mut data = RawData::U16(store(&image, w, &[0, 3, 6, 1, 4, 2, 5], &[0, 2, 4, 1, 3]));
+        assert_ne!(samples(&data), image, "the fixture has to actually be permuted");
+        deinterleave(&mut data, w, h, 1, 3, 2).unwrap();
+        assert_eq!(samples(&data), image);
+    }
+
+    #[test]
+    fn deinterleave_is_a_no_op_at_one_and_refuses_a_hostile_factor() {
+        let image: Vec<u16> = (0..48).collect();
+        let mut plain = RawData::U16(image.clone());
+        deinterleave(&mut plain, 8, 6, 1, 1, 1).unwrap();
+        assert_eq!(samples(&plain), image);
+
+        // A hostile factor is an error, not a scrambled image.
+        let mut hostile = RawData::U16(image);
+        assert!(deinterleave(&mut hostile, 8, 6, 1, 1 << 20, 1).is_err());
+    }
+}
diff --git a/crates/raw/src/gaintable.rs b/crates/raw/src/gaintable.rs
index 750a1c70..cec1d682 100644
--- a/crates/raw/src/gaintable.rs
+++ b/crates/raw/src/gaintable.rs
@@ -1,8 +1,20 @@
 //! DNG `ProfileGainTableMap` (tag 52525, DNG 1.6) and `ProfileGainTableMap2` (tag 52544, DNG 1.7):
 //! a coarse grid of 1D gain tables carrying the maker's local tone mapping. Apple ProRAW has one.
 //!
-//! We read and write the tag (a DNG export keeps it) but don't render it: Lightroom Classic
-//! renders Apple ProRAW without the map (see [`crate::profile`]), and so do we.
+//! We read and write the tag (a DNG export keeps it) but don't render it by default: Lightroom
+//! Classic renders Apple ProRAW without the map (see [`crate::profile`]), and so do we. The photo's
+//! "camera local tone mapping" option renders it ([`GainTableMap::gain`], applied by the pipeline),
+//! as the camera itself does.
+//!
+//! Applying it (DNG 1.7.1, `ProfileGainTableMap` → "Description"):
+//!
+//! - the four tables around a position are interpolated bilinearly; outside the grid the edge
+//!   tables are replicated. Positions are relative to the active area at pixel centres;
+//! - the table input `clamp((R, G, B, min, max) · weights, 0, 1) ^ gamma` is computed in linear
+//!   RIMM (ProPhoto) after the baseline exposure;
+//! - the gain is the table looked up linearly at `input × MapPointsN` ("multiply the table input
+//!   value by MapPointsN to compute the floating-point table index"), clamped to the last point,
+//!   and multiplies R, G and B. Results may exceed 1 and aren't clipped.
 //!
 //! - The grid has `MapPointsV × MapPointsH` tables of `MapPointsN` gains. Its origin and spacing
 //!   are relative to the active area (1.0 = the active area's height or width).
@@ -153,6 +165,135 @@ impl GainTableMap {
     }
 }
 
+/// Applying the map (see the module docs). Index arithmetic saturates and every lookup is
+/// checked: the fields are public and the struct is deserializable, so a hand-built or damaged map
+/// must not overflow or panic, whatever it holds.
+impl GainTableMap {
+    /// The gain at relative active-area position (`x`, `y`) for `p`, a linear ProPhoto (RIMM)
+    /// colour after the baseline exposure. 1.0 for a map that can't be evaluated. For many pixels,
+    /// [`Self::evaluator`] once and [`GainEval::gain`] per pixel.
+    pub fn gain(&self, p: [f32; 3], x: f64, y: f64) -> f32 {
+        self.evaluator().map_or(1.0, |e| e.gain(p, x, y))
+    }
+
+    /// The map ready to evaluate per pixel, or `None` when it can't be (inconsistent sizes).
+    pub fn evaluator(&self) -> Option<GainEval<'_>> {
+        let n = self.points_n;
+        let tables = self.points_v.saturating_mul(self.points_h);
+        if n == 0 || tables == 0 || tables.saturating_mul(n) != self.gains.len() {
+            return None;
+        }
+        let axis = |points: usize, origin: f64, spacing: f64| Axis {
+            last: points.saturating_sub(1),
+            origin,
+            // (a degenerate axis replicates its first table)
+            inv: if points > 1 && spacing.is_finite() && spacing > 0.0 { 1.0 / spacing } else { 0.0 },
+        };
+        Some(GainEval { map: self, v: axis(self.points_v, self.origin_v, self.spacing_v), h: axis(self.points_h, self.origin_h, self.spacing_h) })
+    }
+}
+
+/// One grid axis, prepared: last table index, origin and inverse spacing (0: one table).
+#[derive(Clone, Copy, Debug)]
+struct Axis {
+    last: usize,
+    origin: f64,
+    inv: f64,
+}
+
+impl Axis {
+    /// The cell at relative position `pos`: (first table, second table, weight of the second).
+    /// Outside the grid the edge table is replicated.
+    #[inline]
+    fn cell(self, pos: f64) -> (usize, usize, f32) {
+        if self.last == 0 || self.inv == 0.0 {
+            return (0, 0, 0.0);
+        }
+        let f = (pos - self.origin) * self.inv;
+        let f = if f.is_nan() { 0.0 } else { f.clamp(0.0, self.last as f64) };
+        // (≥ 0: `as` truncates like `floor`, which isn't inlined on baseline x86-64)
+        let i0 = (f as usize).min(self.last);
+        let i1 = i0.saturating_add(1).min(self.last);
+        (i0, i1, (f - i0 as f64) as f32)
+    }
+}
+
+/// Grid cell along one axis (see [`Axis::cell`]).
+#[cfg(test)]
+fn cell(pos: f64, origin: f64, spacing: f64, points: usize) -> (usize, usize, f32) {
+    let inv = if points > 1 && spacing.is_finite() && spacing > 0.0 { 1.0 / spacing } else { 0.0 };
+    Axis { last: points.saturating_sub(1), origin, inv }.cell(pos)
+}
+
+/// A [`GainTableMap`] prepared for evaluating many pixels.
+#[derive(Clone, Copy, Debug)]
+pub struct GainEval<'a> {
+    map: &'a GainTableMap,
+    v: Axis,
+    h: Axis,
+}
+
+impl GainEval<'_> {
+    /// [`GainTableMap::gain`].
+    #[inline]
+    pub fn gain(&self, p: [f32; 3], x: f64, y: f64) -> f32 {
+        let m = self.map;
+        let (v0, v1, fv) = self.v.cell(y);
+        let (h0, h1, fh) = self.h.cell(x);
+        // one fractional index for the four tables (≥ 0, so `as` truncates)
+        let n = m.points_n;
+        let last = n - 1;
+        let idx = (input(m, p) * n as f32).min(last as f32);
+        let i0 = (idx as usize).min(last);
+        let i1 = i0.saturating_add(1).min(last);
+        let t = idx - i0 as f32;
+        // (v ≤ points_v − 1, h ≤ points_h − 1 and i ≤ n − 1, with points_v·points_h·n = gains.len()
+        // checked by `evaluator`: none of this overflows, and `get` still guards each read)
+        let at = |v: usize, h: usize| {
+            let table = m.gains.get((v * m.points_h + h) * n..).unwrap_or(&[]);
+            let g0 = table.get(i0).copied().unwrap_or(1.0);
+            let g1 = table.get(i1).copied().unwrap_or(1.0);
+            g0 + (g1 - g0) * t
+        };
+        let (a, b, c, d) = (at(v0, h0), at(v0, h1), at(v1, h0), at(v1, h1));
+        let top = a + (b - a) * fh;
+        let bottom = c + (d - c) * fh;
+        let g = top + (bottom - top) * fv;
+        if g.is_finite() { g.max(0.0) } else { 1.0 }
+    }
+}
+
+/// The table input for `p` (linear ProPhoto, after the baseline exposure).
+#[inline]
+fn input(m: &GainTableMap, p: [f32; 3]) -> f32 {
+    let w = &m.weights;
+    let lo = p[0].min(p[1]).min(p[2]);
+    let hi = p[0].max(p[1]).max(p[2]);
+    let x = w[0] * p[0] + w[1] * p[1] + w[2] * p[2] + w[3] * lo + w[4] * hi;
+    let x = if x.is_nan() { 0.0 } else { x.clamp(0.0, 1.0) };
+    if m.gamma == 1.0 { x } else { x.powf(m.gamma) }
+}
+
+/// Where the pixels of a developed source sit in the raw's active area, for [`GainTableMap::gain`].
+/// The source is the default crop of the active area (`rect`, relative to the active area),
+/// then EXIF-`orientation`ed. Resolution independent.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SourcePlacement {
+    /// x, y, width, height of the developed crop, relative to the active area.
+    pub rect: [f64; 4],
+    /// The EXIF orientation applied to the developed crop.
+    pub orientation: lightcraft_geom::Orientation,
+}
+
+impl SourcePlacement {
+    /// Relative active-area position of normalized (0..1) coordinates of the oriented source.
+    pub fn active(&self, u: f64, v: f64) -> (f64, f64) {
+        let (u, v) = self.orientation.inverse().map(u, v, 1.0, 1.0);
+        let [x, y, w, h] = self.rect;
+        (x + u * w, y + v * h)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -322,4 +463,106 @@ mod tests {
             assert_eq!(GainTableMap::parse(&b, order, true).unwrap(), g);
         }
     }
+
+    fn map(dims: [usize; 3], spacing: [f64; 2], origin: [f64; 2], weights: [f32; 5], gains: Vec<f32>) -> GainTableMap {
+        let [points_v, points_h, points_n] = dims;
+        let [spacing_v, spacing_h] = spacing;
+        let [origin_v, origin_h] = origin;
+        GainTableMap { points_v, points_h, points_n, spacing_v, spacing_h, origin_v, origin_h, weights, gamma: 1.0, gains }
+    }
+
+    const LUMA: [f32; 5] = [1.0 / 3.0, 1.0 / 3.0, 1.0 / 3.0, 0.0, 0.0];
+
+    #[test]
+    fn gain_follows_the_table_input_at_input_times_n() {
+        // one table of 3 points: index = input × 3 (DNG 1.7.1), clamped to the last point
+        let m = map([1, 1, 3], [1.0, 1.0], [0.0, 0.0], LUMA, vec![1.0, 2.0, 3.0]);
+        assert_eq!(m.gain([0.0; 3], 0.5, 0.5), 1.0);
+        assert!((m.gain([1.0 / 3.0; 3], 0.5, 0.5) - 2.0).abs() < 1e-5, "index 1");
+        assert!((m.gain([1.0 / 6.0; 3], 0.5, 0.5) - 1.5).abs() < 1e-5, "index 0.5: linear in the table");
+        assert!((m.gain([0.9; 3], 0.5, 0.5) - 3.0).abs() < 1e-5, "index 2.7 clamps to the last point");
+        // min/max weights and gamma: input = max(R, G, B)², two points
+        let mut m = map([1, 1, 2], [1.0, 1.0], [0.0, 0.0], [0.0, 0.0, 0.0, 0.0, 1.0], vec![1.0, 3.0]);
+        m.gamma = 2.0;
+        // max 0.5 → 0.25 → index 0.5 → ×2
+        assert!((m.gain([0.1, 0.5, 0.2], 0.0, 0.0) - 2.0).abs() < 1e-5);
+    }
+
+    #[test]
+    fn tables_interpolate_across_the_grid_and_replicate_at_the_edges() {
+        // 1 × 2 constant tables at x = 0.25 (×1) and x = 0.75 (×3)
+        let m = map([1, 2, 1], [1.0, 0.5], [0.0, 0.25], LUMA, vec![1.0, 3.0]);
+        let g = |x: f64| m.gain([0.2; 3], x, 0.5);
+        assert!((g(0.25) - 1.0).abs() < 1e-5 && (g(0.5) - 2.0).abs() < 1e-5 && (g(0.75) - 3.0).abs() < 1e-5);
+        assert!((g(0.0) - 1.0).abs() < 1e-5 && (g(1.0) - 3.0).abs() < 1e-5);
+        assert!((g(-10.0) - 1.0).abs() < 1e-5 && (g(10.0) - 3.0).abs() < 1e-5);
+        // vertically too: 2 × 1 at y = 0 (×1) and y = 1 (×2)
+        let m = map([2, 1, 1], [1.0, 1.0], [0.0, 0.0], LUMA, vec![1.0, 2.0]);
+        assert!((m.gain([0.2; 3], 0.5, 0.25) - 1.25).abs() < 1e-5);
+    }
+
+    #[test]
+    fn hand_built_maps_never_panic() {
+        // review on #273: `(i0 + 1).min(points - 1)` overflowed for points_v = usize::MAX at +inf
+        let mut m = map([usize::MAX, 1, 1], [1.0, 1.0], [0.0, 0.0], LUMA, vec![2.0]);
+        assert_eq!(m.gain([0.5; 3], 0.5, f64::INFINITY), 1.0, "inconsistent sizes: no gain");
+        for (v, h, n, len) in [(usize::MAX, 1, 1, 1), (1, usize::MAX, usize::MAX, 3), (0, 0, 0, 0), (2, 2, 0, 0), (1, 1, 2, 1)] {
+            m.points_v = v;
+            m.points_h = h;
+            m.points_n = n;
+            m.gains = vec![2.0; len];
+            for spacing in [0.0, -1.0, f64::NAN, f64::INFINITY, 1e-300] {
+                m.spacing_v = spacing;
+                m.spacing_h = spacing;
+                for p in [[0.5; 3], [f32::NAN; 3], [f32::INFINITY, 0.0, -1.0], [1e30; 3]] {
+                    for (x, y) in [(0.5, 0.5), (f64::INFINITY, f64::NEG_INFINITY), (f64::NAN, f64::NAN)] {
+                        assert!(m.gain(p, x, y).is_finite());
+                    }
+                }
+            }
+        }
+        // the grid cell itself saturates (the reviewer's case, reached directly)
+        assert_eq!(cell(f64::INFINITY, 0.0, 1.0, usize::MAX), (usize::MAX - 1, usize::MAX - 1, 0.0));
+        assert_eq!(cell(f64::NEG_INFINITY, 0.0, 1.0, usize::MAX).0, 0);
+        // a consistent map with a huge grid and positions far outside it
+        let m = map([1, 1, 2], [1e-300, 1e-300], [0.0, 0.0], [f32::MAX; 5], vec![1.0, 4.0]);
+        assert!(m.gain([1e30; 3], f64::INFINITY, -f64::INFINITY).is_finite());
+    }
+
+    #[test]
+    fn placement_undoes_crop_and_orientation() {
+        // the source is the right half of the active area, rotated 90° clockwise
+        let p = SourcePlacement { rect: [0.5, 0.0, 0.5, 1.0], orientation: lightcraft_geom::Orientation::Rotate90 };
+        // the oriented source's top-left came from the crop's bottom-left
+        let (x, y) = p.active(0.0, 0.0);
+        assert!((x - 0.5).abs() < 1e-12 && (y - 1.0).abs() < 1e-12, "{x} {y}");
+        // its top-right came from the crop's top-left
+        let (x, y) = p.active(1.0, 0.0);
+        assert!((x - 0.5).abs() < 1e-12 && y.abs() < 1e-12, "{x} {y}");
+        let plain = SourcePlacement { rect: [0.0, 0.0, 1.0, 1.0], orientation: lightcraft_geom::Orientation::Normal };
+        assert_eq!(plain.active(0.25, 0.75), (0.25, 0.75));
+    }
+}
+
+/// `GTM_FILE=photo.dng cargo test --release -p lightcraft-raw gain_throughput -- --ignored --nocapture`:
+/// the cost of [`GainEval::gain`] per pixel on a real file's map.
+#[cfg(test)]
+mod bench {
+    #[test]
+    #[ignore]
+    fn gain_throughput() {
+        let Some(path) = std::env::var_os("GTM_FILE") else { return };
+        let raw = crate::decode(&std::fs::read(path).unwrap()).unwrap();
+        let m = raw.color.profile.gain_table_map.expect("the file has no gain table map");
+        let e = m.evaluator().unwrap();
+        let n = 3_000_000usize;
+        let t = std::time::Instant::now();
+        let mut acc = 0f32;
+        for i in 0..n {
+            let (x, y) = ((i % 2048) as f64 / 2048.0, (i / 2048) as f64 / 1536.0);
+            let v = ((i * 7919) % 1000) as f32 / 1000.0 * 0.5;
+            acc += e.gain([v, v * 0.9, v * 0.8], x, y);
+        }
+        println!("{}×{}×{} map: {:.1} ns/px ({acc})", m.points_v, m.points_h, m.points_n, t.elapsed().as_secs_f64() * 1e9 / n as f64);
+    }
 }
diff --git a/crates/raw/src/highlight.rs b/crates/raw/src/highlight.rs
index 1731cb25..7fc05660 100644
--- a/crates/raw/src/highlight.rs
+++ b/crates/raw/src/highlight.rs
@@ -2,9 +2,22 @@
 //!
 //! - [`clip_neutral`]: white-balance-aware clipping so that sensor-clipped areas render neutral instead of
 //!   magenta/cyan (each channel limited to the smallest white-balanced clip level).
-//! - [`reconstruct`]: where only some channels are clipped, rebuild them from the unclipped channels using the
-//!   local chromaticity of nearby unclipped pixels (diffused into the clipped region with a coarse-to-fine
-//!   normalised-convolution fill). Fully clipped pixels become neutral at the brightest plausible level.
+//! - [`reconstruct`] / [`reconstruct_with`]: where only some channels are clipped, rebuild them from the
+//!   unclipped channels using the chromaticity of reliable unclipped content nearby (bright, away from edges and
+//!   from the clipped pixels themselves; diffused into the clipped region coarse to fine) unless both the pixel's
+//!   own channels and the clipped surface's colour just below its clip (the rim) contradict it, and neutral where
+//!   there is none within reach. Right past the rim, the rim's colour carries on. Fully clipped pixels become
+//!   neutral at the brightest plausible level; partly clipped ones fade into it on their way from the first channel
+//!   clipping to the last, pale ones from the start.
+//!
+//! Why the care: the white-balance gains push clipped channels apart (green clips first, red and blue keep
+//! rising), so whatever colour the rebuilt pixels carry is hidden at Neutral only by the tone map's roll-off to
+//! white. Any darkening (Highlights, negative Exposure or Whites) brings it out. Three things used to leak colour
+//! in: the chromaticity of whatever unclipped pixel happened to be nearest (dark foliage, purple and green
+//! fringes along branches, pixels demosaiced from clipped neighbours); a colour model that does not render the
+//! camera's white-balanced neutral as neutral (a look fitted to the camera's JPEG, a camera profile); and, in a
+//! pale partly clipped sky, the colour of another reliable surface (bright foliage) and the sky's own faint
+//! colour, which darkening and a camera profile turned teal.
 
 use lightcraft_raster::Rgb32f;
 use rayon::prelude::*;
@@ -20,119 +33,374 @@ pub fn clip_neutral(img: &mut Rgb32f, wb: [f32; 3], clip: f32) {
     }
 }
 
-/// Fill `values` (per-pixel vectors) where `valid` is false from valid neighbours, coarse to fine.
-fn fill_invalid(w: usize, h: usize, values: &mut [[f32; 3]], valid: &mut [bool]) {
-    if w == 0 || h == 0 || valid.iter().all(|&v| v) || !valid.iter().any(|&v| v) {
-        return;
-    }
-    // Build a pyramid of weighted means, fill each level from the next coarser one.
-    let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
-    let mut cv = vec![[0f32; 3]; cw * ch];
-    let mut cval = vec![false; cw * ch];
-    {
-        let (values, valid) = (&*values, &*valid);
-        downsample(w, h, &mut cv, &mut cval, |i| valid[i].then(|| values[i]));
-    }
-    if cw * ch < w * h {
-        fill_invalid(cw, ch, &mut cv, &mut cval);
-    } else {
-        // cannot shrink further (1×1): nothing valid anywhere handled above
-        return;
-    }
-    values.par_chunks_mut(w).zip(valid.par_chunks_mut(w)).enumerate().for_each(|(y, (vrow, okrow))| {
-        for x in 0..w {
-            if !okrow[x] {
-                vrow[x] = upsample(&cv, cw, ch, x, y);
-                okrow[x] = true;
-            }
-        }
-    });
+/// Unclipped pixels lend their chromaticity in proportion to how close they come to clipping (their largest
+/// channel, relative to the clip level): from nothing below `SOURCE_LO` to fully above `SOURCE_HI`. Dark content
+/// (foliage, branches, buildings against a clipped sky) says nothing about the sky's colour.
+const SOURCE_LO: f32 = 0.25;
+const SOURCE_HI: f32 = 0.6;
+/// Sources on a strong edge (a 3 × 3 half-resolution neighbour brighter or darker by this many stops) are
+/// left out, fading from `EDGE_LO` to `EDGE_HI`: edge pixels mix two surfaces and carry lens fringes.
+const EDGE_LO: f32 = 0.15;
+const EDGE_HI: f32 = 0.4;
+/// Source cells within this many half-resolution cells of a clipped pixel are left out: their channels were
+/// demosaiced partly from clipped samples. (At least 1: the same neighbourhood tells which cells clipped
+/// pixels sample.)
+const MARGIN: usize = 1;
+/// Weight of the coarser estimate against a cell's own sources when the pyramid is pushed back down (in units
+/// of source density: a cell half covered by full-weight sources counts 0.5).
+const PRIOR: f32 = 0.01;
+/// The rebuilt colour fades to neutral where reliable content covers less than `SUPPORT` of the surroundings at
+/// every scale up to `REACH` of the long edge (so previews and exports agree), gradually, as the coverage of the
+/// widest one falls: a clipped sky between bare branches is better white than the colour of a river far away.
+const REACH: f32 = 1.0 / 4.0;
+const SUPPORT: f32 = 0.05;
+/// An unclipped channel above `FLOOR_LO` of its clip level counts more and more as the clip floor it is about to
+/// become (see [`reconstruct_with`]).
+const FLOOR_LO: f32 = 0.75;
+/// A clipped pixel takes its estimated colour (reliable colour around, or the neutral guess) only as far as it is
+/// brighter (or otherwise unlike) the unclipped pixels nearest its clip: the "rim", unclipped pixels above `RIM_LO`
+/// of the clip level, weighted towards the clip, the clipped surface's own colour just below it. Up to `NEAR_RIM`
+/// stops past the rim (the rim is an average, a little below the clip) it is rebuilt with the rim's colour, and
+/// over the next `DEPTH` stops it goes over to the estimate, so a surface runs into clipping without a step
+/// whatever its colour and whatever lent the estimate; well past it, or where the rim is another surface (its
+/// colour differs; a clipped channel differs by at least as much as it lies above the rim's), the estimate applies.
+const RIM_LO: f32 = 0.85;
+const NEAR_RIM: f32 = 0.03;
+const DEPTH: f32 = 0.2;
+/// Reliable colour counts less and less as both the pixel's own channels (see [`contradiction`]) and the rim's
+/// colour contradict it, by `AGREE.0` to `AGREE.1` stops: it is another surface's, like bright foliage below a pale
+/// sky, whose green would turn the sky teal. (Either alone can be wrong: a pixel's own channels are noisy and
+/// can't speak for the channels that clipped, and the rim can be another surface, like a white window frame
+/// around a bright view.)
+const AGREE: (f32, f32) = (0.15, 0.4);
+/// On the way from the first channel clipping to the last, a partly clipped pixel's brightness goes over to the
+/// clipped neutral's in the second half, and so does the colour of a strongly coloured one (saturation relative to
+/// the white above `PALE.1`). A pale one's colour (below `PALE.0`) goes over from the start: the few per cent of
+/// colour left in a pale sky once a channel clipped is as much the estimate's error as the sky's, and darkening
+/// shows it.
+const PALE: (f32, f32) = (0.2, 0.4);
+
+#[inline]
+fn smoothstep(e0: f32, e1: f32, x: f32) -> f32 {
+    let t = ((x - e0) / (e1 - e0)).clamp(0.0, 1.0);
+    t * t * (3.0 - 2.0 * t)
 }
 
-/// One pyramid step: each `2 × 2` block of a `w × h` level becomes the mean of its valid
-/// entries (`at(i)`: the value at index `i` when valid) in `cv`, `cval` (`⌈w/2⌉ × ⌈h/2⌉`).
-fn downsample(w: usize, h: usize, cv: &mut [[f32; 3]], cval: &mut [bool], at: impl Fn(usize) -> Option<[f32; 3]> + Sync) {
-    let cw = w.div_ceil(2);
-    cv.par_chunks_mut(cw).zip(cval.par_chunks_mut(cw)).enumerate().for_each(|(y, (vrow, okrow))| {
+/// One level of a pyramid, `w × h` cells of `N - 1` values and a weight. Pulled: per cell the weighted sums of
+/// the values and the weight, as densities (per pixel of the cell). Pushed: the estimated values, and still the
+/// weight. The chromaticity pyramid holds red and blue chromaticity, the rim pyramid white-balanced RGB.
+struct Level<const N: usize> {
+    w: usize,
+    h: usize,
+    cells: Vec<[f32; N]>,
+}
+
+/// Bilinear sample of a level at the centre of pixel `(x, y)` of a grid `scale` times finer.
+#[inline]
+fn sample<const N: usize>(l: &Level<N>, scale: f32, x: usize, y: usize) -> [f32; N] {
+    let (cv, cw, ch) = (&l.cells, l.w, l.h);
+    let fx = ((x as f32 + 0.5) / scale - 0.5).clamp(0.0, cw.saturating_sub(1) as f32);
+    let fy = ((y as f32 + 0.5) / scale - 0.5).clamp(0.0, ch.saturating_sub(1) as f32);
+    let (x0, y0) = (fx.floor() as usize, fy.floor() as usize);
+    let (x1, y1) = ((x0 + 1).min(cw.saturating_sub(1)), (y0 + 1).min(ch.saturating_sub(1)));
+    let (tx, ty) = (fx - x0 as f32, fy - y0 as f32);
+    let g = |xx: usize, yy: usize| cv.get(yy * cw + xx).copied().unwrap_or([0.0; N]);
+    let (a, b, c, d) = (g(x0, y0), g(x1, y0), g(x0, y1), g(x1, y1));
+    std::array::from_fn(|k| {
+        let top = a[k] + (b[k] - a[k]) * tx;
+        let bot = c[k] + (d[k] - c[k]) * tx;
+        top + (bot - top) * ty
+    })
+}
+
+/// The half-resolution source level of `img`: every `2 × 2` block's source-weighted chromaticity sums, with
+/// blocks near clipped pixels or on strong edges left out. Also returns, per cell, whether a clipped pixel lies
+/// in its row within [`MARGIN`] cells (the vertical half of that test is left to the readers).
+fn sources(img: &Rgb32f, wb: [f32; 3], clip: f32) -> (Level<3>, Vec<bool>) {
+    let (w, h) = (img.width, img.height);
+    let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
+    // per cell: [red sum, blue sum, weight] densities, luminance, whether it holds a clipped pixel
+    let mut cells = vec![[0f32; 3]; cw * ch];
+    let mut lum = vec![0f32; cw * ch];
+    let mut near = vec![false; cw * ch];
+    cells.par_chunks_mut(cw).zip(lum.par_chunks_mut(cw)).zip(near.par_chunks_mut(cw)).enumerate().for_each(|(y, ((crow, lrow), nrow))| {
+        let mut touched = vec![false; cw];
+        let row = |r: usize| img.data.get(r * w..(r + 1) * w).unwrap_or(&[]);
+        let (r0, r1) = (row(2 * y), row(2 * y + 1));
+        let lo = SOURCE_LO * clip;
         for x in 0..cw {
-            let (mut s, mut n) = ([0f32; 3], 0);
-            for dy in 0..2 {
-                for dx in 0..2 {
-                    let (sx, sy) = (2 * x + dx, 2 * y + dy);
-                    if sx < w
-                        && sy < h
-                        && let Some(v) = at(sy * w + sx)
-                    {
-                        for c in 0..3 {
-                            s[c] += v[c];
-                        }
-                        n += 1;
-                    }
+            let (mut a, mut sum, mut n, mut hit) = ([0f32; 3], 0f32, 0usize, false);
+            let span = 2 * x..(2 * x + 2).min(w);
+            for p in r0.get(span.clone()).unwrap_or(&[]).iter().chain(r1.get(span).unwrap_or(&[])) {
+                let q = [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]];
+                let s = q[0].max(0.0) + q[1].max(0.0) + q[2].max(0.0);
+                sum += s;
+                n += 1;
+                let top = p[0].max(p[1]).max(p[2]);
+                if top >= clip {
+                    hit = true;
+                    continue;
+                }
+                if top > lo && s > 1e-4 {
+                    let b = smoothstep(SOURCE_LO, SOURCE_HI, top / clip) / s;
+                    a[0] += b * q[0].max(0.0);
+                    a[1] += b * q[2].max(0.0);
+                    a[2] += b * s;
                 }
             }
-            if n > 0 {
-                vrow[x] = s.map(|v| v / n as f32);
-                okrow[x] = true;
-            }
+            let k = 1.0 / n.max(1) as f32;
+            crow[x] = a.map(|v| v * k);
+            lrow[x] = (sum * k).max(1e-6);
+            touched[x] = hit;
+        }
+        for (x, nr) in nrow.iter_mut().enumerate() {
+            *nr = touched.get(x.saturating_sub(MARGIN)..=(x + MARGIN).min(cw - 1)).is_some_and(|t| t.iter().any(|&t| t));
         }
     });
+    // leave out cells near clipped pixels and on strong edges (luminance ratios to the neighbours)
+    let (lum, near_ref) = (&lum, &near);
+    let (edge_lo, edge_hi) = (EDGE_LO.exp2(), EDGE_HI.exp2());
+    cells.par_chunks_mut(cw).enumerate().for_each(|(y, row)| {
+        let (ya, yb) = (y.saturating_sub(MARGIN), (y + MARGIN).min(ch - 1));
+        let (ea, eb) = (y.saturating_sub(1), (y + 1).min(ch - 1));
+        for (x, cell) in row.iter_mut().enumerate() {
+            if cell[2] <= 0.0 {
+                continue;
+            }
+            if (ya..=yb).any(|yy| near_ref.get(yy * cw + x).copied().unwrap_or(false)) {
+                *cell = [0.0; 3];
+                continue;
+            }
+            let l = lum.get(y * cw + x).copied().unwrap_or(1.0);
+            let (xa, xb) = (x.saturating_sub(1), (x + 1).min(cw - 1));
+            let (mut lo, mut hi) = (l, l);
+            for yy in ea..=eb {
+                for &v in lum.get(yy * cw + xa..=yy * cw + xb).unwrap_or(&[]) {
+                    lo = lo.min(v);
+                    hi = hi.max(v);
+                }
+            }
+            let keep = 1.0 - smoothstep(edge_lo, edge_hi, (hi / l).max(l / lo));
+            *cell = cell.map(|v| v * keep);
+        }
+    });
+    (Level { w: cw, h: ch, cells }, near)
 }
 
-/// Bilinear sample of the `cw × ch` coarse level at fine pixel `(x, y)` (twice the resolution).
-fn upsample(cv: &[[f32; 3]], cw: usize, ch: usize, x: usize, y: usize) -> [f32; 3] {
-    let fx = ((x as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (cw - 1) as f32);
-    let fy = ((y as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (ch - 1) as f32);
-    let (x0, y0) = (fx.floor() as usize, fy.floor() as usize);
-    let (x1, y1) = ((x0 + 1).min(cw - 1), (y0 + 1).min(ch - 1));
-    let (tx, ty) = (fx - x0 as f32, fy - y0 as f32);
-    let g = |xx: usize, yy: usize| cv[yy * cw + xx];
-    let mut v = [0f32; 3];
-    for c in 0..3 {
-        let top = g(x0, y0)[c] + (g(x1, y0)[c] - g(x0, y0)[c]) * tx;
-        let bot = g(x0, y1)[c] + (g(x1, y1)[c] - g(x0, y1)[c]) * tx;
-        v[c] = top + (bot - top) * ty;
+/// The quarter-resolution rim level of `img`: every `4 × 4` block's white-balanced RGB of its unclipped pixels
+/// above [`RIM_LO`] of the clip level, weighted (steeply) towards the clip, as densities. Pixels next to clipped
+/// ones (`margin`, by half-resolution cell) are left out, like the colour sources: they were demosaiced partly from
+/// clipped samples, and lens fringes along clipped content would pass for its colour.
+fn rim(img: &Rgb32f, wb: [f32; 3], clip: f32, margin: &(dyn Fn(usize, usize) -> bool + Sync)) -> Level<4> {
+    let (w, h) = (img.width, img.height);
+    let (cw, ch) = (w.div_ceil(4), h.div_ceil(4));
+    let mut cells = vec![[0f32; 4]; cw * ch];
+    cells.par_chunks_mut(cw).enumerate().for_each(|(y, row)| {
+        for (x, cell) in row.iter_mut().enumerate() {
+            let (mut a, mut n) = ([0f32; 4], 0usize);
+            for sy in 4 * y..(4 * y + 4).min(h) {
+                for (i, p) in img.data.get(sy * w + 4 * x..sy * w + (4 * x + 4).min(w)).unwrap_or(&[]).iter().enumerate() {
+                    n += 1;
+                    let top = p[0].max(p[1]).max(p[2]) / clip;
+                    if !(RIM_LO..1.0).contains(&top) || margin((4 * x + i) / 2, sy / 2) {
+                        continue;
+                    }
+                    let k = ((top - RIM_LO) / (1.0 - RIM_LO)).powi(4);
+                    for c in 0..3 {
+                        a[c] += k * p[c] * wb[c];
+                    }
+                    a[3] += k;
+                }
+            }
+            *cell = a.map(|v| v / n.max(1) as f32);
+        }
+    });
+    Level { w: cw, h: ch, cells }
+}
+
+/// The next coarser level: each `2 × 2` block's mean densities.
+fn pull<const N: usize>(l: &Level<N>) -> Level<N> {
+    let (w, h) = (l.w.div_ceil(2), l.h.div_ceil(2));
+    let mut cells = vec![[0f32; N]; w * h];
+    cells.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
+        for (x, cell) in row.iter_mut().enumerate() {
+            let (mut s, mut n) = ([0f32; N], 0usize);
+            for (sx, sy) in [(2 * x, 2 * y), (2 * x + 1, 2 * y), (2 * x, 2 * y + 1), (2 * x + 1, 2 * y + 1)] {
+                if let Some(c) = (sx < l.w && sy < l.h).then(|| l.cells.get(sy * l.w + sx)).flatten() {
+                    for k in 0..N {
+                        s[k] += c[k];
+                    }
+                    n += 1;
+                }
+            }
+            *cell = s.map(|v| v / n.max(1) as f32);
+        }
+    });
+    Level { w, h, cells }
+}
+
+/// The estimated values of the cells of `levels[0]` that `needed` marks (all of them when `None`), and of every
+/// cell of the coarser levels: each level's own sources blended with the next coarser estimate. The top level is
+/// its own sources' weighted mean (normalised: however sparse they are in a large empty picture, the empty part
+/// never pulls the estimate anywhere), and `empty` (at zero weight) when it has none at all.
+fn push<const N: usize>(levels: &mut [Level<N>], empty: [f32; N], needed: Option<&(dyn Fn(usize, usize) -> bool + Sync)>) {
+    let estimate = |cell: [f32; N], prior: [f32; N]| -> [f32; N] {
+        let weight = cell[N - 1];
+        let d = weight + PRIOR;
+        std::array::from_fn(|k| if k + 1 == N { weight } else { (cell[k] + PRIOR * prior[k]) / d })
+    };
+    let Some(last) = levels.last_mut() else { return };
+    last.cells.iter_mut().for_each(|c| {
+        let weight = c[N - 1];
+        *c = if weight > 0.0 { std::array::from_fn(|k| if k + 1 == N { weight } else { c[k] / weight }) } else { empty };
+    });
+    for i in (0..levels.len().saturating_sub(1)).rev() {
+        let (fine, coarse) = levels.split_at_mut(i + 1);
+        let (Some(fine), Some(coarse)) = (fine.last_mut(), coarse.first()) else { continue };
+        let w = fine.w;
+        let needed = needed.filter(|_| i == 0);
+        fine.cells.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
+            for (x, cell) in row.iter_mut().enumerate() {
+                if needed.is_some_and(|f| !f(x, y)) {
+                    continue;
+                }
+                *cell = estimate(*cell, sample(coarse, 2.0, x, y));
+            }
+        });
     }
-    v
 }
 
-/// White-balanced chromaticity of an unclipped pixel (`None`: clipped or too dark to tell).
-#[inline]
-fn chroma_of(p: &[f32; 3], wb: [f32; 3], clip: f32) -> Option<[f32; 3]> {
-    if p[0] >= clip || p[1] >= clip || p[2] >= clip {
+/// How many stops two chromaticities differ by in any channel ratio.
+fn unlike(a: [f32; 3], b: [f32; 3]) -> f32 {
+    let ratio = |i: usize, j: usize| (a[i].max(1e-6) * b[j].max(1e-6)) / (a[j].max(1e-6) * b[i].max(1e-6));
+    [(0, 1), (0, 2), (1, 2)].iter().map(|&(i, j)| ratio(i, j).log2().abs()).fold(0.0f32, f32::max)
+}
+
+/// How far channel `c` of a pixel (sensor values `p`, clipped channels `cl`) only bounds its true value from below:
+/// fully once clipped, and increasingly from `FLOOR_LO` of the clip on, so that nothing compared with it jumps where
+/// it clips.
+fn bound(p: [f32; 3], cl: [bool; 3], clip: f32, c: usize) -> f32 {
+    if cl[c] { 1.0 } else { smoothstep(FLOOR_LO, 1.0, p[c] / clip) }
+}
+
+/// How many stops the channels of a partly clipped pixel (sensor values `p`, white-balanced `q`, clipped channels
+/// `cl`) contradict chromaticity `r`: how far the levels they imply spread, where a clipped channel's only bounds the
+/// level from below (see [`bound`]). 0 for the pixel's own colour, whatever its level.
+fn contradiction(p: [f32; 3], q: [f32; 3], cl: [bool; 3], r: [f32; 3], clip: f32) -> f32 {
+    let (mut lo, mut hi) = (f32::INFINITY, 0f32);
+    for c in 0..3 {
+        let level = q[c] / r[c].max(1e-3);
+        hi = hi.max(level);
+        let w = bound(p, cl, clip, c);
+        if r[c] > 1e-3 && w < 1.0 {
+            lo = lo.min(level / (1.0 - w));
+        }
+    }
+    if hi > 0.0 && lo > 0.0 && lo.is_finite() { (hi / lo).log2().max(0.0) } else { 0.0 }
+}
+
+/// The white-balanced colour of a partly clipped pixel (sensor values `p`, white-balanced `q`, clipped channels
+/// `cl`) whose colour is estimated at chromaticity `r`: clipped channels rebuilt, unclipped ones kept. `None`
+/// when no unclipped channel can tell the level.
+fn rebuild(p: [f32; 3], q: [f32; 3], cl: [bool; 3], r: [f32; 3], clip: f32, max_level: f32) -> Option<[f32; 3]> {
+    // The white-balanced channel sum the unclipped channels imply: their mean, except that a channel about to clip
+    // counts more and more as the floor it is about to become (continuous with the neighbours where it has).
+    let (mut sum, mut near_clip, mut k) = (0f32, 0f32, 0usize);
+    for c in 0..3 {
+        if !cl[c] && r[c] > 1e-3 {
+            let s = q[c] / r[c];
+            sum += s;
+            near_clip = near_clip.max(s * smoothstep(FLOOR_LO, 1.0, p[c] / clip));
+            k += 1;
+        }
+    }
+    if k == 0 {
         return None;
     }
-    let q = [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]];
-    let s = q[0] + q[1] + q[2];
-    (s > 1e-4).then(|| q.map(|v| v.max(0.0) / s))
+    // Two clipped channels must not be left at their clip levels: those differ by the white-balance gains (green
+    // clips first), and the pair would show as magenta or red. They keep the estimate's ratio instead, at the level
+    // that lifts each to its clip (no channel above the clipped neutral), and so does a channel about to clip (the
+    // same floor, so nothing jumps where it clips).
+    let floor = (0..3).filter(|&c| cl[c]).map(|c| q[c] / r[c].max(1e-3)).fold(0.0f32, f32::max);
+    let top = r[0].max(r[1]).max(r[2]).max(1e-3);
+    let sum = (sum / k as f32).max(near_clip.max(floor).min(max_level / top));
+    Some(std::array::from_fn(|c| if cl[c] { q[c].max(sum * r[c]) } else { q[c] }))
+}
+
+/// Reconstruct partially clipped channels, with a neutral that is neutral in camera RGB. See
+/// [`reconstruct_with`].
+pub fn reconstruct(img: &mut Rgb32f, wb: [f32; 3], clip: f32) -> usize {
+    reconstruct_with(img, wb, clip, [1.0; 3])
 }
 
 /// Reconstruct partially clipped channels. `clip` is the sensor clip level in normalised units (use slightly
-/// below 1.0, e.g. 0.99), `wb` the white-balance multipliers that will be applied afterwards.
-/// Returns the number of pixels that had at least one clipped channel.
-///
-/// The chromaticity field is diffused coarse to fine from the unclipped pixels. A clipped pixel is
-/// never valid at full resolution, so its chromaticity is always the bilinear sample of the
-/// half-resolution level: we start the pyramid there, straight from the image, and never build
-/// the full-resolution field (same result, a quarter of the memory and far less work).
-pub fn reconstruct(img: &mut Rgb32f, wb: [f32; 3], clip: f32) -> usize {
+/// below 1.0, e.g. 0.99), `wb` the white-balance multipliers that will be applied afterwards, `white` the
+/// white-balanced camera RGB that the colour model applied afterwards renders neutral (`[1, 1, 1]` for a model
+/// that maps the white-balanced neutral to neutral), scaled to the brightness that `[1, 1, 1]` renders at.
+/// Fully clipped pixels become `white` times the brightest plausible level; partly clipped ones take the
+/// chromaticity of reliable unclipped content nearby, and that of `white` where there is none.
+/// Returns the number of pixels that had at least one clipped channel; the others are left exactly as they were.
+pub fn reconstruct_with(img: &mut Rgb32f, wb: [f32; 3], clip: f32, white: [f32; 3]) -> usize {
     let (w, h) = (img.width, img.height);
     let is_clipped = |p: &[f32; 3]| p[0] >= clip || p[1] >= clip || p[2] >= clip;
     let count = img.data.par_iter().filter(|p| is_clipped(p)).count();
-    if count == 0 {
+    if count == 0 || w == 0 || h == 0 {
         return 0;
     }
-    // chromaticity (white-balanced ratios to the channel sum) of unclipped pixels, at half resolution
+    // a white far from the camera's neutral (or not a number) is a broken colour model: keep the camera's
+    let plausible = white.iter().all(|v| v.is_finite() && (1.0 / 16.0..=16.0).contains(v));
+    let white = if plausible { white } else { [1.0; 3] };
+    let total = white[0] + white[1] + white[2];
+    let neutral = [white[0] / total, white[1] / total, white[2] / total];
+    // A clipped pixel is never a source, so its chromaticity is always the bilinear sample of the
+    // half-resolution estimate: the pyramid starts there, straight from the image.
+    let (first, near) = sources(img, wb, clip);
+    let mut levels = vec![first];
+    while let Some(l) = levels.last().filter(|l| l.w > 1 || l.h > 1) {
+        let next = pull(l);
+        levels.push(next);
+    }
+    // a clipped pixel samples the cells within one of its own, which are within one of a clipped cell
     let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
-    let mut cv = vec![[1f32 / 3.0; 3]; cw * ch];
-    let mut cval = vec![false; cw * ch];
-    {
-        let data = &img.data;
-        downsample(w, h, &mut cv, &mut cval, |i| chroma_of(&data[i], wb, clip));
+    let needed = |x: usize, y: usize| (y.saturating_sub(1)..=(y + 1).min(ch - 1)).any(|yy| near.get(yy * cw + x).copied().unwrap_or(false));
+    push(&mut levels, [neutral[0], neutral[2], 0.0], Some(&needed));
+    // How much reliable content lies around each needed cell: its density at any scale up to [`REACH`] (level
+    // i's cells span 2^i cells of level 0). Near reliable content some fine level is dense with it; far from it
+    // only the widest one may still hold a little, and the trust fades with that. Kept in the third entry of the
+    // level 0 estimates, which clipped pixels sample with their colour.
+    let reach = REACH * w.max(h) as f32 / 2.0;
+    let widest = (0..levels.len()).find(|&i| (1u64 << i.min(62)) as f32 >= reach).unwrap_or(levels.len().saturating_sub(1));
+    if let Some((first, coarser)) = levels.split_first_mut() {
+        let support: Vec<(&Level<3>, f32)> = coarser.iter().take(widest).enumerate().map(|(i, l)| (l, (1u64 << (i + 1).min(62)) as f32)).collect();
+        let fw = first.w;
+        first.cells.par_chunks_mut(fw).enumerate().for_each(|(y, row)| {
+            for (x, cell) in row.iter_mut().enumerate() {
+                if !needed(x, y) {
+                    continue;
+                }
+                let mut t = 0f32;
+                for &(l, scale) in &support {
+                    t = t.max(smoothstep(0.0, SUPPORT, sample(l, scale, x, y)[2]));
+                    if t >= 1.0 {
+                        break;
+                    }
+                }
+                cell[2] = t;
+            }
+        });
     }
-    if cw * ch < w * h {
-        fill_invalid(cw, ch, &mut cv, &mut cval);
-    }
-    let any_valid = cw * ch < w * h && cval.iter().any(|&v| v);
+    let Some(field) = levels.first() else { return count };
+    // the rim (level 0 of its pyramid holds the estimate), if there is one anywhere at all
+    let rims = {
+        let mut levels = vec![rim(img, wb, clip, &needed)];
+        while let Some(l) = levels.last().filter(|l| l.w > 1 || l.h > 1) {
+            let next = pull(l);
+            levels.push(next);
+        }
+        push(&mut levels, [0.0; 4], None);
+        Some(levels).filter(|levels| levels.last().is_some_and(|top| top.cells.iter().any(|c| c[3] > 0.0)))
+    };
+    let rim_field = rims.as_ref().and_then(|l| l.first());
     let max_level = wb.iter().cloned().fold(0.0f32, f32::max) * clip;
     img.data.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
         for (x, px) in row.iter_mut().enumerate() {
@@ -141,27 +409,81 @@ pub fn reconstruct(img: &mut Rgb32f, wb: [f32; 3], clip: f32) -> usize {
             if !cl.iter().any(|&b| b) {
                 continue;
             }
-            let r = if any_valid { upsample(&cv, cw, ch, x, y) } else { [1f32 / 3.0; 3] };
             let q = [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]];
-            // estimate the white-balanced channel sum from the unclipped channels
-            let (mut sum, mut k) = (0f32, 0usize);
-            for c in 0..3 {
-                if !cl[c] && r[c] > 1e-3 {
-                    sum += q[c] / r[c];
-                    k += 1;
+            // rebuilt with the colour of the reliable content around, and with neutral, blended by how much of it
+            // there is and how well the pixel agrees with it (blending the results, not the colours, keeps the
+            // estimate consistent with the pixel's own unclipped channels all the way)
+            let e = sample(field, 2.0, x, y);
+            let borrowed = [e[0], 1.0 - e[0] - e[1], e[1]];
+            let edge = rim_field.map(|rim| sample(rim, 4.0, x, y));
+            let mut trust = e[2].clamp(0.0, 1.0);
+            if trust > 0.0 {
+                let mut off = contradiction(p, q, cl, borrowed, clip);
+                if off > AGREE.0 {
+                    off = off.min(edge.map_or(0.0, |edge| {
+                        let s = edge[0] + edge[1] + edge[2];
+                        if s > 1e-6 { unlike([edge[0] / s, edge[1] / s, edge[2] / s], borrowed) } else { 0.0 }
+                    }));
                 }
+                trust *= 1.0 - smoothstep(AGREE.0, AGREE.1, off);
             }
-            let mut out = q;
-            if k == 0 {
-                let v = q.iter().cloned().fold(0.0f32, f32::max).max(max_level);
-                out = [v; 3];
-            } else {
-                let sum = sum / k as f32;
-                for c in 0..3 {
-                    if cl[c] {
-                        out[c] = q[c].max(sum * r[c]);
-                    }
+            // either applies only as far as the pixel lies past the rim nearest its clip (in any channel); nearer, the
+            // pixel is rebuilt with the rim's colour
+            let at_rim = edge.and_then(|edge| {
+                // stops between pixel and rim in each channel; a clipped channel's true value lies at least as far
+                // above the rim's as its clip, and no further below (see [`bound`])
+                let ratio = (0..3)
+                    .map(|c| {
+                        let (a, b) = (q[c].max(1e-12), edge[c].max(1e-12));
+                        if a >= b {
+                            return a / b;
+                        }
+                        match bound(p, cl, clip, c) {
+                            w if w <= 0.0 => b / a,
+                            w if w >= 1.0 => 1.0,
+                            w => (b / a).powf(1.0 - w),
+                        }
+                    })
+                    .fold(1.0f32, f32::max);
+                let past = ratio.log2().min(64.0);
+                let k = smoothstep(NEAR_RIM, NEAR_RIM + DEPTH, past);
+                let s = edge[0] + edge[1] + edge[2];
+                (k < 1.0 && s > 1e-6).then(|| rebuild(p, q, cl, [edge[0] / s, edge[1] / s, edge[2] / s], clip, max_level)).flatten().map(|a| (a, k))
+            });
+            let past_rim = |b: [f32; 3]| -> [f32; 3] {
+                let Some((a, k)) = at_rim else { return b };
+                std::array::from_fn(|c| a[c] + (b[c] - a[c]) * k)
+            };
+            let local = (trust > 0.0).then(|| rebuild(p, q, cl, borrowed, clip, max_level)).flatten().map(past_rim);
+            let plain = (trust < 1.0).then(|| rebuild(p, q, cl, neutral, clip, max_level)).flatten().map(past_rim);
+            let mut out = match (local, plain) {
+                (Some(a), Some(b)) => std::array::from_fn(|c| b[c] + (a[c] - b[c]) * trust),
+                (Some(a), None) | (None, Some(a)) => a,
+                (None, None) => {
+                    let v = q.iter().cloned().fold(0.0f32, f32::max).max(max_level);
+                    white.map(|c| c * v)
                 }
+            };
+            // Fade into the fully clipped neutral on the way from the first channel clipping (no change: continuous
+            // with the unclipped neighbours) to the last one clipping (all of it: continuous with the fully clipped
+            // ones). The way is measured in stops: how far the rebuilt clipped channels lie above their clip,
+            // against how far the lowest unclipped channel still lies below its own.
+            let above = (0..3).filter(|&c| cl[c]).map(|c| (out[c] / q[c].max(1e-9)).max(1.0).log2()).fold(0.0f32, f32::max);
+            let lowest = (0..3).filter(|&c| !cl[c]).map(|c| p[c]).fold(f32::MAX, f32::min);
+            let below = (clip / lowest.max(1e-6)).log2().max(0.0);
+            let way = if above > 0.0 && lowest < clip { above / (above + below) } else { 0.0 };
+            // The brightness goes over in the second half of the way, and so does the colour of a strongly coloured
+            // pixel; a pale one's goes over from the start ([`PALE`]).
+            let u = [out[0] / white[0], out[1] / white[1], out[2] / white[2]];
+            let (lo, hi) = (u[0].min(u[1]).min(u[2]), u[0].max(u[1]).max(u[2]));
+            let saturation = if hi > 0.0 && hi.is_finite() { 1.0 - lo.max(0.0) / hi } else { 1.0 };
+            let start = 0.5 * smoothstep(PALE.0, PALE.1, saturation);
+            let (t_level, t_colour) = (smoothstep(0.5, 1.0, way), smoothstep(start, start + 0.5, way));
+            if t_colour > 0.0 {
+                let level = (out[0] + out[1] + out[2]) / total;
+                let full = q.iter().cloned().fold(0.0f32, f32::max).max(max_level);
+                let v = level + (full - level) * t_level;
+                out = std::array::from_fn(|c| out[c] + (white[c] * v - out[c]) * t_colour);
             }
             *px = [out[0] / wb[0], out[1] / wb[1], out[2] / wb[2]];
         }
@@ -173,154 +495,228 @@ pub fn reconstruct(img: &mut Rgb32f, wb: [f32; 3], clip: f32) -> usize {
 mod tests {
     use super::*;
 
-    // The previous full-resolution implementation, kept as the reference for `reconstruct`.
-    /// Fill `values` (per-pixel vectors) where `valid` is false from valid neighbours, coarse to fine.
-    fn fill_invalid_ref(w: usize, h: usize, values: &mut [[f32; 3]], valid: &mut [bool]) {
-        if w == 0 || h == 0 || valid.iter().all(|&v| v) || !valid.iter().any(|&v| v) {
-            return;
-        }
-        // Build a pyramid of weighted means, fill each level from the next coarser one.
-        let (cw, ch) = (w.div_ceil(2), h.div_ceil(2));
-        let mut cv = vec![[0f32; 3]; cw * ch];
-        let mut cval = vec![false; cw * ch];
-        {
-            let (values, valid) = (&*values, &*valid);
-            cv.par_chunks_mut(cw).zip(cval.par_chunks_mut(cw)).enumerate().for_each(|(y, (vrow, okrow))| {
-                for x in 0..cw {
-                    let (mut s, mut n) = ([0f32; 3], 0);
-                    for dy in 0..2 {
-                        for dx in 0..2 {
-                            let (sx, sy) = (2 * x + dx, 2 * y + dy);
-                            if sx < w && sy < h && valid[sy * w + sx] {
-                                for c in 0..3 {
-                                    s[c] += values[sy * w + sx][c];
-                                }
-                                n += 1;
-                            }
-                        }
-                    }
-                    if n > 0 {
-                        vrow[x] = s.map(|v| v / n as f32);
-                        okrow[x] = true;
-                    }
-                }
-            });
-        }
-        if cw * ch < w * h {
-            fill_invalid_ref(cw, ch, &mut cv, &mut cval);
-        } else {
-            // cannot shrink further (1×1): nothing valid anywhere handled above
-            return;
-        }
-        values.par_chunks_mut(w).zip(valid.par_chunks_mut(w)).enumerate().for_each(|(y, (vrow, okrow))| {
-            for x in 0..w {
-                if !okrow[x] {
-                    // bilinear upsample of the coarse level
-                    let fx = ((x as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (cw - 1) as f32);
-                    let fy = ((y as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (ch - 1) as f32);
-                    let (x0, y0) = (fx.floor() as usize, fy.floor() as usize);
-                    let (x1, y1) = ((x0 + 1).min(cw - 1), (y0 + 1).min(ch - 1));
-                    let (tx, ty) = (fx - x0 as f32, fy - y0 as f32);
-                    let g = |xx: usize, yy: usize| cv[yy * cw + xx];
-                    let mut v = [0f32; 3];
-                    for c in 0..3 {
-                        let top = g(x0, y0)[c] + (g(x1, y0)[c] - g(x0, y0)[c]) * tx;
-                        let bot = g(x0, y1)[c] + (g(x1, y1)[c] - g(x0, y1)[c]) * tx;
-                        v[c] = top + (bot - top) * ty;
-                    }
-                    vrow[x] = v;
-                    okrow[x] = true;
-                }
-            }
-        });
+    /// Daylight-like multipliers: green clips first, red and blue keep rising.
+    const WB: [f32; 3] = [2.5, 1.0, 1.6];
+
+    fn balanced(p: [f32; 3]) -> [f32; 3] {
+        [p[0] * WB[0], p[1] * WB[1], p[2] * WB[2]]
     }
 
-    /// Reconstruct partially clipped channels. `clip` is the sensor clip level in normalised units (use slightly
-    /// below 1.0, e.g. 0.99), `wb` the white-balance multipliers that will be applied afterwards.
-    /// Returns the number of pixels that had at least one clipped channel.
-    fn reconstruct_ref(img: &mut Rgb32f, wb: [f32; 3], clip: f32) -> usize {
-        let (w, h) = (img.width, img.height);
-        let n = w * h;
-        let is_clipped = |p: &[f32; 3]| p[0] >= clip || p[1] >= clip || p[2] >= clip;
-        let count = img.data.par_iter().filter(|p| is_clipped(p)).count();
-        if count == 0 {
-            return 0;
-        }
-        // chromaticity (white-balanced ratios to the channel mean) of unclipped pixels
-        let mut chroma = vec![[1f32 / 3.0; 3]; n];
-        let mut valid = vec![false; n];
-        chroma.par_iter_mut().zip(valid.par_iter_mut()).zip(img.data.par_iter()).for_each(|((r, v), p)| {
-            if is_clipped(p) {
-                return;
-            }
-            let q = [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]];
-            let s = q[0] + q[1] + q[2];
-            if s > 1e-4 {
-                *r = q.map(|v| v.max(0.0) / s);
-                *v = true;
-            }
-        });
-        fill_invalid_ref(w, h, &mut chroma, &mut valid);
-        let max_level = wb.iter().cloned().fold(0.0f32, f32::max) * clip;
-        img.data.par_iter_mut().zip(chroma.par_iter()).for_each(|(px, r)| {
-            let p = *px;
-            let cl = [p[0] >= clip, p[1] >= clip, p[2] >= clip];
-            if !cl.iter().any(|&b| b) {
-                return;
-            }
-            let q = [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]];
-            // estimate the white-balanced channel sum from the unclipped channels
-            let (mut sum, mut k) = (0f32, 0usize);
-            for c in 0..3 {
-                if !cl[c] && r[c] > 1e-3 {
-                    sum += q[c] / r[c];
-                    k += 1;
-                }
-            }
-            let mut out = q;
-            if k == 0 {
-                let v = q.iter().cloned().fold(0.0f32, f32::max).max(max_level);
-                out = [v; 3];
+    fn sensor(q: [f32; 3]) -> [f32; 3] {
+        [q[0] / WB[0], q[1] / WB[1], q[2] / WB[2]].map(|v| v.min(1.0))
+    }
+
+    fn chroma(q: [f32; 3]) -> [f32; 3] {
+        let s = q[0] + q[1] + q[2];
+        q.map(|v| v / s)
+    }
+
+    /// A pale blue sky whose green channel clipped, an unclipped strip of the same sky along the top, and a dark
+    /// branch with purple fringes on both sides standing in the clipped part (white-balanced sky colour returned).
+    fn branch_scene() -> (Rgb32f, [f32; 3]) {
+        let sky = [1.10, 1.25, 1.45];
+        let img = Rgb32f::from_fn(192, 128, |x, y| {
+            sensor(if y < 24 {
+                sky.map(|v| v * 0.7)
+            } else if (90..100).contains(&x) && y >= 40 {
+                [0.06, 0.05, 0.03]
+            } else if (x == 89 || x == 100) && y >= 40 {
+                [0.75, 0.25, 0.96]
             } else {
-                let sum = sum / k as f32;
-                for c in 0..3 {
-                    if cl[c] {
-                        out[c] = q[c].max(sum * r[c]);
-                    }
-                }
+                sky
+            })
+        });
+        (img, sky)
+    }
+
+    /// How far chromaticity `got` lies off the way from `from` to neutral (largest channel difference to the
+    /// nearest point of that way).
+    fn off_the_way_to_neutral(got: [f32; 3], from: [f32; 3]) -> f32 {
+        let d: [f32; 3] = std::array::from_fn(|c| 1.0 / 3.0 - from[c]);
+        let len = d.iter().map(|v| v * v).sum::<f32>();
+        let t = if len > 0.0 { ((0..3).map(|c| (got[c] - from[c]) * d[c]).sum::<f32>() / len).clamp(0.0, 1.0) } else { 0.0 };
+        (0..3).map(|c| (got[c] - (from[c] + d[c] * t)).abs()).fold(0.0, f32::max)
+    }
+
+    /// Issue #523: the clipped sky beside a branch took the colour of the branch's fringes and of the branch
+    /// itself (magenta, green), which any darkening of the highlights then showed. Beside the branch it is now the
+    /// clipped sky away from it: the sky's colour, on its way to neutral.
+    #[test]
+    fn fringes_and_dark_branches_do_not_tint_a_clipped_sky() {
+        let (mut img, sky) = branch_scene();
+        assert!(reconstruct(&mut img, WB, 0.99) > 0);
+        let mut worst = 0f32;
+        for y in 40..128 {
+            let away = chroma(balanced(img.get(30, y)));
+            assert!(away == chroma(balanced(img.get(170, y))), "row {y}");
+            let off = off_the_way_to_neutral(away, chroma(sky));
+            assert!(off < 0.005, "row {y}: the clipped sky {away:?} is not the sky's colour on its way to neutral ({off})");
+            for x in [84, 86, 88, 101, 103, 105] {
+                let got = chroma(balanced(img.get(x, y)));
+                worst = worst.max((0..3).map(|c| (got[c] - away[c]).abs()).fold(0.0, f32::max));
             }
-            *px = [out[0] / wb[0], out[1] / wb[1], out[2] / wb[2]];
-        });
-        count
+        }
+        assert!(worst < 0.01, "clipped sky beside the branch is off the sky away from it by {worst}");
     }
 
-    /// `cargo test --release -p lightcraft-raw --lib -- --ignored bench_reconstruct --nocapture`
+    /// A warm light with red and green clipped: left at their clip levels the pair reads red-magenta (the white
+    /// balance multiplies red's clip level by 2.5, green's by 1).
     #[test]
-    #[ignore]
-    fn bench_reconstruct() {
-        let img = Rgb32f::from_fn(6000, 4000, |x, y| {
-            let v = 0.4 + 0.8 * ((x as f32 * 0.003).sin() * (y as f32 * 0.002).cos()).abs();
-            [v.min(1.0), (v * 0.7).min(1.0), (v * 0.5).min(1.0)]
+    fn two_clipped_channels_are_not_left_at_their_clip_levels() {
+        let light = [3.5, 2.6, 0.8];
+        let mut img = Rgb32f::from_fn(64, 64, |x, y| {
+            let d = ((x as f32 - 32.0).powi(2) + (y as f32 - 32.0).powi(2)).sqrt();
+            if d < 20.0 { sensor(light) } else { [0.02; 3] }
         });
-        let wb = [2.0, 1.0, 1.5];
-        let time = |f: &dyn Fn(&mut Rgb32f) -> usize| {
-            (0..3)
-                .map(|_| {
-                    let mut i = img.clone();
-                    let t = std::time::Instant::now();
-                    f(&mut i);
-                    t.elapsed().as_secs_f64() * 1e3
-                })
-                .fold(f64::MAX, f64::min)
-        };
-        let new = time(&|i| reconstruct(i, wb, 0.99));
-        let old = time(&|i| reconstruct_ref(i, wb, 0.99));
-        eprintln!("reconstruct 24 MP: {new:.0} ms (full-resolution reference: {old:.0} ms)");
+        reconstruct(&mut img, WB, 0.99);
+        let q = balanced(img.get(32, 32));
+        assert!((q[2] - 0.8).abs() < 0.1, "the unclipped channel is about kept: {q:?}");
+        let ratio = q[1] / q[0];
+        assert!((0.6..=1.05).contains(&ratio), "green / red {ratio} ({q:?}): not a warm white");
     }
 
-    /// The half-resolution start gives exactly the full-resolution algorithm's result.
     #[test]
-    fn matches_the_full_resolution_reference() {
+    fn fully_clipped_pixels_follow_the_colour_model_white() {
+        let white = [1.03, 0.98, 1.06];
+        let mut img = Rgb32f::filled(8, 8, [1.0; 3]);
+        img.data[0] = [0.3, 0.6, 0.4];
+        reconstruct_with(&mut img, WB, 0.99, white);
+        let q = balanced(img.get(4, 4));
+        let k = q[1] / white[1];
+        assert!((0..3).all(|c| (q[c] - white[c] * k).abs() < 1e-4 * k), "{q:?} is not along {white:?}");
+        assert!(k >= 2.5 * 0.99 - 1e-4, "clipped neutral at least as bright as the highest clip level: {k}");
+        assert_eq!(img.data[0], [0.3, 0.6, 0.4]);
+        // a white that cannot be right falls back to camera neutral, and nothing overflows
+        for bad in [[f32::NAN, 1.0, 1.0], [2.5e38, 0.74, 0.74], [1.0, 0.0, 1.0], [40.0, 1.0, 1.0]] {
+            let mut img = Rgb32f::filled(4, 4, [1.0; 3]);
+            img.data[0] = [1.0, 1.0, 0.5];
+            reconstruct_with(&mut img, WB, 0.99, bad);
+            let q = balanced(img.get(1, 1));
+            assert!((q[0] - q[1]).abs() < 1e-4 && (q[2] - q[1]).abs() < 1e-4, "{bad:?}: {q:?}");
+            assert!(img.data.iter().flatten().all(|v| v.is_finite()), "{bad:?}");
+        }
+    }
+
+    /// Red rises through its clip level across a sky whose green and blue clipped: the rebuilt colour changes
+    /// smoothly (no edge where red clips too) and arrives at the clipped neutral.
+    #[test]
+    fn rebuilt_colour_is_continuous_as_more_channels_clip() {
+        let blue = [1.0, 1.3, 1.9];
+        let img0 = Rgb32f::from_fn(240, 40, |x, y| {
+            if y < 8 {
+                return sensor(blue.map(|v| v * 0.5)); // unclipped sky: the source of colour
+            }
+            let level = 0.6 + 2.2 * x as f32 / 239.0; // red at 0.24 to 1.12 of its clip level
+            sensor([level * WB[0] * 0.4, 1.6, 2.0])
+        });
+        let mut img = img0.clone();
+        reconstruct(&mut img, WB, 0.99);
+        let row: Vec<[f32; 3]> = (0..240).map(|x| chroma(balanced(img.get(x, 30)))).collect();
+        let step = row.windows(2).map(|w| (0..3).map(|c| (w[1][c] - w[0][c]).abs()).fold(0.0, f32::max)).fold(0.0, f32::max);
+        assert!(step < 0.01, "largest chromaticity step between neighbours {step}");
+        let end = row[239];
+        assert!(end.iter().all(|v| (v - 1.0 / 3.0).abs() < 1e-3), "fully clipped end {end:?}");
+    }
+
+    /// A smooth pink ramp (`[0.9k, k, 0.8k]`, k from 0.8 to 1.35) whose green clips first, then red, then blue,
+    /// in `rows` of a `h`-row picture that is otherwise near black: the rebuilt middle row, and where green first
+    /// clips on it.
+    fn rebuilt_ramp(rows: std::ops::Range<usize>, h: usize) -> (Vec<[f32; 3]>, usize) {
+        let (w, k0, k1) = (1600usize, 0.8f32, 1.35f32);
+        let k = |x: usize| k0 + (k1 - k0) * x as f32 / (w - 1) as f32;
+        let img0 = Rgb32f::from_fn(w, h, |x, y| if rows.contains(&y) { [0.9 * k(x), k(x), 0.8 * k(x)].map(|v| v.min(1.0)) } else { [0.01; 3] });
+        let mut img = img0.clone();
+        reconstruct(&mut img, WB, 0.99);
+        let y = (rows.start + rows.end) / 2;
+        let row: Vec<[f32; 3]> = (0..w).map(|x| balanced(img.get(x, y))).collect();
+        (row, (0..w).find(|&x| img0.get(x, y)[1] >= 0.99).unwrap_or(0))
+    }
+
+    /// No channel changes by more than `at_clip` (relative) where green first clips, nor by 3 % anywhere.
+    fn assert_continuous(row: &[[f32; 3]], first: usize, at_clip: f32, case: &str) {
+        // across the first clip the colour carries on as it was (the sensor's own colour, not a fade)
+        let (a, b) = (row[first - 1], row[first]);
+        assert!((0..3).all(|c| (b[c] / a[c] - 1.0).abs() < at_clip), "{case}, first clip: {a:?} then {b:?}");
+        let worst = row.windows(2).map(|p| (0..3).map(|c| (p[1][c] / p[0][c] - 1.0).abs()).fold(0.0, f32::max)).fold(0.0, f32::max);
+        // (a smooth ramp moves 0.04 % per pixel here; the rebuilt colour turns faster where it leaves the colour of
+        // the unclipped part for neutral, but never by a step)
+        assert!(worst < 0.03, "{case}: largest relative step between neighbours {worst}");
+    }
+
+    /// The rebuilt colour has no step anywhere along the ramp: not where green first clips (the neutral fade starts
+    /// from nothing there), nor where red does, nor where the last channel clips (the fade ends at the fully
+    /// clipped neutral).
+    #[test]
+    fn rebuilt_ramp_is_continuous_from_the_first_clip_to_the_last() {
+        let (row, first) = rebuilt_ramp(0..32, 32);
+        assert_continuous(&row, first, 0.002, "full ramp");
+    }
+
+    /// The same ramp as a thin line on near black has no reliable colour around (every pixel of it is on a strong
+    /// edge), so its clipped part falls back to the neutral guess. That guess only applies as far as the line runs
+    /// past its own unclipped part: no step where it first clips, however thin the line and however much dark
+    /// background surrounds it.
+    #[test]
+    fn thin_line_without_reliable_colour_is_continuous_where_it_clips() {
+        for height in [32usize, 512, 1024] {
+            for width in [1usize, 4, 16] {
+                let top = (height - width) / 2;
+                let (row, first) = rebuilt_ramp(top..top + width, height);
+                assert_continuous(&row, first, 0.002, &format!("{width} rows of {height}"));
+                // and well past the first clip the neutral guess has taken over (green as high as red and blue imply)
+                let far = row[1500];
+                assert!(far[1] > 0.95 * far[2], "{width} rows of {height}: {far:?}");
+            }
+        }
+    }
+
+    /// Issue #523 (a river photo darkened by Highlights -75): a pale cyan-blue sky (`[1, 1.07, 1.2]` white-balanced)
+    /// brightening from left to right through the point where green clips (and later blue), above bright
+    /// yellow-green foliage, with thin dark branches standing in its lower half. Its rebuilt colour used to lean
+    /// green to teal: the foliage lent its colour to the sky (green rebuilt from it), with a step where green first
+    /// clips, and the sky kept its own pale colour where Lightroom shows white.
+    #[test]
+    fn pale_sky_by_dark_branches_and_foliage_is_not_tinted() {
+        let sky = [1.0, 1.07, 1.2];
+        let (w, h) = (320usize, 96usize);
+        let k = |x: usize| 0.7 * (1.2 * x as f32 / (w - 1) as f32).exp2();
+        let branches = [150usize, 200, 250];
+        let on_branch = |x: usize| branches.iter().any(|&b| (b.saturating_sub(1)..=b + 2).contains(&x));
+        let img0 = Rgb32f::from_fn(w, h, |x, y| {
+            sensor(if y >= 72 {
+                [0.5, 0.6, 0.22]
+            } else if y >= 40 && branches.iter().any(|&b| x == b || x == b + 1) {
+                [0.1, 0.09, 0.04]
+            } else {
+                sky.map(|v| v * k(x))
+            })
+        });
+        let mut img = img0.clone();
+        reconstruct(&mut img, WB, 0.99);
+        let at = |x: usize, y: usize| chroma(balanced(img.get(x, y)));
+        let first = (0..w).find(|&x| img0.get(x, 20)[1] >= 0.99).unwrap_or(0);
+        assert!(first > 0 && first < 150);
+        let diff = |a: [f32; 3], b: [f32; 3]| (0..3).map(|c| (a[c] - b[c]).abs()).fold(0.0, f32::max);
+        for y in [20, 50] {
+            // no step where green clips
+            let step = diff(at(first - 1, y), at(first, y));
+            assert!(step < 0.001, "row {y}: step of {step} where green clips");
+            for x in first..w {
+                // nothing but the sky's colour on its way to neutral (no green from the foliage)...
+                let off = off_the_way_to_neutral(at(x, y), chroma(sky));
+                assert!(on_branch(x) || off < 0.005, "row {y}, x {x}: {:?} is off the sky's way to neutral by {off}", at(x, y));
+                // ... the same beside the branches as above them ...
+                let beside = diff(at(x, y), at(x, 20));
+                assert!(on_branch(x) || beside < 0.005, "row {y}, x {x}: {:?} beside a branch, {:?} above", at(x, y), at(x, 20));
+            }
+            // ... and neutral well before the last channel clips (the sky is 0.7 stops past green's clip there)
+            let end = at(w - 1, y);
+            assert!(end.iter().all(|v| (v - 1.0 / 3.0).abs() < 0.002), "row {y}: {end:?} at the end");
+        }
+    }
+
+    #[test]
+    fn unclipped_pixels_are_left_exactly() {
         let mut seed = 0x2545_f491_4f6c_dd1du64;
         let mut rnd = move || {
             seed ^= seed << 13;
@@ -328,28 +724,28 @@ mod tests {
             seed ^= seed << 17;
             (seed >> 40) as f32 / (1u64 << 24) as f32
         };
-        for (w, h) in [(1, 1), (1, 2), (3, 1), (7, 5), (64, 48), (129, 77)] {
-            for density in [0.02f32, 0.3, 0.97] {
-                // smooth colour with clipped blobs, some dark pixels, some fully clipped ones
-                let noise: Vec<f32> = (0..w * h).map(|_| rnd()).collect();
-                let img = Rgb32f::from_fn(w, h, |x, y| {
-                    let t = ((x as f32 * 0.21).sin() + (y as f32 * 0.17).cos()) * 0.5;
-                    let base = [0.5 + 0.4 * t, 0.45 - 0.2 * t, 0.3 + 0.1 * t];
-                    let r = noise[y * w + x];
-                    if r < density * 0.3 {
-                        [1.0, 1.0, 1.0]
-                    } else if r < density {
-                        [1.0, base[1] * 1.6, base[2]]
-                    } else if r > 0.995 {
-                        [0.0, 0.0, 0.00001]
-                    } else {
-                        base
-                    }
-                });
-                let wb = [2.1, 1.0, 1.6];
-                let (mut a, mut b) = (img.clone(), img.clone());
-                assert_eq!(reconstruct(&mut a, wb, 0.99), reconstruct_ref(&mut b, wb, 0.99));
-                assert!(a.data == b.data, "{w}×{h} at {density}");
+        for (w, h) in [(1, 1), (3, 1), (7, 5), (64, 48), (129, 77)] {
+            let noise: Vec<f32> = (0..w * h).map(|_| rnd()).collect();
+            let img = Rgb32f::from_fn(w, h, |x, y| {
+                let t = ((x as f32 * 0.21).sin() + (y as f32 * 0.17).cos()) * 0.5;
+                let base = [0.5 + 0.4 * t, 0.45 - 0.2 * t, 0.3 + 0.1 * t];
+                match noise[y * w + x] {
+                    r if r < 0.1 => [1.0; 3],
+                    r if r < 0.4 => [1.0, base[1] * 1.6, base[2]],
+                    r if r > 0.995 => [0.0, 0.0, 0.00001],
+                    _ => base,
+                }
+            });
+            let mut out = img.clone();
+            let n = reconstruct_with(&mut out, [2.1, 1.0, 1.6], 0.99, [1.02, 0.99, 1.05]);
+            let clipped = img.data.iter().filter(|p| p.iter().any(|&v| v >= 0.99)).count();
+            assert_eq!(n, clipped);
+            for (a, b) in img.data.iter().zip(&out.data) {
+                if a.iter().all(|&v| v < 0.99) {
+                    assert_eq!(a, b, "{w}×{h}");
+                } else {
+                    assert!(b.iter().all(|v| v.is_finite() && *v >= 0.0), "{w}×{h}: {b:?}");
+                }
             }
         }
     }
@@ -368,19 +764,23 @@ mod tests {
 
     #[test]
     fn reconstruct_restores_clipped_channel() {
-        // a warm gradient whose red channel clips in the bright half
-        let truth = Rgb32f::from_fn(64, 16, |x, _| {
-            let v = 0.3 + 1.2 * x as f32 / 63.0;
+        // a warm gradient whose red channel clips at its bright end
+        let truth = Rgb32f::from_fn(256, 16, |x, _| {
+            let v = 0.3 + 1.0 * x as f32 / 255.0;
             [v * 1.0, v * 0.6, v * 0.35]
         });
         let mut img = truth.map(|p| p.map(|v| v.min(1.0)));
-        let before: f32 = img.data.iter().zip(&truth.data).map(|(a, b)| (a[0] - b[0]).abs()).sum();
+        let first = (0..256).find(|&x| img.get(x, 8)[0] >= 0.999).unwrap();
+        // near the unclipped gradient (within the reach of its colour) red is rebuilt from it
+        let err = |img: &Rgb32f| -> f32 { (first..first + 12).map(|x| (img.get(x, 8)[0] - truth.get(x, 8)[0]).abs()).sum() };
+        let before = err(&img);
         let n = reconstruct(&mut img, [1.0, 1.0, 1.0], 0.999);
         assert!(n > 0);
-        let after: f32 = img.data.iter().zip(&truth.data).map(|(a, b)| (a[0] - b[0]).abs()).sum();
+        let after = err(&img);
         assert!(after < before * 0.2, "before {before} after {after}");
         // unclipped pixels untouched
         assert_eq!(img.get(0, 0), truth.get(0, 0));
+        assert_eq!(img.get(first - 1, 8), truth.get(first - 1, 8));
     }
 
     #[test]
@@ -394,4 +794,23 @@ mod tests {
         let mut empty = Rgb32f::new(0, 0);
         assert_eq!(reconstruct(&mut empty, [1.0; 3], 0.99), 0);
     }
+
+    /// `cargo test --release -p lightcraft-raw --lib -- --ignored bench_reconstruct --nocapture`
+    #[test]
+    #[ignore]
+    fn bench_reconstruct() {
+        let img = Rgb32f::from_fn(6000, 4000, |x, y| {
+            let v = 0.4 + 0.8 * ((x as f32 * 0.003).sin() * (y as f32 * 0.002).cos()).abs();
+            [v.min(1.0), (v * 0.7).min(1.0), (v * 0.5).min(1.0)]
+        });
+        let ms = (0..3)
+            .map(|_| {
+                let mut i = img.clone();
+                let t = std::time::Instant::now();
+                reconstruct(&mut i, [2.0, 1.0, 1.5], 0.99);
+                t.elapsed().as_secs_f64() * 1e3
+            })
+            .fold(f64::MAX, f64::min);
+        eprintln!("reconstruct 24 MP: {ms:.0} ms");
+    }
 }
diff --git a/crates/raw/src/jxl.rs b/crates/raw/src/jxl.rs
index 9e5bfc5f..5bfbb22d 100644
--- a/crates/raw/src/jxl.rs
+++ b/crates/raw/src/jxl.rs
@@ -9,17 +9,24 @@
 //! tiles decode bit-exactly, whatever bit depth the encoder declared relative to the IFD's
 //! `BitsPerSample`. Float samples are returned as decoded.
 //!
-//! We never request an output colour encoding, so jxl-oxide renders in the codestream's *original*
-//! colour encoding: for lossless (non-XYB) data that is the identity, keeping the values in the raw IFD's
-//! sample space. Lossy (XYB) tiles are converted from XYB back to that signalled encoding by jxl-oxide;
-//! [INFERENCE] DNG writers signal a linear encoding matching the raw data there, so the result is the raw
-//! sample space up to the codec's loss — not verified against a real lossy JXL DNG.
+//! Lossless (non-XYB) tiles are rendered in the codestream's own colour encoding, which is the identity,
+//! keeping the values in the raw IFD's sample space. Lossy (XYB) tiles are decoded by jxl-oxide to linear
+//! sRGB primaries; the codestream's declared primaries are then restored with a plain 3×3 matrix. We
+//! never let jxl-oxide convert to the declared encoding itself: that step gamut-maps and clips to
+//! [0, 1], which destroys raw values above 1.0 (a `WhiteLevel` of 32768 puts them far above) and
+//! desaturates. The result is the linear sample space the DNG's `WhiteLevel` refers to, up to the
+//! codec's loss, and can exceed 1.0 or dip below 0.
+//!
+//! Every tile is decoded with wide (32-bit) modular buffers. A lossy tile whose header sets
+//! `modular_16bit_buffers` can still carry values that need more than 16 bits; the narrow buffers then
+//! fail with `InvalidAnsStream` or `UnexpectedEof`.
 
 use crate::tiffraw::ChunkPx;
 use crate::{RawError, Result};
+use jxl_oxide::color::{ColourEncoding, ColourSpace, Primaries, TransferFunction, WhitePoint};
 use jxl_oxide::frame::Encoding;
 use jxl_oxide::image::BitDepth;
-use jxl_oxide::{AllocTracker, JxlImage, JxlThreadPool};
+use jxl_oxide::{AllocTracker, EnumColourEncoding, JxlImage, JxlThreadPool, RenderingIntent};
 
 /// Decoder memory (bytes) allowed per sample of a tile. jxl-oxide 0.12 peaks at about three 32-bit
 /// buffers per sample: measured ≤ 10.3 bytes for lossless (modular) tiles and ≤ 13.5 bytes per
@@ -29,6 +36,99 @@ const BYTES_PER_SAMPLE: usize = 16;
 /// on a 16 × 16 tile.
 const MARGIN_BYTES: usize = 64 << 10;
 
+/// Linear sRGB primaries with a D65 white point (the space jxl-oxide decodes XYB to) and the matrix that
+/// takes a linear colour in it to the codestream's declared primaries (row-major, D65 white point).
+type Matrix = [[f64; 3]; 3];
+
+const D65: [f64; 2] = [0.3127, 0.3290];
+const SRGB: [[f64; 2]; 3] = [[0.640, 0.330], [0.300, 0.600], [0.150, 0.060]];
+const BT2100: [[f64; 2]; 3] = [[0.708, 0.292], [0.170, 0.797], [0.131, 0.046]];
+const P3: [[f64; 2]; 3] = [[0.680, 0.320], [0.265, 0.690], [0.150, 0.060]];
+
+fn inverse(m: Matrix) -> Matrix {
+    let c =
+        |i: usize, j: usize| m[(i + 1) % 3][(j + 1) % 3] * m[(i + 2) % 3][(j + 2) % 3] - m[(i + 1) % 3][(j + 2) % 3] * m[(i + 2) % 3][(j + 1) % 3];
+    let det = m[0][0] * c(0, 0) + m[0][1] * c(0, 1) + m[0][2] * c(0, 2);
+    let mut out = [[0.0; 3]; 3];
+    for (i, row) in out.iter_mut().enumerate() {
+        for (j, v) in row.iter_mut().enumerate() {
+            *v = c(j, i) / det;
+        }
+    }
+    out
+}
+
+fn mul(a: Matrix, b: Matrix) -> Matrix {
+    let mut out = [[0.0; 3]; 3];
+    for (i, row) in out.iter_mut().enumerate() {
+        for (j, v) in row.iter_mut().enumerate() {
+            *v = (0..3).map(|k| a[i][k] * b[k][j]).sum();
+        }
+    }
+    out
+}
+
+/// Linear RGB → XYZ for primaries `p` (xy) and the D65 white point.
+fn rgb_to_xyz(p: [[f64; 2]; 3]) -> Matrix {
+    let xyz = |[x, y]: [f64; 2]| [x / y, 1.0, (1.0 - x - y) / y];
+    let cols = [xyz(p[0]), xyz(p[1]), xyz(p[2])];
+    let prim = [[cols[0][0], cols[1][0], cols[2][0]], [1.0, 1.0, 1.0], [cols[0][2], cols[1][2], cols[2][2]]];
+    let w = xyz(D65);
+    let inv = inverse(prim);
+    let s: [f64; 3] = std::array::from_fn(|i| (0..3).map(|k| inv[i][k] * w[k]).sum());
+    std::array::from_fn(|i| std::array::from_fn(|j| prim[i][j] * s[j]))
+}
+
+/// How a chunk is rendered by jxl-oxide.
+#[derive(Debug, Clone, Copy, PartialEq)]
+enum Output {
+    /// In the codestream's own colour encoding (non-XYB: the identity).
+    AsCoded,
+    /// XYB (lossy) data: linear sRGB primaries from the decoder, then `Some(matrix)` to the declared
+    /// primaries (`None` when those are sRGB's).
+    FromXyb(Option<[[f32; 3]; 3]>),
+}
+
+/// Decide how to render a chunk from its header: whether it is XYB-coded, the declared colour
+/// encoding and the intensity target. Lossy data is only accepted when the declared encoding is a
+/// linear RGB one with a D65 white point (what a raw DNG writer signals) and no HDR tone mapping would
+/// apply, otherwise the samples cannot be restored faithfully.
+fn output_for(xyb: bool, encoding: &ColourEncoding, intensity_target: f32, planes: usize) -> Result<Output> {
+    if !xyb {
+        return Ok(Output::AsCoded);
+    }
+    let unsupported = |what: &str| RawError::Unsupported(format!("lossy JPEG XL tile with {what}"));
+    if planes != 3 {
+        return Err(unsupported("a single colour plane"));
+    }
+    let ColourEncoding::Enum(e) = encoding else {
+        return Err(unsupported("an ICC profile instead of a colour encoding"));
+    };
+    if e.colour_space != ColourSpace::Rgb || e.tf != TransferFunction::Linear {
+        return Err(unsupported("a declared encoding that is not linear RGB"));
+    }
+    if e.white_point != WhitePoint::D65 {
+        return Err(unsupported("a white point other than D65"));
+    }
+    if intensity_target > 255.0 {
+        return Err(unsupported("an intensity target above 255 nits"));
+    }
+    let primaries = match e.primaries {
+        Primaries::Srgb => return Ok(Output::FromXyb(None)),
+        Primaries::Bt2100 => BT2100,
+        Primaries::P3 => P3,
+        Primaries::Custom { red, green, blue } => [red, green, blue].map(|c| c.as_float().map(f64::from)),
+    };
+    if primaries.iter().any(|p| p[1] <= 0.0) {
+        return Err(unsupported("invalid primaries"));
+    }
+    let m = mul(inverse(rgb_to_xyz(primaries)), rgb_to_xyz(SRGB));
+    if m.iter().flatten().any(|v| !v.is_finite()) {
+        return Err(unsupported("degenerate primaries"));
+    }
+    Ok(Output::FromXyb(Some(m.map(|r| r.map(|v| v as f32)))))
+}
+
 fn corrupt(e: impl std::fmt::Display) -> RawError {
     RawError::Corrupt(format!("JPEG XL tile: {e}"))
 }
@@ -37,7 +137,7 @@ fn corrupt(e: impl std::fmt::Display) -> RawError {
 /// nominal `cw × ch`, or the part of it inside the image `vw × vh` (edge tiles), `cpp` colour planes,
 /// a sample type matching the IFD. Returns the decoder and the codestream's integer maximum (0 for float).
 #[allow(clippy::too_many_arguments)]
-fn open(src: &[u8], cw: usize, ch: usize, vw: usize, vh: usize, cpp: usize, bits: u32, float: bool) -> Result<(JxlImage, f32)> {
+fn open(src: &[u8], cw: usize, ch: usize, vw: usize, vh: usize, cpp: usize, bits: u32, float: bool) -> Result<(JxlImage, f32, Output)> {
     if !matches!(cpp, 1 | 3) {
         return Err(RawError::Unsupported(format!("JPEG XL with {cpp} samples per pixel")));
     }
@@ -49,8 +149,9 @@ fn open(src: &[u8], cw: usize, ch: usize, vw: usize, vh: usize, cpp: usize, bits
     let pixels = cw.saturating_mul(ch);
     let budget = |planes: usize| pixels.saturating_mul(planes).saturating_mul(BYTES_PER_SAMPLE);
     let tracker = AllocTracker::with_limit(budget(cpp).saturating_add(MARGIN_BYTES));
-    let img = JxlImage::builder()
+    let mut img = JxlImage::builder()
         .pool(JxlThreadPool::none()) // chunks are already decoded in parallel
+        .force_wide_buffers(true) // see the module documentation
         .alloc_tracker(tracker.clone())
         .read(std::io::Cursor::new(src))
         .map_err(corrupt)?;
@@ -75,7 +176,11 @@ fn open(src: &[u8], cw: usize, ch: usize, vw: usize, vh: usize, cpp: usize, bits
         BitDepth::FloatSample { .. } if float => 0.0,
         d => return Err(RawError::Corrupt(format!("JPEG XL tile sample type {d:?} does not match the IFD"))),
     };
-    Ok((img, max))
+    let output = output_for(header.metadata.xyb_encoded, &header.metadata.colour_encoding, header.metadata.tone_mapping.intensity_target, planes)?;
+    if matches!(output, Output::FromXyb(_)) {
+        img.request_color_encoding(EnumColourEncoding::srgb_linear(RenderingIntent::Relative));
+    }
+    Ok((img, max, output))
 }
 
 /// Check the first chunk's headers ([`open`]) without decoding pixels (header-only probing).
@@ -88,7 +193,7 @@ pub(crate) fn check(src: &[u8], cw: usize, ch: usize, vw: usize, vh: usize, cpp:
 /// in-image size `vw × vh` fills the top-left of that, the rest stays 0.
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn decode(src: &[u8], cw: usize, ch: usize, vw: usize, vh: usize, cpp: usize, bits: u32, float: bool) -> Result<ChunkPx> {
-    let (img, max) = open(src, cw, ch, vw, vh, cpp, bits, float)?;
+    let (img, max, output) = open(src, cw, ch, vw, vh, cpp, bits, float)?;
     if img.num_loaded_keyframes() == 0 {
         return Err(corrupt("no complete frame"));
     }
@@ -100,22 +205,116 @@ pub(crate) fn decode(src: &[u8], cw: usize, ch: usize, vw: usize, vh: usize, cpp
     }
     let n = cw.saturating_mul(ch).saturating_mul(cpp);
     let rows = fb.buf().chunks_exact(jw * fc);
+    // lossy data: restore the declared primaries (see the module documentation)
+    let matrix = match output {
+        Output::FromXyb(m) => m,
+        Output::AsCoded => None,
+    };
+    let restore = |s: &[f32], d: &mut [f32]| match matrix {
+        Some(m) => {
+            for (d, row) in d.iter_mut().zip(&m) {
+                *d = row[0] * s[0] + row[1] * s[1] + row[2] * s[2];
+            }
+        }
+        None => d.copy_from_slice(&s[..cpp]),
+    };
     Ok(if float {
         let mut out = vec![0f32; n];
         for (dst, src) in out.chunks_exact_mut(cw * cpp).zip(rows) {
             for (d, s) in dst.chunks_exact_mut(cpp).zip(src.chunks_exact(fc)) {
-                d.iter_mut().zip(s).for_each(|(d, s)| *d = *s);
+                restore(s, d);
             }
         }
         ChunkPx::F32(out)
     } else {
         let mut out = vec![0u16; n];
+        let mut px = [0f32; 3];
         for (dst, src) in out.chunks_exact_mut(cw * cpp).zip(rows) {
             for (d, s) in dst.chunks_exact_mut(cpp).zip(src.chunks_exact(fc)) {
+                restore(s, &mut px[..cpp]);
                 // `as` saturates (NaN → 0): lossy overshoot clips to the integer range
-                d.iter_mut().zip(s).for_each(|(d, s)| *d = (s * max).round() as u16);
+                d.iter_mut().zip(&px).for_each(|(d, s)| *d = (s * max).round() as u16);
             }
         }
         ChunkPx::U16(out)
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use jxl_oxide::color::Customxy;
+
+    fn linear(primaries: Primaries) -> ColourEncoding {
+        ColourEncoding::Enum(EnumColourEncoding {
+            colour_space: ColourSpace::Rgb,
+            white_point: WhitePoint::D65,
+            primaries,
+            tf: TransferFunction::Linear,
+            rendering_intent: RenderingIntent::Perceptual,
+        })
+    }
+
+    fn matrix(o: Output) -> [[f32; 3]; 3] {
+        match o {
+            Output::FromXyb(Some(m)) => m,
+            other => panic!("expected a matrix, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn data_that_is_not_xyb_is_rendered_as_coded() {
+        // lossless tiles: whatever the header declares, the decoder must not convert anything
+        for e in
+            [linear(Primaries::Srgb), linear(Primaries::Bt2100), ColourEncoding::Enum(EnumColourEncoding::srgb_gamma22(RenderingIntent::Relative))]
+        {
+            assert_eq!(output_for(false, &e, 255.0, 3).unwrap(), Output::AsCoded);
+            assert_eq!(output_for(false, &e, 10_000.0, 1).unwrap(), Output::AsCoded);
+        }
+    }
+
+    #[test]
+    fn lossy_data_with_srgb_primaries_needs_no_matrix() {
+        assert_eq!(output_for(true, &linear(Primaries::Srgb), 255.0, 3).unwrap(), Output::FromXyb(None));
+    }
+
+    #[test]
+    fn lossy_data_is_restored_to_the_declared_primaries() {
+        // linear sRGB to linear BT.2020/BT.2100 primaries (D65), as published in ITU-R BT.2087
+        let expect = [[0.6274, 0.3293, 0.0433], [0.0691, 0.9195, 0.0114], [0.0164, 0.0880, 0.8956]];
+        let m = matrix(output_for(true, &linear(Primaries::Bt2100), 255.0, 3).unwrap());
+        for (r, e) in m.iter().zip(&expect) {
+            for (v, e) in r.iter().zip(e) {
+                assert!((v - e).abs() < 1e-3, "{m:?}");
+            }
+            // the white point maps to itself: rows sum to one
+            assert!((r.iter().sum::<f32>() - 1.0).abs() < 1e-5, "{m:?}");
+        }
+        // custom primaries equal to the named ones give the same matrix
+        let xy = |[x, y]: [f64; 2]| Customxy { x: (x * 1e6) as i32, y: (y * 1e6) as i32 };
+        let custom = Primaries::Custom { red: xy(BT2100[0]), green: xy(BT2100[1]), blue: xy(BT2100[2]) };
+        let c = matrix(output_for(true, &linear(custom), 255.0, 3).unwrap());
+        assert!(c.iter().flatten().zip(m.iter().flatten()).all(|(a, b)| (a - b).abs() < 1e-5), "{c:?} {m:?}");
+        // the sRGB primaries lie inside the wider P3 gamut: the full-saturation sRGB green is a valid P3 colour
+        let inv = matrix(output_for(true, &linear(Primaries::P3), 255.0, 3).unwrap());
+        let srgb_green_in_p3 = [inv[0][1], inv[1][1], inv[2][1]];
+        assert!(srgb_green_in_p3.iter().all(|v| (0.0..=1.0).contains(v)), "sRGB green lies inside P3");
+    }
+
+    #[test]
+    fn lossy_data_that_cannot_be_restored_is_unsupported() {
+        let bad = |xyb_planes: usize, e: ColourEncoding, it: f32| matches!(output_for(true, &e, it, xyb_planes), Err(RawError::Unsupported(_)));
+        assert!(bad(1, linear(Primaries::Srgb), 255.0), "grey");
+        assert!(bad(3, linear(Primaries::Srgb), 10_000.0), "HDR intensity target would tone-map");
+        assert!(bad(3, ColourEncoding::Enum(EnumColourEncoding::srgb_gamma22(RenderingIntent::Relative)), 255.0), "non-linear");
+        let mut e = EnumColourEncoding::srgb_linear(RenderingIntent::Relative);
+        e.white_point = WhitePoint::Dci;
+        assert!(bad(3, ColourEncoding::Enum(e.clone()), 255.0), "white point");
+        e.white_point = WhitePoint::D65;
+        e.primaries =
+            Primaries::Custom { red: Customxy { x: 0, y: 0 }, green: Customxy { x: 300_000, y: 600_000 }, blue: Customxy { x: 150_000, y: 60_000 } };
+        assert!(bad(3, ColourEncoding::Enum(e.clone()), 255.0), "degenerate primaries");
+        e.colour_space = ColourSpace::Grey;
+        assert!(bad(3, ColourEncoding::Enum(e.clone()), 255.0), "grey declared");
+    }
+}
diff --git a/crates/raw/src/lib.rs b/crates/raw/src/lib.rs
index 11ec839f..e21ee347 100644
--- a/crates/raw/src/lib.rs
+++ b/crates/raw/src/lib.rs
@@ -16,9 +16,8 @@
 //! `jxl` feature, on by default), tiled/stripped, CFA and LinearRaw),
 //! Canon CR2 / CR3 (lossless CRX Bayer and version 0x100/0x200 C-RAW), Nikon NEF/NRW (uncompressed, Huffman lossless / lossy compressed), Sony ARW (uncompressed, ARW2, lossless), Fujifilm RAF (uncompressed Bayer
 //! and X-Trans, lossless and lossy compressed), Panasonic RW2 / Leica RWL / Panasonic RAW (every raw format: compressed 4 and 6, the prefix-coded strips of 8,
-//! packed 2/5/7, the 16-bit words of the oldest bodies), Pentax PEF (uncompressed, Huffman), Olympus ORF (uncompressed).
-//! [`embedded_preview`] covers these containers' JPEG previews. Variants we can't decode yet (Nikon "lossy after split" NEF,
-//! compressed ORF, CR3 unverified marker families / C-RAW configurations) return [`RawError::Unsupported`]; each vendor module documents its sources
+//! packed 2/5/7, the 16-bit words of the oldest bodies), Pentax PEF (uncompressed, Huffman), Olympus ORF (uncompressed: 16-bit words, 12-bit XZ-2 words, 12-bit 16-byte blocks of the E-300/E-330/E-500).
+//! [`embedded_preview`] covers these containers' JPEG previews. Variants we can't decode yet (compressed ORF, CR3 unverified marker families / C-RAW configurations) return [`RawError::Unsupported`]; each vendor module documents its sources
 //! (public specifications, tag-name documentation, black-box analysis of CC0 samples) and gaps. Non-DNG files carry no
 //! colour matrix: [`color`] falls back to a documented neutral model. The decoders never panic on malformed input.
 #![forbid(unsafe_code)]
@@ -37,6 +36,7 @@ pub mod ljpeg;
 pub mod opcodes;
 mod preview;
 pub mod profile;
+mod saturation;
 pub mod semantic;
 mod tiffraw;
 mod unpack;
@@ -49,7 +49,7 @@ pub use lightcraft_geom::Orientation;
 pub use lightcraft_meta::Metadata;
 pub use lightcraft_raster::Rgb32f;
 pub use opcodes::{Opcode, OpcodeLists};
-pub use preview::{PreviewColorSpace, embedded_preview, embedded_preview_color_space};
+pub use preview::{PreviewColorSpace, embedded_preview, embedded_preview_color_space, embedded_preview_dynamic_range_optimized};
 pub use semantic::{SemanticMask, semantic_masks};
 
 use lightcraft_color::Xy;
@@ -96,6 +96,10 @@ pub enum RawFormat {
     Mrw,
     /// Sigma / Foveon X3F (`FOVb`).
     X3f,
+    /// A TIFF-based raw that has no DNG version tag but describes itself the way DNG does (a
+    /// full-resolution CFA image with black/white levels, a default crop and `AsShotNeutral`):
+    /// Hasselblad 3FR and FFF. Read by the DNG reader.
+    CfaTiff,
     /// Another TIFF-based raw (3FR, IIQ, ERF, KDC, DCR, MOS, …).
     OtherTiff,
 }
@@ -114,6 +118,8 @@ impl RawFormat {
                 | RawFormat::Raf
                 | RawFormat::Rw2
                 | RawFormat::Pef
+                | RawFormat::CfaTiff
+                | RawFormat::Srw
         )
     }
 }
@@ -153,6 +159,11 @@ pub fn probe(bytes: &[u8]) -> Option<RawFormat> {
     }
     let make = t.find(lightcraft_tiff::tags::MAKE).and_then(|e| e.value.as_str()).unwrap_or_default().to_ascii_uppercase();
     let has_cfa = has_raw_ifd(&t);
+    // Pentax's reader takes the layout from the Exif `CFAPattern` when no IFD has a CFA photometric (uncompressed
+    // and PackBits PEFs), so for the Pentax family that tag counts as raw evidence too
+    let pentax_raw = has_cfa || t.exif().is_some_and(|e| e.contains(vendor::EXIF_CFA_PATTERN));
+    // Samsung's raw IFD uses private compressions 32769..=32773 (`vendor::srw`), 32773 being PackBits elsewhere
+    let samsung_raw = has_cfa || t.all_ifds().iter().any(|i| i.u16(lightcraft_tiff::tags::COMPRESSION).is_some_and(|c| (32769..=32773).contains(&c)));
     if make.starts_with("CANON") && t.ifds.len() >= 4 && t.ifds[3].u16(lightcraft_tiff::tags::COMPRESSION) == Some(6) {
         return Some(RawFormat::Cr2);
     }
@@ -162,18 +173,31 @@ pub fn probe(bytes: &[u8]) -> Option<RawFormat> {
     if make.starts_with("SONY") && has_cfa {
         return Some(RawFormat::Arw);
     }
-    if (make.starts_with("PENTAX") || make.starts_with("RICOH")) && has_cfa {
+    if (make.starts_with("PENTAX") || make.starts_with("RICOH")) && pentax_raw {
         return Some(RawFormat::Pef);
     }
-    if make.starts_with("SAMSUNG") && has_cfa {
+    // a Samsung-branded body built on a Pentax design writes a Pentax-style maker note (the note's own magic)
+    if make.starts_with("SAMSUNG") && pentax_raw && has_pentax_maker_note(&t, bytes) {
+        return Some(RawFormat::Pef);
+    }
+    if make.starts_with("SAMSUNG") && samsung_raw {
         return Some(RawFormat::Srw);
     }
+    if dng::is_plain_cfa_tiff(&t, bytes) {
+        return Some(RawFormat::CfaTiff);
+    }
     if has_cfa || thumbnail_shell(&t, bytes.len()).is_some() || is_preview_container(ifd0) {
         return Some(RawFormat::OtherTiff);
     }
     None
 }
 
+/// Whether the Exif maker note starts with the signature of the Pentax layouts (`AOC\0` or `PENTAX \0`).
+fn has_pentax_maker_note(t: &Tiff, bytes: &[u8]) -> bool {
+    let Some(e) = t.exif().and_then(|e| e.get(lightcraft_tiff::tags::MAKER_NOTE)) else { return false };
+    bytes.get(e.offset as usize..).is_some_and(|n| n.starts_with(b"AOC\0") || n.starts_with(b"PENTAX \0"))
+}
+
 /// Whether some IFD is marked as raw: CFA photometric, or a raw-only compression value (99 is not a
 /// registered TIFF compression; Leaf MOS files use it for their tiled 16-bit lossless-JPEG raw),
 /// or vendor-specific raw tags (Sony tone curve, CFA pattern, or Pentax compression 65535).
@@ -260,6 +284,15 @@ fn thumbnail_shell(t: &Tiff, len: usize) -> Option<ThumbnailShell> {
 /// Why [`decode`] gives up on a file [`probe`] called [`RawFormat::OtherTiff`].
 fn other_tiff_reason(bytes: &[u8]) -> String {
     let t = Tiff::parse_with(bytes, &lightcraft_tiff::ParseOptions { max_ifds: 256, ..Default::default() }).ok();
+    // a DNG-style CFA IFD whose lossless JPEG the lossless decoder rejects: say why
+    if let Some(t) = &t
+        && let Some(info) = dng::raw_ifd(t).and_then(|i| i.image().ok())
+        && info.compression == lightcraft_tiff::tags::compression::JPEG
+        && let Some(src) = info.chunks(bytes.len() as u64).first().and_then(|c| lightcraft_tiff::image::chunk_bytes(bytes, c))
+        && let Err(e) = ljpeg::frame_info(src)
+    {
+        return format!("raw image coded as lossless JPEG that is not decoded yet ({e})");
+    }
     match t.as_ref().filter(|t| !has_raw_ifd(t)).and_then(|t| thumbnail_shell(t, bytes.len())) {
         Some(s) => format!(
             "{}x{} raw image in a private block, not decoded yet (the file's first image is a {}x{} reduced copy)",
@@ -300,7 +333,7 @@ pub(crate) enum Mode {
 
 fn decode_with(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     match probe(bytes).ok_or(RawError::NotRaw)? {
-        RawFormat::Dng => dng::decode(bytes, mode),
+        RawFormat::Dng => dng::decode(bytes, mode).map(lift_clipped),
         RawFormat::Cr2 => vendor::cr2::decode(bytes, mode),
         RawFormat::Cr3 => vendor::cr3::decode(bytes, mode),
         RawFormat::Nef | RawFormat::Nrw => vendor::nef::decode(bytes),
@@ -309,11 +342,20 @@ fn decode_with(bytes: &[u8], mode: Mode) -> Result<RawImage> {
         RawFormat::Rw2 => vendor::rw2::decode(bytes, mode),
         RawFormat::Pef => vendor::pef::decode(bytes, mode),
         RawFormat::Orf => vendor::orf::decode(bytes, mode),
+        RawFormat::CfaTiff => dng::decode_as(bytes, mode, RawFormat::CfaTiff).map(lift_clipped),
+        RawFormat::Srw => vendor::srw::decode(bytes, mode),
         RawFormat::OtherTiff => Err(RawError::Unsupported(other_tiff_reason(bytes))),
         other => Err(RawError::Unsupported(format!("{other:?} files are not decoded yet"))),
     }
 }
 
+/// DNG writers state a white level the sensor may never reach; samples stuck at the real saturation point are
+/// raised to the white level so they count as clipped (see [`RawImage::lift_clipped_samples`]).
+fn lift_clipped(mut r: RawImage) -> RawImage {
+    r.lift_clipped_samples();
+    r
+}
+
 /// A raw file's description without its samples (see [`probe_info`]).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct RawInfo {
@@ -526,7 +568,8 @@ pub struct ColorData {
     pub baseline_sharpness: Option<f64>,
     /// The file's own camera-profile look (`ProfileHueSatMap*`, `ProfileLookTable*`,
     /// `ProfileToneCurve`), applied by [`color`]'s users at render time, and its
-    /// `ProfileGainTableMap*`, kept (a DNG export writes it back) but not rendered.
+    /// `ProfileGainTableMap*`, kept (a DNG export writes it back) and rendered only when a photo's
+    /// "Camera local tone mapping" option asks for it (`lightcraft_pipeline::local_tone`).
     #[serde(default)]
     pub profile: profile::ProfileLook,
 }
@@ -876,6 +919,18 @@ mod tests {
         assert_eq!(probe(&padded(&[rgb_ifd(16, 12), rgb_ifd(400, 300)])), None);
         // no dimensions at all
         assert_eq!(probe(&padded(&[IfdBuilder::new().with(t::MAKE, Value::Ascii("X".into()))])), None);
+        // raw evidence without a CFA photometric: Pentax's Exif `CFAPattern` (uncompressed / PackBits PEFs) and
+        // Samsung's private compressions (here 32773, PackBits elsewhere: NX1, NX500)
+        let mut pef = rgb_ifd(400, 300);
+        pef.set(t::MAKE, Value::Ascii("PENTAX Corporation".into()));
+        let mut exif = exif_size(400, 300);
+        exif.set(vendor::EXIF_CFA_PATTERN, Value::Undefined(vec![0, 2, 0, 2, 0, 1, 1, 2]));
+        pef.set_child(t::EXIF_IFD, exif);
+        assert_eq!(probe(&padded(&[pef])), Some(RawFormat::Pef));
+        let mut srw = rgb_ifd(400, 300);
+        srw.set(t::MAKE, Value::Ascii("SAMSUNG".into()));
+        srw.set(t::COMPRESSION, Value::Short(vec![32773]));
+        assert_eq!(probe(&padded(&[srw])), Some(RawFormat::Srw));
         // camera-authored or exported TIFFs preserving camera Make tags remain ordinary images
         for make in ["SONY", "NIKON CORPORATION", "PENTAX", "RICOH", "SAMSUNG"] {
             let mut cam = rgb_ifd(400, 300);
@@ -922,6 +977,32 @@ mod tests {
         assert_eq!(probe(&g), None);
     }
 
+    /// A GoPro GPR (a DNG with VC-5 coded raw data, Compression 9) is refused by the full decode with
+    /// a reason that names the format, whatever its tile bytes hold; the header probe still
+    /// describes it (so it imports).
+    #[test]
+    fn gopro_vc5_dng_is_unsupported_with_a_clear_reason() {
+        let mut ifd = IfdBuilder::new();
+        ifd.set(t::NEW_SUBFILE_TYPE, Value::Long(vec![0]));
+        ifd.set(t::IMAGE_WIDTH, Value::Long(vec![32]));
+        ifd.set(t::IMAGE_LENGTH, Value::Long(vec![16]));
+        ifd.set(t::BITS_PER_SAMPLE, Value::Short(vec![16]));
+        ifd.set(t::SAMPLES_PER_PIXEL, Value::Short(vec![1]));
+        ifd.set(t::PHOTOMETRIC, Value::Short(vec![32803]));
+        ifd.set(t::COMPRESSION, Value::Short(vec![9]));
+        ifd.set(t::DNG_VERSION, Value::Byte(vec![1, 4, 0, 0]));
+        ifd.set(t::CFA_REPEAT_PATTERN_DIM, Value::Short(vec![2, 2]));
+        ifd.set(t::CFA_PATTERN_EP, Value::Byte(vec![0, 1, 1, 2]));
+        ifd.set_image(ImageData::Tiles { tile_width: 32, tile_height: 16, tiles: vec![vec![0x5au8; 400]] });
+        let bytes = write(&[ifd]);
+        assert_eq!(probe(&bytes), Some(RawFormat::Dng));
+        let want = "DNG compression 9 (GoPro VC-5) is not decoded yet";
+        let Err(RawError::Unsupported(why)) = decode(&bytes) else { panic!("expected Unsupported from decode") };
+        assert_eq!(why, want);
+        let info = probe_info(&bytes).expect("header probe describes the file");
+        assert_eq!((info.width, info.height), (32, 16));
+    }
+
     /// Compression 99 (not a registered TIFF value; Leaf MOS tiles) marks a raw even without a CFA tag.
     #[test]
     fn private_compression_99_is_a_raw() {
@@ -930,6 +1011,148 @@ mod tests {
         assert_eq!(probe(&write(&[ifd])), Some(RawFormat::OtherTiff));
     }
 
+    // --- TIFF raws that describe their raw IFD the way DNG does but carry no DNG version tag ---
+
+    /// 8 x 6 samples, 16 bits, value `1000 + 100 y + x`.
+    fn cfa_samples() -> Vec<u16> {
+        (0..48u16).map(|i| 1000 + 100 * (i / 8) + i % 8).collect()
+    }
+
+    /// A small raw in the layout of the Hasselblad 3FR/FFF family: IFD0 is a reduced RGB image with the
+    /// colour tags, a SubIFD holds the full-resolution CFA image (no `CFAPattern`, DNG-style levels and
+    /// crop). `strip` is the CFA image's data and `compression` its coding.
+    fn plain_cfa_tiff(compression: u16, strip: Vec<u8>, pattern: Option<[u8; 4]>) -> Vec<u8> {
+        let mut raw = IfdBuilder::new();
+        raw.set(t::NEW_SUBFILE_TYPE, Value::Long(vec![0]));
+        raw.set(t::IMAGE_WIDTH, Value::Long(vec![8]));
+        raw.set(t::IMAGE_LENGTH, Value::Long(vec![6]));
+        raw.set(t::BITS_PER_SAMPLE, Value::Short(vec![16]));
+        raw.set(t::SAMPLES_PER_PIXEL, Value::Short(vec![1]));
+        raw.set(t::PHOTOMETRIC, Value::Short(vec![t::photometric::CFA]));
+        raw.set(t::COMPRESSION, Value::Short(vec![compression]));
+        raw.set(t::BLACK_LEVEL, Value::Rational(vec![(256, 1)]));
+        raw.set(t::WHITE_LEVEL, Value::Long(vec![60000]));
+        raw.set(t::DEFAULT_CROP_ORIGIN, Value::Short(vec![2, 2]));
+        raw.set(t::DEFAULT_CROP_SIZE, Value::Short(vec![4, 2]));
+        if let Some(p) = pattern {
+            raw.set(t::CFA_REPEAT_PATTERN_DIM, Value::Short(vec![2, 2]));
+            raw.set(t::CFA_PATTERN_EP, Value::Byte(p.to_vec()));
+        }
+        raw.set_image(ImageData::Strips { rows_per_strip: 6, strips: vec![strip] });
+        let mut ifd0 = rgb_ifd(4, 3);
+        ifd0.set(t::MAKE, Value::Ascii("Hasselblad".into()));
+        ifd0.set(t::COLOR_MATRIX_1, Value::SRational(vec![(5, 10), (-1, 10), (0, 10), (-5, 10), (12, 10), (3, 10), (-1, 10), (2, 10), (6, 10)]));
+        ifd0.set(t::AS_SHOT_NEUTRAL, Value::Rational(vec![(2, 5), (1, 1), (3, 5)]));
+        ifd0.add_sub_ifd(raw);
+        write(&[ifd0])
+    }
+
+    fn le_words(v: &[u16]) -> Vec<u8> {
+        v.iter().flat_map(|x| x.to_le_bytes()).collect()
+    }
+
+    /// Known answer: samples, black and white level, crop and colour come from the file's own tags; the
+    /// layout it does not state is RGGB.
+    #[test]
+    fn uncompressed_cfa_tiff_without_a_dng_version_decodes() {
+        let bytes = plain_cfa_tiff(1, le_words(&cfa_samples()), None);
+        assert_eq!(probe(&bytes), Some(RawFormat::CfaTiff));
+        let r = decode(&bytes).unwrap();
+        assert_eq!((r.format, r.width, r.height, r.bits), (RawFormat::CfaTiff, 8, 6, 16));
+        assert_eq!(r.data, RawData::U16(cfa_samples()));
+        assert_eq!(r.cfa.as_ref().unwrap().name(), "RGGB");
+        assert_eq!((r.black.mean(), r.white.clone()), (256.0, vec![60000.0]));
+        assert_eq!(r.crop, Rect::new(2, 2, 4, 2));
+        assert!(color::has_matrix(&r.color));
+        assert_eq!(r.color.as_shot_neutral, Some([0.4, 1.0, 0.6]));
+        // headers only: the same description without samples
+        let i = probe_info(&bytes).unwrap();
+        assert_eq!((i.format, i.cfa.as_ref().map(Cfa::name), i.crop), (RawFormat::CfaTiff, Some("RGGB".to_string()), Rect::new(2, 2, 4, 2)));
+    }
+
+    /// Without DNG's white-balance tag the file is left alone (a Kodak or Sinar TIFF with a CFA IFD, say).
+    #[test]
+    fn cfa_tiff_without_a_white_balance_tag_is_not_claimed() {
+        let mut raw = IfdBuilder::new();
+        raw.set(t::IMAGE_WIDTH, Value::Long(vec![8]));
+        raw.set(t::IMAGE_LENGTH, Value::Long(vec![6]));
+        raw.set(t::BITS_PER_SAMPLE, Value::Short(vec![16]));
+        raw.set(t::SAMPLES_PER_PIXEL, Value::Short(vec![1]));
+        raw.set(t::PHOTOMETRIC, Value::Short(vec![t::photometric::CFA]));
+        raw.set(t::COMPRESSION, Value::Short(vec![1]));
+        raw.set_image(ImageData::Strips { rows_per_strip: 6, strips: vec![le_words(&cfa_samples())] });
+        let mut ifd0 = rgb_ifd(4, 3);
+        ifd0.add_sub_ifd(raw);
+        assert_eq!(probe(&write(&[ifd0])), Some(RawFormat::OtherTiff));
+    }
+
+    /// A stated `CFAPattern` wins over the RGGB default.
+    #[test]
+    fn cfa_tiff_keeps_a_stated_pattern() {
+        let bytes = plain_cfa_tiff(1, le_words(&cfa_samples()), Some([2, 1, 1, 0]));
+        assert_eq!(decode(&bytes).unwrap().cfa.unwrap().name(), "BGGR");
+    }
+
+    /// The lossless-JPEG coding of the same layout goes through the lossless decoder (one strip for the
+    /// whole image, as the 3FR/FFF files have it).
+    #[test]
+    fn lossless_jpeg_cfa_tiff_decodes() {
+        let strip = ljpeg::encode(&cfa_samples(), 8, 6, 1, 16, 1, 0);
+        let bytes = plain_cfa_tiff(7, strip, None);
+        assert_eq!(probe(&bytes), Some(RawFormat::CfaTiff));
+        let r = decode(&bytes).unwrap();
+        assert_eq!(r.data, RawData::U16(cfa_samples()));
+        assert_eq!(r.cfa.unwrap().name(), "RGGB");
+    }
+
+    /// A lossless-JPEG scan whose predictor selection value is outside 0 to 7 (the 3FR/FFF files use 8) is
+    /// not a coding the lossless decoder knows: the file stays an undecodable raw, with that as the reason,
+    /// and keeps the stand-in preview an unsupported container gets.
+    #[test]
+    fn cfa_tiff_with_an_unknown_predictor_stays_undecodable() {
+        let mut strip = ljpeg::encode(&cfa_samples(), 8, 6, 1, 16, 1, 0);
+        let sos = strip.windows(2).position(|w| w == [0xff, 0xda]).unwrap();
+        let ss = sos + 2 + 2 + 1 + 2;
+        assert_eq!(strip[ss], 1, "selection value byte");
+        strip[ss] = 8;
+        assert!(matches!(ljpeg::decode(&strip, 1 << 20), Err(RawError::Unsupported(w)) if w.contains("selection value 8")));
+        let bytes = plain_cfa_tiff(7, strip, None);
+        assert_eq!(probe(&bytes), Some(RawFormat::OtherTiff));
+        assert!(!RawFormat::OtherTiff.is_supported());
+        let Err(RawError::Unsupported(why)) = decode(&bytes) else { panic!("expected Unsupported") };
+        assert!(why.contains("lossless JPEG") && why.contains("selection value 8"), "{why}");
+    }
+
+    /// Other codings of a CFA IFD (here Deflate) are not claimed by the plain reader.
+    #[test]
+    fn cfa_tiff_with_another_coding_is_not_claimed() {
+        let bytes = plain_cfa_tiff(8, vec![0; 96], None);
+        assert_eq!(probe(&bytes), Some(RawFormat::OtherTiff));
+    }
+
+    /// A Samsung-branded body whose maker note has a Pentax layout is read by the Pentax reader; another
+    /// Samsung file stays with the Samsung format.
+    #[test]
+    fn samsung_make_with_a_pentax_maker_note_is_pef() {
+        let with_note = |note: &[u8], cfa: bool| {
+            let mut ifd = rgb_ifd(16, 12);
+            if cfa {
+                ifd.set(t::PHOTOMETRIC, Value::Short(vec![t::photometric::CFA]));
+            }
+            ifd.set(t::MAKE, Value::Ascii("SAMSUNG TECHWIN".into()));
+            let mut exif = IfdBuilder::new();
+            exif.set(t::MAKER_NOTE, Value::Undefined(note.to_vec()));
+            ifd.set_child(t::EXIF_IFD, exif);
+            write(&[ifd])
+        };
+        assert_eq!(probe(&with_note(b"AOC\0MM\0\x01\0\0\0\0\0\0", true)), Some(RawFormat::Pef));
+        assert_eq!(probe(&with_note(b"PENTAX \0MM\0\0\0\0\0\0\0", true)), Some(RawFormat::Pef));
+        assert_eq!(probe(&with_note(b"STMN100\0\0\0\0\0\0\0\0\0", true)), Some(RawFormat::Srw));
+        // without raw evidence (an RGB image from such a body) neither reader claims it (#281)
+        assert_eq!(probe(&with_note(b"AOC\0MM\0\x01\0\0\0\0\0\0", false)), None);
+        assert_eq!(probe(&with_note(b"STMN100\0\0\0\0\0\0\0\0\0", false)), None);
+    }
+
     #[test]
     fn probe_rejects_junk() {
         assert_eq!(probe(b""), None);
diff --git a/crates/raw/src/ljpeg.rs b/crates/raw/src/ljpeg.rs
index c8087a8e..02ae5e80 100644
--- a/crates/raw/src/ljpeg.rs
+++ b/crates/raw/src/ljpeg.rs
@@ -325,8 +325,11 @@ fn parse_header(d: &[u8]) -> Result<Header, RawError> {
                 }
                 h.predictor = seg[1 + 2 * ns];
                 h.pt = seg[3 + 2 * ns] & 15;
-                if !(0..=7).contains(&h.predictor) {
-                    return Err(err("bad predictor"));
+                if h.predictor > 7 {
+                    return Err(RawError::Unsupported(format!(
+                        "lossless JPEG scan with predictor selection value {} (T.81 defines 0 to 7)",
+                        h.predictor
+                    )));
                 }
                 if h.pt >= h.precision {
                     return Err(err("bad point transform"));
@@ -369,12 +372,25 @@ fn check_subsampled(h: &Header) -> Result<usize, RawError> {
     Ok(vertical)
 }
 
-/// Sony M/S tiles: horizontal prediction, no restart markers. Keep subsampled planes separate;
-/// expanding them into a mosaic would silently corrupt the existing CFA callers.
-pub(crate) fn frame_info_subsampled(d: &[u8]) -> Result<(usize, usize), RawError> {
+/// Sony M/S tiles and Canon sRAW / mRAW: horizontal prediction, no restart markers. Keep subsampled planes
+/// separate; expanding them into a mosaic would silently corrupt the existing CFA callers.
+/// Returns (width, height, vertical subsampling of the chroma planes).
+pub(crate) fn frame_info_subsampled(d: &[u8]) -> Result<(usize, usize, usize), RawError> {
     let h = parse_header(d)?;
-    check_subsampled(&h)?;
-    Ok((h.width, h.height))
+    let vertical = check_subsampled(&h)?;
+    Ok((h.width, h.height, vertical))
+}
+
+/// How the first-column prediction and the running predictor of a subsampled frame are chosen.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Prediction {
+    /// Sony: the left neighbour in the plane; at the first column the sample above, except that a top luma
+    /// row of an MCU row reads the previous MCU row's top luma sample.
+    Geometric,
+    /// Canon: every component is its own one-dimensional chain in decoding order (the previous sample of the
+    /// same component, so the second luma row of a 4:2:0 MCU continues from the end of the first); the first
+    /// sample of each MCU row starts from the first sample of the previous MCU row.
+    Sequential,
 }
 
 pub(crate) struct FrameSubsampled {
@@ -385,11 +401,13 @@ pub(crate) struct FrameSubsampled {
     pub planes: [Vec<u16>; 3],
 }
 
-/// Sony's 4:2:0 / 4:2:2 LJ92 variants: T.81 MCU ordering and differences, modulo 2^16.
-/// At the first column, the top luma row predicts from the previous MCU row's top
+/// The 4:2:0 / 4:2:2 LJ92 variants of Sony (M/S ARW) and Canon (sRAW / mRAW): T.81 MCU ordering and differences,
+/// modulo 2^16. [`Prediction`] selects the predictor each maker uses.
+///
+/// Sony: at the first column, the top luma row predicts from the previous MCU row's top
 /// sample (two image rows above), and the bottom row from the current top sample.
 /// Observed black-box: using the immediately preceding image row introduces tile seams.
-pub(crate) fn decode_subsampled(d: &[u8], max_samples: usize) -> Result<FrameSubsampled, RawError> {
+pub(crate) fn decode_subsampled(d: &[u8], max_samples: usize, prediction: Prediction) -> Result<FrameSubsampled, RawError> {
     let h = parse_header(d)?;
     let vertical = check_subsampled(&h)?;
     let pixels = h.width.checked_mul(h.height).ok_or_else(|| err("frame too large"))?;
@@ -410,6 +428,9 @@ pub(crate) fn decode_subsampled(d: &[u8], max_samples: usize) -> Result<FrameSub
     let mut planes = [vec![0u16; pixels], vec![0u16; chroma], vec![0u16; chroma]];
     let mut br = BitReader::new(entropy);
     let init = 1i32 << (h.precision - h.pt - 1);
+    // Sequential prediction: the last sample of each component, and the first sample of its previous MCU row
+    let mut last = [init; 3];
+    let mut row_first = [init; 3];
     for my in 0..h.height / vertical {
         for mx in 0..h.width / 2 {
             for (c, plane) in planes.iter_mut().enumerate() {
@@ -420,20 +441,24 @@ pub(crate) fn decode_subsampled(d: &[u8], max_samples: usize) -> Result<FrameSub
                     for dx in 0..horizontal_factor {
                         let (x, y) = (mx * horizontal_factor + dx, my * vertical_factor + dy);
                         let i = y * width + x;
-                        let pred = if x > 0 {
-                            plane[i - 1] as i32
-                        } else if c == 0 && dy == 0 && y >= vertical {
-                            plane[i - vertical * width] as i32
-                        } else if y > 0 {
-                            plane[i - width] as i32
-                        } else {
-                            init
+                        let pred = match prediction {
+                            Prediction::Geometric if x > 0 => plane[i - 1] as i32,
+                            Prediction::Geometric if c == 0 && dy == 0 && y >= vertical => plane[i - vertical * width] as i32,
+                            Prediction::Geometric if y > 0 => plane[i - width] as i32,
+                            Prediction::Geometric => init,
+                            Prediction::Sequential if mx == 0 && dx == 0 && dy == 0 => row_first[c],
+                            Prediction::Sequential => last[c],
                         };
                         let ssss = tables[c].decode(&mut br)?;
                         if ssss > 16 {
                             return Err(err("invalid difference category"));
                         }
-                        plane[i] = ((pred + diff_value(&mut br, ssss)) & 0xffff) as u16;
+                        let value = ((pred + diff_value(&mut br, ssss)) & 0xffff) as u16;
+                        plane[i] = value;
+                        last[c] = i32::from(value);
+                        if mx == 0 && dx == 0 && dy == 0 {
+                            row_first[c] = i32::from(value);
+                        }
                     }
                 }
             }
@@ -816,11 +841,13 @@ pub(crate) mod tests {
 
     /// Independent 4×4, 16-bit Sony 4:2:0 stream. Hand-specified differences in MCU order.
     pub(crate) fn fixture_420() -> Vec<u8> {
-        fixture_subsampled(4, 0x22, &[-31768, 1, 1000, 1, -16384, -16284, 1, 1, 1, 1, 1, 2, 100, 1, 1000, 1, 100, 100, 1, 1, 1, 1, 1, 2])
+        fixture_subsampled(4, 4, 0x22, &[-31768, 1, 1000, 1, -16384, -16284, 1, 1, 1, 1, 1, 2, 100, 1, 1000, 1, 100, 100, 1, 1, 1, 1, 1, 2])
     }
 
-    fn fixture_subsampled(height: u8, sampling: u8, differences: &[i32]) -> Vec<u8> {
-        let mut out = vec![0xff, 0xd8, 0xff, 0xc3, 0, 17, 16, 0, height, 0, 4, 3, 1, sampling, 0, 2, 0x11, 0, 3, 0x11, 0];
+    /// A 16-bit three-component frame of `width × height` pixels with the given luma `sampling` (`0x21` / `0x22`)
+    /// and one shared 5-bit Huffman table, whose differences are written as given (MCU order).
+    pub(crate) fn fixture_subsampled(width: u8, height: u8, sampling: u8, differences: &[i32]) -> Vec<u8> {
+        let mut out = vec![0xff, 0xd8, 0xff, 0xc3, 0, 17, 16, 0, height, 0, width, 3, 1, sampling, 0, 2, 0x11, 0, 3, 0x11, 0];
         out.extend_from_slice(&[0xff, 0xc4, 0, 36, 0]);
         let mut counts = [0; 16];
         counts[4] = 17;
@@ -844,28 +871,28 @@ pub(crate) mod tests {
     #[test]
     fn horizontal_only_subsampling_preserves_rows_and_chroma() {
         // Independent 4×2, 16-bit 4:2:2 stream: two luma samples, Cb, Cr per MCU.
-        let enc = fixture_subsampled(2, 0x21, &[-31768, 1, -16384, -16284, 1, 1, 1, 2, 100, 1, 100, 100, 1, 1, 1, 2]);
-        let frame = decode_subsampled(&enc, 16).unwrap();
+        let enc = fixture_subsampled(4, 2, 0x21, &[-31768, 1, -16384, -16284, 1, 1, 1, 2, 100, 1, 100, 100, 1, 1, 1, 2]);
+        let frame = decode_subsampled(&enc, 16, Prediction::Geometric).unwrap();
         assert_eq!((frame.width, frame.height, frame.vertical_subsampling), (4, 2, 1));
         assert_eq!(frame.planes[0], [1000, 1001, 1002, 1003, 1100, 1101, 1102, 1103]);
         assert_eq!(frame.planes[1], [16384, 16385, 16484, 16485]);
         assert_eq!(frame.planes[2], [16484, 16486, 16584, 16586]);
         assert!(decode(&enc, 24).is_err());
-        assert!(matches!(decode_subsampled(&enc, 15), Err(RawError::Limit(_))));
-        assert!(decode_subsampled(&enc[..enc.len() - 6], 16).is_err());
+        assert!(matches!(decode_subsampled(&enc, 15, Prediction::Geometric), Err(RawError::Limit(_))));
+        assert!(decode_subsampled(&enc[..enc.len() - 6], 16, Prediction::Geometric).is_err());
     }
 
     #[test]
     fn subsampled_mcu_order_preserves_each_plane() {
         let enc = fixture_420();
-        let frame = decode_subsampled(&enc, 24).unwrap();
+        let frame = decode_subsampled(&enc, 24, Prediction::Geometric).unwrap();
         assert_eq!((frame.width, frame.height), (4, 4));
         assert_eq!(frame.planes[0], [1000, 1001, 1002, 1003, 2000, 2001, 2002, 2003, 1100, 1101, 1102, 1103, 2100, 2101, 2102, 2103]);
         assert_eq!(frame.planes[1], [16384, 16385, 16484, 16485]);
         assert_eq!(frame.planes[2], [16484, 16486, 16584, 16586]);
         assert!(decode(&enc, 48).is_err()); // CFA API must keep rejecting subsampling.
-        assert!(matches!(decode_subsampled(&enc, 23), Err(RawError::Limit(_))));
-        assert!(decode_subsampled(&enc[..enc.len() - 6], 24).is_err());
+        assert!(matches!(decode_subsampled(&enc, 23, Prediction::Geometric), Err(RawError::Limit(_))));
+        assert!(decode_subsampled(&enc[..enc.len() - 6], 24, Prediction::Geometric).is_err());
         let mut bad = enc.clone();
         bad[10] = 3; // odd frame width
         assert!(frame_info_subsampled(&bad).is_err());
@@ -875,6 +902,25 @@ pub(crate) mod tests {
         assert!(frame_info_subsampled(&bad).is_err());
     }
 
+    #[test]
+    fn sequential_prediction_chains_each_component_in_decoding_order() {
+        // Canon sRAW / mRAW: the same stream as `subsampled_mcu_order_preserves_each_plane`, but each component
+        // continues from its previous sample in decoding order (the second luma row of an MCU follows the first),
+        // and a new MCU row starts from the first sample of the previous one. Worked out by hand from init 32768.
+        let enc = fixture_420();
+        let frame = decode_subsampled(&enc, 24, Prediction::Sequential).unwrap();
+        assert_eq!((frame.width, frame.height, frame.vertical_subsampling), (4, 4, 2));
+        assert_eq!(frame.planes[0], [1000, 1001, 2003, 2004, 2001, 2002, 2005, 2006, 1100, 1101, 2103, 2104, 2101, 2102, 2105, 2106]);
+        assert_eq!(frame.planes[1], [16384, 16385, 16484, 16485]);
+        assert_eq!(frame.planes[2], [16484, 16486, 16584, 16586]);
+        // 4:2:2 has one luma row per MCU row, so both predictions agree
+        let enc = fixture_subsampled(4, 2, 0x21, &[-31768, 1, -16384, -16284, 1, 1, 1, 2, 100, 1, 100, 100, 1, 1, 1, 2]);
+        assert_eq!(
+            decode_subsampled(&enc, 16, Prediction::Sequential).unwrap().planes,
+            decode_subsampled(&enc, 16, Prediction::Geometric).unwrap().planes
+        );
+    }
+
     fn noise(n: usize, bits: u32, seed: u64) -> Vec<u16> {
         let mut s = seed;
         (0..n)
diff --git a/crates/raw/src/preview.rs b/crates/raw/src/preview.rs
index 371b5e4a..d34fb4c6 100644
--- a/crates/raw/src/preview.rs
+++ b/crates/raw/src/preview.rs
@@ -31,6 +31,21 @@ pub fn embedded_preview_color_space(bytes: &[u8]) -> Option<PreviewColorSpace> {
     }
 }
 
+/// Whether the camera optimised its embedded JPEG's dynamic range with local tone mapping that the raw data doesn't
+/// carry: Sony's Dynamic Range Optimizer (maker note `0xb025`, see `vendor::arw`). Such a JPEG is brighter in its
+/// darker regions than the raw developed with the camera's global tone curve. `Some(false)` when the file says it
+/// was off, `None` when it doesn't say (other makers, notes without the tag, undocumented values).
+pub fn embedded_preview_dynamic_range_optimized(bytes: &[u8]) -> Option<bool> {
+    let tiff = Tiff::parse(bytes).ok()?;
+    let make = tiff.ifds.first()?.string(t::MAKE)?;
+    if !make.trim().to_ascii_uppercase().starts_with("SONY") {
+        return None;
+    }
+    let e = tiff.exif()?.get(t::MAKER_NOTE)?;
+    let mn = makernote::parse_makernote(bytes, e.offset, e.count() as u64, tiff.order, &make)?;
+    crate::vendor::arw::dynamic_range_optimizer(&mn)
+}
+
 /// Whether `b` looks like a displayable (DCT) JPEG: SOI, and the first SOF marker is not lossless.
 fn is_dct_jpeg(b: &[u8]) -> bool {
     if b.len() < 4 || b[0] != 0xff || b[1] != 0xd8 {
diff --git a/crates/raw/src/profile.rs b/crates/raw/src/profile.rs
index a21444c4..582bf944 100644
--- a/crates/raw/src/profile.rs
+++ b/crates/raw/src/profile.rs
@@ -12,7 +12,8 @@
 //!   weight); `ProfileLookTableData` comes after exposure compensation and before any tone curve.
 //! - `ProfileToneCurve`: (input, output) pairs in linear gamma from (0, 0) to (1, 1).
 //! - `ProfileGainTableMap*` ([`crate::gaintable`]) is read and kept (a DNG export writes it back)
-//!   but not rendered: Lightroom Classic renders Apple ProRAW without it (measured on the iPhone
+//!   but not rendered by default (the photo's "Camera local tone mapping" option renders it, in the
+//!   pipeline): Lightroom Classic renders Apple ProRAW without it (measured on the iPhone
 //!   12 Pro corpus file against Lightroom Classic 15.6: with the map the default render is far
 //!   brighter than Lightroom's, mean ΔE00 19; without it Lightroom's output is a tight function of
 //!   the hue/saturation map, exposure compensation and tone curve alone).
diff --git a/crates/raw/src/saturation.rs b/crates/raw/src/saturation.rs
new file mode 100644
index 00000000..aaa0a6df
--- /dev/null
+++ b/crates/raw/src/saturation.rs
@@ -0,0 +1,270 @@
+//! Sensors that clip below the stated white level.
+//!
+//! A DNG's `WhiteLevel` is what the writer says the sample range tops out at, not always where the
+//! sensor really saturates: a camera app can state 4095 for 12-bit data that piles up at 3567 (85 % of
+//! the range above black). Highlight handling ([`crate::highlight`]) treats samples at the white level
+//! as clipped; samples stuck 15 % below it look like real, bright, unclipped light, so white balance
+//! multiplies each channel's plateau by a different factor and the highlights turn magenta or cyan.
+//!
+//! [`RawImage::lift_clipped_samples`] finds the real saturation point of each colour from the samples
+//! (a pile-up of identical values near the top of the range) and raises the samples at or above it to
+//! the stated white level. Nothing else changes: unclipped samples keep their values, and a file whose
+//! data really reaches its white level, or has no pile-up, is left alone.
+
+use crate::{RawData, RawImage};
+
+/// A saturation plateau must hold at least this share of its colour's samples (and 100 of them)...
+const MIN_SHARE: f64 = 1e-4;
+/// ...and be at least this many times as populated as the average value just below it.
+const MIN_SPIKE: f64 = 16.0;
+/// Plateaus within this share of the range from the white level are the white level (no lift needed).
+const NEAR_WHITE: f32 = 0.03;
+/// ...and have next to nothing above it (a real clip point is the top of the data; a popular value in the
+/// middle of sparse or curve-coded data has plenty of samples above): at most this share of the plateau
+/// lies more than `ABOVE_MARGIN` of the range over it (a few counts of noise or gain spill past the plateau).
+const MAX_ABOVE: f64 = 0.02;
+const ABOVE_MARGIN: f32 = 0.01;
+/// How far below the plateau the "average value just below it" reaches.
+const NEIGHBOURHOOD: usize = 64;
+
+impl RawImage {
+    /// The value each colour's samples saturate at, when that is clearly below the stated white level
+    /// (see the module docs). Only single-plane integer CFA data is examined.
+    pub fn saturation_points(&self) -> [Option<u16>; 3] {
+        let none = [None; 3];
+        let (RawData::U16(d), Some(cfa)) = (&self.data, &self.cfa) else { return none };
+        let white = self.white_at(0);
+        let black = self.black.mean();
+        // a hostile file can state any levels: NaN, negative or inverted ones are left alone
+        let levels_ok = black.is_finite() && white.is_finite() && black >= 0.0 && white > black && white <= 65535.0;
+        if self.cpp != 1 || !cfa.valid() || self.width.checked_mul(self.height) != Some(d.len()) || !levels_ok {
+            return none;
+        }
+        let a = self.active_area;
+        let fits = |start: usize, len: usize, max: usize| start.checked_add(len).is_some_and(|end| end <= max);
+        if !fits(a.x, a.width, self.width) || !fits(a.y, a.height, self.height) {
+            return none;
+        }
+        let lo = (black + 0.5 * (white - black)).ceil().max(0.0) as usize;
+        let hi = (white as usize).min(65535);
+        if lo + NEIGHBOURHOOD >= hi {
+            return none;
+        }
+        let mut hist = vec![[0u32; 3]; 65536];
+        let mut total = [0u64; 3];
+        for y in 0..a.height {
+            let row = &d[(a.y + y) * self.width + a.x..][..a.width];
+            for (x, &v) in row.iter().enumerate() {
+                let c = cfa.color_at(a.x + x, a.y + y).min(2) as usize;
+                total[c] += 1;
+                hist[v as usize][c] += 1;
+            }
+        }
+        let mut out = none;
+        for c in 0..3 {
+            // the most populated value of the upper half of the range
+            let Some((v, n)) = (lo..hi).map(|v| (v, hist[v][c])).max_by_key(|&(v, n)| (n, v)) else { continue };
+            if (n as f64) < (total[c] as f64 * MIN_SHARE).max(100.0) || v as f32 >= white - NEAR_WHITE * (white - black) {
+                continue;
+            }
+            let below: u64 = (v.saturating_sub(NEIGHBOURHOOD)..v).map(|u| hist[u][c] as u64).sum();
+            let from = (v + ((ABOVE_MARGIN * (white - black)) as usize).max(1) + 1).min(hist.len());
+            let above: u64 = hist[from..].iter().map(|h| h[c] as u64).sum();
+            if n as f64 >= MIN_SPIKE * (below as f64 / NEIGHBOURHOOD as f64).max(1.0) && above as f64 <= MAX_ABOVE * n as f64 {
+                out[c] = Some(v as u16);
+            }
+        }
+        out
+    }
+
+    /// Raise samples at or above their colour's real saturation point ([`Self::saturation_points`]) to the
+    /// stated white level, so highlight reconstruction recognises them as clipped. Returns how many
+    /// samples changed (0: the data is untouched).
+    pub fn lift_clipped_samples(&mut self) -> usize {
+        let points = self.saturation_points();
+        if points.iter().all(Option::is_none) {
+            return 0;
+        }
+        let (a, w, white) = (self.active_area, self.width, self.white_at(0).round() as u16);
+        let Some(cfa) = self.cfa.clone() else { return 0 };
+        let RawData::U16(d) = &mut self.data else { return 0 };
+        let mut changed = 0;
+        for y in 0..a.height {
+            let row = &mut d[(a.y + y) * w + a.x..][..a.width];
+            for (x, v) in row.iter_mut().enumerate() {
+                let c = cfa.color_at(a.x + x, a.y + y).min(2) as usize;
+                if let Some(p) = points[c]
+                    && *v >= p
+                    && *v < white
+                {
+                    *v = white;
+                    changed += 1;
+                }
+            }
+        }
+        changed
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::*;
+
+    /// A 64 x 64 RGGB mosaic with a gradient, black 528, whose samples above `clip` (when given) are
+    /// stuck at `clip` like a sensor that saturates early.
+    fn raw_with(clip: Option<u16>, white: f32) -> RawImage {
+        let data = (0..64 * 64)
+            .map(|i| {
+                let v = 528 + ((i % 64) * 60 + (i / 64) * 7) as u16 % 4000;
+                clip.map_or(v, |c| v.min(c))
+            })
+            .collect();
+        RawImage {
+            format: RawFormat::Dng,
+            width: 64,
+            height: 64,
+            cpp: 1,
+            data: RawData::U16(data),
+            cfa: Cfa::bayer("RGGB"),
+            bits: 12,
+            black: BlackLevel::uniform(528.0),
+            white: vec![white],
+            active_area: Rect::new(0, 0, 64, 64),
+            crop: Rect::new(0, 0, 64, 64),
+            orientation: Orientation::Normal,
+            color: ColorData::default(),
+            wb_multipliers: None,
+            linearized: false,
+            opcodes: OpcodeLists::default(),
+            metadata: Metadata::default(),
+        }
+    }
+
+    /// The gradient of `raw_with`, wrapped so it never gets near the top of the range.
+    fn without_top(r: &mut RawImage) {
+        if let RawData::U16(d) = &mut r.data {
+            for v in d.iter_mut() {
+                *v = 528 + (*v - 528) % 3000;
+            }
+        }
+    }
+
+    #[test]
+    fn hostile_levels_are_left_alone() {
+        // a negative or NaN black level used to let the search start below NEIGHBOURHOOD and underflow
+        for black in [-5000.0, f32::NAN] {
+            let mut r = raw_with(Some(40), 4095.0);
+            r.black = BlackLevel::uniform(black);
+            assert_eq!(r.saturation_points(), [None; 3]);
+            assert_eq!(r.lift_clipped_samples(), 0);
+        }
+        // an active area that runs past the image (or overflows when added up) is refused
+        let mut r = raw_with(Some(3567), 4095.0);
+        r.active_area = Rect::new(usize::MAX, 0, 2, 64);
+        assert_eq!(r.saturation_points(), [None; 3]);
+    }
+
+    #[test]
+    fn a_pile_up_below_the_white_level_is_found_and_lifted() {
+        let mut r = raw_with(Some(3567), 4095.0);
+        assert!(r.saturation_points().iter().all(|p| *p == Some(3567)), "{:?}", r.saturation_points());
+        let before = r.data.clone();
+        assert!(r.lift_clipped_samples() > 100);
+        let (RawData::U16(b), RawData::U16(a)) = (&before, &r.data) else { return };
+        for (x, y) in b.iter().zip(a) {
+            // plateau samples go to the white level, everything else is untouched
+            assert_eq!(*y, if *x >= 3567 { 4095 } else { *x });
+        }
+        assert_eq!(r.lift_clipped_samples(), 0, "idempotent");
+    }
+
+    #[test]
+    fn data_that_reaches_its_white_level_is_left_alone() {
+        let mut r = raw_with(Some(4095), 4095.0);
+        let before = r.data.clone();
+        assert_eq!(r.saturation_points(), [None; 3]);
+        assert_eq!(r.lift_clipped_samples(), 0);
+        assert_eq!(r.data, before);
+    }
+
+    #[test]
+    fn data_without_a_pile_up_is_left_alone() {
+        let mut r = raw_with(None, 4095.0);
+        without_top(&mut r);
+        let before = r.data.clone();
+        assert_eq!(r.saturation_points(), [None; 3]);
+        assert_eq!(r.lift_clipped_samples(), 0);
+        assert_eq!(r.data, before);
+    }
+
+    /// Sparse or curve-coded data has popular values with plenty of samples above them: not a clip point.
+    #[test]
+    fn a_popular_value_with_data_above_it_is_not_a_clip_point() {
+        let mut r = raw_with(None, 4095.0);
+        without_top(&mut r);
+        if let RawData::U16(d) = &mut r.data {
+            for (i, v) in d.iter_mut().enumerate() {
+                // a third of the samples sit on one code in the upper half, a few hundred are brighter
+                *v = if i % 3 == 0 {
+                    3000
+                } else if i % 11 == 0 {
+                    3000 + (i % 700) as u16 + 1
+                } else {
+                    *v
+                };
+            }
+        }
+        assert_eq!(r.saturation_points(), [None; 3]);
+        assert_eq!(r.lift_clipped_samples(), 0);
+    }
+
+    #[test]
+    fn a_few_stuck_samples_are_not_a_plateau() {
+        let mut r = raw_with(None, 4095.0);
+        without_top(&mut r);
+        if let RawData::U16(d) = &mut r.data {
+            for v in d.iter_mut().take(20) {
+                *v = 3800;
+            }
+        }
+        assert_eq!(r.saturation_points(), [None; 3]);
+    }
+
+    /// The decoder applies it: a DNG that states 4095 but saturates at 3567 comes back with the plateau at 4095.
+    #[test]
+    fn decoding_a_dng_lifts_the_plateau() {
+        let r = raw_with(Some(3567), 4095.0);
+        let opts = DngWriteOptions { compression: DngCompression::Uncompressed, ..Default::default() };
+        let bytes = write_dng(&r, &opts).unwrap_or_default();
+        let back = decode(&bytes).map(|b| b.data);
+        let (Ok(RawData::U16(d)), RawData::U16(orig)) = (back, &r.data) else { panic!("decode failed") };
+        assert!(orig.contains(&3567));
+        assert!(d.iter().all(|&v| v != 3567));
+        assert_eq!(d.iter().filter(|&&v| v == 4095).count(), orig.iter().filter(|&&v| v == 3567).count());
+    }
+
+    /// The reported bug end to end: a white wall that clips at 3567 under a stated 4095, with the camera's
+    /// white balance (red x2.46, blue x1.59), must come out neutral after highlight reconstruction.
+    #[test]
+    fn early_clipping_renders_neutral_after_white_balance() {
+        let wb = [2.46f32, 1.0, 1.59];
+        let mut r = raw_with(None, 4095.0);
+        let cfa = r.cfa.clone().unwrap_or_else(Cfa::xtrans);
+        // a wall far brighter than any channel's clip point
+        let wall = Rgb32f::from_fn(64, 64, |_, _| [4.0, 4.0, 4.0]);
+        let n = demosaic::mosaic_from_rgb(&wall, &cfa);
+        r.data = RawData::U16(n.data.iter().map(|&v| (528.0 + v * 3039.0).min(3567.0) as u16).collect());
+        let render = |r: &RawImage| {
+            let mut img = r.develop(Method::Bilinear).unwrap_or_else(|_| Rgb32f::new(1, 1));
+            highlight::reconstruct(&mut img, wb, 0.99);
+            let p = img.get(32, 32);
+            [p[0] * wb[0], p[1] * wb[1], p[2] * wb[2]]
+        };
+        let tint = |p: [f32; 3]| (p[0] / p[1] - 1.0).abs().max((p[2] / p[1] - 1.0).abs());
+        let before = render(&r);
+        assert!(tint(before) > 0.3, "the plateau is not recognised as clipped: {before:?}");
+        assert!(r.lift_clipped_samples() > 1000);
+        let after = render(&r);
+        assert!(tint(after) < 0.01, "{after:?}");
+    }
+}
diff --git a/crates/raw/src/tiffraw.rs b/crates/raw/src/tiffraw.rs
index c28b8b64..676bb619 100644
--- a/crates/raw/src/tiffraw.rs
+++ b/crates/raw/src/tiffraw.rs
@@ -108,6 +108,10 @@ pub fn read_image(data: &[u8], info: &ImageInfo, order: ByteOrder, packing: Pack
         let (c, px) = match r {
             Ok(v) => v,
             Err(e) => {
+                // a JPEG XL tile that cannot be decoded is not a partial image: the file stays preview-only
+                if info.compression == comp::JPEG_XL {
+                    return Err(e);
+                }
                 first_err.get_or_insert(e);
                 continue;
             }
diff --git a/crates/raw/src/vendor/arw.rs b/crates/raw/src/vendor/arw.rs
index acaacf0b..0fa501ac 100644
--- a/crates/raw/src/vendor/arw.rs
+++ b/crates/raw/src/vendor/arw.rs
@@ -14,11 +14,23 @@
 //!    a 128-bit little-endian block: 11-bit max, 11-bit min, 4-bit index of the max, 4-bit index of the min and 14
 //!    seven-bit deltas above the min, scaled by the smallest shift that fits `max − min` into 7 bits.
 //!
-//! White balance: the raw IFD's `0x7313` levels when present (bodies from about 2017 on); otherwise the
-//! `WB_RGBLevels` of the maker note's enciphered `Tag2010` block (see [`DECIPHER`] and [`TAG2010_WB`]). Without
-//! either, an ARW opened with unit multipliers, i.e. a strong green cast (issue #148). Black level: the raw IFD's
-//! `0x7310`, else the level stored in the encrypted `SR2SubIFD` (see [`SR2_BLACK_AT`]; 800 rather than the
-//! default 512 on 1″-sensor bodies such as the RX100 series), else 512 (14-bit) / 128 (12-bit).
+//! White balance: `WB_RGGBLevels` (`0x7313`), the gains the camera applied. Bodies from about 2017 on write them in
+//! plain form in the raw IFD; every ARW from the DSLR-A200 on has them in the encrypted `SR2SubIFD` (see
+//! [`super::sr2`]), and the two agree on every file that has both. Only when neither can be read do we fall back on
+//! the `WB_RGBLevels` of the maker note's enciphered `Tag2010` block (see [`DECIPHER`] and [`TAG2010_WB`]), which
+//! can differ widely from what the camera applied (issue #535). Without any, an ARW opened with unit multipliers,
+//! i.e. a strong green cast (issue #148).
+//!
+//! Black level: the raw IFD's `0x7310`, else the level stored in the encrypted `SR2SubIFD` (see [`sr2_black`]; 800
+//! rather than the default 512 on 1″-sensor bodies such as the RX100 series), else 512 (14-bit) / 128 (12-bit).
+//! Downsized lossless (YCbCr) data sit [`YCBCR_OFFSET`] above that.
+//!
+//! The Sony DSC-R1 (.SR2, 2005) stores uncompressed 16-bit words big-endian inside a little-endian TIFF
+//! ([`word16_order`]). Measured on the CC0 DSC-R1 (raw.pixls.us 3221): StripByteCounts 20780544 = 3984×2608×2; read
+//! big-endian the maximum is 16368 and the image is smooth (neighbour roughness 0.012 against 0.249), read
+//! little-endian the maximum is 65340 (noise). Black stays the default 512 (the masked columns read 511.4) and white
+//! comes from the data. The crop and white balance are NOT addressed here: the file has no maker-note `FullImageSize`
+//! and no plain WB tag (they live in its `SR2SubIFD`), so it opens uncropped with unit multipliers.
 //!
 //! Also: uncompressed 16-bit ARW, and lossless-compressed ARW (Compression 7, ILCE-7M4 and later): LJ92 tiles whose
 //! frames hold one 2×2 CFA cell per four-component sample ([`read_quad_tiles`]). Other lossless-JPEG layouts go
@@ -42,6 +54,23 @@ const REFERENCE_BLACK_WHITE: u16 = 532;
 /// Maker-note tags (ExifTool Sony tag names): the enciphered `Tag2010` block and `FullImageSize` (height, width).
 const MN_TAG2010: u16 = 0x2010;
 const MN_FULL_IMAGE_SIZE: u16 = 0xb02b;
+/// Maker-note `DynamicRangeOptimizer` (ExifTool Sony tag documentation, int32u): 0 Off, 1 Standard, 2 Advanced
+/// Auto, 3 Auto, 8–12 Advanced Lv1–Lv5, 16–23 Lv1–Lv8. Sony writes a second tag of that name, `0xb04f` (0 Off,
+/// 1 Standard, 2 Plus), but it adds nothing: on the 241 Sony raws (75 bodies) of 264 checked that carry both, it
+/// reads 1 whenever `0xb025` is on, whatever the level, and 0 when off; older bodies (DSLR-A100 to A900,
+/// NEX-3/5/C3, SLT-A33/A35/A55) leave it out. `0xb025` was present on all 264 files (98 bodies).
+const MN_DYNAMIC_RANGE_OPTIMIZER: u16 = 0xb025;
+
+/// Whether the camera's Dynamic Range Optimizer (DRO) was on for this shot. DRO is a local tone operator that
+/// brightens darker regions of the camera's JPEG (and the preview embedded in the ARW) but leaves the raw data
+/// alone; the factory default is Auto. `None` when the maker note doesn't record it or holds an undocumented value.
+pub(crate) fn dynamic_range_optimizer(note: &makernote::MakerNote) -> Option<bool> {
+    match note.ifd.u64(MN_DYNAMIC_RANGE_OPTIMIZER)? {
+        0 => Some(false),
+        1..=3 | 8..=12 | 16..=23 => Some(true),
+        _ => None,
+    }
+}
 
 /// Inverse of Sony's maker-note byte substitution. ExifTool's Sony tag documentation states that the data of
 /// tags `0x2010`, `0x9050` and `0x94xx` "is encrypted by a simple substitution cipher" (no decoder source was
@@ -62,9 +91,12 @@ const DECIPHER: [u8; 256] = {
 };
 
 /// `Tag2010` layouts (ExifTool "Sony Tag2010a" … "Tag2010i" tables): the models each is documented for and the
-/// byte offset of `WB_RGBLevels` (three `u16`, the as-shot white balance as R, G, B gains; Tag2010g and h share
-/// the offset). Newer bodies (Tag2010i) also write the levels in plain form in the raw IFD (`0x7313`), which takes
-/// precedence.
+/// byte offset of `WB_RGBLevels` (three `u16`, R, G, B gains; Tag2010g and h share the offset). Only a fallback
+/// for files whose `WB_RGGBLevels` (`0x7313`, plain or in the `SR2SubIFD`) cannot be read. On the 45 CC0
+/// raw.pixls.us ARWs that have both but no plain `0x7313`, the two agree within 5 % on 35 and differ by 8–100 %
+/// on the other 10: five of the eight shot with a preset, colour temperature or custom white balance (ILCE-3500 at
+/// 5600 K: R −34 %, B +100 %) and five in Auto (SLT-A37: R −32 %, B +53 %). Where the camera JPEG has enough
+/// neutral pixels to tell, the gains the camera applied are `WB_RGGBLevels`, not these.
 const TAG2010_WB: &[(&[&str], usize)] = &[
     (&["NEX-5N"], 4476),
     (&["SLT-A65", "SLT-A77", "NEX-7", "NEX-VG20E"], 4480),
@@ -154,9 +186,9 @@ const TAG2010_WB: &[(&[&str], usize)] = &[
     ),
 ];
 
-/// As-shot white balance from the maker note's enciphered `Tag2010` block (bodies that do not write `0x7313` in
-/// the raw IFD: most ARWs before 2017). `model` is the Exif model; Sony appends a regional "V" to some names
-/// (SLT-A77V), which the documented lists omit.
+/// White balance from the maker note's enciphered `Tag2010` block, the fallback described at [`TAG2010_WB`].
+/// `model` is the Exif model; Sony appends a regional "V" to some names (SLT-A77V), which the documented lists
+/// omit.
 fn tag2010_wb(model: &str, block: &[u8], order: lightcraft_tiff::ByteOrder) -> Option<[f32; 3]> {
     let model = model.trim();
     let &(_, offset) = TAG2010_WB.iter().find(|(models, _)| models.iter().any(|m| model == *m || model.strip_suffix('V') == Some(*m)))?;
@@ -171,6 +203,18 @@ fn tag2010_wb(model: &str, block: &[u8], order: lightcraft_tiff::ByteOrder) -> O
     ((0.2..=8.0).contains(&r) && (0.2..=8.0).contains(&b)).then_some([r, 1.0, b])
 }
 
+/// White-balance gains `[R/G, 1, B/G]` from `WB_RGGBLevels` (R, G, G, B); `None` unless there are four levels
+/// with a positive green and plausible ratios.
+fn rggb_gains(levels: &[f64]) -> Option<[f32; 3]> {
+    let &[r, g1, g2, b] = levels else { return None };
+    let g = (g1 + g2) / 2.0;
+    if !g.is_finite() || g <= 0.0 {
+        return None;
+    }
+    let (r, b) = (r / g, b / g);
+    ((0.2..=8.0).contains(&r) && (0.2..=8.0).contains(&b)).then_some([r as f32, 1.0, b as f32])
+}
+
 /// The inverse tone curve: 11-bit code → 14-bit sensor value.
 pub(crate) fn code_curve(thresholds: &[u64]) -> Vec<u16> {
     let mut bp = [0usize, 4095, 4095, 4095, 4095, 4095];
@@ -302,6 +346,18 @@ fn read_quad_tiles(bytes: &[u8], info: &ImageInfo) -> Result<Vec<u16>> {
     Ok(out)
 }
 
+/// Sony's downsized lossless ARWs (M and S sizes: linear YCbCr, already white-balanced) are stored this far above the
+/// sensor black level the raw IFD records (`0x7310`, 512 in every file seen); their reference levels say Y black 0.
+/// Measured against a full-size coding of the same scene shot seconds apart, on the pixels where both camera JPEGs
+/// agree: YCbCr = k · (full-size − black) · WB + b, with b 1015–1052 and green k 0.98–1.02, on 11 of 12 files from
+/// four bodies (ILCE-7M4 M, S and APS-C S; ILCE-7RM5 M, S and S35 S; ILCE-7CR M, S and S35 S; ILCE-9M3 M, S and
+/// APS-C S; the twelfth's reference was shot 24 s later, 7 % brighter). Their darkest 0.1 % lies at 1047–1127. So
+/// black and white both move up by 512: the scale stays the full-size raw's, and an M/S file renders like its
+/// full-size twin. Subtracting only 512 left a pedestal of 3 % of white, lifting the shadows (issue #535).
+const YCBCR_OFFSET: f32 = 512.0;
+/// White of the YCbCr data before [`YCBCR_OFFSET`]: the reference levels' Y white (required by [`read_ycbcr_tiles`]).
+const YCBCR_WHITE: f32 = 16383.0;
+
 /// Downsized M/S ARWs are linear YCbCr 4:2:0 / 4:2:2, not CFA, despite retaining dummy CFA tags.
 /// T.81 supplies the lossless coding; TIFF 6.0 supplies the YCbCr coefficients and reference
 /// levels. Sony's reference chroma black and white are identical (the neutral offset).
@@ -338,7 +394,7 @@ fn read_ycbcr_tiles(bytes: &[u8], info: &ImageInfo, raw: &Ifd, mode: Mode) -> Re
         .map(|c| {
             let src = chunk_bytes(bytes, c).ok_or_else(|| RawError::Corrupt("YCbCr tile outside file".into()))?;
             let limit = (c.width as usize).checked_mul(c.height as usize).and_then(|n| n.checked_mul(3)).ok_or(RawError::Limit("tile too large"))?;
-            let f = ljpeg::decode_subsampled(src, limit)?;
+            let f = ljpeg::decode_subsampled(src, limit, ljpeg::Prediction::Geometric)?;
             if f.width != c.width as usize || f.height != c.height as usize {
                 return Err(RawError::Corrupt("Sony YCbCr tile dimensions".into()));
             }
@@ -367,57 +423,48 @@ fn read_ycbcr_tiles(bytes: &[u8], info: &ImageInfo, raw: &Ifd, mode: Mode) -> Re
     Ok(out)
 }
 
-/// `SR2Private` tags (ExifTool "Sony SR2Private" table; the IFD is referenced by IFD0's `DNGPrivateData`).
-const SR2_SUBIFD_OFFSET: u16 = 0x7200;
-const SR2_SUBIFD_LENGTH: u16 = 0x7201;
-const SR2_SUBIFD_KEY: u16 = 0x7221;
-/// Black level inside the encrypted `SR2SubIFD` (bodies that do not write `0x7310` in the raw IFD), recovered by
-/// black-box known-plaintext analysis of CC0 raw.pixls.us samples; no description of Sony's cipher was used.
+/// The black level stored in the encrypted `SR2SubIFD` (`0x7310`; bodies that do not write it in the raw IFD keep
+/// it only there), in 14-bit units; `None` unless it is SHORT, count 4, and the four levels are equal and plausible.
 ///
-/// Every Sony ARW we examined (16 files, 15 bodies, 2012–2021) stores the same key (`11 22 33 44`), so its
-/// keystream is the same in every file. The DSC-RX100M6 and ILCE-7M3 also write their black levels in plain form
-/// (`0x7310`: 800 and 512); XOR-ing their `SR2SubIFD`s against each other matched `pack(512×4) ^ pack(800×4)` at
-/// exactly one position, byte 2510, which gave the eight keystream bytes there. Applied to the other files at that
-/// position they decode to four equal levels that agree with each sensor's dark-pixel floor: 800 on every 1″-sensor
-/// body (RX10, RX100 … RX100M5), 512 on the APS-C/full-frame ones (NEX-5N/6, SLT-A77, ILCE-6000/7/7M2/7RM2), in
-/// both `SR2SubIFD` sizes seen (29252 and 56958 bytes). Newer layouts (ILCE-7M4, 35398 bytes) put other data there
-/// and are rejected by the plausibility checks; those bodies write `0x7310` anyway.
-const SR2_BLACK_AT: usize = 2510;
-const SR2_BLACK_KEYSTREAM: [u8; 8] = [0x43, 0xcb, 0x86, 0xb6, 0x11, 0xd2, 0x1a, 0x73];
-const SR2_KEY: [u8; 4] = [0x11, 0x22, 0x33, 0x44];
-
-/// The per-channel black level from the encrypted `SR2SubIFD` (see [`SR2_BLACK_AT`]), in 14-bit units; `None`
-/// unless the file uses the known key and the four decoded levels are equal and plausible.
-fn sr2_black(bytes: &[u8], ifd0: &Ifd, order: lightcraft_tiff::ByteOrder) -> Option<f32> {
-    let private = ifd0.bytes(t::DNG_PRIVATE_DATA)?;
-    let at = order.read_u32(private, 0)? as u64;
-    let opts = lightcraft_tiff::ParseOptions { max_ifds: 1, max_depth: 0, follow_children: false, ..Default::default() };
-    let (sr2, _) = lightcraft_tiff::parse_ifd_at(bytes, at, order, 0, false, &opts).ok()?;
-    if sr2.bytes(SR2_SUBIFD_KEY)? != SR2_KEY {
-        return None;
+/// Its value sits at a layout-dependent position (1638 … 2786 bytes into the block), which the directory entry
+/// gives. Reading a fixed position instead (2510, right for the 29252, 33210 and 56958-byte layouts) read other data
+/// on the DSLR-A450/A500/A550 (27152 bytes: 354–365) and the DSLR-A700 (62112 bytes: 975), whose black is 512 by
+/// ExifTool and by the data floor (issue #535).
+fn sr2_black(sr2: &super::sr2::SubIfd) -> Option<f32> {
+    match sr2.short_bytes(BLACK_LEVEL)? {
+        (3, plain) if plain.len() == 8 => sr2_black_levels(plain, sr2.order()),
+        _ => None,
     }
-    let (start, len) = (usize::try_from(sr2.u64(SR2_SUBIFD_OFFSET)?).ok()?, usize::try_from(sr2.u64(SR2_SUBIFD_LENGTH)?).ok()?);
-    if len < SR2_BLACK_AT + 8 {
-        return None;
-    }
-    sr2_black_levels(bytes.get(start.checked_add(SR2_BLACK_AT)?..start.checked_add(SR2_BLACK_AT + 8)?)?, order)
 }
 
-/// Decipher the eight `SR2SubIFD` bytes at [`SR2_BLACK_AT`] into one black level (the mean of four near-equal,
-/// plausible per-channel levels).
-fn sr2_black_levels(cipher: &[u8], order: lightcraft_tiff::ByteOrder) -> Option<f32> {
-    let plain: Vec<u8> = cipher.iter().zip(SR2_BLACK_KEYSTREAM).map(|(c, k)| c ^ k).collect();
-    let levels: Vec<u16> = (0..4).filter_map(|i| order.read_u16(&plain, 2 * i)).collect();
+/// One black level from the four deciphered per-channel levels (their mean), when they are near-equal and plausible.
+fn sr2_black_levels(plain: &[u8], order: lightcraft_tiff::ByteOrder) -> Option<f32> {
+    let levels: Vec<u16> = (0..4).filter_map(|i| order.read_u16(plain, 2 * i)).collect();
     let (&lo, &hi) = (levels.iter().min()?, levels.iter().max()?);
     (levels.len() == 4 && (64..=4096).contains(&lo) && hi - lo <= 64).then(|| levels.iter().map(|&v| f32::from(v)).sum::<f32>() / 4.0)
 }
 
+/// Byte order of 16-bit-word samples: the file's own order unless the words only fit the sample width in the other
+/// (see the DSC-R1 note at the top). Sampled across the strip; the order is swapped only when the file order leaves
+/// more than 1 % of the sampled words at or above `1 << max(bits, 14)` while the other order leaves none.
+fn word16_order(strip: &[u8], bits: u32, file: lightcraft_tiff::ByteOrder) -> lightcraft_tiff::ByteOrder {
+    use lightcraft_tiff::ByteOrder::{Big, Little};
+    let other = if file == Little { Big } else { Little };
+    let limit = 1u32 << bits.clamp(14, 16);
+    let (mut n, mut over_file, mut over_other) = (0usize, 0usize, 0usize);
+    let words = strip.len() / 2;
+    let step = (words / 65536).max(1);
+    for &b in strip.as_chunks::<2>().0.iter().step_by(step) {
+        n += 1;
+        over_file += usize::from(u32::from(file.u16(b)) >= limit);
+        over_other += usize::from(u32::from(other.u16(b)) >= limit);
+    }
+    if n > 0 && over_other == 0 && over_file * 100 > n { other } else { file }
+}
+
 /// The image area for files without Sony's crop tags (`0x74c7/0x74c8`, written since about 2017): the DNG-style
-/// default crop when the raw IFD has one, else the maker note's `FullImageSize` (the camera JPEG's size) anchored
-/// at the top-left. Older bodies store a few columns of padding at the right edge of the raw frame (constant
-/// values, 8–32 columns on the samples we checked) inside a frame 16–48 pixels wider than `FullImageSize`, so
-/// the anchored crop removes them while keeping the CFA phase.
-fn default_crop(raw: &Ifd, mn: Option<&makernote::MakerNote>, w: usize, h: usize) -> Rect {
+/// default crop when the raw IFD has one, else the image size the camera records (see [`recorded_size_crop`]).
+fn default_crop(raw: &Ifd, mn: Option<&makernote::MakerNote>, exif_size: Option<(u64, u64)>, w: usize, h: usize) -> Rect {
     let full = Rect::new(0, 0, w, h);
     if let (Some([x, y]), Some([cw, ch])) = (raw.u64s(t::DEFAULT_CROP_ORIGIN).as_deref(), raw.u64s(t::DEFAULT_CROP_SIZE).as_deref())
         && *cw > 0
@@ -426,14 +473,37 @@ fn default_crop(raw: &Ifd, mn: Option<&makernote::MakerNote>, w: usize, h: usize
         return Rect::new(*x as usize, *y as usize, *cw as usize, *ch as usize).clipped(w, h);
     }
     match mn.and_then(|m| m.ifd.u64s(MN_FULL_IMAGE_SIZE)).as_deref() {
-        // only a plausible trim: never more than 64 pixels per side, never an enlargement
-        Some([fh, fw]) if *fw as usize <= w && *fh as usize <= h && *fw as usize + 64 >= w && *fh as usize + 64 >= h => {
-            Rect::new(0, 0, *fw as usize, *fh as usize)
-        }
+        Some([fh, fw]) => recorded_size_crop((*fw, *fh), exif_size, w, h).unwrap_or(full),
         _ => full,
     }
 }
 
+/// The crop for the maker note's `FullImageSize` `full` (width, height: the camera JPEG's size) and the Exif image
+/// size `exif` (`PixelXDimension` × `PixelYDimension`) in a `w × h` frame; `None` when they don't describe a crop of
+/// it. Older bodies store a few columns of padding at the right edge of the raw frame (constant values, 8–32 columns
+/// on the samples we checked) inside a frame 16–48 pixels wider than `FullImageSize`, so the crop is anchored at
+/// the left, which removes them while keeping the CFA phase. In the camera's 3:2 mode it is also anchored at the
+/// top. An in-camera aspect ratio narrower than the frame (16:9) is centred vertically, as measured by registering
+/// each camera JPEG on its raw (the ILCE-7SM2's 4240 × 2384 at y 228–232 of 2848; the DSLR-A580's 4912 × 2760 at
+/// y 258–262 of 3280; issue #535): its height comes from `FullImageSize` (ILCE-7SM2) or, when that still says
+/// 3:2, from an Exif image size of the same width (DSLR-A580).
+fn recorded_size_crop(full: (u64, u64), exif: Option<(u64, u64)>, w: usize, h: usize) -> Option<Rect> {
+    let (fw, fh) = (usize::try_from(full.0).ok()?, usize::try_from(full.1).ok()?);
+    // only a plausible trim of the width: never more than 64 pixels, never an enlargement
+    if fw == 0 || fh == 0 || fw > w || fw.saturating_add(64) < w || fh > h {
+        return None;
+    }
+    let height = match exif.and_then(|(ew, eh)| Some((usize::try_from(ew).ok()?, usize::try_from(eh).ok()?))) {
+        Some((ew, eh)) if ew == fw && eh > 0 && eh < fh => eh,
+        _ => fh,
+    };
+    if height.saturating_add(64) >= h {
+        return Some(Rect::new(0, 0, fw, height));
+    }
+    // an in-camera aspect ratio: at least half the frame's height, centred (an even offset keeps the CFA phase)
+    (height * 2 >= h).then(|| Rect::new(0, ((h - height) / 2) & !1, fw, height))
+}
+
 fn raw_ifd(tiff: &Tiff) -> Option<&Ifd> {
     tiff.all_ifds()
         .into_iter()
@@ -454,13 +524,17 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     let linear_rgb = info.compression == 7 && info.photometric == photometric::YCBCR;
     let chunks = info.chunks(bytes.len() as u64);
     let strip_len: u64 = chunks.iter().map(|c| c.len).sum();
+    // The row-per-w-bytes (ARW2) layout stores exactly one byte per pixel in a single strip; all 108 such files in the test
+    // archive measure exactly width x height. A200/A230/A350 files carry a strip 4-23 % larger than that (and A290/A390 one
+    // smaller), which is a different packing, so they are refused rather than read with the wrong layout.
+    let one_byte_per_sample = chunks.len() == 1 && strip_len == (w * h) as u64;
     let (data, out_bits) = match info.compression {
         7 if linear_rgb => (RawData::U16(read_ycbcr_tiles(bytes, &info, raw, mode)?), 14),
-        32767 if chunks.len() == 1 && strip_len >= (w * h) as u64 && strip_len < (w * h) as u64 * 5 / 4 && mode == Mode::Header => {
+        32767 if one_byte_per_sample && mode == Mode::Header => {
             chunk_bytes(bytes, &chunks[0]).ok_or_else(|| RawError::Corrupt("raw strip outside file".into()))?;
             (RawData::U16(Vec::new()), 14)
         }
-        32767 if chunks.len() == 1 && strip_len >= (w * h) as u64 && strip_len < (w * h) as u64 * 5 / 4 => {
+        32767 if one_byte_per_sample => {
             let src = chunk_bytes(bytes, &chunks[0]).ok_or_else(|| RawError::Corrupt("raw strip outside file".into()))?;
             let curve = code_curve(&raw.u64s(TONE_CURVE).unwrap_or_else(|| vec![8000, 10400, 12900, 14100]));
             let mut data = vec![0u16; w * h];
@@ -473,7 +547,7 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
             });
             (RawData::U16(data), 14)
         }
-        32767 => return Err(RawError::Unsupported("Sony ARW version 1 / packed compressed variant".into())),
+        32767 => return Err(RawError::Unsupported("Sony ARW version 1 / packed compressed variant (raw strip is not one byte per pixel)".into())),
         7 if is_quad_tiled(bytes, &info) => match mode {
             Mode::Full => (RawData::U16(read_quad_tiles(bytes, &info)?), bits),
             Mode::Header => {
@@ -482,8 +556,13 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
             }
         },
         1 => {
-            let packing = if strip_len >= (w * h * 2) as u64 { Packing::Word16 } else { Packing::Msb };
-            (read_image_in(mode, bytes, &info, tiff.order, packing)?, bits)
+            let word16 = strip_len >= (w * h * 2) as u64;
+            let packing = if word16 { Packing::Word16 } else { Packing::Msb };
+            let order = match chunks.first().and_then(|c| chunk_bytes(bytes, c)) {
+                Some(strip) if word16 => word16_order(strip, bits, tiff.order),
+                _ => tiff.order,
+            };
+            (read_image_in(mode, bytes, &info, order, packing)?, bits)
         }
         _ => (read_image_in(mode, bytes, &info, tiff.order, Packing::Msb)?, bits),
     };
@@ -502,15 +581,19 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
         _ => Cfa::bayer_static("RGGB"),
     };
     let default_black = if scale_bits >= 14 { 512.0 } else { 128.0 };
+    // the decrypted SR2SubIFD, read once and only when a plain black level or white balance is missing
+    let sr2_cell = std::cell::OnceCell::new();
+    let sr2 = || sr2_cell.get_or_init(|| super::sr2::SubIfd::read(bytes, ifd0, tiff.order)).as_ref();
     let black = match raw.f64s(BLACK_LEVEL).as_deref() {
-        Some(v) if linear_rgb && !v.is_empty() => BlackLevel::uniform((v.iter().sum::<f64>() / v.len() as f64) as f32),
+        Some(v) if linear_rgb && !v.is_empty() => BlackLevel::uniform((v.iter().sum::<f64>() / v.len() as f64) as f32 + YCBCR_OFFSET),
         Some([a, b, c, d]) => {
             BlackLevel { repeat_rows: 2, repeat_cols: 2, values: vec![*a as f32, *b as f32, *c as f32, *d as f32], ..Default::default() }
         }
-        _ => BlackLevel::uniform(sr2_black(bytes, ifd0, tiff.order).filter(|_| scale_bits >= 14).unwrap_or(default_black)),
+        _ if linear_rgb => BlackLevel::uniform(default_black + YCBCR_OFFSET),
+        _ => BlackLevel::uniform((scale_bits >= 14).then(|| sr2().and_then(sr2_black)).flatten().unwrap_or(default_black)),
     };
     let white = if linear_rgb {
-        16383.0
+        YCBCR_WHITE + YCBCR_OFFSET
     } else {
         raw.f64(t::WHITE_LEVEL).map(|v| v as f32).filter(|v| *v > 0.0).unwrap_or_else(|| super::white_from_data(samples, scale_bits))
     };
@@ -521,15 +604,15 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
         .and_then(|e| makernote::parse_makernote(bytes, e.offset, e.count() as u64, tiff.order, &ifd0.string(t::MAKE).unwrap_or_default()));
     let wb = raw
         .f64s(WB_RGGB)
-        .filter(|v| v.len() == 4 && v[1] > 0.0 && v[0] > 0.0 && v[3] > 0.0)
-        .map(|v| {
-            let g = (v[1] + v[2]) / 2.0;
-            [(v[0] / g) as f32, 1.0, (v[3] / g) as f32]
-        })
+        .and_then(|v| rggb_gains(&v))
+        .or_else(|| rggb_gains(&sr2()?.shorts(WB_RGGB)?))
         .or_else(|| mn.as_ref().and_then(|m| tag2010_wb(&model, m.ifd.bytes(MN_TAG2010)?, m.order)));
     let crop = match (raw.u64s(CROP_TOP_LEFT).as_deref(), raw.u64s(CROP_SIZE).as_deref()) {
         (Some([x, y]), Some([cw, ch])) if *cw > 0 && *ch > 0 => Rect::new(*x as usize, *y as usize, *cw as usize, *ch as usize).clipped(w, h),
-        _ => default_crop(raw, mn.as_ref(), w, h),
+        _ => {
+            let exif_size = tiff.exif().and_then(|e| Some((e.u64(t::PIXEL_X_DIMENSION)?, e.u64(t::PIXEL_Y_DIMENSION)?)));
+            default_crop(raw, mn.as_ref(), exif_size, w, h)
+        }
     };
     let mut metadata = lightcraft_meta::from_tiff(&tiff);
     metadata.width = Some(crop.width as u32);
@@ -587,6 +670,9 @@ mod tests {
         assert!(full.cfa.is_none());
         assert_eq!(full.data.len(), 48);
         assert_eq!(full.wb_multipliers, Some([1.0; 3]));
+        // the YCbCr data sit 512 above the recorded sensor black level; white moves with it
+        assert_eq!((full.black.mean(), full.white_at(0)), (1024.0, 16895.0));
+        assert_eq!((header.black.mean(), header.white_at(0)), (1024.0, 16895.0));
         let RawData::U16(ref pixels) = full.data else {
             panic!("integer ARW");
         };
@@ -595,6 +681,57 @@ mod tests {
         assert_eq!((developed.width, developed.height), (4, 4));
     }
 
+    #[test]
+    fn recorded_size_crops_in_camera_aspect_ratios() {
+        // 3:2: anchored at the top-left, as before (ILCE-7S, DSLR-A700 whose Exif size is the whole frame)
+        assert_eq!(recorded_size_crop((4240, 2832), Some((4240, 2832)), 4288, 2848), Some(Rect::new(0, 0, 4240, 2832)));
+        assert_eq!(recorded_size_crop((4272, 2848), Some((4288, 2856)), 4288, 2856), Some(Rect::new(0, 0, 4272, 2848)));
+        assert_eq!(recorded_size_crop((4240, 2832), None, 4288, 2848), Some(Rect::new(0, 0, 4240, 2832)));
+        // 16:9 from FullImageSize (ILCE-7SM2) and from the Exif size when FullImageSize says 3:2 (DSLR-A580): centred
+        assert_eq!(recorded_size_crop((4240, 2384), Some((4240, 2384)), 4288, 2848), Some(Rect::new(0, 232, 4240, 2384)));
+        assert_eq!(recorded_size_crop((4912, 3264), Some((4912, 2760)), 4928, 3280), Some(Rect::new(0, 260, 4912, 2760)));
+        // offsets stay even (CFA phase)
+        assert_eq!(recorded_size_crop((4240, 2386), None, 4288, 2848).map(|r| r.y), Some(230));
+        // not a crop of this frame: wider than it, far narrower, under half its height, empty, hostile values
+        assert_eq!(recorded_size_crop((4300, 2832), None, 4288, 2848), None);
+        assert_eq!(recorded_size_crop((4000, 2832), None, 4288, 2848), None);
+        assert_eq!(recorded_size_crop((4240, 1000), None, 4288, 2848), None);
+        assert_eq!(recorded_size_crop((0, 2832), None, 4288, 2848), None);
+        assert_eq!(recorded_size_crop((u64::MAX, u64::MAX), Some((u64::MAX, 1)), 4288, 2848), None);
+        assert_eq!(recorded_size_crop((4240, 2832), Some((4240, 0)), 4288, 2848), Some(Rect::new(0, 0, 4240, 2832)));
+    }
+
+    /// A 32767-compressed ARW whose single strip is `strip` bytes for a 32 x 4 image.
+    fn arw_with_strip(strip: usize) -> Vec<u8> {
+        use lightcraft_tiff::{IfdBuilder, ImageData, TiffWriter, Value};
+        let mut raw = IfdBuilder::new();
+        raw.set(t::MAKE, Value::Ascii("SONY".into()));
+        raw.set(t::MODEL, Value::Ascii("DSLR-A200".into()));
+        raw.set(t::IMAGE_WIDTH, Value::Long(vec![32]));
+        raw.set(t::IMAGE_LENGTH, Value::Long(vec![4]));
+        raw.set(t::BITS_PER_SAMPLE, Value::Short(vec![12]));
+        raw.set(t::SAMPLES_PER_PIXEL, Value::Short(vec![1]));
+        raw.set(t::PHOTOMETRIC, Value::Short(vec![photometric::CFA]));
+        raw.set(t::COMPRESSION, Value::Short(vec![32767]));
+        raw.set(TONE_CURVE, Value::Short(vec![8000, 10400, 12900, 14100]));
+        raw.set_image(ImageData::Strips { rows_per_strip: 4, strips: vec![vec![0u8; strip]] });
+        TiffWriter::default().write(&[raw]).unwrap()
+    }
+
+    #[test]
+    fn strip_larger_or_smaller_than_one_byte_per_pixel_is_the_packed_variant() {
+        for strip in [32 * 4 + 8, 32 * 4 * 5 / 4 - 1, 32 * 4 - 1] {
+            for mode in [Mode::Header, Mode::Full] {
+                let err = decode(&arw_with_strip(strip), mode).unwrap_err();
+                assert!(matches!(err, RawError::Unsupported(ref m) if m.contains("packed compressed variant")), "{strip} {mode:?}: {err:?}");
+            }
+        }
+        for mode in [Mode::Header, Mode::Full] {
+            let r = decode(&arw_with_strip(32 * 4), mode);
+            assert!(!matches!(r, Err(RawError::Unsupported(ref m)) if m.contains("packed compressed variant")), "{r:?}");
+        }
+    }
+
     /// Encode one 16-value set as an ARW2 block (the paper's scheme, used here to test the decoder).
     pub(crate) fn encode_block(v: &[u16; 16]) -> [u8; 16] {
         let (imax, &max) = v.iter().enumerate().max_by_key(|(i, x)| (**x, usize::MAX - *i)).unwrap();
@@ -697,19 +834,320 @@ mod tests {
         assert!(tag2010_wb("DSC-RX100M3", &encipher(&odd), Little).is_none());
     }
 
+    /// A Sony-style file: IFD0 (`make`) → Exif → maker note `SONY DSC \0\0\0` + an IFD of `entries` (tag, type,
+    /// count, inline value bytes), the layout of the camera's own notes; `count` overrides the entry count.
+    fn sony_file(order: lightcraft_tiff::ByteOrder, make: &str, entries: &[(u16, u16, u32, [u8; 4])], count: Option<u16>) -> Vec<u8> {
+        use lightcraft_tiff::{ByteOrder, IfdBuilder, TiffWriter, Value};
+        let (u16b, u32b) = match order {
+            ByteOrder::Little => (u16::to_le_bytes as fn(u16) -> [u8; 2], u32::to_le_bytes as fn(u32) -> [u8; 4]),
+            ByteOrder::Big => (u16::to_be_bytes as fn(u16) -> [u8; 2], u32::to_be_bytes as fn(u32) -> [u8; 4]),
+        };
+        let mut note = b"SONY DSC \0\0\0".to_vec();
+        note.extend(u16b(count.unwrap_or(entries.len() as u16)));
+        for &(tag, kind, n, value) in entries {
+            note.extend(u16b(tag));
+            note.extend(u16b(kind));
+            note.extend(u32b(n));
+            note.extend(value);
+        }
+        note.extend(u32b(0));
+        let mut exif = IfdBuilder::new();
+        exif.set(t::MAKER_NOTE, Value::Undefined(note));
+        let mut ifd0 = IfdBuilder::new();
+        ifd0.set(t::MAKE, Value::Ascii(make.into()));
+        ifd0.set(t::MODEL, Value::Ascii("ILCE-7CR".into()));
+        ifd0.set_child(t::EXIF_IFD, exif);
+        TiffWriter::new(order, false).write(&[ifd0]).unwrap()
+    }
+
+    #[test]
+    fn dynamic_range_optimizer_is_read_from_the_sony_note() {
+        use lightcraft_tiff::ByteOrder::{Big, Little};
+        let long = |order, v: u32| match order {
+            Little => v.to_le_bytes(),
+            Big => v.to_be_bytes(),
+        };
+        let short = |order, v: u16| match order {
+            Little => [v.to_le_bytes()[0], v.to_le_bytes()[1], 0, 0],
+            Big => [v.to_be_bytes()[0], v.to_be_bytes()[1], 0, 0],
+        };
+        let dro = |bytes: &[u8]| crate::embedded_preview_dynamic_range_optimized(bytes);
+        for order in [Little, Big] {
+            // every documented value: Off; Standard, Advanced Auto, Auto (the factory default); Advanced Lv1–5; Lv1–8
+            let documented: Vec<u32> = [0, 1, 2, 3].into_iter().chain(8..=12).chain(16..=23).collect();
+            for &value in &documented {
+                let file = sony_file(order, "SONY", &[(MN_DYNAMIC_RANGE_OPTIMIZER, 4, 1, long(order, value))], None);
+                assert_eq!(dro(&file), Some(value != 0), "{order:?} {value}");
+            }
+            // undocumented values say nothing
+            for value in (0..=64).filter(|v| !documented.contains(v)).chain([255, 65535, u32::MAX]) {
+                let file = sony_file(order, "SONY", &[(MN_DYNAMIC_RANGE_OPTIMIZER, 4, 1, long(order, value))], None);
+                assert_eq!(dro(&file), None, "{order:?} {value}");
+            }
+            // stored as a SHORT: same reading
+            assert_eq!(dro(&sony_file(order, "SONY", &[(MN_DYNAMIC_RANGE_OPTIMIZER, 3, 1, short(order, 18))], None)), Some(true));
+            // the coarse 0xb04f alone is not used, nor is an ASCII or empty value
+            assert_eq!(dro(&sony_file(order, "SONY", &[(0xb04f, 3, 1, short(order, 1))], None)), None);
+            assert_eq!(dro(&sony_file(order, "SONY", &[(MN_DYNAMIC_RANGE_OPTIMIZER, 2, 2, *b"3\0\0\0")], None)), None);
+            assert_eq!(dro(&sony_file(order, "SONY", &[(MN_DYNAMIC_RANGE_OPTIMIZER, 4, 0, [0; 4])], None)), None);
+            // other makers' notes are not read as Sony's
+            assert_eq!(dro(&sony_file(order, "NIKON CORPORATION", &[(MN_DYNAMIC_RANGE_OPTIMIZER, 4, 1, long(order, 3))], None)), None);
+        }
+    }
+
+    #[test]
+    fn hostile_sony_notes_are_read_safely() {
+        use lightcraft_tiff::ByteOrder::Little;
+        let entry = [(MN_DYNAMIC_RANGE_OPTIMIZER, 4, 1, 3u32.to_le_bytes())];
+        let good = sony_file(Little, "SONY", &entry, None);
+        assert_eq!(crate::embedded_preview_dynamic_range_optimized(&good), Some(true));
+        // an entry count far beyond the note: at most the entries actually there are read
+        assert_ne!(crate::embedded_preview_dynamic_range_optimized(&sony_file(Little, "SONY", &entry, Some(u16::MAX))), Some(false));
+        // an entry pointing outside the file
+        let outside = [(MN_DYNAMIC_RANGE_OPTIMIZER, 4, 2, 0xffff_fff0u32.to_le_bytes())];
+        assert_eq!(crate::embedded_preview_dynamic_range_optimized(&sony_file(Little, "SONY", &outside, None)), None);
+        // every truncation of a good file, and no file at all
+        for len in 0..good.len() {
+            let _ = crate::embedded_preview_dynamic_range_optimized(&good[..len]);
+        }
+        assert_eq!(crate::embedded_preview_dynamic_range_optimized(b"not a TIFF"), None);
+        assert_eq!(crate::embedded_preview_dynamic_range_optimized(&[]), None);
+        // a Sony file without a maker note
+        let mut ifd0 = lightcraft_tiff::IfdBuilder::new();
+        ifd0.set(t::MAKE, lightcraft_tiff::Value::Ascii("SONY".into()));
+        assert_eq!(crate::embedded_preview_dynamic_range_optimized(&lightcraft_tiff::TiffWriter::new(Little, false).write(&[ifd0]).unwrap()), None);
+    }
+
+    #[test]
+    fn rggb_gains_need_four_plausible_levels() {
+        assert_eq!(rggb_gains(&[2048.0, 1024.0, 1024.0, 1536.0]), Some([2.0, 1.0, 1.5]));
+        assert_eq!(rggb_gains(&[2048.0, 1000.0, 1048.0, 1536.0]), Some([2.0, 1.0, 1.5]));
+        for bad in [
+            &[2048.0, 1024.0, 1024.0][..],
+            &[2048.0, 1024.0, 1024.0, 1536.0, 1.0],
+            &[2048.0, 1024.0, -1024.0, 1536.0],
+            &[2048.0, 0.0, 0.0, 1536.0],
+            &[2048.0, f64::NAN, 1024.0, 1536.0],
+            &[-2048.0, 1024.0, 1024.0, 1536.0],
+            &[9000.0, 1024.0, 1024.0, 1536.0],
+            &[2048.0, 1024.0, 1024.0, f64::INFINITY],
+        ] {
+            assert_eq!(rggb_gains(bad), None, "{bad:?}");
+        }
+    }
+
+    /// A 32 × 4 ARW2 file whose white balance can come from the raw IFD's `0x7313`, an encrypted `SR2SubIFD`
+    /// (reached through `DNGPrivateData` and the `SR2Private` IFD, as Sony stores it, with `key`; black level 800)
+    /// and a maker note whose `Tag2010` block (RX100 III layout) holds `WB_RGBLevels`.
+    fn arw_with_wb(plain: Option<[u16; 4]>, sr2: Option<[u16; 4]>, tag2010: Option<[u16; 3]>, key: [u8; 4]) -> Vec<u8> {
+        use lightcraft_tiff::{ByteOrder::Little, IfdBuilder, ImageData, TiffWriter, Value};
+        let mut tag2010_block = vec![0u8; 700];
+        for (i, v) in tag2010.unwrap_or([0; 3]).iter().enumerate() {
+            tag2010_block[612 + 2 * i..614 + 2 * i].copy_from_slice(&v.to_le_bytes());
+        }
+        let tag2010_block = encipher(&tag2010_block);
+        // the maker note: "SONY DSC " header, then an IFD whose offsets are file offsets
+        let note = |at: usize| -> Vec<u8> {
+            let mut n = b"SONY DSC \0\0\0".to_vec();
+            n.extend([1, 0]);
+            n.extend(MN_TAG2010.to_le_bytes());
+            n.extend(7u16.to_le_bytes());
+            n.extend((tag2010_block.len() as u32).to_le_bytes());
+            n.extend(((at + n.len() + 8) as u32).to_le_bytes());
+            n.extend([0; 4]);
+            n.extend(&tag2010_block);
+            n
+        };
+        let mut raw = IfdBuilder::new();
+        raw.set(t::MAKE, Value::Ascii("SONY".into()));
+        raw.set(t::MODEL, Value::Ascii("DSC-RX100M3".into()));
+        raw.set(t::IMAGE_WIDTH, Value::Long(vec![32]));
+        raw.set(t::IMAGE_LENGTH, Value::Long(vec![4]));
+        raw.set(t::BITS_PER_SAMPLE, Value::Short(vec![12]));
+        raw.set(t::SAMPLES_PER_PIXEL, Value::Short(vec![1]));
+        raw.set(t::PHOTOMETRIC, Value::Short(vec![photometric::CFA]));
+        raw.set(t::COMPRESSION, Value::Short(vec![32767]));
+        raw.set(TONE_CURVE, Value::Short(vec![8000, 10400, 12900, 14100]));
+        raw.set(t::DNG_PRIVATE_DATA, Value::Byte(vec![0; 4]));
+        if let Some(levels) = plain {
+            raw.set(WB_RGGB, Value::Short(levels.to_vec()));
+        }
+        if tag2010.is_some() {
+            raw.set_child(t::EXIF_IFD, IfdBuilder::new().with(t::MAKER_NOTE, Value::Undefined(note(0))));
+        }
+        raw.set_image(ImageData::Strips { rows_per_strip: 4, strips: vec![vec![0u8; 32 * 4]] });
+        let mut file = TiffWriter::default().write(&[raw]).unwrap();
+        let parsed = Tiff::parse(&file).unwrap();
+        if let Some(e) = parsed.exif().and_then(|e| e.get(t::MAKER_NOTE)) {
+            let at = e.offset as usize;
+            file[at..at + e.count()].copy_from_slice(&note(at));
+        }
+        if let Some(levels) = sr2 {
+            // SR2Private IFD (three entries), then the encrypted SR2SubIFD
+            let private = file.len();
+            let start = private + 2 + 3 * 12 + 4;
+            let block = super::super::sr2::tests::block(start, &[(BLACK_LEVEL, 3, &[800; 4]), (WB_RGGB, 8, &levels)], Little);
+            file.extend([3, 0]);
+            for (tag, kind, value) in
+                [(0x7200u16, 4u16, (start as u32).to_le_bytes()), (0x7201, 4, (block.len() as u32).to_le_bytes()), (0x7221, 7, key)]
+            {
+                file.extend(tag.to_le_bytes());
+                file.extend(kind.to_le_bytes());
+                file.extend(if kind == 7 { 4u32 } else { 1 }.to_le_bytes());
+                file.extend(value);
+            }
+            file.extend([0; 4]);
+            file.extend(block);
+            let at = parsed.ifds[0].get(t::DNG_PRIVATE_DATA).unwrap().offset as usize;
+            file[at..at + 4].copy_from_slice(&(private as u32).to_le_bytes());
+        }
+        file
+    }
+
+    #[test]
+    fn white_balance_prefers_the_applied_levels() {
+        const KEY: [u8; 4] = [0x11, 0x22, 0x33, 0x44];
+        let (plain, sr2, tag2010) = ([2048, 1024, 1024, 1536], [2932, 1024, 1024, 1576], [484, 256, 788]);
+        let wb = |file: Vec<u8>| {
+            let header = decode(&file, Mode::Header).unwrap();
+            let full = decode(&file, Mode::Full).unwrap();
+            assert_eq!(header.wb_multipliers, full.wb_multipliers);
+            assert_eq!(header.black, full.black);
+            full.wb_multipliers
+        };
+        // the same decrypted directory gives the black level, with the known key only
+        let black = |file: Vec<u8>| decode(&file, Mode::Full).unwrap().black.mean();
+        assert_eq!(black(arw_with_wb(None, Some(sr2), None, KEY)), 800.0);
+        assert_eq!(black(arw_with_wb(None, Some(sr2), None, [1, 2, 3, 4])), 512.0);
+        assert_eq!(black(arw_with_wb(None, None, None, KEY)), 512.0);
+        let sr2_gains = Some([2932.0 / 1024.0, 1.0, 1576.0 / 1024.0]);
+        // the encrypted SR2SubIFD's WB_RGGBLevels over Tag2010 (issue #535: ILCE-3500 at 5600 K) and when alone
+        assert_eq!(wb(arw_with_wb(None, Some(sr2), Some(tag2010), KEY)), sr2_gains);
+        assert_eq!(wb(arw_with_wb(None, Some(sr2), None, KEY)), sr2_gains);
+        // the plain levels over both
+        assert_eq!(wb(arw_with_wb(Some(plain), Some(sr2), Some(tag2010), KEY)), Some([2.0, 1.0, 1.5]));
+        // Tag2010 when the SR2SubIFD has another key, implausible levels or none at all
+        let fallback = Some([484.0 / 256.0, 1.0, 788.0 / 256.0]);
+        assert_eq!(wb(arw_with_wb(None, Some(sr2), Some(tag2010), [1, 2, 3, 4])), fallback);
+        assert_eq!(wb(arw_with_wb(None, Some([9000, 1024, 1024, 1576]), Some(tag2010), KEY)), fallback);
+        assert_eq!(wb(arw_with_wb(None, None, Some(tag2010), KEY)), fallback);
+        assert_eq!(wb(arw_with_wb(None, None, None, KEY)), None);
+    }
+
+    #[test]
+    fn broken_sr2_private_data_is_ignored() {
+        const KEY: [u8; 4] = [0x11, 0x22, 0x33, 0x44];
+        let file = arw_with_wb(None, Some([2932, 1024, 1024, 1576]), None, KEY);
+        let at = Tiff::parse(&file).unwrap().ifds[0].get(t::DNG_PRIVATE_DATA).unwrap().offset as usize;
+        let private = u32::from_le_bytes(file[at..at + 4].try_into().unwrap()) as usize;
+        let patched = |pos: usize, bytes: &[u8]| {
+            let mut f = file.clone();
+            f[pos..pos + bytes.len()].copy_from_slice(bytes);
+            decode(&f, Mode::Full).map(|img| img.wb_multipliers)
+        };
+        // DNGPrivateData pointing nowhere or into the image; SR2SubIFD offset or length past the end, or enormous
+        for (pos, bytes) in [
+            (at, u32::MAX.to_le_bytes()),
+            (at, 8u32.to_le_bytes()),
+            (private + 2 + 8, u32::MAX.to_le_bytes()),
+            (private + 2 + 12 + 8, u32::MAX.to_le_bytes()),
+            (private + 2 + 12 + 8, (file.len() as u32).to_le_bytes()),
+            (private + 2 + 12 + 8, (1u32 << 21).to_le_bytes()),
+        ] {
+            assert_eq!(patched(pos, &bytes).unwrap(), None, "{pos} {bytes:?}");
+        }
+        // the file cut anywhere inside the SR2 data still decodes (the image comes first), without white balance
+        for len in [private, private + 20, file.len() - 30, file.len() - 1] {
+            let img = decode(&file[..len], Mode::Full).unwrap();
+            assert_eq!(img.wb_multipliers, None, "{len}");
+        }
+    }
+
     #[test]
     fn sr2_black_level_decodes_and_rejects_garbage() {
         use lightcraft_tiff::ByteOrder::Little;
-        let cipher =
-            |levels: [u16; 4]| -> Vec<u8> { levels.iter().flat_map(|v| v.to_le_bytes()).zip(SR2_BLACK_KEYSTREAM).map(|(p, k)| p ^ k).collect() };
-        assert_eq!(sr2_black_levels(&cipher([800; 4]), Little), Some(800.0));
-        assert_eq!(sr2_black_levels(&cipher([512, 512, 514, 512]), Little), Some(512.5));
-        assert_eq!(sr2_black_levels(&cipher([65320, 64928, 65260, 488]), Little), None); // ILCE-7M4's layout
-        assert_eq!(sr2_black_levels(&cipher([0; 4]), Little), None);
-        assert_eq!(sr2_black_levels(&cipher([800; 4])[..5], Little), None);
+        let plain = |levels: [u16; 4]| -> Vec<u8> { levels.iter().flat_map(|v| v.to_le_bytes()).collect() };
+        assert_eq!(sr2_black_levels(&plain([800; 4]), Little), Some(800.0));
+        assert_eq!(sr2_black_levels(&plain([512, 512, 514, 512]), Little), Some(512.5));
+        assert_eq!(sr2_black_levels(&plain([65320, 64928, 65260, 488]), Little), None);
+        assert_eq!(sr2_black_levels(&plain([0; 4]), Little), None);
+        assert_eq!(sr2_black_levels(&plain([800; 4])[..5], Little), None);
         assert_eq!(sr2_black_levels(&[], Little), None);
     }
 
+    /// An encrypted `SR2SubIFD` of `len` bytes at file offset `start` whose first entry is a black level stored at
+    /// `value_pos` (relative), holding `levels`; `other` puts four more levels at position 2510 (where the old
+    /// fixed read looked).
+    fn sr2_block(start: usize, len: usize, tag: u16, value_pos: usize, levels: [u16; 4], other: Option<[u16; 4]>) -> Vec<u8> {
+        let mut plain = vec![0u8; len];
+        plain[0..2].copy_from_slice(&180u16.to_le_bytes());
+        plain[2..4].copy_from_slice(&tag.to_le_bytes());
+        plain[4..6].copy_from_slice(&3u16.to_le_bytes());
+        plain[6..10].copy_from_slice(&4u32.to_le_bytes());
+        plain[10..14].copy_from_slice(&((start + value_pos) as u32).to_le_bytes());
+        for (i, v) in levels.iter().enumerate() {
+            plain[value_pos + 2 * i..value_pos + 2 * i + 2].copy_from_slice(&v.to_le_bytes());
+        }
+        if let Some(o) = other {
+            for (i, v) in o.iter().enumerate() {
+                plain[2510 + 2 * i..2510 + 2 * i + 2].copy_from_slice(&v.to_le_bytes());
+            }
+        }
+        super::super::sr2::tests::encrypt(&mut plain);
+        plain
+    }
+
+    /// [`sr2_black`] on the encrypted `SR2SubIFD` bytes `block`, which start at file offset `start`.
+    fn sr2_black_in(block: &[u8], start: usize, order: lightcraft_tiff::ByteOrder) -> Option<f32> {
+        sr2_black(&super::super::sr2::SubIfd::decrypt(block, start, order))
+    }
+
+    #[test]
+    fn sr2_black_level_follows_the_first_entry_to_its_layout() {
+        use lightcraft_tiff::ByteOrder::Little;
+        let start = 37584;
+        // the value position of every layout seen, e.g. the DSLR-A700's (62112 bytes, value at 1638) and the
+        // DSLR-A450/A500/A550's (27152 bytes, value at 2166); the first four are those of bodies without a plain 0x7310
+        for pos in [1638, 2166, 2418, 2510, 2030, 2102, 2186, 2558, 2786] {
+            for level in [512, 800] {
+                let block = sr2_block(start, 27152, BLACK_LEVEL, pos, [level; 4], None);
+                assert_eq!(sr2_black_in(&block, start, Little), Some(f32::from(level)), "value at {pos}");
+            }
+        }
+        // the A700's layout holds four other equal values at 2510 (975 each); the old fixed read took those
+        let a700 = sr2_block(start, 62112, BLACK_LEVEL, 1638, [512; 4], Some([975; 4]));
+        assert_eq!(sr2_black_in(&a700, start, Little), Some(512.0));
+        // not a black-level entry, another type, a value outside the block, before it
+        assert_eq!(sr2_black_in(&sr2_block(start, 27152, 0x7311, 2166, [512; 4], None), start, Little), None);
+        let mut long = sr2_block(start, 27152, BLACK_LEVEL, 2166, [512; 4], None);
+        long[4] ^= 3 ^ 4; // SHORT -> LONG (type field of the first entry)
+        assert_eq!(sr2_black_in(&long, start, Little), None);
+        assert_eq!(sr2_black_in(&sr2_block(start, 27152, BLACK_LEVEL, 2166, [512; 4], None)[..2170], start, Little), None);
+        let block = sr2_block(start, 27152, BLACK_LEVEL, 2166, [512; 4], None);
+        assert_eq!(sr2_black_in(&block, start + 4000, Little), None, "value offset before the block");
+        assert_eq!(sr2_black_in(&block[..10], start, Little), None, "truncated directory");
+        assert_eq!(sr2_black_in(&[], start, Little), None);
+        // implausible levels at a known position
+        assert_eq!(sr2_black_in(&sr2_block(start, 27152, BLACK_LEVEL, 2166, [4; 4], None), start, Little), None);
+    }
+
+    #[test]
+    fn word16_byte_order_follows_the_sample_range() {
+        use lightcraft_tiff::ByteOrder::{Big, Little};
+        let be: Vec<u8> = (0..4096u16).flat_map(|i| (512 + i * 3).to_be_bytes()).collect(); // 512..12800 big-endian words
+        assert_eq!(word16_order(&be, 14, Little), Big);
+        let le: Vec<u8> = (0..4096u16).flat_map(|i| (512 + i * 3).to_le_bytes()).collect();
+        assert_eq!(word16_order(&le, 14, Little), Little);
+        // values whose bytes are all below 0x40 fit both ways: keep the file order
+        let amb: Vec<u8> = (0..4096usize).flat_map(|i| [(i % 60) as u8, (i % 50) as u8]).collect();
+        assert_eq!(word16_order(&amb, 14, Little), Little);
+        assert_eq!(word16_order(&[], 14, Big), Big);
+        // any `bits` value (even a corrupt one) clamps to 14..=16 instead of overflowing the shift
+        for bits in [0, 1, 12, 14, 16, 17, 31, 32, 33, u32::MAX] {
+            let _ = word16_order(&be, bits, Little);
+        }
+    }
+
     #[test]
     fn quad_tiles_place_cfa_cells() {
         // 14×12 mosaic in 8×8 tiles (the right and bottom tiles overhang), each tile a 4×4 frame of 2×2 cells,
diff --git a/crates/raw/src/vendor/cr2.rs b/crates/raw/src/vendor/cr2.rs
index d6529ece..7f52888f 100644
--- a/crates/raw/src/vendor/cr2.rs
+++ b/crates/raw/src/vendor/cr2.rs
@@ -13,20 +13,27 @@
 //!   read per file (no model table); files without the tag fall back to RGGB (issue #85). The parity of the
 //!   `SensorInfo` borders does *not* predict it (RGGB files come with both even and odd top borders).
 //! - `SensorInfo` (maker note `0x00e0`): sensor width/height and the left/top/right/bottom borders of the image
-//!   area; the masked columns left of it give the black level.
+//!   area. Light already reaches some columns left of that border (EOS 6D: masked columns 0–70, border 84; 10–36
+//!   such columns on every corpus body), so the masked columns that give the black level are measured from the
+//!   data ([`masked_columns`]) rather than taken as the whole border.
 //! - `ColorBalance` (maker note `0x4001`): as-shot `RGGB` levels at a model-dependent offset; we probe the known
 //!   offsets and accept the first plausible quadruple. The array is 16-bit words; some models store it as UNDEFINED
 //!   bytes (ColorData versions -3 and -4), which are paired up in the maker note's byte order first.
-//! - sRAW / mRAW (YCbCr, subsampled) are not supported yet.
+//! - sRAW / mRAW (raw IFD tag `0xc6c5` = 4) hold subsampled YCbCr instead of a mosaic: see [`sraw`].
+
+mod sraw;
 
 use super::{black_from_columns, white_from_data};
 use crate::{BlackLevel, Cfa, ColorData, Mode, OpcodeLists, RawData, RawError, RawFormat, RawImage, Rect, Result, ljpeg};
 use lightcraft_geom::Orientation;
 use lightcraft_tiff::image::chunk_bytes;
 use lightcraft_tiff::{ByteOrder, Ifd, Tiff, Value, makernote, tags as t};
+use std::ops::Range;
 
 const CR2_SLICE: u16 = 0xc640;
 const SRAW_TYPE: u16 = 0xc6c5;
+/// `SRAW_TYPE` value of the YCbCr frames of sRAW / mRAW (IFD2's preview image carries 3).
+const SRAW_YCC: u32 = 4;
 const CR2_CFA_PATTERN: u16 = 0xc5e0;
 const SENSOR_INFO: u16 = 0x00e0;
 const COLOR_BALANCE: u16 = 0x4001;
@@ -75,12 +82,46 @@ fn wb_from_color_balance(v: &[u64]) -> Option<[f32; 3]> {
     None
 }
 
+/// The optically black columns left of the image area: from column 2 up to two columns before the first column
+/// whose mean (over the image rows) rises above the leftmost columns' level by more than 1/256 of the remaining
+/// range (at least 16), else up to two columns before the image area. Empty when the border is too narrow.
+fn masked_columns(data: &[u16], width: usize, active: Rect, white: f32) -> Range<usize> {
+    let limit = active.x.saturating_sub(2).min(width);
+    if limit < 4 || active.height == 0 {
+        return 0..0;
+    }
+    let step = (active.height / 256).max(1);
+    let column_mean = |x: usize| {
+        let (mut sum, mut n) = (0.0, 0usize);
+        for y in (active.y..active.y.saturating_add(active.height)).step_by(step) {
+            if let Some(&v) = y.checked_mul(width).and_then(|i| data.get(i.checked_add(x)?)) {
+                sum += f64::from(v);
+                n += 1;
+            }
+        }
+        (n > 0).then(|| sum / n as f64)
+    };
+    let means: Vec<f64> = (2..limit).map_while(column_mean).collect();
+    let mut first: Vec<f64> = means.iter().take(8).copied().collect();
+    first.sort_by(f64::total_cmp);
+    let Some(&level) = first.get(first.len() / 2) else { return 0..0 };
+    let tolerance = ((f64::from(white) - level) / 256.0).max(16.0);
+    let end = match means.iter().position(|&m| m > level + tolerance) {
+        // `means[k]` is column `2 + k`: stop two columns before it
+        Some(k) => k,
+        None => 2 + means.len(),
+    };
+    2..end.max(2)
+}
+
 pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     let tiff = Tiff::parse(bytes)?;
     let ifd0 = &tiff.ifds[0];
     let raw = raw_ifd(&tiff).ok_or_else(|| RawError::Corrupt("CR2 without raw IFD".into()))?;
-    if raw.u32(SRAW_TYPE).is_some_and(|v| v != 1) {
-        return Err(RawError::Unsupported("Canon sRAW/mRAW".into()));
+    match raw.u32(SRAW_TYPE) {
+        Some(SRAW_YCC) => return sraw::decode(bytes, &tiff, raw, mode),
+        Some(v) if v != 1 => return Err(RawError::Unsupported(format!("Canon raw type {v}"))),
+        _ => {}
     }
     let off = raw.u64(t::STRIP_OFFSETS).ok_or(RawError::Tiff(lightcraft_tiff::TiffError::MissingTag(t::STRIP_OFFSETS)))?;
     let len = raw.u64(t::STRIP_BYTE_COUNTS).unwrap_or(bytes.len() as u64 - off.min(bytes.len() as u64));
@@ -148,12 +189,11 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     }
     let wb = mn.as_ref().and_then(|m| m.ifd.value(COLOR_BALANCE).map(|v| words(v, m.order))).and_then(|v| wb_from_color_balance(&v));
     let cfa = cfa_from_tag(raw.u64(CR2_CFA_PATTERN)).unwrap_or_else(|| Cfa::bayer_static("RGGB"));
-    let black = if active.x >= 8 {
-        black_from_columns(&data, width, 2..active.x - 2, active.y..active.y + active.height, active)
-    } else {
-        BlackLevel::uniform(0.0)
-    };
     let white = white_from_data(&data, prec as u32);
+    let black = match masked_columns(&data, width, active, white) {
+        cols if cols.len() >= 2 => black_from_columns(&data, width, cols, active.y..active.y + active.height, active),
+        _ => BlackLevel::uniform(0.0),
+    };
     let mut metadata = lightcraft_meta::from_tiff(&tiff);
     metadata.width = Some(active.width as u32);
     metadata.height = Some(active.height as u32);
@@ -293,6 +333,25 @@ pub(crate) mod tests {
         assert_eq!(words(&Value::Undefined(vec![1, 0, 2]), ByteOrder::Little), vec![1]);
     }
 
+    /// Light reaches columns left of the `SensorInfo` border (as on the EOS 6D): the black level comes from the
+    /// masked columns only, not from the image columns between them and the border.
+    #[test]
+    fn black_from_masked_columns_only() {
+        let (w, h, border, light) = (40, 12, 20, 14);
+        let data: Vec<u16> = (0..w * h).map(|i| if i % w < light { 2048 + (i % 2) as u16 } else { 6000 }).collect();
+        let active = Rect::new(border, 2, w - border, h - 2);
+        let cols = masked_columns(&data, w, active, 15000.0);
+        assert_eq!(cols, 2..light - 2);
+        let black = black_from_columns(&data, w, cols, 2..h, active);
+        assert!(black.values.iter().all(|v| (2048.0..=2049.0).contains(v)), "{:?}", black.values);
+        // the whole border masked: every column but the two next to the image
+        let dark: Vec<u16> = (0..w * h).map(|i| if i % w < border { 2048 } else { 6000 }).collect();
+        assert_eq!(masked_columns(&dark, w, active, 15000.0), 2..border - 2);
+        // too narrow a border, or no samples (headers-only decode): none
+        assert!(masked_columns(&dark, w, Rect::new(5, 0, 30, h), 15000.0).is_empty());
+        assert!(masked_columns(&[], w, active, 15000.0).is_empty());
+    }
+
     /// A maker note holding only `ColorData` (`0x4001`) as `ty` (3 = SHORT, 7 = UNDEFINED) with `n` values, a plain
     /// IFD whose value offset is relative to the TIFF header (patched once the note's position is known).
     fn note_with_color_data(ty: u16, data: &[u8]) -> Vec<u8> {
diff --git a/crates/raw/src/vendor/cr2/sraw.rs b/crates/raw/src/vendor/cr2/sraw.rs
new file mode 100644
index 00000000..68b40623
--- /dev/null
+++ b/crates/raw/src/vendor/cr2/sraw.rs
@@ -0,0 +1,578 @@
+//! Canon sRAW / mRAW: reduced-resolution YCbCr "raw" frames in CR2 (raw IFD tag `0xc6c5` = 4).
+//!
+//! What the files contain (measured on the 31 CC0 sRAW / mRAW samples of 16 models, see the evidence below):
+//!
+//! - The raw strip is one lossless-JPEG frame with three components. Luma is sampled 2×1 (sRAW, 4:2:2, `0x21`) or
+//!   2×2 (mRAW, 4:2:0, `0x22`), both chroma components 1×1; precision 15, predictor 1, no restart markers.
+//!   The frame's width and height are only a factorisation of the sample count: they are not the image size.
+//! - The decoded sample stream (MCU after MCU: `Y Y Cb Cr` or `Y Y Y Y Cb Cr`) is cut into vertical slices exactly
+//!   like the CFA data (`cr2_slice = [n, w, last]`, widths counted in samples). A slice row is a whole number of
+//!   MCUs, so the image is `Σw / MCU-size × 2` pixels wide, and one slice row is one pixel row (4:2:2) or two (4:2:0).
+//! - Prediction: each component is a one-dimensional chain in decoding order (so the second luma row of a 4:2:0 MCU
+//!   continues from the end of the first), and the first sample of every frame row starts from the first sample of
+//!   the previous one ([`ljpeg::Prediction::Sequential`]). The Sony prediction (geometric) gives vertical stripes on
+//!   these files.
+//! - The samples are linear. Luma is the BT.601 luma (0.299, 0.587, 0.114; also the TIFF 6.0 default
+//!   `YCbCrCoefficients`) of white-balanced camera RGB, about 7/8 of the black-subtracted sensor counts; chroma is
+//!   centred on 16384. White balance is baked in (neutral surfaces have neutral chroma); which of the maker note's
+//!   white-balance sets was used is not always the as-shot one, so it is not undone.
+//! - Chroma is stored as a scaled colour difference, `R − Y = a·(Cr − 16384)` and `B − Y = b·(Cb − 16384)`, with
+//!   `G` from the luma equation. `a` and `b` are about 1.0 on bodies from 2012 on, but about 5.7 and 7.4 (the TIFF
+//!   6.0 YCbCr ratio 1.402 : 1.772, scaled by about 4.1) on the 2008–2010 bodies (5D Mark II, 50D, 7D, 60D, 1D Mark IV).
+//!   Rather than keying a table on the model, the gains are measured per file against the 16-bit RGB image the
+//!   camera stores in IFD2 for these files (see [`chroma_gains`]).
+//!
+//! Only these files were used as evidence: the sRAW samples themselves, the same cameras' CFA files of the same
+//! scenes (raw counts against the decoded samples), and the IFD2 image. The ExifTool tag documentation was used for
+//! tag names.
+
+use super::{COLOR_BALANCE, CR2_SLICE, SENSOR_INFO, words};
+use crate::{BlackLevel, ColorData, Mode, OpcodeLists, RawData, RawError, RawFormat, RawImage, Rect, Result, ljpeg};
+use lightcraft_geom::Orientation;
+use lightcraft_tiff::image::{Chunk, chunk_bytes};
+use lightcraft_tiff::{ByteOrder, Ifd, Tiff, makernote, tags as t};
+use rayon::prelude::*;
+
+/// Chroma samples are centred on this value.
+const CHROMA_CENTRE: f64 = 16384.0;
+/// BT.601 luma weights, the TIFF 6.0 default `YCbCrCoefficients`.
+const KR: f64 = 0.299;
+const KG: f64 = 0.587;
+const KB: f64 = 0.114;
+/// Decoded luma relative to black-subtracted sensor counts (white-balanced): 0.877, 0.877, 0.896, 0.880, 0.871, 0.851
+/// and 0.846 on the 7D Mark II, 5DS R, 6D Mark II, 5DS, 5D Mark II, 1D X Mark II and 50D (CFA and sRAW files of the
+/// same scene), so 7/8. It sets the white level, so that a file renders about as bright as the CFA file of the same
+/// scene.
+const LUMA_GAIN: f32 = 0.875;
+/// Full scale of a 14-bit sensor, the white level of a CFA CR2 without a saturation plateau.
+const SENSOR_FULL: f32 = 16383.0;
+/// Mid-tone limit (IFD2 units) of the pixels used for the chroma fit: above about a quarter of full scale the
+/// camera's own RGB image rolls off.
+const FIT_LIMIT: f64 = 4096.0;
+
+/// How the decoded frame maps to the image.
+#[derive(Debug, PartialEq)]
+pub(super) struct Layout {
+    pub width: usize,
+    pub height: usize,
+    /// Vertical subsampling of the chroma planes: 1 (4:2:2, sRAW) or 2 (4:2:0, mRAW).
+    pub vertical: usize,
+    /// Slice widths in samples.
+    widths: Vec<usize>,
+    /// Slice height in MCU rows.
+    rows: usize,
+    /// Samples per MCU.
+    mcu: usize,
+    /// Frame size from the SOF3 header.
+    frame_width: usize,
+    frame_height: usize,
+}
+
+impl Layout {
+    /// The layout of a `frame_width × frame_height` frame with `vertical` chroma subsampling and `cr2_slice` tag
+    /// values `slices` (`[n, w, last]`).
+    pub(super) fn new(frame_width: usize, frame_height: usize, vertical: usize, slices: &[u64]) -> Result<Layout> {
+        let &[n, w, last] = slices else { return Err(RawError::Corrupt("sRAW without slice layout".into())) };
+        if n > 64 || w == 0 || last == 0 {
+            return Err(RawError::Corrupt("sRAW slice layout".into()));
+        }
+        let mcu = 2 * vertical + 2;
+        let mut widths = vec![w as usize; n as usize];
+        widths.push(last as usize);
+        if widths.iter().any(|w| w % mcu != 0) {
+            return Err(RawError::Corrupt("sRAW slice is not a whole number of MCUs".into()));
+        }
+        let samples =
+            frame_width.checked_mul(frame_height).and_then(|p| p.checked_add(p / vertical)).ok_or(RawError::Limit("sRAW frame too large"))?;
+        let row = widths.iter().try_fold(0usize, |a, &w| a.checked_add(w)).ok_or(RawError::Limit("sRAW slice widths"))?;
+        if samples == 0 || row == 0 || samples % row != 0 {
+            return Err(RawError::Corrupt(format!("sRAW slices ({row} samples per row) do not divide the frame ({samples} samples)")));
+        }
+        let rows = samples / row;
+        let (width, height) = (row / mcu * 2, rows * vertical);
+        if width.checked_mul(height).and_then(|p| p.checked_mul(3)).is_none_or(|s| s > crate::MAX_SAMPLES) {
+            return Err(RawError::Limit("sRAW image too large"));
+        }
+        Ok(Layout { width, height, vertical, widths, rows, mcu, frame_width, frame_height })
+    }
+}
+
+/// Planar YCbCr at image geometry: luma `width × height`, chroma `width/2 × height/vertical`.
+struct Planes {
+    width: usize,
+    height: usize,
+    vertical: usize,
+    y: Vec<u16>,
+    cb: Vec<u16>,
+    cr: Vec<u16>,
+}
+
+impl Planes {
+    fn chroma_width(&self) -> usize {
+        self.width / 2
+    }
+
+    /// Re-chop the decoded MCU stream into image planes.
+    fn arrange(frame: &ljpeg::FrameSubsampled, layout: &Layout) -> Planes {
+        let (w, h, v, m) = (layout.width, layout.height, layout.vertical, layout.mcu);
+        let cw = w / 2;
+        let mut p = Planes { width: w, height: h, vertical: v, y: vec![0; w * h], cb: vec![0; cw * (h / v)], cr: vec![0; cw * (h / v)] };
+        let mcus_per_frame_row = layout.frame_width / 2;
+        let mut x0 = 0;
+        for &sw in &layout.widths {
+            let per_row = sw / m;
+            let first = layout.rows * (x0 / m);
+            for r in 0..layout.rows {
+                for k in 0..per_row {
+                    let q = first + r * per_row + k;
+                    let (qy, qx) = (q / mcus_per_frame_row, q % mcus_per_frame_row);
+                    let px = (x0 / m + k) * 2;
+                    for dy in 0..v {
+                        let src = (qy * v + dy) * layout.frame_width + qx * 2;
+                        let dst = (r * v + dy) * w + px;
+                        p.y[dst..dst + 2].copy_from_slice(&frame.planes[0][src..src + 2]);
+                    }
+                    p.cb[r * cw + px / 2] = frame.planes[1][qy * mcus_per_frame_row + qx];
+                    p.cr[r * cw + px / 2] = frame.planes[2][qy * mcus_per_frame_row + qx];
+                }
+            }
+            x0 += sw;
+        }
+        p
+    }
+
+    /// Mean luma / Cb / Cr over the pixel window `[x0, x1) × [y0, y1)` (non-empty, inside the image).
+    fn window_mean(&self, x0: usize, x1: usize, y0: usize, y1: usize) -> (f64, f64, f64) {
+        let (mut sy, mut ny) = (0f64, 0f64);
+        for y in y0..y1 {
+            let row = &self.y[y * self.width + x0..y * self.width + x1];
+            sy += row.iter().map(|&v| f64::from(v)).sum::<f64>();
+            ny += row.len() as f64;
+        }
+        let (cx0, cx1) = (x0 / 2, x1.div_ceil(2).max(x0 / 2 + 1));
+        let (cy0, cy1) = (y0 / self.vertical, y1.div_ceil(self.vertical).max(y0 / self.vertical + 1));
+        let (mut sb, mut sr, mut nc) = (0f64, 0f64, 0f64);
+        for y in cy0..cy1.min(self.height / self.vertical) {
+            for x in cx0..cx1.min(self.chroma_width()) {
+                sb += f64::from(self.cb[y * self.chroma_width() + x]);
+                sr += f64::from(self.cr[y * self.chroma_width() + x]);
+                nc += 1.0;
+            }
+        }
+        let nc = nc.max(1.0);
+        (sy / ny.max(1.0), sb / nc - CHROMA_CENTRE, sr / nc - CHROMA_CENTRE)
+    }
+
+    /// Linear RGB (`width × height × 3`): `R = Y + a·Cr`, `B = Y + b·Cb`, `G` from the luma equation.
+    fn to_rgb(&self, a: f64, b: f64) -> Vec<u16> {
+        let (gr, gb) = ((KR / KG * a) as f32, (KB / KG * b) as f32);
+        let (a, b) = (a as f32, b as f32);
+        let cw = self.chroma_width();
+        let centre = CHROMA_CENTRE as f32;
+        let mut out = vec![0u16; self.width * self.height * 3];
+        out.par_chunks_mut(self.width * 3).enumerate().for_each(|(y, row)| {
+            let luma = &self.y[y * self.width..(y + 1) * self.width];
+            let chroma = (y / self.vertical) * cw;
+            for (x, px) in row.as_chunks_mut::<3>().0.iter_mut().enumerate() {
+                let (cb, cr) = (f32::from(self.cb[chroma + x / 2]) - centre, f32::from(self.cr[chroma + x / 2]) - centre);
+                let l = f32::from(luma[x]);
+                px[0] = (l + a * cr).round().clamp(0.0, 65535.0) as u16;
+                px[1] = (l - gr * cr - gb * cb).round().clamp(0.0, 65535.0) as u16;
+                px[2] = (l + b * cb).round().clamp(0.0, 65535.0) as u16;
+            }
+        });
+        out
+    }
+}
+
+/// The 16-bit RGB image in IFD2 (`SRawType` 3): the camera's own rendering of the same frame at a fraction of the
+/// size, white-balanced and linear below about a quarter of full scale.
+struct Preview {
+    width: usize,
+    height: usize,
+    rgb: Vec<u16>,
+}
+
+fn read_preview(bytes: &[u8], tiff: &Tiff) -> Option<Preview> {
+    let info = tiff.ifds.get(2)?.image().ok()?;
+    let (w, h) = (info.width as usize, info.height as usize);
+    if info.samples_per_pixel != 3 || info.bits_per_sample != [16, 16, 16] || info.compression != 1 || info.planar != 1 || info.sample_format != 1 {
+        return None;
+    }
+    let n = w.checked_mul(h)?.checked_mul(3)?;
+    if n == 0 || n > 1 << 24 {
+        return None;
+    }
+    let mut raw: Vec<u8> = Vec::with_capacity(n * 2);
+    for c in info.chunks(bytes.len() as u64) {
+        raw.extend_from_slice(chunk_bytes(bytes, &c)?);
+        if raw.len() >= n * 2 {
+            break;
+        }
+    }
+    if raw.len() < n * 2 {
+        return None;
+    }
+    let order: ByteOrder = tiff.order;
+    let rgb = raw.as_chunks::<2>().0.iter().take(n).map(|&c| order.u16(c)).collect();
+    Some(Preview { width: w, height: h, rgb })
+}
+
+#[derive(Default)]
+struct Regression {
+    n: f64,
+    sx: f64,
+    st: f64,
+    sxx: f64,
+    sxt: f64,
+    stt: f64,
+}
+
+impl Regression {
+    fn add(&mut self, x: f64, t: f64) {
+        self.n += 1.0;
+        self.sx += x;
+        self.st += t;
+        self.sxx += x * x;
+        self.sxt += x * t;
+        self.stt += t * t;
+    }
+
+    /// Least-squares slope of `t` on `x` (with intercept) and its residual sum of squares.
+    fn slope(&self) -> Option<(f64, f64)> {
+        let var = self.n * self.sxx - self.sx * self.sx;
+        if self.n < 500.0 || var <= 1e-9 * self.n * self.n {
+            return None;
+        }
+        let slope = (self.n * self.sxt - self.sx * self.st) / var;
+        let icpt = (self.st - slope * self.sx) / self.n;
+        let rss =
+            self.stt - 2.0 * slope * self.sxt - 2.0 * icpt * self.st + slope * slope * self.sxx + 2.0 * slope * icpt * self.sx + self.n * icpt * icpt;
+        Some((slope, rss.max(0.0)))
+    }
+}
+
+/// How the IFD2 image sits on the full-size planes: its pixel `(i, j)` covers the window starting at
+/// `(x0 + i·sx, y0 + j·sy)` and `sx × sy` pixels large.
+struct Grid {
+    x0: f64,
+    y0: f64,
+    sx: f64,
+    sy: f64,
+}
+
+/// The chroma gains `(a, b)` of this file (`R − Y = a·Cr`, `B − Y = b·Cb`), by least squares of the IFD2 image
+/// against the planes averaged to its size. Where IFD2 sits on the frame depends on the model (the whole frame,
+/// the sensor's active area, or a whole or half-integer reduction of the frame that overhangs it by a few pixels),
+/// so these are tried and the best fit is kept. `None` when the file has no usable IFD2 or the fit is not well
+/// conditioned.
+fn chroma_gains(planes: &Planes, preview: &Preview, active: Rect) -> Option<(f64, f64)> {
+    let (pw, ph) = (preview.width as f64, preview.height as f64);
+    let (w, h) = (planes.width as f64, planes.height as f64);
+    let grids = [
+        Grid { x0: 0.0, y0: 0.0, sx: w / pw, sy: h / ph },
+        Grid { x0: active.x as f64, y0: active.y as f64, sx: active.width as f64 / pw, sy: active.height as f64 / ph },
+        Grid { x0: 0.0, y0: 0.0, sx: (2.0 * w / pw).round() / 2.0, sy: (2.0 * h / ph).round() / 2.0 },
+    ];
+    let mut best: Option<(f64, f64, f64)> = None;
+    for g in &grids {
+        if !(g.sx >= 1.0 && g.sy >= 1.0) {
+            continue;
+        }
+        let (mut fr, mut fb) = (Regression::default(), Regression::default());
+        for j in 0..preview.height {
+            let y0 = (g.y0 + j as f64 * g.sy) as usize;
+            let y1 = ((g.y0 + (j + 1) as f64 * g.sy) as usize).min(planes.height);
+            for i in 0..preview.width {
+                let p = &preview.rgb[(j * preview.width + i) * 3..][..3];
+                let [r, gr, b] = [f64::from(p[0]), f64::from(p[1]), f64::from(p[2])];
+                if r.max(gr).max(b) >= FIT_LIMIT || r.min(gr).min(b) <= 0.0 {
+                    continue;
+                }
+                let x0 = (g.x0 + i as f64 * g.sx) as usize;
+                let x1 = ((g.x0 + (i + 1) as f64 * g.sx) as usize).min(planes.width);
+                if x1 <= x0 || y1 <= y0 {
+                    continue;
+                }
+                let (y, cb, cr) = planes.window_mean(x0, x1, y0, y1);
+                if y < 150.0 {
+                    continue;
+                }
+                fr.add(cr, r - y);
+                fb.add(cb, b - y);
+            }
+        }
+        if let (Some((a, ra)), Some((b, rb))) = (fr.slope(), fb.slope()) {
+            let cost = (ra + rb) / (fr.n + fb.n);
+            if a.is_finite() && b.is_finite() && best.is_none_or(|(_, _, c)| cost < c) {
+                best = Some((a, b, cost));
+            }
+        }
+    }
+    best.map(|(a, b, _)| (a, b)).filter(|(a, b)| (0.25..=16.0).contains(a) && (0.25..=16.0).contains(b))
+}
+
+/// Word index of `AverageBlackLevel` (four equal-ish values) in the maker note's `ColorData` by `ColorDataVersion`
+/// (word 0), located by searching the CC0 samples for the values ExifTool reports.
+fn average_black_at(version: i16) -> Option<usize> {
+    Some(match version {
+        6 | 7 | 9 => 231,
+        10 | 11 => 276,
+        12 | 13 | 15 => 326,
+        _ => return None,
+    })
+}
+
+/// The sensor's black level in raw counts from `ColorData` (`None` for versions whose position is not known, and
+/// when the four values are not plausible and near-equal).
+fn colour_data_black(words: &[u64]) -> Option<f32> {
+    let version = words.first().map(|&v| v as u16 as i16)?;
+    let q = words.get(average_black_at(version)?..)?.get(..4)?;
+    let (lo, hi) = (q.iter().min()?, q.iter().max()?);
+    ((256..=4096).contains(lo) && hi - lo <= 8).then(|| q.iter().sum::<u64>() as f32 / 4.0)
+}
+
+/// Decode a Canon sRAW / mRAW CR2 into linear white-balanced camera RGB (`cpp` 3).
+pub(super) fn decode(bytes: &[u8], tiff: &Tiff, raw: &Ifd, mode: Mode) -> Result<RawImage> {
+    let ifd0 = &tiff.ifds[0];
+    let off = raw.u64(t::STRIP_OFFSETS).ok_or(RawError::Tiff(lightcraft_tiff::TiffError::MissingTag(t::STRIP_OFFSETS)))?;
+    let len = raw.u64(t::STRIP_BYTE_COUNTS).unwrap_or(bytes.len() as u64 - off.min(bytes.len() as u64));
+    let chunk = Chunk { index: 0, x: 0, y: 0, width: 0, height: 0, plane: 0, offset: off, len };
+    let src = chunk_bytes(bytes, &chunk).ok_or_else(|| RawError::Corrupt("raw strip outside file".into()))?;
+    let (fw, fh, vertical) = ljpeg::frame_info_subsampled(src)?;
+    let slices = raw.u64s(CR2_SLICE).unwrap_or_default();
+    let layout = Layout::new(fw, fh, vertical, &slices)?;
+
+    let make = ifd0.string(t::MAKE).unwrap_or_default();
+    let mn =
+        tiff.exif().and_then(|e| e.get(t::MAKER_NOTE)).and_then(|e| makernote::parse_makernote(bytes, e.offset, e.count() as u64, tiff.order, &make));
+    let (w, h) = (layout.width, layout.height);
+    let mut active = Rect::new(0, 0, w, h);
+    if let Some(si) = mn.as_ref().and_then(|m| m.ifd.u64s(SENSOR_INFO)).filter(|v| v.len() >= 9) {
+        let (l, tp, r, b) = (si[5] as usize, si[6] as usize, si[7] as usize, si[8] as usize);
+        if r > l && b > tp && r < w && b < h {
+            active = Rect::new(l, tp, r - l + 1, b - tp + 1);
+        }
+    }
+    let colour_data = mn.as_ref().and_then(|m| m.ifd.value(COLOR_BALANCE).map(|v| words(v, m.order)));
+    let black_counts = colour_data.as_deref().and_then(colour_data_black);
+    // 1.0 = a CFA CR2 of the same body at full 14-bit scale; see LUMA_GAIN
+    let white = LUMA_GAIN * (SENSOR_FULL - black_counts.unwrap_or(0.0));
+
+    let data = match mode {
+        Mode::Header => Vec::new(),
+        Mode::Full => {
+            let samples = fw * fh + fw * fh / vertical;
+            let frame = ljpeg::decode_subsampled(src, samples.min(crate::MAX_SAMPLES), ljpeg::Prediction::Sequential)?;
+            let planes = Planes::arrange(&frame, &layout);
+            drop(frame);
+            let (a, b) = read_preview(bytes, tiff).and_then(|p| chroma_gains(&planes, &p, active)).unwrap_or((1.0, 1.0));
+            planes.to_rgb(a, b)
+        }
+    };
+
+    let mut metadata = lightcraft_meta::from_tiff(tiff);
+    metadata.width = Some(active.width as u32);
+    metadata.height = Some(active.height as u32);
+    let img = RawImage {
+        format: RawFormat::Cr2,
+        width: w,
+        height: h,
+        cpp: 3,
+        data: RawData::U16(data),
+        cfa: None,
+        bits: 14,
+        black: BlackLevel::uniform(0.0),
+        white: vec![white],
+        active_area: active,
+        crop: Rect::new(0, 0, active.width, active.height),
+        orientation: Orientation::from_exif(ifd0.u16(t::ORIENTATION).unwrap_or(1)),
+        color: ColorData::default(),
+        // the camera's white balance is already applied, as in Sony's linear YCbCr
+        wb_multipliers: Some([1.0; 3]),
+        linearized: false,
+        opcodes: OpcodeLists::default(),
+        metadata,
+    };
+    img.validate_for(mode)?;
+    Ok(img)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use lightcraft_tiff::{IfdBuilder, ImageData, TiffWriter, Value};
+
+    const SRAW_TYPE_TAG: u16 = 0xc6c5;
+
+    /// The 4:2:2 stream of `ljpeg`'s hand-coded fixture (4 × 2 frame, two MCUs per frame row) decodes to luma
+    /// 1000 1001 / 1002 1003 / 1100 1101 / 1102 1103 in MCU order, Cb 16384 16385 16484 16485, Cr 16484 16486
+    /// 16584 16586.
+    fn stream_422() -> Vec<u8> {
+        ljpeg::tests::fixture_subsampled(4, 2, 0x21, &[-31768, 1, -16384, -16284, 1, 1, 1, 2, 100, 1, 100, 100, 1, 1, 1, 2])
+    }
+
+    /// A CR2 whose raw IFD holds `stream` cut into the slices `slices` (IFD2 = a 2 × 2 16-bit RGB image when
+    /// `preview` is given).
+    fn sraw_file(stream: Vec<u8>, slices: [u16; 3], sraw_type: u32, preview: Option<[u16; 12]>) -> Vec<u8> {
+        let mut ifd0 = IfdBuilder::new();
+        ifd0.set(t::MAKE, Value::Ascii("Canon".into()));
+        ifd0.set(t::MODEL, Value::Ascii("Canon EOS Test".into()));
+        let mut ifd2 = IfdBuilder::new();
+        if let Some(p) = preview {
+            ifd2.set(t::COMPRESSION, Value::Short(vec![1]));
+            ifd2.set(t::PHOTOMETRIC, Value::Short(vec![2]));
+            ifd2.set(t::IMAGE_WIDTH, Value::Long(vec![2]));
+            ifd2.set(t::IMAGE_LENGTH, Value::Long(vec![2]));
+            ifd2.set(t::BITS_PER_SAMPLE, Value::Short(vec![16, 16, 16]));
+            ifd2.set(t::SAMPLES_PER_PIXEL, Value::Short(vec![3]));
+            ifd2.set_image(ImageData::Strips { rows_per_strip: 2, strips: vec![p.iter().flat_map(|v| v.to_le_bytes()).collect()] });
+        } else {
+            ifd2.set(1, Value::Short(vec![0]));
+        }
+        let mut ifd3 = IfdBuilder::new();
+        ifd3.set(t::COMPRESSION, Value::Short(vec![6]));
+        ifd3.set(SRAW_TYPE_TAG, Value::Long(vec![sraw_type]));
+        ifd3.set(CR2_SLICE, Value::Short(slices.to_vec()));
+        ifd3.set_image(ImageData::Strips { rows_per_strip: 2, strips: vec![stream] });
+        TiffWriter::new(ByteOrder::Little, false).write(&[ifd0, IfdBuilder::new().with(1, Value::Short(vec![0])), ifd2, ifd3]).unwrap()
+    }
+
+    #[test]
+    fn slices_are_cut_back_into_image_columns_and_converted() {
+        // slices [1, 4, 4]: two slices of one MCU per row; slice 0 holds MCUs 0 and 1 (image rows 0 and 1), slice 1
+        // holds MCUs 2 and 3, so the image is 4 × 2 with luma 1000 1001 1100 1101 / 1002 1003 1102 1103.
+        let bytes = sraw_file(stream_422(), [1, 4, 4], 4, None);
+        let img = crate::decode(&bytes).unwrap();
+        assert_eq!((img.width, img.height, img.cpp), (4, 2, 3));
+        assert!(img.cfa.is_none());
+        assert_eq!(img.wb_multipliers, Some([1.0; 3]));
+        let RawData::U16(px) = &img.data else { panic!("integer data") };
+        // no IFD2: chroma gains 1; R = Y + Cr', B = Y + Cb', G from the BT.601 luma
+        let expect = |y: f64, cb: f64, cr: f64| {
+            let (r, b) = (y + cr, y + cb);
+            [r, (y - KR * r - KB * b) / KG, b].map(|v| v.round() as i32)
+        };
+        let cases = [
+            ((0, 0), expect(1000.0, 0.0, 100.0)),
+            ((1, 0), expect(1001.0, 0.0, 100.0)),
+            ((2, 0), expect(1100.0, 100.0, 200.0)),
+            ((3, 0), expect(1101.0, 100.0, 200.0)),
+            ((0, 1), expect(1002.0, 1.0, 102.0)),
+            ((3, 1), expect(1103.0, 101.0, 202.0)),
+        ];
+        for ((x, y), want) in cases {
+            let got: Vec<i32> = px[(y * 4 + x) * 3..][..3].iter().map(|&v| i32::from(v)).collect();
+            assert!(got.iter().zip(want).all(|(g, w)| (g - w).abs() <= 1), "({x},{y}): {got:?} vs {want:?}");
+        }
+        // header-only decoding reports the same image
+        assert_eq!(crate::probe_info(&bytes).unwrap(), img.info());
+        assert!(img.develop(crate::Method::Bilinear).is_ok());
+    }
+
+    #[test]
+    fn a_preview_too_small_to_fit_leaves_the_gains_at_one() {
+        // IFD2 of 2 × 2 pixels cannot support a fit (it needs hundreds of samples): the file still decodes
+        let with = crate::decode(&sraw_file(stream_422(), [1, 4, 4], 4, Some([900; 12]))).unwrap();
+        let without = crate::decode(&sraw_file(stream_422(), [1, 4, 4], 4, None)).unwrap();
+        assert_eq!(with.data, without.data);
+    }
+
+    #[test]
+    fn only_ycbcr_frames_take_this_path() {
+        // other raw types (3 is the preview image's) stay unsupported, as before
+        for kind in [0, 2, 3, 5] {
+            let bytes = sraw_file(stream_422(), [1, 4, 4], kind, None);
+            assert!(matches!(crate::decode(&bytes), Err(RawError::Unsupported(_))), "type {kind}");
+        }
+    }
+
+    #[test]
+    fn slice_layouts_must_fit_the_frame() {
+        let ok = Layout::new(4, 2, 1, &[1, 4, 4]).unwrap();
+        assert_eq!((ok.width, ok.height), (4, 2));
+        // 4:2:0: six samples per MCU, one slice row is two image rows
+        let l = Layout::new(8, 4, 2, &[1, 12, 12]).unwrap();
+        assert_eq!((l.width, l.height), (8, 4));
+        assert!(Layout::new(4, 2, 1, &[1, 3, 5]).is_err()); // not whole MCUs
+        assert!(Layout::new(4, 2, 1, &[1, 4, 8]).is_err()); // rows do not divide the frame
+        assert!(Layout::new(4, 2, 1, &[1, 0, 4]).is_err());
+        assert!(Layout::new(4, 2, 1, &[4, 4]).is_err()); // not three values
+        assert!(Layout::new(4, 2, 1, &[65, 4, 4]).is_err());
+        // slice widths whose sum overflows (or wraps to zero) are rejected, not divided by
+        assert!(Layout::new(4, 2, 1, &[3, 1 << 62, 1 << 62]).is_err());
+        assert!(Layout::new(4, 2, 1, &[1, u64::MAX - 3, 4]).is_err());
+        let bytes = sraw_file(stream_422(), [1, 4, 8], 4, None);
+        assert!(crate::decode(&bytes).is_err());
+    }
+
+    /// Textured luma and smooth chroma on `w × h` planes.
+    fn test_planes(w: usize, h: usize, vertical: usize) -> Planes {
+        let y: Vec<u16> = (0..w * h).map(|i| (600 + ((i % w) * 13 + (i / w) * 29) % 1500) as u16).collect();
+        let cw = w / 2;
+        let ch = h / vertical;
+        let cb = (0..cw * ch).map(|i| (16384 + (i % cw) as i32 * 7 - (i / cw) as i32 * 3 - 150) as u16).collect();
+        let cr = (0..cw * ch).map(|i| (16384 + (i / cw) as i32 * 5 + (i % cw) as i32 * 2 - 120) as u16).collect();
+        Planes { width: w, height: h, vertical, y, cb, cr }
+    }
+
+    /// An IFD2 image of `pw × ph` pixels at `scale` per pixel, built the way the files relate it to the planes.
+    fn preview_of(p: &Planes, pw: usize, ph: usize, scale: usize, a: f64, b: f64, pedestal: f64) -> Preview {
+        let mut rgb = Vec::new();
+        for j in 0..ph {
+            for i in 0..pw {
+                let (y, cb, cr) = p.window_mean(i * scale, (i + 1) * scale, j * scale, (j + 1) * scale);
+                let (r, bl) = (y + a * cr, y + b * cb);
+                let g = (y - KR * r - KB * bl) / KG;
+                rgb.extend([r, g, bl].map(|v| (v + pedestal).round().clamp(0.0, 65535.0) as u16));
+            }
+        }
+        Preview { width: pw, height: ph, rgb }
+    }
+
+    #[test]
+    fn chroma_gains_are_measured_against_the_preview() {
+        for vertical in [1, 2] {
+            for (a, b) in [(1.0, 1.0), (5.7, 7.4), (1.13, 1.12)] {
+                let planes = test_planes(160, 96, vertical);
+                // IFD2 is a plain 1/4 reduction, optionally with a black pedestal (some bodies add one)
+                for pedestal in [0.0, 520.0] {
+                    let preview = preview_of(&planes, 40, 24, 4, a, b, pedestal);
+                    let (ga, gb) =
+                        chroma_gains(&planes, &preview, Rect::new(0, 0, 160, 96)).unwrap_or_else(|| panic!("no fit for {a}, {b}, {vertical}"));
+                    assert!((ga / a - 1.0).abs() < 0.02 && (gb / b - 1.0).abs() < 0.02, "vertical {vertical}: ({a}, {b}) measured as ({ga}, {gb})");
+                }
+            }
+        }
+        // the preview overhangs the frame by a few pixels: the whole-frame scale (4.1) is wrong, 4 is right
+        let planes = test_planes(164, 96, 1);
+        let mut preview = preview_of(&planes, 40, 24, 4, 5.7, 7.4, 0.0);
+        let (ga, gb) = chroma_gains(&planes, &preview, Rect::new(0, 0, 164, 96)).unwrap();
+        assert!((ga / 5.7 - 1.0).abs() < 0.02 && (gb / 7.4 - 1.0).abs() < 0.02, "({ga}, {gb})");
+        // a preview of something else gives no usable fit rather than a wild gain
+        preview.rgb.iter_mut().enumerate().for_each(|(i, v)| *v = (1000 + (i * 7919) % 3000) as u16);
+        assert!(
+            chroma_gains(&planes, &preview, Rect::new(0, 0, 164, 96)).is_none_or(|(a, b)| (0.25..=16.0).contains(&a) && (0.25..=16.0).contains(&b))
+        );
+    }
+
+    #[test]
+    fn colour_data_black_by_version() {
+        let mut w = vec![0u64; 400];
+        w[0] = 7;
+        w[231..235].copy_from_slice(&[2048, 2047, 2048, 2048]);
+        assert_eq!(colour_data_black(&w), Some(2047.75));
+        w[0] = 12;
+        assert_eq!(colour_data_black(&w), None); // the black level of another version lives elsewhere
+        w[326..330].copy_from_slice(&[512, 512, 511, 512]);
+        assert_eq!(colour_data_black(&w), Some(511.75));
+        w[326..330].copy_from_slice(&[512, 512, 100, 512]); // implausible
+        assert_eq!(colour_data_black(&w), None);
+        w[0] = 3;
+        assert_eq!(colour_data_black(&w), None); // no position known: black 0
+        w[0] = 65533; // -3
+        assert_eq!(colour_data_black(&w), None);
+        assert_eq!(colour_data_black(&[]), None);
+        assert_eq!(colour_data_black(&[7, 1, 2]), None);
+    }
+}
diff --git a/crates/raw/src/vendor/cr3.rs b/crates/raw/src/vendor/cr3.rs
index c51f8e30..b5442790 100644
--- a/crates/raw/src/vendor/cr3.rs
+++ b/crates/raw/src/vendor/cr3.rs
@@ -7,6 +7,15 @@
 //!
 //! `IAD1` stores the valid sensor area separately from the recommended image crop. Both use inclusive
 //! sensor offsets. The CFA is anchored at the full sensor's origin; cropping shifts its phase later.
+//!
+//! The in-camera aspect ratio (3:2, 4:3, 16:9, 1:1 ...) is not applied to the sensor data: the raw always
+//! holds the whole image. The maker note's `AspectInfo` (tag `0x009a`; ExifTool names `AspectRatio`,
+//! `CroppedImageWidth`, `CroppedImageHeight`, `CroppedImageLeft`, `CroppedImageTop`) holds the shot's rectangle
+//! as five 32-bit values, measured from the top-left of the recommended image crop (the "Canon image", whose
+//! size is ExifTool's `CanonImageWidth` x `CanonImageHeight`). That rectangle replaces the crop. Established
+//! on the CC0 PowerShot SX70 HS, EOS 250D, PowerShot G5 X Mark II and EOS M6 Mark II samples shot at 3:2, 4:3,
+//! 16:9 and 1:1: the rectangle is centred, has the shot's aspect, and files shot at the sensor's own aspect
+//! store the whole image.
 //! Unknown camera metadata versions are ignored rather than assigned a guessed white balance.
 
 use super::{black_from_columns, crx, white_from_data};
@@ -17,6 +26,7 @@ use lightcraft_tiff::{Ifd, Tiff};
 const SENSOR_INFO: u16 = 0x00e0;
 const COLOR_DATA: u16 = 0x4001;
 const LENS_MODEL: u16 = 0x0095;
+const ASPECT_INFO: u16 = 0x009a;
 
 /// Pick the first largest raw track. Equal-sized later tracks can be the Dual Pixel delta, which
 /// must never replace the main sensor image. An invalid full-size descriptor is reported, not
@@ -83,16 +93,26 @@ fn sensor_crop(maker: Option<&Ifd>, width: usize, height: usize) -> Option<Rect>
     )
 }
 
+/// The shot's aspect-ratio rectangle from `AspectInfo`, placed inside `image` (the recommended crop). `None`
+/// when the tag is absent or malformed, or its rectangle doesn't fit inside `image`.
+fn aspect_crop(maker: Option<&Ifd>, image: Rect) -> Option<Rect> {
+    let data = maker?.u64s(ASPECT_INFO)?;
+    let [width, height, left, top] = [1usize, 2, 3, 4].map(|i| data.get(i).and_then(|&v| usize::try_from(v).ok()));
+    let (width, height, left, top) = (width?, height?, left?, top?);
+    if width < 2 || height < 2 || left.checked_add(width)? > image.width || top.checked_add(height)? > image.height {
+        return None;
+    }
+    Some(Rect::new(image.x.checked_add(left)?, image.y.checked_add(top)?, width, height))
+}
+
 fn geometry(area: Option<&Cr3ImageArea>, maker: Option<&Ifd>, width: usize, height: usize) -> (Rect, Rect) {
     let area = area.filter(|a| usize::from(a.width) == width && usize::from(a.height) == height);
     let sensor = sensor_crop(maker, width, height);
     let active = area.and_then(|a| a.active).and_then(|b| inclusive_rect(b, width, height)).or(sensor).unwrap_or(Rect::new(0, 0, width, height));
-    let crop = area.and_then(|a| inclusive_rect(a.crop, width, height)).or(sensor).and_then(|c| relative_crop(c, active)).unwrap_or(Rect::new(
-        0,
-        0,
-        active.width,
-        active.height,
-    ));
+    // The recommended crop, when the file gives a consistent one. `AspectInfo` is measured from its origin, so it
+    // is only applied on top of that; without it (the crop doesn't fit the valid area) the whole active area stays.
+    let recommended = area.and_then(|a| inclusive_rect(a.crop, width, height)).or(sensor).and_then(|c| relative_crop(c, active));
+    let crop = recommended.map(|c| aspect_crop(maker, c).unwrap_or(c)).unwrap_or(Rect::new(0, 0, active.width, active.height));
     (active, crop)
 }
 
@@ -266,6 +286,10 @@ mod tests {
     }
 
     fn synthetic_header() -> Vec<u8> {
+        synthetic_header_with(None)
+    }
+
+    fn synthetic_header_with(aspect: Option<[u32; 5]>) -> Vec<u8> {
         use lightcraft_tiff::{ByteOrder, TiffWriter, tags as t};
         let tiff = |b: IfdBuilder| TiffWriter::new(ByteOrder::Little, false).write(&[b]).unwrap();
         let cmt1 = tiff(
@@ -275,11 +299,13 @@ mod tests {
                 .with(t::ORIENTATION, Value::Short(vec![6])),
         );
         let cmt2 = tiff(IfdBuilder::new().with(t::ISO_SPEED, Value::Short(vec![800])));
-        let cmt3 = tiff(
-            IfdBuilder::new()
-                .with(SENSOR_INFO, Value::Short(vec![34, 64, 48, 1, 1, 6, 4, 61, 45]))
-                .with(LENS_MODEL, Value::Ascii("RF-S18-45mm F4.5-6.3 IS STM".into())),
-        );
+        let mut cmt3 = IfdBuilder::new()
+            .with(SENSOR_INFO, Value::Short(vec![34, 64, 48, 1, 1, 6, 4, 61, 45]))
+            .with(LENS_MODEL, Value::Ascii("RF-S18-45mm F4.5-6.3 IS STM".into()));
+        if let Some(a) = aspect {
+            cmt3 = cmt3.with(ASPECT_INFO, Value::Long(a.to_vec()));
+        }
+        let cmt3 = tiff(cmt3);
         let mut canon = vec![0x85, 0xc0, 0xb6, 0x87, 0x82, 0x0f, 0x11, 0xe0, 0x81, 0x11, 0xf4, 0xce, 0x46, 0x2b, 0x6a, 0x48];
         canon.extend([box_bytes(b"CMT1", &cmt1), box_bytes(b"CMT2", &cmt2), box_bytes(b"CMT3", &cmt3)].concat());
         let mut coding = vec![0u8; 52];
@@ -374,6 +400,60 @@ mod tests {
         assert!(decode(&bytes[..4200], Mode::Header).is_err());
     }
 
+    #[test]
+    fn aspect_info_replaces_the_crop() {
+        // 16:9 inside the 56 x 42 recommended crop at (2, 2): 56 x 30, 6 rows down.
+        let bytes = synthetic_header_with(Some([7, 56, 30, 0, 6]));
+        let image = decode(&bytes, Mode::Header).unwrap();
+        assert_eq!(image.active_area, Rect::new(4, 2, 60, 46));
+        assert_eq!(image.crop, Rect::new(2, 8, 56, 30));
+        assert_eq!((image.metadata.width, image.metadata.height), (Some(56), Some(30)));
+        // 1:1 with a left offset.
+        let image = decode(&synthetic_header_with(Some([1, 42, 42, 7, 0])), Mode::Header).unwrap();
+        assert_eq!(image.crop, Rect::new(9, 2, 42, 42));
+        // The whole image, as stored for a shot at the sensor's own aspect, changes nothing.
+        let image = decode(&synthetic_header_with(Some([0, 56, 42, 0, 0])), Mode::Header).unwrap();
+        assert_eq!(image.crop, Rect::new(2, 2, 56, 42));
+    }
+
+    #[test]
+    fn aspect_info_that_does_not_fit_is_ignored() {
+        for bad in [[7, 57, 30, 0, 6], [7, 56, 30, 0, 13], [7, 56, 30, 1, 6], [7, 1, 30, 0, 0], [7, 56, 0, 0, 0], [7, u32::MAX, 30, 0, 0]] {
+            let image = decode(&synthetic_header_with(Some(bad)), Mode::Header).unwrap();
+            assert_eq!(image.crop, Rect::new(2, 2, 56, 42), "{bad:?}");
+        }
+    }
+
+    /// Some crop-mode files (EOS R5 Mark II 7883) record a recommended crop that reaches past their valid area. The
+    /// whole active area stays then, and `AspectInfo`, which is measured from the recommended crop, is not applied.
+    #[test]
+    fn aspect_info_needs_a_consistent_recommended_crop() {
+        let aspect = lightcraft_tiff::IfdBuilder::new().with(ASPECT_INFO, Value::Long(vec![13, 5088, 3392, 0, 0]));
+        let bytes = lightcraft_tiff::TiffWriter::new(lightcraft_tiff::ByteOrder::Little, false).write(&[aspect]).unwrap();
+        let maker = Tiff::parse(&bytes).unwrap().ifds.remove(0);
+        let area =
+            |crop| Cr3ImageArea { width: 5376, height: 3574, crop, active: Some([132, 160, 5243, 3567]), masked_left: [0; 4], masked_top: None };
+        // crop right edge 5359 > active right edge 5243: not a crop of the active area
+        assert_eq!(geometry(Some(&area([272, 172, 5359, 3563])), Some(&maker), 5376, 3574).1, Rect::new(0, 0, 5112, 3408));
+        // consistent crop: AspectInfo applies from its origin
+        assert_eq!(geometry(Some(&area([140, 172, 5227, 3563])), Some(&maker), 5376, 3574).1, Rect::new(8, 12, 5088, 3392));
+    }
+
+    /// `AspectInfo` as the SX70 HS 16:9 sample stores it, byte for byte (little-endian LONG x 5), read through
+    /// the TIFF parser: AspectRatio 7, 5184 x 2912 at (0, 488).
+    #[test]
+    fn aspect_info_known_bytes() {
+        let mut tiff = b"II*
".to_vec();
+        tiff.extend_from_slice(&[0x9a, 0x00, 0x04, 0x00, 0x05, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x00, 0x00]);
+        tiff.extend_from_slice(&[0, 0, 0, 0]);
+        tiff.extend_from_slice(&[0x07, 0, 0, 0, 0x40, 0x14, 0, 0, 0x60, 0x0b, 0, 0, 0, 0, 0, 0, 0xe8, 0x01, 0, 0]);
+        let parsed = Tiff::parse(&tiff).unwrap();
+        let maker = parsed.ifds.first();
+        assert_eq!(aspect_crop(maker, Rect::new(132, 40, 5184, 3888)), Some(Rect::new(132, 528, 5184, 2912)));
+        assert_eq!(aspect_crop(maker, Rect::new(0, 0, 5184, 2000)), None);
+        assert_eq!(aspect_crop(None, Rect::new(0, 0, 5184, 3888)), None);
+    }
+
     fn prepend_tracks(bytes: &[u8], tracks: &[u8]) -> Vec<u8> {
         let ftyp_end = u32::from_be_bytes(bytes[..4].try_into().unwrap()) as usize;
         let moov_len = u32::from_be_bytes(bytes[ftyp_end..ftyp_end + 4].try_into().unwrap()) as usize;
diff --git a/crates/raw/src/vendor/crx.rs b/crates/raw/src/vendor/crx.rs
index dfdc73c5..2d15627f 100644
--- a/crates/raw/src/vendor/crx.rs
+++ b/crates/raw/src/vendor/crx.rs
@@ -9,7 +9,8 @@
 //! CC0 raw.pixls.us files against an external decoder used only as a black-box oracle.
 //!
 //! Current support: version 0x100 lossless Bayer RAW and horizontal-tile C-RAW,
-//! plus version 0x200 single-tile 14-bit C-RAW with adaptive QP quantization.
+//! plus version 0x200 single-tile 14-bit C-RAW with adaptive QP quantization
+//! (including odd-height QP maps, as on the EOS R7).
 //! Both ff01/ff02/ff03 and ff11/ff12/ff13 marker families are supported.
 //! Six full M50/R100/R8 sensor fixtures match an external decoder sample for sample.
 //! Unverified coding variants return explicit unsupported errors.
@@ -173,9 +174,6 @@ fn supports(config: &Cr3Compression) -> Result<()> {
     if config.version == 0x200 && (config.levels != 3 || config.bit_depth != 14 || config.tile_width != config.width) {
         return Err(RawError::Unsupported("Canon CRX version 0x200 requires a single-tile 14-bit Bayer C-RAW image".into()));
     }
-    if config.version == 0x200 && !config.height.div_ceil(4).is_multiple_of(2) {
-        return Err(RawError::Unsupported("Canon CRX adaptive QP map with an odd height".into()));
-    }
     if config.median_bit_depth.is_some() {
         return Err(RawError::Unsupported("Canon CRX extended median-bit-depth header".into()));
     }
@@ -418,7 +416,9 @@ fn adaptive_step(map: &QpMap, band: usize, x: usize, y: usize, base: u32, gain:
         let index = row.checked_mul(map.width).and_then(|n| n.checked_add(column)).ok_or(RawError::Limit("CRX QP map index"))?;
         let first = *map.data.get(index).ok_or_else(|| corrupt("QP coordinate outside map"))?;
         let value = if band < 7 {
-            let second_row = row + 1;
+            // An odd-height map (R7: 4732 rows give 1183 QP rows) leaves the
+            // last row of the coarser bands without a partner; it is used alone.
+            let second_row = (row + 1).min(map.height - 1);
             let second = *map.data.get(second_row * map.width + column).ok_or_else(|| corrupt("QP average outside map"))?;
             (first + second) / 2
         } else {
@@ -734,9 +734,6 @@ fn high_frequency_band(src: &[u8], width: usize, height: usize) -> Result<Vec<i3
 }
 
 fn qp_map(src: &[u8], width: usize, height: usize) -> Result<QpMap> {
-    if !height.is_multiple_of(2) {
-        return Err(RawError::Unsupported("Canon CRX adaptive QP map with an odd height".into()));
-    }
     let count = width.checked_mul(height).filter(|&n| width > 0 && n > 0 && n <= MAX_CRX_SAMPLES / 32).ok_or(RawError::Limit("CRX QP map size"))?;
     let mut data = Vec::new();
     data.try_reserve_exact(count).map_err(|_| RawError::Limit("CRX QP allocation"))?;
@@ -1006,6 +1003,17 @@ mod tests {
         assert!(matches!(qp_map(&[0, 0, 1, 4, 0x94], 1, 4), Err(RawError::Unsupported(_))));
     }
 
+    #[test]
+    fn odd_height_qp_map_uses_its_last_row_alone() {
+        // EOS R7 C-RAW: 4732 sensor rows give a 1183-row QP map, so the last
+        // row of the coarser high-frequency bands has no partner row.
+        let map = QpMap { width: 1, height: 3, data: vec![150, 153, 151] };
+        assert_eq!(adaptive_step(&map, 4, 0, 0, 0, 4).unwrap(), 7);
+        // Row 2 alone is QP 151; averaging with a missing row would leave the table.
+        assert_eq!(adaptive_step(&map, 4, 0, 1, 0, 4).unwrap(), adaptive_step(&map, 7, 0, 2, 0, 4).unwrap());
+        assert!(adaptive_step(&map, 4, 0, 2, 0, 4).is_err());
+    }
+
     #[test]
     fn adaptive_v200_craw_reconstructs_sensor_samples() {
         let mut config = coding();
diff --git a/crates/raw/src/vendor/mod.rs b/crates/raw/src/vendor/mod.rs
index fbbc18eb..e0019c48 100644
--- a/crates/raw/src/vendor/mod.rs
+++ b/crates/raw/src/vendor/mod.rs
@@ -12,10 +12,31 @@ pub mod pef;
 pub mod raf;
 mod rafc;
 pub mod rw2;
+mod sr2;
+pub mod srw;
 
-use crate::{BlackLevel, Rect};
+use crate::{BlackLevel, Cfa, Rect};
+use lightcraft_tiff::Tiff;
 use std::ops::Range;
 
+/// Exif `CFAPattern`.
+pub(crate) const EXIF_CFA_PATTERN: u16 = 0xa302;
+
+/// The colour-filter layout from the Exif `CFAPattern` tag (`0xa302`: two 16-bit repeat counts, found in either
+/// byte order, then one byte per site: 0 = red, 1 = green, 2 = blue), when it describes a 2×2 Bayer cell.
+pub(crate) fn cfa_from_exif(tiff: &Tiff) -> Option<Cfa> {
+    let &[c0, c1, r0, r1, s0, s1, s2, s3] = tiff.exif()?.bytes(EXIF_CFA_PATTERN)? else { return None };
+    let two = |a: u8, b: u8| matches!((a, b), (2, 0) | (0, 2));
+    let name = match [s0, s1, s2, s3] {
+        [0, 1, 1, 2] => "RGGB",
+        [2, 1, 1, 0] => "BGGR",
+        [1, 0, 2, 1] => "GRBG",
+        [1, 2, 0, 1] => "GBRG",
+        _ => return None,
+    };
+    (two(c0, c1) && two(r0, r1)).then(|| Cfa::bayer_static(name))
+}
+
 /// Black level per 2×2 CFA position (anchored at the active area origin) from masked sensor columns `cols` over
 /// rows `rows`. Falls back to 0 when the region is empty.
 pub(crate) fn black_from_columns(data: &[u16], width: usize, cols: Range<usize>, rows: Range<usize>, active: Rect) -> BlackLevel {
diff --git a/crates/raw/src/vendor/nef.rs b/crates/raw/src/vendor/nef.rs
index 5ca66af4..c7b99e93 100644
--- a/crates/raw/src/vendor/nef.rs
+++ b/crates/raw/src/vendor/nef.rs
@@ -3,8 +3,10 @@
 //! Sources: TIFF 6.0 (the raw image is a standard CFA SubIFD), Laurent Clévy's NEF structure notes (prose: IFD
 //! layout, SubIFDs, maker note header) and the ExifTool Nikon tag-name documentation (`0x000c` WB_RBLevels,
 //! `0x003d` BlackLevel, `0x0096` NEFLinearizationTable). The Huffman-compressed data (compression 34713) is decoded
-//! by [`super::nefc`], which documents its clean-room sources; files it can't decode yet ("lossy after split")
-//! are reported as [`RawError::Unsupported`] and their embedded previews still work.
+//! by [`super::nefc`], which documents its clean-room sources; "lossy after split" files are decoded when their strip follows the
+//! rule documented there; files it can't decode are reported as [`RawError::Unsupported`] and their embedded previews still work. So are High Efficiency NEFs
+//! (HE / HE★, Z 8, Z 9, Z 6III, Z f): they keep compression 34713 but carry a wavelet codestream that starts with
+//! the JPEG XS markers SOC + CAP (ISO/IEC 21122-1, `FF10 FF50`) and have no `0x0096` table (issue #193).
 
 use super::{nefc, white_from_data};
 use crate::tiffraw::{Packing, read_image};
@@ -18,6 +20,11 @@ const WB_RB_LEVELS: u16 = 0x000c;
 const BLACK_LEVEL: u16 = 0x003d;
 const LINEARIZATION_TABLE: u16 = 0x0096;
 const CROP_AREA: u16 = 0x0045;
+/// JPEG XS start of codestream (SOC, `FF10`) followed by its mandatory capabilities marker (CAP, `FF50`).
+const JPEG_XS_START: [u8; 4] = [0xff, 0x10, 0xff, 0x50];
+/// Why a High Efficiency NEF shows its embedded preview: the UI shows the part before " (".
+pub(crate) const HIGH_EFFICIENCY: &str =
+    "Nikon High Efficiency NEF (HE / HE★, a JPEG XS-based codec with no public specification; shoot RAW Lossless compressed to edit the raw data)";
 /// Maker note `0x0014`, the "NRW" data block of Coolpix raws: `"NRW "` + a 4-character version, then fields. In
 /// version `0104` the `u32` at byte `0x20` is the black level in sample units (200 in the four 12-bit files here
 /// that have 200 as their darkest samples, 0 in the one whose samples reach 0).
@@ -166,6 +173,13 @@ fn uncompressed(bytes: &[u8], info: &ImageInfo, order: ByteOrder, mn: Option<&ma
 
 /// Nikon Huffman-compressed strip (see [`super::nefc`]); the decode table is maker note `0x0096`.
 fn compressed(bytes: &[u8], info: &ImageInfo, mn: Option<&makernote::MakerNote>) -> Result<RawData> {
+    let starts_with = |magic: &[u8]| {
+        let start = info.chunks(bytes.len() as u64).first().and_then(|c| usize::try_from(c.offset).ok());
+        start.and_then(|o| bytes.get(o..o.checked_add(magic.len())?)) == Some(magic)
+    };
+    if starts_with(&JPEG_XS_START) {
+        return Err(RawError::Unsupported(HIGH_EFFICIENCY.into()));
+    }
     // (some Z bodies label uncompressed, row-padded data 34713 without a table: not handled here yet)
     let table = mn
         .and_then(|m| Some((m.ifd.bytes(LINEARIZATION_TABLE)?, m.order)))
@@ -354,6 +368,24 @@ mod tests {
     #[test]
     fn compressed_without_table_is_unsupported() {
         let bytes = nef(34713, 14, vec![vec![0; 64]], 8, 8, 8);
-        assert!(matches!(crate::decode(&bytes), Err(RawError::Unsupported(_))));
+        let Err(RawError::Unsupported(why)) = crate::decode(&bytes) else { panic!("expected unsupported") };
+        assert!(why.contains("linearization table"), "{why}");
+    }
+
+    /// Issue #193: a High Efficiency NEF (Z f, Z 8: compression 34713, no `0x0096` table, a JPEG XS codestream) is
+    /// named as such instead of being blamed on the missing table, and the header probe reports the same reason.
+    #[test]
+    fn high_efficiency_nef_is_named() {
+        let mut strip = vec![0xff, 0x10, 0xff, 0x50, 0x00, 0x22];
+        strip.resize(64, 0);
+        let bytes = nef(34713, 14, vec![strip], 8, 8, 8);
+        for result in [crate::decode(&bytes).map(|_| ()), crate::probe_info(&bytes).map(|_| ())] {
+            let Err(RawError::Unsupported(why)) = result else { panic!("expected unsupported") };
+            assert_eq!(why, HIGH_EFFICIENCY);
+            assert!(why.starts_with("Nikon High Efficiency NEF ("), "{why}");
+        }
+        // a strip too short to hold the markers is still the missing-table case, not a panic
+        let short = nef(34713, 14, vec![vec![0xff, 0x10]], 1, 1, 1);
+        assert!(matches!(crate::decode(&short), Err(RawError::Unsupported(w)) if w.contains("linearization table")));
     }
 }
diff --git a/crates/raw/src/vendor/nefc.rs b/crates/raw/src/vendor/nefc.rs
index 8ac9e73c..8dab6b5d 100644
--- a/crates/raw/src/vendor/nefc.rs
+++ b/crates/raw/src/vendor/nefc.rs
@@ -39,9 +39,18 @@
 //!   252 in 12-bit units); with the first-interval step they sit at that black level.
 //! - Values in the maker note are in the maker note's byte order (newer bodies write little-endian notes).
 //!
+//! "Lossy after split" (non-zero split row at `0x0096` offset 562, type 2 tables only, found in 11 of the CC0
+//! samples): derived by black-box analysis of those files. Rows below the split row use the lossy Huffman path
+//! above unchanged. Row `split` starts at the very next bit (no alignment); from there every pixel is a word of
+//! `bits - 4` bits (8 at 12 bit, 10 at 14 bit), MSB first, with no row padding. A word is a complete prefix code
+//! for a difference category `n` followed by the top `W - prefix length` bits of the T.81 additional bits (the low
+//! bits are dropped); the difference is the centre of the magnitude bin that was kept. The predictor is the same
+//! as above and the running value is not clamped (only the sample index is, before the curve lookup). The camera
+//! ends the strip with 0 to 7 one-bits after the last full row, which the decoder checks.
+//!
 //! Not supported (returned as [`RawError::Unsupported`], the embedded preview is used instead):
-//! - "Lossy after split" files (non-zero split row at `0x0096` offset 562): from that row on a different table
-//!   is used which our analysis has not recovered yet.
+//! - "Lossy after split" files whose fixed-rate section does not end within the last byte of the strip (see
+//!   below): refused rather than decoded wrongly.
 //! - Other `0x0096` versions, bit depths other than 12/14.
 //! - Code words that never occurred in any sample (the lossy 12-bit 8-bit code word `11111110`, and code words
 //!   longer than 9 bits in the lossy tables) are rejected as corrupt; they cannot code a difference within the
@@ -102,6 +111,8 @@ pub(crate) struct DecodeTable {
     pub encoding: Encoding,
     /// Predictor seeds `[row parity][column]`.
     pub seeds: [[i32; 2]; 2],
+    /// First row of the fixed-rate section ("lossy after split"), 0 when the whole strip is Huffman coded.
+    pub split: usize,
 }
 
 /// Parse maker note `0x0096` for a `bits`-bit image. `order` is the maker note's byte order.
@@ -116,6 +127,7 @@ pub(crate) fn parse_table(t: &[u8], order: ByteOrder, bits: u32) -> Result<Decod
     for (i, s) in seeds.iter_mut().flatten().enumerate() {
         *s = u16_at(2 + 2 * i).ok_or_else(short)? as i32;
     }
+    let mut split = 0;
     let encoding = match (v0, v1) {
         (0x46, _) => Encoding::Lossless,
         (0x44, 0x10 | 0x20 | 0x40) => {
@@ -127,12 +139,7 @@ pub(crate) fn parse_table(t: &[u8], order: ByteOrder, bits: u32) -> Result<Decod
             if v1 == 0x10 {
                 Encoding::Lossy(points)
             } else {
-                let split = u16_at(562).unwrap_or(0);
-                if split != 0 {
-                    return Err(RawError::Unsupported(format!(
-                        "Nikon \"lossy after split\" compressed NEF (split at row {split}) is not decoded yet"
-                    )));
-                }
+                split = u16_at(562).unwrap_or(0) as usize;
                 // type 2: `n` points covering `range` codes, one every `range / (n - 1)`; the curve's first interval
                 // rises by exactly that step (identity in the dark part) and the table version sets the span:
                 // `0x20` covers all 2^bits codes, `0x40` the first quarter (see the module docs)
@@ -156,7 +163,66 @@ pub(crate) fn parse_table(t: &[u8], order: ByteOrder, bits: u32) -> Result<Decod
         }
         _ => return Err(RawError::Unsupported(format!("Nikon compressed NEF version {v0:#04x} {v1:#04x}"))),
     };
-    Ok(DecodeTable { encoding, seeds })
+    Ok(DecodeTable { encoding, seeds, split })
+}
+
+/// Difference-category prefix codes of the fixed-rate section: `(prefix bits, prefix length, category n)`.
+/// A word of `W` bits is a prefix followed by `W - length` bits of the T.81 additional bits of category `n`.
+/// (The 14-bit `010` = category 12 never occurs in the samples; its category is deduced.)
+const FIXED_12: &[(u32, u32, u32)] = &[
+    (0b00, 2, 9),
+    (0b010, 3, 10),
+    (0b011, 3, 8),
+    (0b100, 3, 7),
+    (0b101, 3, 6),
+    (0b110, 3, 5),
+    (0b1110, 4, 4),
+    (0b11110, 5, 3),
+    (0b111110, 6, 2),
+    (0b1111110, 7, 1),
+    (0b11111110, 8, 0),
+];
+const FIXED_14: &[(u32, u32, u32)] = &[
+    (0b00, 2, 8),
+    (0b010, 3, 12),
+    (0b011, 3, 11),
+    (0b100, 3, 10),
+    (0b101, 3, 9),
+    (0b110, 3, 7),
+    (0b1110, 4, 6),
+    (0b11110, 5, 5),
+    (0b111110, 6, 4),
+    (0b1111110, 7, 3),
+    (0b11111110, 8, 2),
+    (0b111111110, 9, 1),
+    (0b1111111110, 10, 0),
+];
+
+/// Word (`bits - 4` bits) to dequantised difference for the fixed-rate section; `None` marks the unused all-ones word.
+fn fixed_word_table(bits: u32) -> Vec<Option<i32>> {
+    let (w, codes) = if bits == 12 { (8, FIXED_12) } else { (10, FIXED_14) };
+    let mut lut = vec![None; 1usize << w];
+    for &(prefix, len, n) in codes {
+        let kept = w - len;
+        for m in 0..1u32 << kept {
+            let e = n.saturating_sub(kept);
+            let ex = (m << e) as i32;
+            let half = (1i32 << e) >> 1;
+            let d = if n == 0 {
+                0
+            } else if ex >= 1 << (n - 1) {
+                ex + half
+            } else if e > 0 {
+                ex + half - (1 << n)
+            } else {
+                ex - ((1 << n) - 1)
+            };
+            if let Some(slot) = lut.get_mut(((prefix << kept) | m) as usize) {
+                *slot = Some(d);
+            }
+        }
+    }
+    lut
 }
 
 /// Decode a `w × h` Nikon Huffman-compressed strip `src` with `bits`-bit samples.
@@ -183,6 +249,11 @@ pub(crate) fn decode(src: &[u8], w: usize, h: usize, bits: u32, table: &DecodeTa
         Encoding::Lossless => (&[], (1i32 << bits) - 1),
         Encoding::Lossy(curve) => (curve, curve.len() as i32 - 1),
     };
+    if table.split != 0 && table.split >= h {
+        return Err(RawError::Corrupt(format!("NEF: split row {} outside the {h} rows", table.split)));
+    }
+    let fixed = if table.split != 0 { fixed_word_table(bits) } else { Vec::new() };
+    let word = bits - 4;
     let mut out = vec![0u16; n];
     let mut stream = Bits::new(src);
     let mut vpred = table.seeds;
@@ -191,7 +262,12 @@ pub(crate) fn decode(src: &[u8], w: usize, h: usize, bits: u32, table: &DecodeTa
         let seeds = vpred.get_mut(y & 1).ok_or(RawError::Limit("NEF row"))?;
         let mut hpred = [0i32; 2];
         for (x, o) in row.iter_mut().enumerate() {
-            let d = diff(&mut stream, &huff).ok_or_else(|| RawError::Corrupt(format!("NEF: invalid Huffman code at row {y}")))?;
+            let d = if table.split != 0 && y >= table.split {
+                let code = stream.get(word) as usize;
+                fixed.get(code).copied().flatten().ok_or_else(|| RawError::Corrupt(format!("NEF: invalid fixed-rate word at row {y}")))?
+            } else {
+                diff(&mut stream, &huff).ok_or_else(|| RawError::Corrupt(format!("NEF: invalid Huffman code at row {y}")))?
+            };
             let p = if x < 2 {
                 let s = seeds.get_mut(x).ok_or(RawError::Limit("NEF column"))?;
                 *s += d;
@@ -202,7 +278,7 @@ pub(crate) fn decode(src: &[u8], w: usize, h: usize, bits: u32, table: &DecodeTa
                 hpred[x & 1]
             };
             let v = p.clamp(0, max);
-            clipped += (v != p) as usize;
+            clipped += (v != p && (table.split == 0 || y < table.split)) as usize;
             *o = if lut.is_empty() { v as u16 } else { lut.get(v as usize).copied().unwrap_or(0) };
         }
         // the camera pads the strip; reading more than a few bytes past its end means truncated or corrupt data
@@ -210,6 +286,19 @@ pub(crate) fn decode(src: &[u8], w: usize, h: usize, bits: u32, table: &DecodeTa
             return Err(RawError::Corrupt(format!("NEF: compressed data ends at row {y} of {h}")));
         }
     }
+    if table.split != 0 {
+        // the fixed-rate section must fill the rest of the strip: whole rows of w words and 0..7 bits of padding.
+        // A strip may hold a few more rows than the image (one body stores 4022 rows for 4020); anything else means
+        // the file does not follow the rule, so refuse it instead of decoding it wrongly.
+        let left = (src.len() * 8).checked_sub(stream.consumed_bits());
+        let row_bits = w * word as usize;
+        if !left.is_some_and(|l| l % row_bits < 8 && l / row_bits <= 4) {
+            return Err(RawError::Unsupported(format!(
+                "Nikon \"lossy after split\" NEF whose fixed-rate section (from row {}) does not end within the last byte",
+                table.split
+            )));
+        }
+    }
     // a wrong table / corrupt stream drifts out of range quickly; real files stay inside (a handful of edge pixels)
     if clipped > n / 1000 + 16 {
         return Err(RawError::Corrupt(format!("NEF: {clipped} decoded values out of range")));
@@ -293,7 +382,7 @@ mod tests {
 
     fn lossless(bits: u32) -> DecodeTable {
         let s = 1 << (bits - 3);
-        DecodeTable { encoding: Encoding::Lossless, seeds: [[s, s], [s, s]] }
+        DecodeTable { encoding: Encoding::Lossless, seeds: [[s, s], [s, s]], split: 0 }
     }
 
     #[test]
@@ -417,6 +506,84 @@ mod tests {
         assert!(parse_table(&odd, ByteOrder::Little, 12).is_err());
     }
 
+    /// Pack a string of `0`/`1` (spaces ignored) MSB first, padding the last byte with one-bits like the camera.
+    fn pack(bits: &str) -> Vec<u8> {
+        let b: Vec<bool> = bits.chars().filter(|c| !c.is_whitespace()).map(|c| c == '1').collect();
+        b.chunks(8).map(|c| (0..8).fold(0u8, |a, i| (a << 1) | c.get(i).copied().unwrap_or(true) as u8)).collect()
+    }
+
+    fn split_table(v1: u8, seed: u16, step: u16, white: u16, split: u16) -> DecodeTable {
+        let mut t = hand_table(v1, seed, step, white);
+        t[562..564].copy_from_slice(&split.to_le_bytes());
+        parse_table(&t, ByteOrder::Little, if step == 4 { 12 } else { 14 }).unwrap()
+    }
+
+    /// 12-bit "lossy after split": row 0 Huffman coded, rows 1 and 2 as 8-bit words that follow the last Huffman
+    /// bit directly. Bit strings written by hand from the rule (prefix, then the kept top bits of the extra bits).
+    const SPLIT_12: &str = "011 100 11110 1110 0 11110         11111110 11110100 11100111 01110000         00000001 11111110 01111111 11111110";
+
+    #[test]
+    fn lossy_after_split_known_answers_12_bit() {
+        let t = split_table(0x40, 252, 4, 4095, 1);
+        assert_eq!(t.split, 1);
+        let out = decode(&pack(SPLIT_12), 4, 3, 12, &t).unwrap();
+        // row 1: d = 0 (n0), +4 (n3, exact), -8 (n4, exact), +132 (n8 keeps 5 bits: 16 << 3 plus half a bin, 4);
+        // row 2: -500 (n9 keeps 6 bits: bin 1 of the negative side, centre -508 + 8), then +252 on the running
+        // value -244 which is not clamped (8, not 252)
+        assert_eq!(out, [256, 252, 255, 252, 252, 256, 244, 388, 0, 252, 8, 252]);
+    }
+
+    #[test]
+    fn lossy_after_split_known_answers_14_bit() {
+        let t = split_table(0x40, 1008, 16, 16383, 1);
+        // row 0 as in the 0x40 test above; row 1 in 10-bit words: 0 (n0), +32 (n6, exact), -254 (n8, exact),
+        // +510 (n9 keeps 7 bits: 127 << 2 plus 2)
+        let bits = "1100 100 111110 11110 0 111110 1111111110 1110100000 0000000001 1011111111";
+        let out = decode(&pack(bits), 4, 2, 14, &t);
+        // word 3 is `00` + 8 bits: 00 00000001 -> n8 extra 00000001 = -254
+        assert_eq!(out.unwrap(), [1012, 1008, 1011, 1008, 1008, 1040, 754, 1550]);
+    }
+
+    #[test]
+    fn lossy_after_split_dequantisation_is_symmetric() {
+        let lut = fixed_word_table(12);
+        assert_eq!((lut[0b00_000000], lut[0b00_111111]), (Some(-508), Some(508)));
+        assert_eq!((lut[0b011_00000], lut[0b011_11111]), (Some(-252), Some(252)));
+        assert_eq!(lut[0b11111110], Some(0));
+        assert_eq!(lut[0xff], None);
+        let lut = fixed_word_table(14);
+        assert_eq!((lut[0b00_00000000], lut[0b00_11111111]), (Some(-255), Some(255)));
+        assert_eq!(lut[0b101_0000000], Some(-510));
+        assert_eq!(lut[0b1111111110], Some(0));
+        assert_eq!(lut[0x3ff], None);
+        for bits in [12, 14] {
+            let lut = fixed_word_table(bits);
+            assert_eq!(lut.iter().filter(|d| d.is_none()).count(), 1, "{bits}-bit: only the all-ones word is unused");
+        }
+    }
+
+    #[test]
+    fn lossy_after_split_refuses_strips_that_do_not_follow_the_rule() {
+        let t = split_table(0x40, 252, 4, 4095, 1);
+        let mut longer = pack(SPLIT_12);
+        longer.extend_from_slice(&[0xff; 3]);
+        assert!(matches!(decode(&longer, 4, 3, 12, &t), Err(RawError::Unsupported(_))));
+        let shorter = &pack(SPLIT_12)[..10];
+        assert!(decode(shorter, 4, 3, 12, &t).is_err());
+        // the unused all-ones word
+        let bad = pack("011 100 11110 1110 0 11110 11111111 11111110 11111110 11111110");
+        assert!(matches!(decode(&bad, 4, 2, 12, &t), Err(RawError::Corrupt(_))));
+        // a split row beyond the image
+        assert!(matches!(decode(&pack(SPLIT_12), 4, 1, 12, &t), Err(RawError::Corrupt(_))));
+        // through the container
+        let mut table = hand_table(0x40, 252, 4, 4095);
+        table[562..564].copy_from_slice(&1u16.to_le_bytes());
+        let ok = crate::decode(&nef_file(pack(SPLIT_12), 4, 3, 12, table.clone(), ByteOrder::Little)).unwrap();
+        assert_eq!(ok.data, crate::RawData::U16(vec![256, 252, 255, 252, 252, 256, 244, 388, 0, 252, 8, 252]));
+        let e = crate::decode(&nef_file(longer, 4, 3, 12, table, ByteOrder::Little));
+        assert!(matches!(e, Err(RawError::Unsupported(_))), "{e:?}");
+    }
+
     #[test]
     fn lossy_type1_full_curve() {
         let mut t = vec![0x44, 0x10, 0, 10, 0, 10, 0, 10, 0, 10, 0, 5];
@@ -436,7 +603,7 @@ mod tests {
         let corrupt = |r: Result<DecodeTable>| matches!(r, Err(RawError::Corrupt(_)));
         let mut split = lossy_table(12, ByteOrder::Big);
         split[562..564].copy_from_slice(&345u16.to_be_bytes());
-        assert!(unsupported(parse_table(&split, ByteOrder::Big, 12)));
+        assert_eq!(parse_table(&split, ByteOrder::Big, 12).unwrap().split, 345);
         assert!(unsupported(parse_table(&[0x49, 0x30, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], ByteOrder::Big, 12)));
         assert!(unsupported(parse_table(&lossy_table(12, ByteOrder::Big), ByteOrder::Big, 16)));
         assert!(corrupt(parse_table(&[], ByteOrder::Big, 12)));
@@ -502,11 +669,11 @@ mod tests {
         let src = encode(&img, w, &LOSSY_12, t.seeds);
         let r = crate::decode(&nef_file(src.clone(), w as u32, h as u32, 12, table.clone(), ByteOrder::Little)).unwrap();
         assert_eq!(r.data, crate::RawData::U16(img.iter().map(|&v| curve[v as usize]).collect()));
-        // the split variant falls back to the preview
+        // a split file whose strip does not follow the fixed-rate rule is refused, never decoded wrongly
         let mut split = table;
         split[562..564].copy_from_slice(&3u16.to_le_bytes());
         let e = crate::decode(&nef_file(src, w as u32, h as u32, 12, split, ByteOrder::Little));
-        assert!(matches!(e, Err(RawError::Unsupported(_))), "{e:?}");
+        assert!(e.is_err(), "{e:?}");
     }
 
     #[test]
diff --git a/crates/raw/src/vendor/orf.rs b/crates/raw/src/vendor/orf.rs
index 59c5f14c..6d77925a 100644
--- a/crates/raw/src/vendor/orf.rs
+++ b/crates/raw/src/vendor/orf.rs
@@ -10,6 +10,24 @@
 //!   four bits zero in more than 99% of samples), which we shift down.
 //! - 12-bit packed (XZ-2): each row is a sequence of little-endian 32-bit words read MSB-first (found by testing
 //!   candidate bit orders for the smoothest image).
+//! - 12-bit packed in two fields (a few old compacts): IFD0 says uncompressed, 12 bits, many strips, and the strip
+//!   byte counts add up to exactly width × height × 1.5. Samples are packed MSB-first, two per three bytes
+//!   (`b0 << 4 | b1 >> 4`, `(b1 & 15) << 8 | b2`), rows are `width × 1.5` bytes with no padding. Stored rows
+//!   `0..h0` are the even output rows and the rows from `h0` on the odd ones (`h0 = (height + 1) / 2`, height
+//!   odd); the strip table has one gap where the second field starts (follow the offsets) and omits the last row
+//!   of the second field, which sits in the bytes right after the last strip. Derived by black-box analysis of
+//!   six CC0 files (C5060WZ, C7070WZ, SP-510UZ, SP-550UZ, SP-565UZ, SP-570UZ). Their Exif `CFAPattern` states the
+//!   layout (it matches the embedded thumbnails), the maker note's entries `0x1017`/`0x1018` hold the red and
+//!   blue gain (first value, 256 = 1.0; checked against neutral areas of the thumbnail), and nothing states a
+//!   black level or an active area.
+//! - 12-bit blocks (E-300, E-500, E-330; the E-M5 Mark II and PEN-F high-resolution files): one strip of 12.8 bits
+//!   per pixel, `width * 8 / 5` bytes per row, made of 16-byte blocks. A block is 15 sample bytes followed by one
+//!   pad byte that is always zero; the 15 bytes are a little-endian 120-bit string holding ten 12-bit samples, sample
+//!   `i` at bits `[12 i, 12 i + 12)`, i.e. per byte triple `s0 = b0 | (b1 & 15) << 8`, `s1 = b1 >> 4 | b2 << 4`, left
+//!   to right. The layout was first recalled only roughly ("ten pixels, then a skipped byte"); the pad position
+//!   (last), the bit order and the pixel order were fixed by measurement on the CC0 files 2878 (E-300), 3540 (E-500)
+//!   and 3624 (E-330), as was the sensor-origin RGGB anchoring (the maker-note crop offsets are odd). The E-M5 Mark II
+//!   and PEN-F files were only checked for smoothness, not for CFA anchoring or black level.
 //! - Olympus's compressed ORF (most interchangeable-lens bodies since ~2008) is not decoded: no permissively
 //!   licensed description exists. It reports [`RawError::Unsupported`]; the embedded preview still works.
 //! - The colour-filter layout is the file's Exif `CFAPattern`: GRBG on the E-1 and E-400, RGGB on the XZ-2, where
@@ -18,7 +36,7 @@
 //!   pattern is anchored at the sensor origin (assumed) or at the active area. Files without a usable tag fall back
 //!   to the green diagonal found from the data, which can't tell red from blue (GRBG or RGGB is assumed).
 
-use super::white_from_data;
+use super::{cfa_from_exif, white_from_data};
 use crate::tiffraw::{Packing, read_image};
 use crate::unpack::unpack_msb;
 use crate::{BlackLevel, Cfa, ColorData, Mode, OpcodeLists, RawData, RawError, RawFormat, RawImage, Rect, Result};
@@ -34,9 +52,9 @@ pub(crate) const PREVIEW_START: u16 = 0x0101;
 pub(crate) const PREVIEW_LENGTH: u16 = 0x0102;
 const WB_RB: u16 = 0x0100;
 const BLACK: u16 = 0x0600;
+const MN_WB_RED: u16 = 0x1017;
+const MN_WB_BLUE: u16 = 0x1018;
 const CROP: [u16; 4] = [0x0612, 0x0613, 0x0614, 0x0615];
-/// Exif `CFAPattern`.
-const EXIF_CFA_PATTERN: u16 = 0xa302;
 
 /// The Olympus maker note.
 pub(crate) fn maker_note(bytes: &[u8], tiff: &Tiff) -> Option<MakerNote> {
@@ -70,19 +88,28 @@ pub(crate) fn unpack_row_le32_msb(src: &[u8], bits: u32, out: &mut [u16]) {
     unpack_msb(&swapped, bits, out);
 }
 
-/// The colour-filter layout from the Exif `CFAPattern` tag (`0xa302`: two 16-bit repeat counts, found in either
-/// byte order, then one byte per site: 0 = red, 1 = green, 2 = blue), when it describes a 2×2 Bayer cell.
-fn cfa_from_exif(tiff: &Tiff) -> Option<Cfa> {
-    let &[c0, c1, r0, r1, s0, s1, s2, s3] = tiff.exif()?.bytes(EXIF_CFA_PATTERN)? else { return None };
-    let two = |a: u8, b: u8| matches!((a, b), (2, 0) | (0, 2));
-    let name = match [s0, s1, s2, s3] {
-        [0, 1, 1, 2] => "RGGB",
-        [2, 1, 1, 0] => "BGGR",
-        [1, 0, 2, 1] => "GRBG",
-        [1, 2, 0, 1] => "GBRG",
-        _ => return None,
-    };
-    (two(c0, c1) && two(r0, r1)).then(|| Cfa::bayer_static(name))
+/// Unpack one row of 12-bit samples stored as 16-byte blocks: ten little-endian 12-bit fields in bytes 0..15, byte 15
+/// a pad. `src` must hold exactly `out.len() / 10` blocks (`out.len()` a multiple of 10).
+pub(crate) fn unpack_row_blocks16(src: &[u8], out: &mut [u16]) -> Result<()> {
+    if !out.len().is_multiple_of(10) || src.len() != out.len() / 10 * 16 {
+        return Err(RawError::Corrupt("ORF 12-bit block row has the wrong size".into()));
+    }
+    let (blocks, _) = src.as_chunks::<16>();
+    let (pixels, _) = out.as_chunks_mut::<10>();
+    for (block, px) in blocks.iter().zip(pixels) {
+        for k in 0..5 {
+            let (b0, b1, b2) = (block[3 * k] as u16, block[3 * k + 1] as u16, block[3 * k + 2] as u16);
+            px[2 * k] = b0 | (b1 & 15) << 8;
+            px[2 * k + 1] = b1 >> 4 | b2 << 4;
+        }
+    }
+    Ok(())
+}
+
+/// Whether the strip is the 12.8 bits per pixel block layout: a single strip, rows a whole number of 16-byte
+/// blocks of ten pixels.
+fn is_block16(w: usize, n: usize, total: u64, chunks: usize) -> bool {
+    chunks == 1 && w.is_multiple_of(10) && total.checked_mul(10) == (n as u64).checked_mul(16)
 }
 
 /// The layout found from the samples, for files without the Exif tag: GRBG when the greens sit on the main
@@ -115,6 +142,50 @@ pub(crate) fn cfa_from_data(d: &[u16], w: usize, a: Rect) -> Cfa {
     Cfa::bayer_static(if main < anti { "GRBG" } else { "RGGB" })
 }
 
+/// Byte offsets of the stored rows of the two-field 12-bit layout, or `None` unless every condition holds
+/// exactly: odd height, even width, `strips` (offset, byte count; the whole table, not just the strips that fit the
+/// rows-per-strip grid, since the field seam leaves a short strip) that are whole rows summing to
+/// `width × height × 1.5` bytes, exactly one gap between consecutive strips (the second field starts right after
+/// it, at row `(height + 1) / 2`), and a last row, right after the final strip, inside the file. Returns
+/// `height + 1` offsets.
+fn field_rows(strips: &[(u64, u64)], w: usize, h: usize, file_len: usize) -> Option<Vec<usize>> {
+    let rb = w.checked_mul(3)? / 2;
+    if rb == 0 || !w.is_multiple_of(2) || h.is_multiple_of(2) || h < 3 || strips.len() < 2 {
+        return None;
+    }
+    let h0 = h.div_ceil(2);
+    let total = strips.iter().try_fold(0u64, |a, s| a.checked_add(s.1))?;
+    if total != (rb as u64).checked_mul(h as u64)? {
+        return None;
+    }
+    let mut rows = Vec::with_capacity(h + 1);
+    let mut gaps = 0;
+    let mut end = None;
+    for &(offset, len) in strips {
+        let next_end = offset.checked_add(len).filter(|e| len > 0 && len % rb as u64 == 0 && *e <= file_len as u64)?;
+        match end {
+            Some(e) if offset < e => return None,
+            // the gap must be the field seam
+            Some(e) if offset > e => {
+                if rows.len() != h0 {
+                    return None;
+                }
+                gaps += 1;
+            }
+            _ => {}
+        }
+        end = Some(next_end);
+        let (offset, rb) = (usize::try_from(offset).ok()?, rb);
+        rows.extend((0..usize::try_from(len).ok()? / rb).map(|r| offset + r * rb));
+    }
+    let tail = usize::try_from(end?).ok()?;
+    if gaps != 1 || rows.len() != h || tail.checked_add(rb)? > file_len {
+        return None;
+    }
+    rows.push(tail);
+    Some(rows)
+}
+
 pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     let tiff = Tiff::parse(bytes)?;
     let ifd0 = &tiff.ifds[0];
@@ -124,11 +195,26 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     let chunks = info.chunks(bytes.len() as u64);
     let total: u64 = chunks.iter().map(|c| c.len).sum();
     let stated = cfa_from_exif(&tiff);
+    let mut two_field = false;
     let (mut data, bits) = if info.compression != 1 {
         return Err(RawError::Unsupported(format!("ORF compression {}", info.compression)));
     } else if total >= (n as u64) * 2 {
         let d = read_image(bytes, &info, tiff.order, Packing::Word16)?;
         (d, 16)
+    } else if is_block16(w, n, total, chunks.len()) {
+        let src = chunk_bytes(bytes, &chunks[0]).ok_or_else(|| RawError::Corrupt("ORF strip outside file".into()))?;
+        let stride = w / 10 * 16;
+        if src.len() as u64 != total || src.len() / stride != h {
+            return Err(RawError::Corrupt("ORF strip shorter than its rows".into()));
+        }
+        let d = if mode == Mode::Full || stated.is_none() {
+            let mut d = vec![0u16; n];
+            d.par_chunks_mut(w).enumerate().try_for_each(|(y, row)| unpack_row_blocks16(&src[y * stride..(y + 1) * stride], row))?;
+            d
+        } else {
+            Vec::new()
+        };
+        (RawData::U16(d), 12)
     } else if total * 8 >= (n as u64) * 12 && total * 8 < (n as u64) * 13 && chunks.len() == 1 {
         let src = chunk_bytes(bytes, &chunks[0]).ok_or_else(|| RawError::Corrupt("ORF strip outside file".into()))?;
         // the depth is fixed here, so a header-only probe needs the samples only when the file doesn't state its
@@ -142,6 +228,26 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
             Vec::new()
         };
         (RawData::U16(d), 12)
+    } else if let Some(rows) = (info.bits() == 12 && info.samples_per_pixel == 1 && info.planar != 2 && info.offsets.len() == info.byte_counts.len())
+        .then(|| field_rows(&info.offsets.iter().copied().zip(info.byte_counts.iter().copied()).collect::<Vec<_>>(), w, h, bytes.len()))
+        .flatten()
+    {
+        two_field = true;
+        let d = if mode == Mode::Full || stated.is_none() {
+            let (rb, h0) = (w * 3 / 2, h.div_ceil(2));
+            let mut d = vec![0u16; n];
+            d.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
+                let stored = if y % 2 == 0 { y / 2 } else { h0 + y / 2 };
+                // every offset was checked against the file by `field_rows`
+                if let Some(src) = rows.get(stored).and_then(|&at| bytes.get(at..at + rb)) {
+                    unpack_msb(src, 12, row);
+                }
+            });
+            d
+        } else {
+            Vec::new()
+        };
+        (RawData::U16(d), 12)
     } else {
         return Err(RawError::Unsupported("Olympus compressed ORF".into()));
     };
@@ -182,7 +288,13 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
         .as_ref()
         .and_then(|i| i.f64s(WB_RB))
         .filter(|v| v.len() >= 2 && v[0] > 0.0 && v[1] > 0.0)
-        .map(|v| [(v[0] / 256.0) as f32, 1.0, (v[1] / 256.0) as f32]);
+        .map(|v| [(v[0] / 256.0) as f32, 1.0, (v[1] / 256.0) as f32])
+        .or_else(|| {
+            // two-field bodies: the red and blue gains lead the entries of the main maker note
+            let m = mn.as_ref().filter(|_| two_field)?;
+            let g = |tag| m.ifd.f64s(tag).and_then(|v| v.first().copied()).filter(|g| *g > 0.0);
+            Some([(g(MN_WB_RED)? / 256.0) as f32, 1.0, (g(MN_WB_BLUE)? / 256.0) as f32])
+        });
     let white = white_from_data(samples, bits);
     let mut metadata = lightcraft_meta::from_tiff(&tiff);
     metadata.width = Some(active.width as u32);
@@ -223,6 +335,7 @@ pub(crate) fn preview(bytes: &[u8]) -> Option<&[u8]> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::vendor::EXIF_CFA_PATTERN;
     use lightcraft_tiff::{ByteOrder, IfdBuilder, ImageData, TiffWriter};
 
     fn orf(w: u32, h: u32, bits: u16, strip: Vec<u8>) -> Vec<u8> {
@@ -353,6 +466,104 @@ mod tests {
         }
     }
 
+    /// Output sample (x, y) of the two-field tests: distinct per site, all below 4096.
+    fn field_px(x: usize, y: usize) -> u16 {
+        ((y * 331 + x * 17 + 5) % 4096) as u16
+    }
+
+    /// 12 bits MSB-first, two samples per three bytes, for output row `y`.
+    fn packed_row(w: usize, y: usize) -> Vec<u8> {
+        (0..w)
+            .step_by(2)
+            .flat_map(|x| {
+                let (a, b) = (field_px(x, y), field_px(x + 1, y));
+                [(a >> 4) as u8, ((a & 15) << 4 | b >> 8) as u8, b as u8]
+            })
+            .collect()
+    }
+
+    /// A two-field file: strips A1 (two rows), A2 (one row), a gap, B (all but the last row of the second field),
+    /// with the last row of the second field right after B, as the strip table of the old compacts has it (width 8,
+    /// height 5). `table_gap` keeps the gap in the table (else the strips are contiguous and the table is wrong).
+    fn two_field(table_gap: bool) -> Vec<u8> {
+        let (w, h) = (8usize, 5usize);
+        let h0 = h.div_ceil(2);
+        // stored rows: the even output rows, then the odd ones (the last of them is past the picture)
+        let stored: Vec<Vec<u8>> = (0..h0).map(|k| packed_row(w, 2 * k)).chain((0..h0).map(|k| packed_row(w, 2 * k + 1))).collect();
+        let a1 = stored[..2].concat();
+        let a2 = stored[2].clone();
+        let gap = vec![0xffu8; 20];
+        let b = stored[3].clone();
+        let b2 = stored[4].clone();
+        let last = stored[5].clone();
+        let mut ifd = IfdBuilder::new();
+        ifd.set(t::IMAGE_WIDTH, Value::Long(vec![w as u32]));
+        ifd.set(t::IMAGE_LENGTH, Value::Long(vec![h as u32]));
+        ifd.set(t::BITS_PER_SAMPLE, Value::Short(vec![12]));
+        ifd.set(t::COMPRESSION, Value::Short(vec![1]));
+        ifd.set(t::PHOTOMETRIC, Value::Short(vec![2]));
+        ifd.set(t::MAKE, Value::Ascii("OLYMPUS OPTICAL CO.,LTD".into()));
+        ifd.set_image(ImageData::Strips { rows_per_strip: 2, strips: vec![a1, a2, gap, b, b2, last] });
+        let mut exif = IfdBuilder::new();
+        exif.set(EXIF_CFA_PATTERN, Value::Undefined(BGGR.to_vec()));
+        ifd.set_child(t::EXIF_IFD, exif);
+        let mut b = TiffWriter::new(ByteOrder::Little, false).write(&[ifd]).unwrap();
+        b[2] = b'R';
+        b[3] = b'S';
+        // keep strips A1, A2, B1 and B2 in the table (drop the gap and the last row): four strips for a grid of three
+        let le = |b: &[u8], at: usize| u32::from_le_bytes(b[at..at + 4].try_into().unwrap());
+        let at0 = le(&b, 4) as usize;
+        let n = u16::from_le_bytes([b[at0], b[at0 + 1]]) as usize;
+        for e in (0..n).map(|i| at0 + 2 + 12 * i) {
+            let tag = u16::from_le_bytes([b[e], b[e + 1]]);
+            if tag != t::STRIP_OFFSETS && tag != t::STRIP_BYTE_COUNTS {
+                continue;
+            }
+            let at = le(&b, e + 8) as usize;
+            let all: Vec<u32> = (0..6).map(|i| le(&b, at + 4 * i)).collect();
+            let keep: Vec<u32> = if table_gap { vec![all[0], all[1], all[3], all[4]] } else { vec![all[0], all[1], all[2], all[3]] };
+            b[e + 4..e + 8].copy_from_slice(&(keep.len() as u32).to_le_bytes());
+            for (i, v) in keep.iter().enumerate() {
+                b[at + 4 * i..at + 4 * i + 4].copy_from_slice(&v.to_le_bytes());
+            }
+        }
+        b
+    }
+
+    #[test]
+    fn two_field_12_bit_layout() {
+        let bytes = two_field(true);
+        let r = crate::decode(&bytes).unwrap();
+        let want: Vec<u16> = (0..5).flat_map(|y| (0..8).map(move |x| field_px(x, y))).collect();
+        assert_eq!((r.data.clone(), r.bits, r.width, r.height), (RawData::U16(want), 12, 8, 5));
+        assert_eq!(r.cfa.as_ref().unwrap().name(), "BGGR");
+        assert_eq!(crate::probe_info(&bytes).unwrap(), r.info());
+        // the table without the gap: sizes no longer add up
+        let e = crate::decode(&two_field(false)).map(|_| ());
+        assert!(matches!(e, Err(RawError::Unsupported(_))), "{e:?}");
+    }
+
+    #[test]
+    fn two_field_layout_needs_every_condition() {
+        let chunk = |_index: usize, offset: u64, rows: u64| (offset, rows * 12);
+        // width 8, height 5: rows 0..3 are the first field, the gap, rows 3..5, the last row after them
+        let good = [chunk(0, 100, 2), chunk(1, 124, 1), chunk(2, 200, 2)];
+        let rows = field_rows(&good, 8, 5, 236).unwrap();
+        assert_eq!(rows, [100, 112, 124, 200, 212, 224]);
+        // the last row must be inside the file
+        assert!(field_rows(&good, 8, 5, 235).is_none());
+        // the gap is the field seam: not after two rows, not absent, not twice
+        assert!(field_rows(&[chunk(0, 100, 2), chunk(1, 140, 1), chunk(2, 164, 2)], 8, 5, 300).is_none());
+        assert!(field_rows(&[chunk(0, 100, 2), chunk(1, 124, 1), chunk(2, 136, 2)], 8, 5, 300).is_none());
+        assert!(field_rows(&[chunk(0, 100, 2), chunk(1, 124, 1), chunk(2, 200, 1), chunk(3, 300, 1)], 8, 5, 400).is_none());
+        // overlapping strips, sizes that don't add up, even height, odd width, a single strip
+        assert!(field_rows(&[chunk(0, 100, 2), chunk(1, 120, 1), chunk(2, 200, 2)], 8, 5, 300).is_none());
+        assert!(field_rows(&[chunk(0, 100, 2), chunk(1, 124, 1), chunk(2, 200, 1)], 8, 5, 300).is_none());
+        assert!(field_rows(&good, 8, 4, 300).is_none());
+        assert!(field_rows(&good, 7, 5, 300).is_none());
+        assert!(field_rows(&good[..1], 8, 5, 300).is_none());
+    }
+
     #[test]
     fn word16_shifted_and_packed12() {
         let (w, h) = (16usize, 4usize);
@@ -374,4 +585,71 @@ mod tests {
         let bytes = orf(w as u32, h as u32, 16, vec![0; 40]);
         assert!(matches!(crate::decode(&bytes), Err(RawError::Unsupported(_))));
     }
+
+    /// Pack samples into 16-byte blocks: ten little-endian 12-bit fields, then a zero pad byte.
+    fn pack_blocks(samples: &[u16]) -> Vec<u8> {
+        samples
+            .chunks(10)
+            .flat_map(|c| {
+                let mut v = 0u128;
+                for (i, s) in c.iter().enumerate() {
+                    v |= (*s as u128 & 0xfff) << (12 * i);
+                }
+                let mut b = v.to_le_bytes();
+                b[15] = 0;
+                b
+            })
+            .collect()
+    }
+
+    #[test]
+    fn block16_round_trip() {
+        let (w, h) = (20usize, 4usize);
+        let samples: Vec<u16> = (0..w * h).map(|i| ((i * 509 + 17) % 4096) as u16).collect();
+        let strip = pack_blocks(&samples);
+        assert_eq!(strip.len(), w * h * 16 / 10);
+        let mut out = vec![0u16; w * h];
+        for (y, row) in out.chunks_mut(w).enumerate() {
+            unpack_row_blocks16(&strip[y * 32..(y + 1) * 32], row).unwrap();
+        }
+        assert_eq!(out, samples);
+        // a known block: s0 = b0 | (b1 & 15) << 8, s1 = b1 >> 4 | b2 << 4
+        let mut px = [0u16; 10];
+        let mut blk = [0u8; 16];
+        blk[..3].copy_from_slice(&[0x21, 0x43, 0x65]);
+        unpack_row_blocks16(&blk, &mut px).unwrap();
+        assert_eq!(&px[..2], &[0x321, 0x654]);
+        // the whole file through the decoder
+        let bytes = orf_with(w as u32, h as u32, 16, strip, Some(RGGB));
+        let r = crate::decode(&bytes).unwrap();
+        assert_eq!(r.bits, 12);
+        let RawData::U16(d) = &r.data else { panic!() };
+        assert_eq!(d, &samples);
+    }
+
+    #[test]
+    fn block16_routing() {
+        assert!(is_block16(3360, 3360 * 2504, 13461504, 1));
+        assert!(!is_block16(3360, 3360 * 2504, 3360 * 2504 * 12 / 8, 1)); // XZ-2: exactly 12.0 bpp
+        assert!(!is_block16(3360, 3360 * 2504, 13461504, 2));
+        assert!(!is_block16(3365, 3365 * 100, 3365 * 100 * 16 / 10, 1));
+        // the 12.0 bpp layout still decodes through its own branch
+        let bytes = orf_with(8, 2, 12, vec![0u8; 8 * 2 * 12 / 8], Some(RGGB));
+        assert!(crate::decode(&bytes).is_ok());
+    }
+
+    #[test]
+    fn block16_short_input_is_an_error() {
+        let mut px = [0u16; 10];
+        assert!(unpack_row_blocks16(&[0u8; 15], &mut px).is_err());
+        assert!(unpack_row_blocks16(&[0u8; 32], &mut px).is_err());
+        assert!(unpack_row_blocks16(&[], &mut px).is_err());
+        let mut odd = [0u16; 7];
+        assert!(unpack_row_blocks16(&[0u8; 16], &mut odd).is_err());
+        // a truncated file never panics
+        let bytes = orf_with(20, 4, 16, pack_blocks(&[5u16; 80]), Some(RGGB));
+        for cut in [bytes.len() - 1, bytes.len() - 40, bytes.len() / 2, 100] {
+            let _ = crate::decode(&bytes[..cut]);
+        }
+    }
 }
diff --git a/crates/raw/src/vendor/pef.rs b/crates/raw/src/vendor/pef.rs
index c9421d3b..d065fc4f 100644
--- a/crates/raw/src/vendor/pef.rs
+++ b/crates/raw/src/vendor/pef.rs
@@ -15,12 +15,12 @@
 //!   (starting at 0). Found by trying candidate predictors and checking the decoded rows are continuous.
 //! - Maker note `0x0038`/`0x0039`: the image area's left/top and width/height (verified against the data).
 
-use super::{black_from_columns, white_from_data};
+use super::{black_from_columns, cfa_from_exif, white_from_data};
 
 use crate::tiffraw::{Packing, read_image_in};
 use crate::{BlackLevel, Cfa, ColorData, Mode, OpcodeLists, RawData, RawError, RawFormat, RawImage, Rect, Result};
 use lightcraft_geom::Orientation;
-use lightcraft_tiff::image::chunk_bytes;
+use lightcraft_tiff::image::{ImageInfo, chunk_bytes};
 use lightcraft_tiff::{ByteOrder, Tiff, makernote, tags as t};
 
 const CROP_ORIGIN: u16 = 0x0038;
@@ -188,6 +188,19 @@ fn dark_trimmed(d: &[u16], w: usize, h: usize) -> Rect {
     Rect::new(left, 0, (right - left) & !1, h)
 }
 
+/// Whether every strip or tile of a one-sample-per-pixel image holds exactly the bytes that its rows need when
+/// the samples are packed MSB-first at the declared bit depth, rows starting on byte boundaries (TIFF 6.0
+/// section 7). A real PackBits stream of such an image has a different length (almost always shorter), so the
+/// exact match is what tells plain samples under a compression tag that says otherwise.
+fn is_exactly_packed(info: &ImageInfo, file_len: u64) -> bool {
+    let bits = u64::from(info.bits());
+    if info.samples_per_pixel != 1 || info.planar != 1 || !(1..=16).contains(&bits) || info.byte_counts.len() != info.offsets.len() {
+        return false;
+    }
+    let chunks = info.chunks(file_len);
+    !chunks.is_empty() && chunks.iter().all(|c| c.len == (u64::from(c.width) * bits).div_ceil(8) * u64::from(c.height))
+}
+
 pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     let tiff = Tiff::parse(bytes)?;
     let ifd0 = &tiff.ifds[0];
@@ -226,6 +239,12 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
             let packing = if strip >= (w * hgt * 2) as u64 { Packing::Word16 } else { Packing::Msb };
             read_image_in(read, bytes, &info, tiff.order, packing)?
         }
+        // Some bodies tag plain packed samples as PackBits (32773). Only a strip that holds exactly the packed
+        // size of its rows is read, as the uncompressed MSB-first samples it is; any other size stays unsupported.
+        32773 if is_exactly_packed(&info, bytes.len() as u64) => {
+            let packed = ImageInfo { compression: 1, ..info.clone() };
+            read_image_in(read, bytes, &packed, tiff.order, Packing::Msb)?
+        }
         c => return Err(RawError::Unsupported(format!("PEF compression {c}"))),
     };
     let RawData::U16(ref samples) = data else { return Err(RawError::Unsupported("float PEF".into())) };
@@ -236,7 +255,11 @@ pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
     };
     let cfa = match (ifd0.u64s(t::CFA_REPEAT_PATTERN_DIM).as_deref(), ifd0.bytes(t::CFA_PATTERN_EP)) {
         (Some([2, 2]), Some(p)) if p.len() == 4 && p.iter().all(|&c| c <= 2) => Cfa { width: 2, height: 2, pattern: p.to_vec() },
-        _ => Cfa::bayer_static("BGGR"),
+        // Every body states its layout in the Exif `CFAPattern`, read from the first sample of the stored array, not
+        // of the image area: the *ist D (origin 19, 11) and the 645D (80, 59) only fit unshifted. The 12-bit 10 MP
+        // bodies and everything from the K-3 on say RGGB; the K-7 / K-5 / 645D generation says BGGR. Files without the
+        // tag keep BGGR.
+        _ => cfa_from_exif(&tiff).unwrap_or_else(|| Cfa::bayer_static("BGGR")),
     };
     let black = match mn.as_ref().and_then(|m| m.ifd.f64s(BLACK_POINT)).as_deref() {
         Some(v @ [_, _, _, _]) => {
@@ -343,4 +366,126 @@ mod tests {
         assert!(decode_huffman(&src[..src.len() / 3], &h, w, hgt, 14).is_err());
         assert!(table(&tb[..20], ByteOrder::Big).is_err());
     }
+
+    /// A big-endian one-strip PEF-style TIFF of `w × h` 12-bit samples with the given compression tag and strip
+    /// byte count, around `payload`.
+    fn tiny_pef(w: u16, h: u16, compression: u16, strip_len: u32, payload: &[u8]) -> Vec<u8> {
+        let entries: [(u16, u16, u32); 9] = [
+            (0x0100, 3, w as u32 * 0x1_0000),           // ImageWidth
+            (0x0101, 3, h as u32 * 0x1_0000),           // ImageLength
+            (0x0102, 3, 12 * 0x1_0000),                 // BitsPerSample
+            (0x0103, 3, compression as u32 * 0x1_0000), // Compression
+            (0x0106, 3, 32803 * 0x1_0000),              // Photometric: CFA
+            (0x0111, 4, 8 + 2 + 9 * 12 + 4),            // StripOffsets
+            (0x0115, 3, 0x1_0000),                      // SamplesPerPixel
+            (0x0116, 3, h as u32 * 0x1_0000),           // RowsPerStrip
+            (0x0117, 4, strip_len),                     // StripByteCounts
+        ];
+        let mut f = b"MM\0*\0\0\0\x08".to_vec();
+        f.extend_from_slice(&9u16.to_be_bytes());
+        for (tag, ty, val) in entries {
+            f.extend_from_slice(&tag.to_be_bytes());
+            f.extend_from_slice(&ty.to_be_bytes());
+            f.extend_from_slice(&1u32.to_be_bytes());
+            f.extend_from_slice(&val.to_be_bytes());
+        }
+        f.extend_from_slice(&0u32.to_be_bytes()); // no next IFD
+        f.extend_from_slice(payload);
+        f
+    }
+
+    /// Eight 12-bit samples, two rows of four, packed MSB-first: 0x123 0x456 0x789 0xabc / 0xdef 0x012 0x345 0x678.
+    const PACKED: [u8; 12] = [0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc, 0xde, 0xf0, 0x12, 0x34, 0x56, 0x78];
+
+    #[test]
+    fn packed_samples_under_the_packbits_tag_are_read_when_the_strip_has_exactly_the_packed_size() {
+        let file = tiny_pef(4, 2, 32773, 12, &PACKED);
+        let img = decode(&file, Mode::Full).unwrap();
+        let RawData::U16(v) = &img.data else { panic!("integer samples") };
+        assert_eq!(v, &[0x123, 0x456, 0x789, 0xabc, 0xdef, 0x012, 0x345, 0x678]);
+        assert_eq!((img.width, img.height, img.bits), (4, 2, 12));
+        // the same bytes tagged as plain uncompressed give the same samples
+        let plain = decode(&tiny_pef(4, 2, 1, 12, &PACKED), Mode::Full).unwrap();
+        assert_eq!(plain.data, img.data);
+        // header-only mode accepts it too
+        assert!(decode(&file, Mode::Header).is_ok());
+    }
+
+    #[test]
+    fn a_packbits_tagged_strip_of_any_other_size_stays_unsupported() {
+        for len in [11u32, 13, 6, 24] {
+            let mut payload = PACKED.to_vec();
+            payload.resize(24, 0x55);
+            let file = tiny_pef(4, 2, 32773, len, &payload);
+            let err = decode(&file, Mode::Full).unwrap_err();
+            assert!(matches!(&err, RawError::Unsupported(m) if m.contains("32773")), "strip of {len} bytes: {err:?}");
+        }
+    }
+
+    /// A 16 x 8 big-endian 12-bit PEF-style file with a 12 x 6 image area at the odd origin (3, 1), the Exif
+    /// `CFAPattern` `pattern` and an AOC maker note with the area tags (and, for 65535, a Huffman table). The samples
+    /// are plain 16-bit words (1), packed 12-bit (32773) or Huffman coded (65535).
+    fn pef_with_pattern(compression: u16, pattern: [u8; 4]) -> Vec<u8> {
+        use lightcraft_tiff::{IfdBuilder, ImageData, TiffWriter, Value};
+        let (w, h) = (16usize, 8usize);
+        let px: Vec<u16> = (0..w * h).map(|i| ((i * 37) % 900 + 100) as u16).collect();
+        let (tb, codes) = test_table();
+        let strip: Vec<u8> = match compression {
+            1 => px.iter().flat_map(|v| v.to_be_bytes()).collect(),
+            32773 => px.chunks(2).flat_map(|p| [(p[0] >> 4) as u8, ((p[0] & 15) << 4 | p[1] >> 8) as u8, p[1] as u8]).collect(),
+            _ => encode(&px, w, &codes),
+        };
+        let build = |table_at: u32| {
+            let mut ifd = IfdBuilder::new();
+            ifd.set(0x0100, Value::Long(vec![w as u32]));
+            ifd.set(0x0101, Value::Long(vec![h as u32]));
+            ifd.set(0x0102, Value::Short(vec![12]));
+            ifd.set(0x0103, Value::Short(vec![compression]));
+            ifd.set(0x0106, Value::Short(vec![32803]));
+            ifd.set(0x010f, Value::Ascii("PENTAX Corporation".into()));
+            ifd.set_image(ImageData::Strips { rows_per_strip: h as u32, strips: vec![strip.clone()] });
+            // AOC + "MM", then the IFD (area origin, area size and, for Huffman data, the table), next-IFD 0, the table
+            let mut note = b"AOCMM".to_vec();
+            let mut entries = vec![(0x0038u16, 3u16, 2u32, [0u8, 3, 0, 1]), (0x0039, 3, 2, [0, 12, 0, 6])];
+            if compression == 65535 {
+                entries.push((0x0220, 7, tb.len() as u32, table_at.to_be_bytes()));
+            }
+            note.extend_from_slice(&(entries.len() as u16).to_be_bytes());
+            for (tag, ty, cnt, val) in entries {
+                note.extend_from_slice(&tag.to_be_bytes());
+                note.extend_from_slice(&ty.to_be_bytes());
+                note.extend_from_slice(&cnt.to_be_bytes());
+                note.extend_from_slice(&val);
+            }
+            note.extend_from_slice(&0u32.to_be_bytes());
+            if compression == 65535 {
+                note.extend_from_slice(&tb);
+            }
+            let mut exif = IfdBuilder::new();
+            exif.set(0xa302, Value::Undefined([&[0, 2, 0, 2][..], &pattern[..]].concat()));
+            exif.set(0x927c, Value::Undefined(note));
+            ifd.set_child(0x8769, exif);
+            TiffWriter::new(ByteOrder::Big, false).write(&[ifd]).unwrap()
+        };
+        let first = build(0);
+        if compression != 65535 {
+            return first;
+        }
+        let at = Tiff::parse(&first).unwrap().exif().unwrap().get(0x927c).unwrap().offset;
+        build((at + 6 + 2 + 3 * 12 + 4) as u32)
+    }
+
+    #[test]
+    fn the_pattern_is_the_exif_cfapattern_from_the_array_origin_for_every_compression() {
+        for compression in [1u16, 32773, 65535] {
+            for (p, name) in [([0u8, 1, 1, 2], "RGGB"), ([2, 1, 1, 0], "BGGR"), ([1, 0, 2, 1], "GRBG"), ([1, 2, 0, 1], "GBRG")] {
+                let img = decode(&pef_with_pattern(compression, p), Mode::Full).unwrap();
+                assert_eq!(img.active_area, Rect::new(3, 1, 12, 6), "compression {compression}");
+                assert_eq!(img.cfa, Some(Cfa::bayer_static(name)), "compression {compression}, Exif {name}");
+            }
+        }
+        // no tag: the assumed layout stays
+        let img = decode(&tiny_pef(4, 2, 1, 16, &[0; 16]), Mode::Full).unwrap();
+        assert_eq!(img.cfa, Some(Cfa::bayer_static("BGGR")));
+    }
 }
diff --git a/crates/raw/src/vendor/sr2.rs b/crates/raw/src/vendor/sr2.rs
new file mode 100644
index 00000000..28bf60ed
--- /dev/null
+++ b/crates/raw/src/vendor/sr2.rs
@@ -0,0 +1,301 @@
+//! Sony's encrypted `SR2SubIFD`.
+//!
+//! Sony ARWs from the DSLR-A200 on carry a private directory, the `SR2SubIFD`, reached from IFD0's
+//! `DNGPrivateData` through the `SR2Private` IFD (`SR2SubIFDOffset` `0x7200`, `SR2SubIFDLength` `0x7201`,
+//! `SR2SubIFDKey` `0x7221`; tag names from ExifTool's Sony tag documentation). The block is a TIFF directory in the
+//! file's byte order whose value offsets are file offsets into the block itself, and the whole block is encrypted.
+//! Among its entries are the black level (`0x7310`) and the white balance the camera applied, `WB_RGGBLevels`
+//! (`0x7313`: R, G, G, B); bodies from about 2017 on also write both in plain form in the raw IFD.
+//!
+//! This module is the only place the block is decrypted: the black level and the white balance are both read through
+//! [`SubIfd`] (issue #535; it replaces positional keystream tables recovered earlier for the black level alone).
+//!
+//! **Clean-room provenance.** The decryption was derived only by black-box known-plaintext analysis of CC0 files. No
+//! raw-decoder source (dcraw, LibRaw, rawspeed, rawloader/rawler, darktable, RawTherapee, ExifTool's Perl code, …)
+//! and no description of Sony's cipher or keystream generator was read or consulted. The steps:
+//!
+//! 1. **Files.** The 126 ARWs with an `SR2SubIFD` among the CC0 Sony samples of raw.pixls.us collected for issue
+//!    #535: 97 bodies from the DSLR-A200 to the ILCE-9M3 and ZV-E1, every Sony body on the site that has one, with
+//!    every coding of the bodies named in open issues.
+//! 2. **Plaintext.** `exiftool -v5 FILE`, run as a black-box tool, prints the decrypted `SR2SubIFD` as a hex dump
+//!    with file offsets. XOR-ing each dumped byte with the byte at the same offset in the file gives the keystream
+//!    byte at that position of the block.
+//! 3. **Comparison.** All 126 files store the key `11 22 33 44`, and their keystreams agree byte for byte at every
+//!    position they share: 15 layouts from 25150 to 62112 bytes, 5.2 MB of keystream in all. Bytes after the last
+//!    whole 4-byte word (two, in every block whose length is not a multiple of four) are stored in the clear.
+//! 4. **Structure.** Read as 32-bit words, the longest keystream (the DSLR-A700 sample `DSC07249.ARW`, SHA-256
+//!    `3159e288…`, 15528 words) was tested for every recurrence `k[n] = k[n − a] ⊕ k[n − b]` with
+//!    `1 ≤ a < b < 300`: an exhaustive search, not a guided one. Exactly two pairs hold on every word: `(63, 127)`
+//!    and `(126, 254)`, the second a consequence of the first. With `(63, 127)`, any 127 consecutive words fix all
+//!    later ones, so [`SEED`] is simply the first 127 words of that file's keystream.
+//! 5. **Checks.** Generated from [`SEED`], the keystream equals the one recovered from each of the 126 files at every
+//!    position. It also reproduces bytes recovered independently from plain tag values before the generator existed
+//!    (8 bytes at position 2510, issue #148, from the plain black levels of the DSC-RX100M6 and ILCE-7M3) and the
+//!    positional tables the black level was read with until issue #535; the unit tests pin all of them.
+//!
+//! Only that key is supported. The one other key seen, in a DSC-R1 SR2 file, gives a different keystream that obeys
+//! the same recurrence from its own first 127 words, but one sample per key cannot show how a seed follows from a
+//! key, so files with another key get `None`.
+
+use lightcraft_tiff::{ByteOrder, Ifd, ParseOptions, tags as t};
+
+/// `SR2Private` tags.
+const SUBIFD_OFFSET: u16 = 0x7200;
+const SUBIFD_LENGTH: u16 = 0x7201;
+const SUBIFD_KEY: u16 = 0x7221;
+/// The key stored by every ARW examined; [`SEED`] is its keystream.
+const KEY: [u8; 4] = [0x11, 0x22, 0x33, 0x44];
+/// Upper bound on the block length we decrypt. The largest seen is 62112 bytes (DSLR-A700).
+const MAX_LEN: usize = 1 << 20;
+/// TIFF field types of the levels: SHORT and SSHORT.
+const SHORT: u16 = 3;
+const SSHORT: u16 = 8;
+
+/// The first 127 keystream words for [`KEY`] (each XOR-ed with four block bytes, most significant byte first).
+/// Later words follow `k[n] = k[n − 63] ⊕ k[n − 127]`; see the module docs.
+const SEED: [u32; 127] = [
+    0x54c2c4d6, 0x49c478bc, 0x34ae2f8e, 0x25d80504, 0xc0d9d6b0, 0xd838fb71, 0xe8eff27d, 0xfbc1fcea, 0x506c499a, 0x47f20f37, 0x710777cf, 0x7867e7ba,
+    0x42d67caa, 0x7f2bd11a, 0x67a216ca, 0x0e986d40, 0x4ae8d4c0, 0xe36778b4, 0x5a958415, 0xdbfe2be8, 0x20faa1aa, 0x7132a6b8, 0xf4de4b7f, 0x55991aa1,
+    0xa849d5aa, 0x49577832, 0xb92f3daa, 0x399cc526, 0x22cdd000, 0xe1977a29, 0x37c5db55, 0xb0177e1e, 0x2a1016aa, 0xa300086e, 0x3bab9bfe, 0x262eece0,
+    0x23771aa9, 0x0a5dc91c, 0x31b902ae, 0x58e64bf8, 0x259c300e, 0xa57705c8, 0x284a6541, 0xfb229c60, 0x1bacaa9e, 0xbcab3350, 0x67cd9fbe, 0x8f135e60,
+    0xf8c26a40, 0x6770da61, 0x3e1febfd, 0xd0c70803, 0x8dbb037b, 0x6f6fa4c5, 0x6749d10d, 0x7f51598d, 0xd5e5a4ec, 0x207dfa91, 0x6558ebc2, 0xbe594639,
+    0x617a9e5d, 0x3c497950, 0x0844eb3f, 0x04207ed2, 0xd27ceac4, 0x70d20f05, 0xb47003f6, 0xe9e4e3ae, 0xcc19d265, 0x326dd956, 0xf0d3a327, 0xb71275f0,
+    0x7994e285, 0x0aff594d, 0x128e8345, 0x7bda597a, 0xd634c380, 0xe24a006f, 0x8974818b, 0x3320b22a, 0xbe808417, 0xa2d5648a, 0x6fe80b39, 0x23ebad41,
+    0xa2d11e5d, 0x027d9397, 0x9a722ac8, 0x432c7dac, 0x7146692a, 0x82a3dc77, 0xd66887c5, 0x831f43b7, 0x4e5dddde, 0x03793f81, 0x306ab437, 0x00ccf86c,
+    0xfc6ed3d2, 0x076b8fdb, 0x9808cfca, 0x0f4eef6e, 0xc8cc3830, 0x104ac16a, 0xa189eff4, 0x3e085c08, 0xd28baf88, 0x5c853ac4, 0xe60480f8, 0xc51acd98,
+    0x691e5ee1, 0x333feeb9, 0x1e35bc33, 0xec4a4642, 0xee57c5a5, 0xbeeb51f7, 0xe0c4f32c, 0xa5422f6a, 0x1d266d12, 0x3752fd3b, 0xfbc53c7d, 0x2421a4a3,
+    0xcdc6a2de, 0x26e6b330, 0x6c073d46, 0x058e2f27, 0x43833f30, 0x46d1382e, 0x5f0804ec,
+];
+
+/// XOR `block` with the keystream from its first byte on (whole 4-byte words; a shorter tail stays as it is).
+/// Encrypts and decrypts alike.
+fn apply_keystream(block: &mut [u8]) {
+    let mut ring = SEED;
+    for (n, word) in block.as_chunks_mut::<4>().0.iter_mut().enumerate() {
+        // `ring[i]` holds k[n − 127] until it is replaced by k[n]; k[n − 63] sits at (n − 63) mod 127
+        let i = n % SEED.len();
+        if n >= SEED.len() {
+            ring[i] ^= ring[(i + 64) % SEED.len()];
+        }
+        for (b, k) in word.iter_mut().zip(ring[i].to_be_bytes()) {
+            *b ^= k;
+        }
+    }
+}
+
+/// A decrypted `SR2SubIFD`.
+pub(crate) struct SubIfd {
+    /// File offset of the block: the directory's value offsets are file offsets.
+    start: usize,
+    plain: Vec<u8>,
+    order: ByteOrder,
+}
+
+impl SubIfd {
+    /// Find and decrypt the file's `SR2SubIFD`; `None` when it has none, it lies outside the file, is larger than
+    /// [`MAX_LEN`] or uses another key than [`KEY`].
+    pub(crate) fn read(bytes: &[u8], ifd0: &Ifd, order: ByteOrder) -> Option<Self> {
+        let at = order.read_u32(ifd0.bytes(t::DNG_PRIVATE_DATA)?, 0)?;
+        let opts = ParseOptions { max_ifds: 1, max_depth: 0, follow_children: false, ..Default::default() };
+        let (private, _) = lightcraft_tiff::parse_ifd_at(bytes, u64::from(at), order, 0, false, &opts).ok()?;
+        if private.bytes(SUBIFD_KEY)? != KEY {
+            return None;
+        }
+        let start = usize::try_from(private.u64(SUBIFD_OFFSET)?).ok()?;
+        let len = usize::try_from(private.u64(SUBIFD_LENGTH)?).ok()?;
+        if len > MAX_LEN {
+            return None;
+        }
+        Some(Self::decrypt(bytes.get(start..start.checked_add(len)?)?, start, order))
+    }
+
+    /// Decrypt `block`, the encrypted directory found at file offset `start`.
+    pub(crate) fn decrypt(block: &[u8], start: usize, order: ByteOrder) -> Self {
+        let mut plain = block.to_vec();
+        apply_keystream(&mut plain);
+        Self { start, plain, order }
+    }
+
+    /// The byte order of the directory's values (the file's).
+    pub(crate) fn order(&self) -> ByteOrder {
+        self.order
+    }
+
+    /// The field type and value bytes of a SHORT or SSHORT entry; `None` when the tag is absent, has another type
+    /// or its values lie outside the block.
+    pub(crate) fn short_bytes(&self, tag: u16) -> Option<(u16, &[u8])> {
+        let o = self.order;
+        let entries = usize::from(o.read_u16(&self.plain, 0)?);
+        let entry = (0..entries).map_while(|i| self.plain.get(2 + 12 * i..14 + 12 * i)).find(|e| o.read_u16(e, 0) == Some(tag))?;
+        let kind = o.read_u16(entry, 2)?;
+        if kind != SHORT && kind != SSHORT {
+            return None;
+        }
+        let size = usize::try_from(o.read_u32(entry, 4)?).ok()?.checked_mul(2)?;
+        let values = if size <= 4 {
+            entry.get(8..8 + size)?
+        } else {
+            let at = usize::try_from(o.read_u32(entry, 8)?).ok()?.checked_sub(self.start)?;
+            self.plain.get(at..at.checked_add(size)?)?
+        };
+        Some((kind, values))
+    }
+
+    /// The values of a SHORT or SSHORT entry (see [`SubIfd::short_bytes`]).
+    pub(crate) fn shorts(&self, tag: u16) -> Option<Vec<f64>> {
+        let (kind, values) = self.short_bytes(tag)?;
+        let value = |v: u16| if kind == SSHORT { f64::from(v as i16) } else { f64::from(v) };
+        Some(values.as_chunks::<2>().0.iter().map(|&c| value(self.order.u16(c))).collect())
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use lightcraft_tiff::ByteOrder::{Big, Little};
+
+    /// An `SR2SubIFD` block for file offset `start`, encrypted: SHORT/SSHORT entries `(tag, type, values)`, values
+    /// of more than two shorts stored after the table at file offsets, as Sony does.
+    pub(crate) fn block(start: usize, entries: &[(u16, u16, &[u16])], order: ByteOrder) -> Vec<u8> {
+        let mut plain = Vec::new();
+        order.put_u16(&mut plain, entries.len() as u16);
+        let mut data = Vec::new();
+        let data_at = start + 2 + 12 * entries.len() + 4;
+        for &(tag, kind, values) in entries {
+            order.put_u16(&mut plain, tag);
+            order.put_u16(&mut plain, kind);
+            order.put_u32(&mut plain, values.len() as u32);
+            let mut field = Vec::new();
+            values.iter().for_each(|&v| order.put_u16(&mut field, v));
+            if field.len() <= 4 {
+                field.resize(4, 0);
+                plain.extend(field);
+            } else {
+                order.put_u32(&mut plain, (data_at + data.len()) as u32);
+                data.extend(field);
+            }
+        }
+        plain.extend([0; 4]);
+        plain.extend(data);
+        plain.extend([0xa5; 2]); // a length that is not a multiple of four, like most real blocks
+        apply_keystream(&mut plain);
+        plain
+    }
+
+    /// Encrypt (or decrypt) `block` in place, as a file stores an `SR2SubIFD` at its first byte.
+    pub(crate) fn encrypt(block: &mut [u8]) {
+        apply_keystream(block);
+    }
+
+    /// Keystream bytes recovered earlier, each from plain tag values or ExifTool's decrypted dump at one position,
+    /// before the generator existed: the black level's 8 bytes at 2510 (#148), and the positional tables the black
+    /// level was read with until #535 (#542: the directory's count and first entry, and the black-level value in the
+    /// four layouts of bodies without a plain `0x7310`). The generator must reproduce every one of them, so the black
+    /// levels it decrypts are those the tables gave.
+    #[test]
+    fn keystream_matches_bytes_recovered_at_single_positions() {
+        let mut ks = vec![0u8; 62114];
+        apply_keystream(&mut ks);
+        let recovered: [(usize, &[u8]); 5] = [
+            (0, &[0x54, 0xc2, 0xc4, 0xd6, 0x49, 0xc4, 0x78, 0xbc, 0x34, 0xae, 0x2f, 0x8e, 0x25, 0xd8]),
+            (1638, &[0x18, 0x95, 0x65, 0xf0, 0x18, 0x8f, 0x61, 0xc6]),
+            (2166, &[0xc6, 0x17, 0x02, 0xcb, 0x89, 0x21, 0xbc, 0x43]),
+            (2418, &[0xd1, 0xef, 0xda, 0xfe, 0x50, 0xf3, 0xd0, 0xbe]),
+            (2510, &[0x43, 0xcb, 0x86, 0xb6, 0x11, 0xd2, 0x1a, 0x73]),
+        ];
+        for (at, bytes) in recovered {
+            assert_eq!(&ks[at..at + bytes.len()], bytes, "keystream at {at}");
+        }
+    }
+
+    /// Known answers recorded from CC0 files without the generator, so that a wrong seed word or recurrence fails
+    /// here even without the corpus: the SHA-256 of the whole keystream recovered from the DSLR-A700 sample
+    /// (`DSC07249.ARW`: the file's bytes XOR ExifTool's decrypted dump; 62112 bytes, the longest block seen, so it
+    /// covers every black-level and white-balance position of every layout), and the encrypted `WB_RGGBLevels` of
+    /// one file per layout of bodies without a plain `0x7313`, with the levels ExifTool decrypts from them.
+    #[test]
+    fn keystream_matches_recorded_known_answers() {
+        use sha2::{Digest, Sha256};
+        let mut ks = vec![0u8; 62112];
+        apply_keystream(&mut ks);
+        let digest: String = Sha256::digest(&ks).iter().map(|b| format!("{b:02x}")).collect();
+        assert_eq!(digest, "d55e96d7bb69cb823d9dfa038dd9f3cfb6b080be4df8c8aa2bc56f71a4a3f183");
+        // (file, position in the block, bytes stored there, WB_RGGBLevels)
+        let cases: [(&str, usize, [u8; 8], [i16; 4]); 4] = [
+            ("DSLR-A700 DSC07249", 1654, [0xc9, 0x2a, 0xb6, 0xa4, 0x1f, 0xc1, 0x72, 0x30], [2128, 1024, 1024, 1564]),
+            ("DSLR-A500 DSC02421", 2182, [0xb9, 0x6a, 0xed, 0xd3, 0x0d, 0xa8, 0xbb, 0xda], [2212, 1024, 1024, 1416]),
+            ("SLT-A33 DSC01867", 2434, [0x3c, 0x43, 0x05, 0x3f, 0x0d, 0xe2, 0x05, 0xcc], [2344, 1024, 1024, 1508]),
+            ("ILCE-3500 DSC06923", 2526, [0x37, 0x2e, 0x71, 0x5b, 0x88, 0xb7, 0x21, 0x73], [2932, 1024, 1024, 1576]),
+        ];
+        for (file, at, stored, levels) in cases {
+            let mut block = vec![0u8; (at + 8).next_multiple_of(4)];
+            block[at..at + 8].copy_from_slice(&stored);
+            apply_keystream(&mut block);
+            let got: Vec<i16> = block[at..at + 8].chunks(2).map(|c| i16::from_le_bytes([c[0], c[1]])).collect();
+            assert_eq!(got, levels, "{file}");
+        }
+    }
+
+    #[test]
+    fn keystream_follows_its_recurrence() {
+        let mut zeros = vec![0u8; 62114];
+        apply_keystream(&mut zeros);
+        // the recurrence, past the seed, and the clear tail
+        let word = |n: usize| u32::from_be_bytes(zeros[4 * n..4 * n + 4].try_into().unwrap());
+        assert_eq!(word(127), SEED[64] ^ SEED[0]);
+        assert!((200..15528).all(|n| word(n) == word(n - 63) ^ word(n - 127)));
+        assert_eq!(zeros[62112..], [0, 0]);
+        // applying it twice restores the input
+        let mut again = zeros.clone();
+        apply_keystream(&mut again);
+        assert!(again[..62112].iter().all(|&b| b == 0));
+    }
+
+    #[test]
+    fn reads_entries_inline_and_at_file_offsets() {
+        for order in [Little, Big] {
+            let start = 75964;
+            let enc = block(start, &[(0x7310, SHORT, &[512; 4]), (0x7311, SHORT, &[256]), (0x7313, SSHORT, &[2212, 1024, 1024, 1416])], order);
+            let sub = SubIfd::decrypt(&enc, start, order);
+            assert_eq!(sub.shorts(0x7313), Some(vec![2212.0, 1024.0, 1024.0, 1416.0]), "{order:?}");
+            assert_eq!(sub.shorts(0x7310), Some(vec![512.0; 4]));
+            assert_eq!(sub.shorts(0x7311), Some(vec![256.0]));
+            assert_eq!(sub.shorts(0x7312), None);
+            // SSHORT is signed
+            let enc = block(start, &[(0x7313, SSHORT, &[0xffff, 1024])], order);
+            assert_eq!(SubIfd::decrypt(&enc, start, order).shorts(0x7313), Some(vec![-1.0, 1024.0]));
+        }
+    }
+
+    #[test]
+    fn hostile_directories_give_none() {
+        let start = 4096;
+        let good = block(start, &[(0x7313, SSHORT, &[2212, 1024, 1024, 1416])], Little);
+        let read = |b: &[u8], start: usize| SubIfd::decrypt(b, start, Little).shorts(0x7313);
+        assert!(read(&good, start).is_some());
+        // decrypted at another file offset, the value offset points before or past the block
+        assert_eq!(read(&good, start + 64), None);
+        assert_eq!(read(&good, start - 64), None);
+        // every truncation, down to empty
+        for n in 0..good.len() - 2 {
+            assert_eq!(read(&good[..n], start), None, "{n} bytes");
+        }
+        // garbage: still encrypted; 65535 entries of tag 0xffff; a huge count, another type, a wild offset
+        assert_eq!(SubIfd { start, plain: good.clone(), order: Little }.shorts(0x7313), None);
+        assert_eq!(SubIfd { start, plain: vec![0xff; 1000], order: Little }.shorts(0x7313), None);
+        let mut plain = good.clone();
+        apply_keystream(&mut plain);
+        let patched = |at: usize, bytes: &[u8]| {
+            let mut p = plain.clone();
+            p[at..at + bytes.len()].copy_from_slice(bytes);
+            apply_keystream(&mut p);
+            read(&p, start)
+        };
+        assert_eq!(patched(6, &u32::MAX.to_le_bytes()), None); // count
+        assert_eq!(patched(4, &4u16.to_le_bytes()), None); // LONG
+        assert_eq!(patched(10, &u32::MAX.to_le_bytes()), None); // value offset
+        // an entry count past the end of the block: the scan stops where the block ends, so an entry before that
+        // point is still found
+        assert_eq!(patched(0, &u16::MAX.to_le_bytes()), Some(vec![2212.0, 1024.0, 1024.0, 1416.0]));
+    }
+}
diff --git a/crates/raw/src/vendor/srw.rs b/crates/raw/src/vendor/srw.rs
new file mode 100644
index 00000000..f64b451f
--- /dev/null
+++ b/crates/raw/src/vendor/srw.rs
@@ -0,0 +1,541 @@
+//! Samsung SRW: the variants that store the sensor samples uncompressed.
+//!
+//! Sources: TIFF 6.0 (container: a big- or little-endian TIFF whose IFD0 points at sub-IFDs, one of them the raw
+//! image), Exif 2.3 (`CFAPattern`, `PixelXDimension`, `PixelYDimension`; maker note `0x927c`), the ExifTool Samsung
+//! tag-name documentation (`SensorAreas` `0xa010`, `EncryptionKey` `0xa020`, `WB_RGGBLevelsUncorrected` `0xa021`,
+//! `WB_RGGBLevelsBlack` `0xa028`, `RawData` `0xa048`) and our own black-box analysis of CC0 samples from raw.pixls.us
+//! (NX5, NX10, NX11, NX20, NX200, NX210, NX1000, NX1100, EX1, WB2000; every number below was measured on them):
+//!
+//! - The raw image is the IFD whose `Compression` is a private value (32769..=32773); its `CFAPattern` (`0x828e`)
+//!   names the 2x2 layout, anchored at the first sample of the stored array. Checked on the files above: the colours
+//!   of the decoded mosaic follow the camera's JPEG best with exactly that layout (`corpus_samsung_srw`).
+//! - Compression 32769 (EX1, WB2000): one 16-bit little-endian word per sample (the TIFF is big-endian, the words are
+//!   not); the strip holds exactly `width * height * 2` bytes.
+//! - Compression 32770 with exactly `width * height * 12 / 8` strip bytes (NX5, NX10, NX11, NX20, NX200, NX210, NX1000,
+//!   NX1100): 12-bit samples, two in three bytes, rows without padding. The NX5/NX10/NX11 files read them MSB-first,
+//!   the others LSB-first; the file doesn't say which, the image does: in the wrong order neighbouring same-colour
+//!   samples differ 5 to 11 times more (10 files, every one decided by that margin), see [`lsb_is_smoother`].
+//! - Every other shape of those and of the other private values (32770 with fewer bytes: NX30, NX300, NX2000,
+//!   EK-GN120; 32772: NX mini, NX3000, NX3300; 32773: NX1, NX500) is a compressed coding: reported as unsupported.
+//! - The maker note is a plain IFD whose value offsets count from the start of the note, not of the TIFF. Several
+//!   vectors are stored offset by `EncryptionKey`, 11 integers in every file (element `i` of a vector uses key
+//!   `i mod 11`): `WB_RGGBLevelsUncorrected` and `WB_RGGBLevelsBlack` hold `value + key`, `RawData` holds
+//!   `value - key`, found by trying both signs and keeping the one that gives plausible numbers (green levels
+//!   4096 in all but one file, saturation levels 4095 or 16383, black levels 0 to 3, the dark-column level).
+//! - `SensorAreas`: the second rectangle (left, top, right, bottom) is the camera JPEG's framing (its size equals the
+//!   JPEG's in every file but WB2000's), used as the active area. Registered against the JPEG its centre agrees to
+//!   within 2 pixels (NX10 family; the NX20 family's JPEG is lens-corrected, edges differ).
+//! - The Exif picture size is smaller than the framing in one direction only on the WB2000 (16:9 from a 4:3 sensor):
+//!   the JPEG is the centre of the framing (registration: top offset 366 = framing top 22 + (2736 - 2048) / 2).
+//! - `RawData`: four black levels, then saturation levels (R, G1, G2, B twice). The EX1 saturates at 15881, not at its
+//!   stated 16383 (85786 samples sit on the plateau), so a plateau below the stated level wins.
+//! - Black: `WB_RGGBLevelsBlack` when it states one (NX5, NX10, NX11: 2 to 3, the right-hand dark columns measure
+//!   3.5 to 4.5); otherwise the dark rows or columns outside the framing (EX1: eight rows at 2.3); otherwise 0.
+//! - `WB_RGGBLevelsUncorrected` divided by its mean green is the as-shot gain: the renders of the 12 files match the
+//!   camera JPEG at median ΔE76 2.2 to 7.6 (10.7 on the backlit WB2000 sample, 5.7 after registration).
+use super::{black_from_columns, white_from_data};
+use crate::unpack::{read_u16s, unpack_lsb, unpack_msb};
+use crate::{BlackLevel, Cfa, ColorData, Mode, OpcodeLists, RawData, RawError, RawFormat, RawImage, Rect, Result};
+use lightcraft_geom::Orientation;
+use lightcraft_tiff::image::chunk_bytes;
+use lightcraft_tiff::{ByteOrder, Ifd, Tiff, tags as t};
+use rayon::prelude::*;
+
+const SENSOR_AREAS: u16 = 0xa010;
+const ENCRYPTION_KEY: u16 = 0xa020;
+const WB_UNCORRECTED: u16 = 0xa021;
+const WB_BLACK: u16 = 0xa028;
+const RAW_DATA: u16 = 0xa048;
+
+/// The private `Compression` values of the raw image IFD.
+const COMPRESSIONS: std::ops::RangeInclusive<u16> = 32769..=32773;
+
+/// The maker-note IFD (offsets relative to the note's own start).
+fn maker_note(bytes: &[u8], tiff: &Tiff) -> Option<Ifd> {
+    let e = tiff.exif()?.get(t::MAKER_NOTE)?;
+    let opts = lightcraft_tiff::ParseOptions { max_ifds: 4, max_depth: 1, follow_children: false, ..Default::default() };
+    lightcraft_tiff::parse_ifd_at(bytes, e.offset, tiff.order, e.offset, false, &opts).ok().map(|(i, _)| i)
+}
+
+/// A key-offset vector: the entries of `tag` shifted by the maker note's key (`sign` is +1 or -1 times the key).
+fn keyed(mn: &Ifd, tag: u16, sign: i64) -> Option<Vec<i64>> {
+    let key = mn.u64s(ENCRYPTION_KEY).filter(|k| k.len() == 11)?;
+    let vals = mn.f64s(tag)?;
+    // 32-bit entries: the stored value wraps modulo 2^32 (a negative number stored as a LONG)
+    Some(vals.iter().enumerate().map(|(i, &v)| i64::from((v as i64).wrapping_add(sign * key[i % 11] as i64) as i32)).collect())
+}
+
+/// The raw image's IFD: the one with a private compression value.
+fn raw_ifd(tiff: &Tiff) -> Option<&Ifd> {
+    tiff.all_ifds().into_iter().find(|i| i.u16(t::COMPRESSION).is_some_and(|c| COMPRESSIONS.contains(&c)) && i.contains(t::IMAGE_WIDTH))
+}
+
+/// How the samples of an IFD are stored, when uncompressed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Coding {
+    /// One little-endian 16-bit word per sample.
+    Words,
+    /// 12-bit samples, two in three bytes: read MSB-first (the NX5, NX10 and NX11 files) or LSB-first (the later
+    /// bodies' files); the file does not say which, the smoother image does ([`lsb_is_smoother`]).
+    Packed12,
+}
+
+fn coding(compression: u16, w: usize, h: usize, strip: u64) -> Option<Coding> {
+    let n = (w as u64).checked_mul(h as u64)?;
+    match compression {
+        32769 if strip == n.checked_mul(2)? => Some(Coding::Words),
+        32770 if w.is_multiple_of(2) && strip == n.checked_mul(12)? / 8 => Some(Coding::Packed12),
+        _ => None,
+    }
+}
+
+pub(crate) fn decode(bytes: &[u8], mode: Mode) -> Result<RawImage> {
+    let tiff = Tiff::parse(bytes)?;
+    let ifd0 = tiff.ifds.first().ok_or_else(|| RawError::Corrupt("SRW without IFDs".into()))?;
+    let raw = raw_ifd(&tiff).ok_or_else(|| RawError::Unsupported("Samsung raw image not found".into()))?;
+    let info = raw.image()?;
+    let (w, h) = (info.width as usize, info.height as usize);
+    let n = w.checked_mul(h).filter(|n| *n > 0 && *n <= crate::MAX_SAMPLES).ok_or(RawError::Limit("image too large"))?;
+    let chunks = info.chunks(bytes.len() as u64);
+    let strip: u64 = chunks.iter().map(|c| c.len).sum();
+    let Some(coding) = coding(info.compression, w, h, strip).filter(|_| chunks.len() == 1) else {
+        return Err(RawError::Unsupported(format!(
+            "Samsung compressed raw (compression {}, {:.2} stored bits per sample)",
+            info.compression,
+            strip as f64 * 8.0 / n as f64
+        )));
+    };
+    let data = if mode == Mode::Full {
+        let src = chunk_bytes(bytes, &chunks[0]).ok_or_else(|| RawError::Corrupt("SRW strip outside file".into()))?;
+        let mut d = vec![0u16; n];
+        match coding {
+            Coding::Words => read_u16s(src, ByteOrder::Little, &mut d),
+            Coding::Packed12 => {
+                let stride = w / 2 * 3;
+                let unpack: fn(&[u8], u32, &mut [u16]) = if lsb_is_smoother(src, w, h) { unpack_lsb } else { unpack_msb };
+                d.par_chunks_mut(w).zip(src.par_chunks(stride)).for_each(|(row, s)| unpack(s, 12, row));
+            }
+        }
+        RawData::U16(d)
+    } else {
+        RawData::U16(Vec::new())
+    };
+
+    let mn = maker_note(bytes, &tiff);
+    // the camera JPEG's framing (left, top, right, bottom), when it lies inside the stored array
+    let active = mn
+        .as_ref()
+        .and_then(|m| m.u64s(SENSOR_AREAS))
+        .filter(|v| v.len() == 8)
+        .map(|v| (v[4] as usize, v[5] as usize, v[6] as usize, v[7] as usize))
+        .filter(|&(l, tp, r, b)| l < r && tp < b && r <= w && b <= h)
+        .map_or(Rect::new(0, 0, w, h), |(l, tp, r, b)| Rect::new(l, tp, r - l, b - tp));
+    let cfa = match (raw.u64s(t::CFA_REPEAT_PATTERN_DIM).as_deref(), raw.bytes(t::CFA_PATTERN_EP)) {
+        (Some([2, 2]), Some(p)) if p.len() == 4 && p.iter().all(|&c| c <= 2) => Cfa { width: 2, height: 2, pattern: p.to_vec() },
+        _ => return Err(RawError::Unsupported("Samsung raw without a 2x2 CFAPattern".into())),
+    };
+    // saturation levels and black levels (R, G1, G2, B), in the file's own words
+    let levels = mn.as_ref().and_then(|m| keyed(m, RAW_DATA, 1)).filter(|v| v.len() == 12);
+    let RawData::U16(samples) = &data else { return Err(RawError::Unsupported("float SRW".into())) };
+    // saturation: the file's level, or lower where the samples pile up (EX1 clips at 15882 of its stated 16383)
+    let stated = levels.as_ref().filter(|v| v[4..].iter().all(|&x| x == v[4]) && (255..=65535).contains(&v[4])).map(|v| v[4] as f32);
+    let bits = stated.map_or((info.bits() as u32).clamp(8, 16), |s| 32 - (s as u32).leading_zeros());
+    let plateau = (!samples.is_empty()).then(|| white_from_data(&active_rows(samples, w, active), bits));
+    let white = match (stated, plateau) {
+        (Some(s), Some(p)) => s.min(p),
+        (Some(s), None) => s,
+        (None, Some(p)) => p,
+        (None, None) => 4095.0,
+    };
+    let tagged_black =
+        mn.as_ref().and_then(|m| keyed(m, WB_BLACK, -1)).filter(|v| v.len() == 4 && v.iter().all(|&x| (0..=u16::MAX as i64).contains(&x)));
+    let black = match tagged_black {
+        Some(v) if v.iter().any(|&x| x > 0) => {
+            // RGGB-ordered levels -> per CFA position at the active area origin
+            let a = cfa.shifted(active.x, active.y);
+            let values = a.pattern.iter().map(|&c| [v[0], (v[1] + v[2]) / 2, v[3]][c as usize] as f32).collect();
+            BlackLevel { repeat_rows: 2, repeat_cols: 2, values, ..Default::default() }
+        }
+        // the file states no black level: measure the masked band around the active area, when there is one
+        _ => masked_black(samples, w, h, active, white),
+    };
+    // as-shot white balance: gains with the greens near 4096 (unity)
+    let wb = mn.as_ref().and_then(|m| keyed(m, WB_UNCORRECTED, -1)).filter(|v| v.len() == 4 && v.iter().all(|&x| x > 0)).map(|v| {
+        let g = (v[1] + v[2]) as f64 / 2.0;
+        [(v[0] as f64 / g) as f32, 1.0, (v[3] as f64 / g) as f32]
+    });
+    let mut metadata = lightcraft_meta::from_tiff(&tiff);
+    let crop = picture_crop(&tiff, active);
+    metadata.width = Some(crop.width as u32);
+    metadata.height = Some(crop.height as u32);
+    let img = RawImage {
+        format: RawFormat::Srw,
+        width: w,
+        height: h,
+        cpp: 1,
+        data,
+        cfa: Some(cfa),
+        bits,
+        black,
+        white: vec![white],
+        active_area: active,
+        crop,
+        orientation: Orientation::from_exif(ifd0.u16(t::ORIENTATION).unwrap_or(1)),
+        color: ColorData::default(),
+        wb_multipliers: wb,
+        linearized: false,
+        opcodes: OpcodeLists::default(),
+        metadata,
+    };
+    img.validate_for(mode)?;
+    Ok(img)
+}
+
+/// Which bit order unpacks 12-bit samples of `w` x `h` (in `src`, `w / 2 * 3` bytes per row) into the image: in
+/// the right order neighbouring samples of one colour differ by little, in the wrong one by about the whole range.
+/// Compares the summed absolute differences of samples two apart over 64 rows from the middle of the frame.
+fn lsb_is_smoother(src: &[u8], w: usize, h: usize) -> bool {
+    let stride = w / 2 * 3;
+    let (mut msb, mut lsb) = (0u64, 0u64);
+    let (mut a, mut b) = (vec![0u16; w], vec![0u16; w]);
+    for y in (h / 5..h * 4 / 5).step_by((h * 3 / 5 / 64).max(1)) {
+        let Some(row) = y.checked_mul(stride).and_then(|s| src.get(s..s + stride)) else { break };
+        unpack_msb(row, 12, &mut a);
+        unpack_lsb(row, 12, &mut b);
+        let spread = |v: &[u16]| v.windows(3).map(|p| u64::from(p[0].abs_diff(p[2]))).sum::<u64>();
+        msb += spread(&a);
+        lsb += spread(&b);
+    }
+    lsb < msb
+}
+
+/// The default crop: the whole framing, or, when the Exif picture size is the framing cut in one direction only
+/// (a 16:9 picture from a 4:3 sensor), the centred part of that size.
+fn picture_crop(tiff: &Tiff, active: Rect) -> Rect {
+    let whole = Rect::new(0, 0, active.width, active.height);
+    let Some(exif) = tiff.exif() else { return whole };
+    let (Some(pw), Some(ph)) = (exif.u32(t::PIXEL_X_DIMENSION), exif.u32(t::PIXEL_Y_DIMENSION)) else { return whole };
+    let (pw, ph) = (pw as usize, ph as usize);
+    if pw == 0 || ph == 0 || pw > active.width || ph > active.height || (pw < active.width && ph < active.height) {
+        return whole;
+    }
+    Rect::new((active.width - pw) / 2, (active.height - ph) / 2, pw, ph)
+}
+
+/// Every third row of the active area (the saturation statistics need no more).
+fn active_rows(d: &[u16], w: usize, a: Rect) -> Vec<u16> {
+    (a.y..a.y + a.height).step_by(3).filter_map(|y| d.get(y * w + a.x..y * w + a.x + a.width)).flatten().copied().collect()
+}
+
+/// Black level from rows or columns outside the active area that are dark (mean below 1.5% of `white`): the
+/// longest run of dark lines on the right, else the left, below, above; at least four lines, the two outermost
+/// rows and columns of the array left out. Uniform 0 when there is no such run.
+fn masked_black(d: &[u16], w: usize, h: usize, a: Rect, white: f32) -> BlackLevel {
+    if d.is_empty() {
+        return BlackLevel::uniform(0.0);
+    }
+    let limit = f64::from(white) * 0.015;
+    let col_mean = |x: usize| {
+        (a.y..a.y + a.height).step_by(7).filter_map(|y| d.get(y * w + x)).map(|&v| f64::from(v)).sum::<f64>() / a.height.div_ceil(7) as f64
+    };
+    let row_mean =
+        |y: usize| (a.x..a.x + a.width).step_by(7).filter_map(|x| d.get(y * w + x)).map(|&v| f64::from(v)).sum::<f64>() / a.width.div_ceil(7) as f64;
+    // the longest run of consecutive dark lines within `lines`
+    let longest = |lines: std::ops::Range<usize>, mean: &dyn Fn(usize) -> f64| {
+        let (mut best, mut start) = (0..0, lines.start);
+        for i in lines.clone() {
+            if mean(i) >= limit {
+                start = i + 1;
+            } else if i + 1 - start > best.len() {
+                best = start..i + 1;
+            }
+        }
+        best
+    };
+    let cols = a.y..a.y + a.height;
+    let rows = a.x..a.x + a.width;
+    let right = longest(a.x + a.width..w.saturating_sub(2), &col_mean);
+    let left = longest(2..a.x, &col_mean);
+    let below = longest(a.y + a.height..h.saturating_sub(2), &row_mean);
+    let above = longest(2..a.y, &row_mean);
+    if right.len() >= 4 {
+        black_from_columns(d, w, right, cols, a)
+    } else if left.len() >= 4 {
+        black_from_columns(d, w, left, cols, a)
+    } else if below.len() >= 4 {
+        black_from_columns(d, w, rows, below, a)
+    } else if above.len() >= 4 {
+        black_from_columns(d, w, rows, above, a)
+    } else {
+        BlackLevel::uniform(0.0)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{decode, probe, probe_info};
+    use lightcraft_tiff::{IfdBuilder, ImageData, TiffWriter, Value};
+
+    const KEY: [u32; 11] = [305, 72, 737, 456, 282, 307, 519, 724, 13, 505, 193];
+
+    /// A maker note in the Samsung layout: a big-endian IFD of LONG vectors, offsets relative to the note's start.
+    fn note(entries: &[(u16, Vec<u32>)]) -> Vec<u8> {
+        let mut head = Vec::new();
+        let mut tail = Vec::new();
+        head.extend_from_slice(&(entries.len() as u16).to_be_bytes());
+        let values_at = 2 + 12 * entries.len() + 4;
+        for (tag, v) in entries {
+            head.extend_from_slice(&tag.to_be_bytes());
+            head.extend_from_slice(&4u16.to_be_bytes());
+            head.extend_from_slice(&(v.len() as u32).to_be_bytes());
+            if v.len() == 1 {
+                head.extend_from_slice(&v[0].to_be_bytes());
+            } else {
+                head.extend_from_slice(&((values_at + tail.len()) as u32).to_be_bytes());
+                tail.extend(v.iter().flat_map(|x| x.to_be_bytes()));
+            }
+        }
+        head.extend_from_slice(&[0; 4]);
+        head.extend(tail);
+        head
+    }
+
+    /// Stored form of a vector the way the file keeps it: `plain + key` (`sign` 1) or `plain - key` (`sign` -1).
+    fn stored(plain: &[i64], sign: i64) -> Vec<u32> {
+        plain.iter().enumerate().map(|(i, &p)| (p + sign * i64::from(KEY[i % 11])) as u32).collect()
+    }
+
+    fn pack12(v: &[u16]) -> Vec<u8> {
+        v.chunks(2).flat_map(|p| [(p[0] >> 4) as u8, ((p[0] & 15) << 4) as u8 | (p[1] >> 8) as u8, p[1] as u8]).collect()
+    }
+
+    fn le_words(v: &[u16]) -> Vec<u8> {
+        v.iter().flat_map(|x| x.to_le_bytes()).collect()
+    }
+
+    struct Spec {
+        w: u32,
+        h: u32,
+        compression: u16,
+        strip: Vec<u8>,
+        pattern: Option<[u8; 4]>,
+        note: Option<Vec<u8>>,
+        picture: Option<(u32, u32)>,
+    }
+
+    fn srw(s: Spec) -> Vec<u8> {
+        let mut raw = IfdBuilder::new();
+        raw.set(t::NEW_SUBFILE_TYPE, Value::Long(vec![0]));
+        raw.set(t::IMAGE_WIDTH, Value::Long(vec![s.w]));
+        raw.set(t::IMAGE_LENGTH, Value::Long(vec![s.h]));
+        raw.set(t::BITS_PER_SAMPLE, Value::Short(vec![12]));
+        raw.set(t::COMPRESSION, Value::Short(vec![s.compression]));
+        raw.set(t::SAMPLES_PER_PIXEL, Value::Short(vec![1]));
+        if let Some(p) = s.pattern {
+            raw.set(t::CFA_REPEAT_PATTERN_DIM, Value::Short(vec![2, 2]));
+            raw.set(t::CFA_PATTERN_EP, Value::Byte(p.to_vec()));
+        }
+        raw.set_image(ImageData::Strips { rows_per_strip: s.h, strips: vec![s.strip] });
+        let mut ifd0 = IfdBuilder::new();
+        ifd0.set(t::MAKE, Value::Ascii("SAMSUNG".into()));
+        ifd0.set(t::MODEL, Value::Ascii("NX0".into()));
+        let mut exif = IfdBuilder::new();
+        if let Some(n) = s.note {
+            exif.set(t::MAKER_NOTE, Value::Undefined(n));
+        }
+        if let Some((pw, ph)) = s.picture {
+            exif.set(t::PIXEL_X_DIMENSION, Value::Long(vec![pw]));
+            exif.set(t::PIXEL_Y_DIMENSION, Value::Long(vec![ph]));
+        }
+        ifd0.set_child(t::EXIF_IFD, exif);
+        ifd0.add_sub_ifd(raw);
+        TiffWriter::new(lightcraft_tiff::ByteOrder::Big, false).write(&[ifd0]).unwrap()
+    }
+
+    /// The camera-stated description every test file carries: JPEG framing, white balance, levels.
+    fn full_note(area: [u32; 4], white: i64, black: i64) -> Vec<u8> {
+        let mut levels = vec![0i64; 4];
+        levels.extend([white; 8]);
+        note(&[
+            (SENSOR_AREAS, vec![0, 0, 64, 32, area[0], area[1], area[2], area[3]]),
+            (ENCRYPTION_KEY, KEY.to_vec()),
+            (WB_UNCORRECTED, stored(&[8192, 4096, 4096, 6144], 1)),
+            (WB_BLACK, stored(&[black; 4], 1)),
+            (RAW_DATA, stored(&levels, -1)),
+        ])
+    }
+
+    /// A smooth gradient with a little texture, `max` the first value that is not reached.
+    fn ramp(w: u32, h: u32, max: u32) -> Vec<u16> {
+        (0..w * h).map(|i| ((1000 + (i % w) * 7 + (i / w) * 5 + (i * 13) % 9) % max) as u16).collect()
+    }
+
+    fn pack12_lsb(v: &[u16]) -> Vec<u8> {
+        v.chunks(2).flat_map(|p| [p[0] as u8, ((p[0] >> 8) as u8) | ((p[1] & 15) << 4) as u8, (p[1] >> 4) as u8]).collect()
+    }
+
+    /// Known answer: the samples, layout, framing, levels and white balance all come from the file's own words.
+    #[test]
+    fn packed_12_bit_samples_decode_with_the_maker_note() {
+        let v = ramp(64, 32, 4096);
+        let bytes = srw(Spec {
+            w: 64,
+            h: 32,
+            compression: 32770,
+            strip: pack12(&v),
+            pattern: Some([2, 1, 1, 0]),
+            note: Some(full_note([6, 4, 58, 30], 4095, 3)),
+            picture: None,
+        });
+        assert_eq!(probe(&bytes), Some(RawFormat::Srw));
+        let r = decode(&bytes).unwrap();
+        assert_eq!((r.format, r.width, r.height, r.bits), (RawFormat::Srw, 64, 32, 12));
+        assert_eq!(r.data, RawData::U16(v));
+        assert_eq!(r.cfa.as_ref().unwrap().name(), "BGGR");
+        assert_eq!(r.active_area, Rect::new(6, 4, 52, 26));
+        assert_eq!(r.crop, Rect::new(0, 0, 52, 26));
+        assert_eq!((r.black.mean(), r.white.clone()), (3.0, vec![4095.0]));
+        assert_eq!(r.wb_multipliers, Some([2.0, 1.0, 1.5]));
+        // headers only: everything but the samples
+        let i = probe_info(&bytes).unwrap();
+        assert_eq!((i.active_area, i.wb_multipliers, i.bits), (Rect::new(6, 4, 52, 26), Some([2.0, 1.0, 1.5]), 12));
+    }
+
+    /// The later bodies pack the same 12-bit samples LSB-first; which of the two orders a file uses is found from
+    /// the samples (the wrong order makes a noisy image), not from the model.
+    #[test]
+    fn lsb_first_packing_is_found_from_the_samples() {
+        let v = ramp(64, 32, 4096);
+        for (strip, name) in [(pack12(&v), "msb"), (pack12_lsb(&v), "lsb")] {
+            let bytes = srw(Spec { w: 64, h: 32, compression: 32770, strip, pattern: Some([1, 0, 2, 1]), note: None, picture: None });
+            assert_eq!(decode(&bytes).unwrap().data, RawData::U16(v.clone()), "{name}");
+        }
+    }
+
+    /// A picture size narrower than the framing in one direction only (16:9 from a 4:3 sensor) is the framing's
+    /// centre; any other size is ignored.
+    #[test]
+    fn the_exif_picture_size_centres_a_one_direction_crop() {
+        let v = ramp(64, 32, 4096);
+        let file = |picture| {
+            srw(Spec {
+                w: 64,
+                h: 32,
+                compression: 32770,
+                strip: pack12(&v),
+                pattern: Some([2, 1, 1, 0]),
+                note: Some(full_note([6, 4, 58, 30], 4095, 0)),
+                picture,
+            })
+        };
+        // framing 52 x 26
+        assert_eq!(decode(&file(Some((52, 18)))).unwrap().crop, Rect::new(0, 4, 52, 18));
+        assert_eq!(decode(&file(Some((40, 26)))).unwrap().crop, Rect::new(6, 0, 40, 26));
+        let r = decode(&file(Some((52, 18)))).unwrap();
+        assert_eq!((r.metadata.width, r.metadata.height), (Some(52), Some(18)));
+        for other in [None, Some((52, 26)), Some((40, 18)), Some((60, 18)), Some((52, 30)), Some((0, 18))] {
+            assert_eq!(decode(&file(other)).unwrap().crop, Rect::new(0, 0, 52, 26), "{other:?}");
+        }
+    }
+
+    /// 16-bit words are little-endian although the file is big-endian; a saturation plateau below the stated
+    /// level wins; dark rows below the framing give the black level when the file states none.
+    #[test]
+    fn word_samples_decode_and_measure_what_the_file_does_not_say() {
+        let (w, h) = (64u32, 40u32);
+        let mut v: Vec<u16> = (0..w * h).map(|i| 3000 + (i * 91 % 5000) as u16).collect();
+        // saturation: a plateau at 15882 inside the framing (rows 4..28), two rows of picture beyond it, dark rows 30..40
+        for i in 0..150usize {
+            v[(4 + i % 24) * 64 + 8 + i / 24] = 15882;
+        }
+        for x in 0..64 * 10 {
+            v[30 * 64 + x] = 80;
+        }
+        let bytes = srw(Spec {
+            w,
+            h,
+            compression: 32769,
+            strip: le_words(&v),
+            pattern: Some([0, 1, 1, 2]),
+            note: Some(full_note([0, 4, 64, 28], 16383, 0)),
+            picture: None,
+        });
+        let r = decode(&bytes).unwrap();
+        assert_eq!(r.data, RawData::U16(v));
+        assert_eq!(r.bits, 14);
+        assert!((15800.0..=15882.0).contains(&r.white[0]), "{:?}", r.white);
+        assert_eq!(r.black.mean(), 80.0);
+        assert_eq!(r.cfa.unwrap().name(), "RGGB");
+    }
+
+    /// Files whose strip is not exactly the uncompressed size (or that use another private value) are compressed
+    /// codings: reported as such, still recognised as SRW.
+    #[test]
+    fn compressed_codings_are_reported_not_misread() {
+        let plain = |compression, strip: Vec<u8>| {
+            srw(Spec { w: 64, h: 32, compression, strip, pattern: Some([2, 1, 1, 0]), note: Some(full_note([0, 0, 64, 32], 4095, 0)), picture: None })
+        };
+        for bytes in [
+            plain(32770, vec![7; 64 * 32 * 12 / 8 - 3]),
+            plain(32772, vec![7; 4000]),
+            plain(32773, pack12(&ramp(64, 32, 4096))),
+            plain(32769, vec![0; 64 * 32]),
+        ] {
+            assert_eq!(probe(&bytes), Some(RawFormat::Srw));
+            let Err(RawError::Unsupported(why)) = decode(&bytes) else { panic!("expected Unsupported") };
+            assert!(why.contains("compressed"), "{why}");
+            assert!(probe_info(&bytes).is_err());
+        }
+    }
+
+    /// Without a maker note the samples still decode: whole array, no white balance, depth from the TIFF tags.
+    #[test]
+    fn a_file_without_a_maker_note_decodes_with_defaults() {
+        let v = ramp(64, 32, 4096);
+        let bytes = srw(Spec { w: 64, h: 32, compression: 32770, strip: pack12(&v), pattern: Some([1, 0, 2, 1]), note: None, picture: None });
+        let r = decode(&bytes).unwrap();
+        assert_eq!(r.data, RawData::U16(v));
+        assert_eq!((r.active_area, r.wb_multipliers, r.black.mean()), (Rect::new(0, 0, 64, 32), None, 0.0));
+        assert_eq!(r.cfa.unwrap().name(), "GRBG");
+        assert_eq!(r.bits, 12);
+    }
+
+    /// A raw IFD that does not say how its mosaic is laid out is not guessed at.
+    #[test]
+    fn a_file_without_a_cfa_pattern_is_unsupported() {
+        let bytes = srw(Spec { w: 64, h: 32, compression: 32770, strip: pack12(&ramp(64, 32, 4096)), pattern: None, note: None, picture: None });
+        assert!(matches!(decode(&bytes), Err(RawError::Unsupported(w)) if w.contains("CFAPattern")));
+    }
+
+    /// A framing rectangle outside the array, or reversed, is ignored; truncated files fail without panicking.
+    #[test]
+    fn hostile_framing_and_truncation_do_not_panic() {
+        let v = ramp(64, 32, 4096);
+        for area in [[0, 0, 65, 32], [10, 0, 10, 32], [0, 40, 64, 20]] {
+            let bytes = srw(Spec {
+                w: 64,
+                h: 32,
+                compression: 32770,
+                strip: pack12(&v),
+                pattern: Some([2, 1, 1, 0]),
+                note: Some(full_note(area, 4095, 0)),
+                picture: None,
+            });
+            assert_eq!(decode(&bytes).unwrap().active_area, Rect::new(0, 0, 64, 32));
+        }
+        let bytes = srw(Spec {
+            w: 64,
+            h: 32,
+            compression: 32770,
+            strip: pack12(&v),
+            pattern: Some([2, 1, 1, 0]),
+            note: Some(full_note([0, 0, 64, 32], 4095, 0)),
+            picture: None,
+        });
+        for cut in [10, bytes.len() / 2, bytes.len() - 20] {
+            let _ = decode(&bytes[..cut]);
+            let _ = probe_info(&bytes[..cut]);
+        }
+    }
+}
diff --git a/crates/raw/tests/corpus.rs b/crates/raw/tests/corpus.rs
index 53193f1f..408c670f 100644
--- a/crates/raw/tests/corpus.rs
+++ b/crates/raw/tests/corpus.rs
@@ -17,6 +17,7 @@ fn corpus_root() -> PathBuf {
 const KNOWN_UNSUPPORTED: &[&str] = &[
     "cr3-",           // Unverified CRX coding variants; exact supported cases live in cr3_corpus.rs.
     "orf-olympus-em", // Olympus compressed ORF
+    "-he.nef",        // Nikon High Efficiency (HE / HE★) NEF, issue #193
     "sraw",           // Canon sRAW / mRAW
 ];
 
@@ -224,6 +225,24 @@ fn corpus_nef_compressed_matches_uncompressed() {
 
 /// raw.pixls.us has the same D7500 scene as 12- and 14-bit lossless compressed NEF. Both store black level 400 in
 /// maker note 0x003d (14-bit units): after subtracting the black level and scaling to white, the two must agree.
+/// Issue #193: the Z f's High Efficiency NEF (no `0x0096` table, a JPEG XS codestream) is named as such and keeps a
+/// full-size embedded JPEG to edit, while the same body's Lossless compressed NEF decodes.
+#[test]
+fn corpus_nef_high_efficiency_is_named() {
+    let dir = corpus_root().join("raw");
+    let (Ok(he), Ok(lossless)) = (std::fs::read(dir.join("nef-nikon-zf-he.nef")), std::fs::read(dir.join("nef-nikon-zf-lossless.nef"))) else {
+        eprintln!("skip: Z f samples absent");
+        return;
+    };
+    for result in [decode(&he).map(|_| ()), probe_info(&he).map(|_| ())] {
+        let Err(RawError::Unsupported(why)) = result else { panic!("Z f HE: expected unsupported") };
+        assert!(why.starts_with("Nikon High Efficiency NEF ("), "{why}");
+    }
+    assert!(embedded_preview(&he).is_some_and(|p| p.len() > 1 << 20), "Z f HE: no full-size preview");
+    let img = decode(&lossless).unwrap();
+    assert_eq!((img.width, img.height, img.bits), (6064, 4040, 14));
+}
+
 #[test]
 fn corpus_nef_12_bit_black_level_matches_14_bit() {
     let dir = corpus_root().join("raw");
@@ -328,17 +347,20 @@ fn corpus_proraw_sky_matte() {
 }
 
 /// Issue #148: Sony ARWs from before ~2017 carry no plain white-balance, black-level or crop tags in the raw IFD.
-/// White balance comes from the maker note's enciphered `Tag2010`, the black level from the encrypted `SR2SubIFD`
-/// and the crop from `FullImageSize`; without them the RX100 III opened bright green. Expected values: the black
-/// levels agree with each sensor's dark-pixel floor, the gains with the neutral sky of the camera JPEG.
+/// White balance and black level come from the encrypted `SR2SubIFD`, the crop from `FullImageSize`; without them
+/// the RX100 III opened bright green. Expected values: the black levels agree with each sensor's dark-pixel floor;
+/// the gains are the `SR2SubIFD`'s `WB_RGGBLevels`, within 4 % of the gains that make the camera JPEG's neutral
+/// pixels neutral (RX100 III 2.59 / 1.69, RX100 2.21 / 2.01, ILCE-7RM2 2.67 / 1.47). Until issue #535 they came
+/// from the maker note's `Tag2010` (2.61 / 1.72, 2.23 / 2.00, 2.58 / 1.46), which differs from what the camera
+/// applied on other files (see `corpus_sony_sr2_white_balance`).
 #[test]
 fn corpus_sony_pre2017_colour_metadata() {
     let dir = corpus_root().join("raw");
     // (file, black, approximate R and B gains, crop width × height)
     let cases = [
-        ("arw-sony-rx100m3.arw", 800.0, [2.61, 1.72], (5472, 3648)),
-        ("arw-sony-rx100.arw", 800.0, [2.23, 2.00], (5472, 3648)),
-        ("arw-sony-a7rm2-12bit-uncompressed.arw", 512.0, [2.58, 1.46], (7952, 5304)),
+        ("arw-sony-rx100m3.arw", 800.0, [2.55, 1.72], (5472, 3648)),
+        ("arw-sony-rx100.arw", 800.0, [2.21, 1.99], (5472, 3648)),
+        ("arw-sony-a7rm2-12bit-uncompressed.arw", 512.0, [2.58, 1.45], (7952, 5304)),
     ];
     let mut seen = 0;
     for (name, black, [r, b], (cw, ch)) in cases {
@@ -357,6 +379,195 @@ fn corpus_sony_pre2017_colour_metadata() {
     eprintln!("pre-2017 Sony ARW colour metadata checked on {seen} files");
 }
 
+/// Sony ILCE-7CR (61 MP), three of the camera's raw codings of one scene on raw.pixls.us: lossless compressed L
+/// (LJ92 tiles of 2×2 cells), lossless compressed M (subsampled YCbCr, already white-balanced) and compressed
+/// (ARW2). Expected values: the files' own black level and default crop, and the as-shot gains of the camera's
+/// colour-temperature setting.
+#[test]
+fn corpus_sony_a7cr_codings() {
+    let dir = corpus_root().join("raw");
+    // (file, colour-filter layout, as-shot R and B gains, default crop x, y, width, height)
+    let cases = [
+        ("arw-sony-a7cr-lossless-l.arw", Some("RGGB"), [2.625, 1.598], (32, 20, 9504, 6336)),
+        ("arw-sony-a7cr-compressed.arw", Some("RGGB"), [2.625, 1.598], (32, 20, 9504, 6336)),
+        ("arw-sony-a7cr-lossless-m.arw", None, [1.0, 1.0], (20, 12, 6240, 4160)),
+    ];
+    let mut decoded = Vec::new();
+    for (name, cfa, [r, b], crop) in cases {
+        let bytes = match std::fs::read(dir.join(name)) {
+            Ok(bytes) => bytes,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                eprintln!("skip: {name} absent");
+                continue;
+            }
+            Err(e) => panic!("{name}: {e}"),
+        };
+        let img = decode(&bytes).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(img.metadata.model.as_deref(), Some("ILCE-7CR"), "{name}: model");
+        assert_eq!(img.cfa.as_ref().map(|c| c.name()).as_deref(), cfa, "{name}: colour-filter layout");
+        // Bayer codings use the file's black level; the YCbCr M coding's pedestal is handled separately (#535, item 3).
+        if cfa.is_some() {
+            assert_eq!(img.black.mean(), 512.0, "{name}: black level");
+        }
+        assert!(img.white_at(0) > 15000.0, "{name}: white {} (14-bit scale)", img.white_at(0));
+        let wb = img.wb_multipliers.unwrap_or_else(|| panic!("{name}: no as-shot white balance"));
+        assert!((wb[0] - r).abs() < 0.01 && wb[1] == 1.0 && (wb[2] - b).abs() < 0.01, "{name}: white balance {wb:?}");
+        assert_eq!((img.crop.x, img.crop.y, img.crop.width, img.crop.height), crop, "{name}: default crop");
+        decoded.push((name, img));
+    }
+    // The lossless and compressed codings are two exposures of the same scene with the same framing: inside the
+    // default crop their mosaics must agree (up to the small differences between two exposures).
+    let crop_means = |img: &lightcraft_raw::RawImage| {
+        let lightcraft_raw::RawData::U16(d) = &img.data else { panic!("float data") };
+        let (w, c, b) = (img.width, img.crop, 32);
+        let mut out = Vec::new();
+        for by in 0..c.height / b {
+            for bx in 0..c.width / b {
+                let (x0, y0) = ((c.x + bx * b) & !1, (c.y + by * b) & !1);
+                let (mut s, mut n) = (0f64, 0f64);
+                for y in y0..y0 + b {
+                    for x in (x0..x0 + b).step_by(2) {
+                        s += d[y * w + x + 1 - (y & 1)] as f64;
+                        n += 1.0;
+                    }
+                }
+                out.push(s / n);
+            }
+        }
+        out
+    };
+    let bayer: Vec<_> = decoded.iter().filter(|(_, img)| img.cfa.is_some()).collect();
+    if let [(a_name, a), (b_name, b)] = bayer.as_slice() {
+        let r = correlation(&crop_means(a), &crop_means(b));
+        eprintln!("ILCE-7CR {a_name} vs {b_name}: green block correlation {r:.4}");
+        assert!(r > 0.98, "correlation {r}");
+    }
+    eprintln!("ILCE-7CR codings checked on {} files", decoded.len());
+}
+
+/// Issue #535: Sony black levels against the data. The SR2SubIFD keeps the black level at a position that depends
+/// on its layout (the DSLR-A500 and A700 read 365 and 975 from a fixed position, where ExifTool and the data say
+/// 512), and the downsized lossless M and S codings (linear YCbCr) sit 512 above the recorded level (1024, with
+/// white moved by the same 512). Each file's darkest 0.1 % per channel must lie just above its black level: a black
+/// level that is too low leaves a pedestal, one that is too high clips the shadows.
+#[test]
+fn corpus_sony_black_levels_sit_at_the_data_floor() {
+    use lightcraft_raw::RawData;
+    let dir = corpus_root().join("raw");
+    // (file, black, white): SR2SubIFD black at three layouts, a plain 0x7310, and the lossless L / M / S codings
+    let cases = [
+        ("arw-sony-a500.arw", 512.0, None),
+        ("arw-sony-a700.arw", 512.0, None),
+        ("arw-sony-rx100m3.arw", 800.0, None),
+        ("arw-sony-a7m4-lossless-l.arw", 512.0, Some(16383.0)),
+        ("arw-sony-a7m4-lossless-m.arw", 1024.0, Some(16895.0)),
+        ("arw-sony-a7m4-lossless-s.arw", 1024.0, Some(16895.0)),
+    ];
+    let mut seen = 0;
+    for (name, black, white) in cases {
+        let bytes = match std::fs::read(dir.join(name)) {
+            Ok(bytes) => bytes,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                eprintln!("skip: {name} absent");
+                continue;
+            }
+            Err(e) => panic!("{name}: {e}"),
+        };
+        let img = decode(&bytes).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(img.black.mean(), black, "{name}: black level");
+        if let Some(white) = white {
+            assert_eq!(img.white_at(0), white, "{name}: white level");
+        }
+        let RawData::U16(ref data) = img.data else { panic!("{name}: integer samples expected") };
+        // per CFA position (2×2) or per colour sample, inside the default crop, about a million samples each
+        let channels = if img.cpp == 3 { 3 } else { 4 };
+        let (a, c) = (img.active_area, img.crop);
+        let step = (c.width * c.height / 1_000_000).max(1);
+        let mut samples = vec![Vec::new(); channels];
+        for (k, (x, y)) in (c.y..c.y + c.height).flat_map(|y| (c.x..c.x + c.width).map(move |x| (x + a.x, y + a.y))).enumerate() {
+            if (k / 2) % step != 0 {
+                continue;
+            }
+            if img.cpp == 3 {
+                for (s, v) in samples.iter_mut().enumerate() {
+                    v.push(data[(y * img.width + x) * 3 + s]);
+                }
+            } else {
+                samples[(y % 2) * 2 + x % 2].push(data[y * img.width + x]);
+            }
+        }
+        for (i, mut v) in samples.into_iter().enumerate() {
+            v.sort_unstable();
+            let floor = f32::from(v[v.len() / 1000]);
+            assert!((black - 64.0..=black + 128.0).contains(&floor), "{name}: channel {i}: darkest 0.1 % at {floor}, black level {black}");
+        }
+        seen += 1;
+    }
+    eprintln!("Sony black levels checked against the data floor on {seen} files");
+}
+
+/// Issue #535: the white balance a Sony ARW records as applied, `WB_RGGBLevels`, read from the encrypted
+/// `SR2SubIFD` when the raw IFD has no plain copy. Before, the first three opened with no white balance (green) and
+/// the last two with the maker note's `Tag2010` gains, which there follow the scene rather than the preset used.
+/// Expected levels: ExifTool's decrypted `WB_RGGBLevels` (green 1024). In brackets, the gains that make the
+/// camera JPEG's neutral pixels neutral.
+#[test]
+fn corpus_sony_sr2_white_balance() {
+    let dir = corpus_root().join("raw");
+    // (file, R and B levels)
+    let cases = [
+        ("arw-sony-a500.arw", [2212, 1416]),        // 27152-byte SR2SubIFD layout (2.04 / 1.35)
+        ("arw-sony-a33.arw", [2344, 1508]),         // 29000-byte layout (2.29 / 1.48)
+        ("arw-sony-a700.arw", [2128, 1564]),        // 62112-byte layout (too few neutral pixels)
+        ("arw-sony-a3500-5600k.arw", [2932, 1576]), // 5600 K (2.76 / 1.53; Tag2010 1.89 / 3.08)
+        ("arw-sony-a7s-shade.arw", [2932, 1372]),   // Shade (2.90 / 1.32; Tag2010 2.63 / 1.52)
+    ];
+    let mut seen = 0;
+    for (name, [r, b]) in cases {
+        let Ok(bytes) = std::fs::read(dir.join(name)) else {
+            eprintln!("skip: {name} absent");
+            continue;
+        };
+        let img = decode(&bytes).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let wb = img.wb_multipliers.unwrap_or_else(|| panic!("{name}: no as-shot white balance"));
+        let (er, eb) = (r as f32 / 1024.0, b as f32 / 1024.0);
+        assert!((wb[0] - er).abs() < 1e-4 && wb[1] == 1.0 && (wb[2] - eb).abs() < 1e-4, "{name}: white balance {wb:?}, expected [{er}, 1, {eb}]");
+        seen += 1;
+    }
+    eprintln!("Sony SR2SubIFD white balance checked on {seen} files");
+}
+
+/// Issue #535: pre-2017 Sony bodies without crop tags shot in the camera's 16:9 mode. The ILCE-7SM2 records the
+/// 16:9 size in `FullImageSize`, the DSLR-A580 only in the Exif image size; both crops are centred vertically (each
+/// camera JPEG registered on its raw) and drop the right-edge padding, so the image matches its JPEG's aspect ratio
+/// and gets a camera look.
+#[test]
+fn corpus_sony_16x9_crops() {
+    let dir = corpus_root().join("raw");
+    let mut seen = 0;
+    for (name, (x, y, w, h)) in [("arw-sony-a7sm2-16x9.arw", (0, 232, 4240, 2384)), ("arw-sony-a580-16x9.arw", (0, 260, 4912, 2760))] {
+        let bytes = match std::fs::read(dir.join(name)) {
+            Ok(bytes) => bytes,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                eprintln!("skip: {name} absent");
+                continue;
+            }
+            Err(e) => panic!("{name}: {e}"),
+        };
+        let img = decode(&bytes).unwrap_or_else(|e| panic!("{name}: {e}"));
+        let c = img.crop;
+        assert_eq!((c.x, c.y, c.width, c.height), (x, y, w, h), "{name}: crop");
+        let jpeg = embedded_preview(&bytes).unwrap_or_else(|| panic!("{name}: no preview"));
+        let mut d = zune_jpeg::JpegDecoder::new(zune_core::bytestream::ZCursor::new(&jpeg));
+        d.decode_headers().unwrap();
+        let info = d.info().unwrap();
+        let (aspect, preview) = (c.width as f64 / c.height as f64, info.width as f64 / info.height as f64);
+        assert!((aspect / preview - 1.0).abs() < 0.02, "{name}: crop aspect {aspect} vs camera JPEG {preview}");
+        seen += 1;
+    }
+    eprintln!("Sony 16:9 crops checked on {seen} files");
+}
+
 /// The embedded JPEG as linear RGB, reduced to `gw × gh` cells.
 fn jpeg_cells(jpeg: &[u8], gw: usize, gh: usize) -> Vec<[f64; 3]> {
     use zune_core::{bytestream::ZCursor, colorspace::ColorSpace, options::DecoderOptions};
@@ -528,6 +739,63 @@ fn corpus_orf_cfa_patterns() {
     eprintln!("ORF CFA layouts checked on {seen} files");
 }
 
+/// Samsung SRW (`crates/raw/src/vendor/srw.rs`): the 12-bit packings of the NX10 and NX20 generations (opposite bit
+/// orders, told apart from the samples) and the 16-bit words of the EX1 and WB2000 decode to the image of the camera's own
+/// JPEG, with the layout, framing, levels and white balance the file's maker note states.
+#[test]
+fn corpus_samsung_srw() {
+    let dir = corpus_root().join("raw");
+    // (file, bits, active area width x height, crop width x height, CFA layout, JPEG shows the whole active area)
+    let cases = [
+        ("srw-samsung-nx10.srw", 12, (4592, 3056), (4592, 3056), "BGGR", true),
+        ("srw-samsung-nx20.srw", 12, (5472, 3648), (5472, 3648), "GRBG", true),
+        ("srw-samsung-ex1.srw", 14, (3648, 2736), (3648, 2736), "RGGB", true),
+    ];
+    let mut seen = 0;
+    for (name, bits, active, crop, cfa, whole) in cases {
+        let Ok(bytes) = std::fs::read(dir.join(name)) else {
+            eprintln!("skip: {name} absent");
+            continue;
+        };
+        let img = decode(&bytes).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(img.format, RawFormat::Srw, "{name}");
+        assert_eq!(img.bits, bits, "{name}: bits");
+        assert_eq!((img.active_area.width, img.active_area.height), active, "{name}: active area");
+        assert_eq!((img.crop.width, img.crop.height), crop, "{name}: crop");
+        assert_eq!(img.cfa.as_ref().map(|c| c.name()).as_deref(), Some(cfa), "{name}: CFA layout");
+        let wb = img.wb_multipliers.unwrap_or_else(|| panic!("{name}: no as-shot white balance"));
+        assert!(wb[0] > 1.0 && wb[1] == 1.0 && wb[2] > 0.5, "{name}: white balance {wb:?}");
+        assert!(img.white_at(0) > (1u32 << bits) as f32 * 0.9 && img.white_at(0) <= ((1u32 << bits) - 1) as f32, "{name}: white {}", img.white_at(0));
+        assert!(img.black.mean() < 8.0, "{name}: black {}", img.black.mean());
+        // the mosaic inside the framing holds no marker or padding values above the saturation level
+        let lightcraft_raw::RawData::U16(d) = &img.data else { panic!("float data") };
+        let a = img.active_area;
+        let above = (a.y..a.y + a.height)
+            .map(|y| d[y * img.width + a.x..y * img.width + a.x + a.width].iter().filter(|&&v| f32::from(v) > ((1u32 << bits) - 1) as f32).count())
+            .sum::<usize>();
+        assert_eq!(above, 0, "{name}: samples above the saturation level in the active area");
+        if whole {
+            let jpeg = embedded_preview(&bytes).unwrap_or_else(|| panic!("{name}: no embedded preview"));
+            let (gw, gh) = (24, 18);
+            let (sites, jpeg) = (raw_sites(&img, gw, gh), jpeg_cells(&jpeg, gw, gh));
+            let layout = img.cfa.clone().unwrap_or_else(|| panic!("{name}: no CFA"));
+            let green: Vec<f64> = sites.iter().map(|s| (0..4).filter(|&i| layout.pattern[i] == 1).map(|i| s[i]).sum::<f64>()).collect();
+            let rho = correlation(&ranks(&green), &ranks(&jpeg.iter().map(|j| j[1]).collect::<Vec<_>>()));
+            let agree = |l: &str| chroma_agreement(&sites, &jpeg, &lightcraft_raw::Cfa::bayer(l).unwrap().pattern);
+            let best_other = ["RGGB", "GRBG", "GBRG", "BGGR"].into_iter().filter(|l| *l != cfa).map(agree).fold(f64::MIN, f64::max);
+            let own = agree(cfa);
+            eprintln!(
+                "{name:26} {}x{} {bits}-bit: green rank correlation {rho:.3}, colour agreement {own:.3} (others <= {best_other:.3})",
+                img.width, img.height
+            );
+            assert!(rho > 0.9, "{name}: rank correlation with the camera JPEG {rho}");
+            assert!(own > 0.5 && own > best_other, "{name}: colours follow the JPEG better with another layout ({own} vs {best_other})");
+        }
+        seen += 1;
+    }
+    eprintln!("Samsung SRW checked on {seen} files");
+}
+
 /// Reference sensor sums and position-weighted sums from black-box decoding, independent
 /// of this implementation. These cover complete images, padding, stripe boundaries and
 /// lossy block quantizer changes; the source files are CC0, fetched by `xtask corpus`.
@@ -598,6 +866,7 @@ fn corpus_raws_keep_their_container_and_are_not_thumbnail_shells() {
             "orf" => RawFormat::Orf,
             "pef" => RawFormat::Pef,
             "raf" => RawFormat::Raf,
+            "srw" => RawFormat::Srw,
             "rw2" | "rwl" | "raw" => RawFormat::Rw2,
             _ => continue,
         };
diff --git a/crates/raw/tests/cr3_corpus.rs b/crates/raw/tests/cr3_corpus.rs
index 6e270576..6cd28c3b 100644
--- a/crates/raw/tests/cr3_corpus.rs
+++ b/crates/raw/tests/cr3_corpus.rs
@@ -15,7 +15,7 @@ fn corpus() -> PathBuf {
     std::env::var_os("LIGHTCRAFT_CORPUS").map(PathBuf::from).unwrap_or_else(|| Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus"))
 }
 
-fn check(name: &str, hash: u64, sensor: (usize, usize)) {
+fn check(name: &str, hash: u64, sensor: (usize, usize), developed: (usize, usize)) {
     let path = corpus().join("raw").join(name);
     let Ok(bytes) = std::fs::read(&path) else {
         eprintln!("skip: {} absent", path.display());
@@ -25,7 +25,7 @@ fn check(name: &str, hash: u64, sensor: (usize, usize)) {
     assert_eq!(raw.format, RawFormat::Cr3);
     raw.validate().unwrap();
     assert_eq!((raw.width, raw.height, raw.cpp), (sensor.0, sensor.1, 1));
-    assert_eq!(raw.info().developed_size(), (6000, 4000));
+    assert_eq!(raw.info().developed_size(), developed);
     assert_eq!(raw.info(), probe_info(&bytes).unwrap());
     let RawData::U16(samples) = &raw.data else { panic!("{name}: integer sensor data expected") };
     let actual =
@@ -39,40 +39,55 @@ fn check(name: &str, hash: u64, sensor: (usize, usize)) {
 fn canon_m50_lossless_sensor_is_exact() {
     // raw.pixls.us/getfile.php/4657; SHA256
     // 1ba9ad6b51b315b88820eb0fe5fd7f52bc136ba37b1a5ca76825ebfe25b18058
-    check("cr3-canon-m50-raw.cr3", 0x6226_1f0b_a81c_fcd2, (6288, 4056));
+    check("cr3-canon-m50-raw.cr3", 0x6226_1f0b_a81c_fcd2, (6288, 4056), (6000, 4000));
 }
 
 #[test]
 fn canon_r100_lossless_sensor_is_exact() {
     // raw.pixls.us/getfile.php/7896; SHA256
     // 6d83217d58a5e6d2dabcf470430e91a16676b60531c025b81fa7453fc74b0521
-    check("cr3-canon-r100-raw.cr3", 0xcbe5_299a_b9c5_2630, (6288, 4056));
+    check("cr3-canon-r100-raw.cr3", 0xcbe5_299a_b9c5_2630, (6288, 4056), (6000, 4000));
 }
 
 #[test]
 fn canon_m50_craw_sensor_is_exact() {
     // raw.pixls.us/getfile.php/2663; SHA256
     // 15384b775867ec4c42b11882837f1e368cedc0561832ffab271221e6bb80be4c
-    check("cr3-canon-m50-craw.cr3", 0x9aac_bfe6_6f50_5e1b, (6288, 4056));
+    // The camera was set to 1:1: the file's AspectInfo is a 4000 x 4000 square at x = 1000 inside the 6000 x 4000
+    // image (the archive's "3:2" label is wrong). The sensor samples are unchanged; only the crop is.
+    check("cr3-canon-m50-craw.cr3", 0x9aac_bfe6_6f50_5e1b, (6288, 4056), (4000, 4000));
 }
 
 #[test]
 fn canon_r100_craw_sensor_is_exact() {
     // raw.pixls.us/getfile.php/7897; SHA256
     // 0b66842b2fe00329ebc05fe8ab9357ddbbe1a0a2d2e69a2893102de7fdf5c942
-    check("cr3-canon-r100-craw.cr3", 0x341c_706b_37c3_8bbf, (6288, 4056));
+    check("cr3-canon-r100-craw.cr3", 0x341c_706b_37c3_8bbf, (6288, 4056), (6000, 4000));
 }
 
 #[test]
 fn canon_r8_lossless_sensor_is_exact() {
     // raw.pixls.us/getfile.php/6585; SHA256
     // 7d5c6dbb11ff7e6ee58715d90a20f5d801e8b103f4711ff6ea329ceafcef254c
-    check("cr3-canon-r8-raw.cr3", 0x63c1_c6d8_d1eb_2312, (6188, 4120));
+    check("cr3-canon-r8-raw.cr3", 0x63c1_c6d8_d1eb_2312, (6188, 4120), (6000, 4000));
 }
 
 #[test]
 fn canon_r8_craw_sensor_is_exact() {
     // raw.pixls.us/getfile.php/6587; SHA256
     // df33cf394573645ce03dea1b2e9f0b5cc2b7734e9e3391ee7114151414cf2812
-    check("cr3-canon-r8-craw.cr3", 0xf836_a663_a795_a375, (6188, 4120));
+    check("cr3-canon-r8-craw.cr3", 0xf836_a663_a795_a375, (6188, 4120), (6000, 4000));
+}
+
+#[test]
+fn canon_m50_craw_crop_is_the_shot_aspect() {
+    // raw.pixls.us/getfile.php/2663: the 1:1 square starts 1000 px right of the recommended crop's origin,
+    // which is (12, 12) inside the valid sensor area.
+    let path = corpus().join("raw").join("cr3-canon-m50-craw.cr3");
+    let Ok(bytes) = std::fs::read(&path) else {
+        eprintln!("skip: {} absent", path.display());
+        return;
+    };
+    let raw = decode(&bytes).unwrap();
+    assert_eq!((raw.crop.x, raw.crop.y, raw.crop.width, raw.crop.height), (1012, 12, 4000, 4000));
 }
diff --git a/crates/raw/tests/dng.rs b/crates/raw/tests/dng.rs
index bba5ac81..44527cf9 100644
--- a/crates/raw/tests/dng.rs
+++ b/crates/raw/tests/dng.rs
@@ -669,6 +669,26 @@ fn malformed_jpeg_xl_tiles_are_errors() {
     assert!(matches!(lightcraft_raw::probe_info(&one(good, 3)), Err(RawError::Corrupt(_))));
 }
 
+/// One undecodable tile makes the whole image an error: it is never returned with a black tile.
+#[test]
+fn a_jpeg_xl_tile_that_fails_is_an_error_for_the_image() {
+    use lightcraft_raw::RawError;
+    let (w, h) = (32, 16);
+    let px = pattern(w, h, 1, 12);
+    let tile = |x0: usize| -> Vec<u16> { (0..16).flat_map(|y| px[y * w + x0..y * w + x0 + 16].to_vec()).collect() };
+    let two = |second: Vec<u8>| {
+        let mut raw = base_ifd(w, h, 12, 1, true);
+        raw.set(t::COMPRESSION, Value::Short(vec![compression::JPEG_XL]));
+        raw.set_image(ImageData::Tiles { tile_width: 16, tile_height: 16, tiles: vec![jxl_encode(&tile(0), 16, 16, 1, false), second] });
+        dng(raw, ByteOrder::Little)
+    };
+    assert_eq!(decode(&two(jxl_encode(&tile(16), 16, 16, 1, false))).unwrap().data, RawData::U16(px.clone()));
+    // the second tile is cut short; the first one alone is not an image
+    let good = jxl_encode(&tile(16), 16, 16, 1, false);
+    assert!(matches!(decode(&two(good[..good.len() / 2].to_vec())), Err(RawError::Corrupt(_))));
+    assert!(matches!(decode(&two(vec![0xff, 0x0a, 1, 2, 3])), Err(RawError::Corrupt(_))));
+}
+
 /// The decoder's memory is bounded by the tile: a grey tile that also codes an alpha channel needs
 /// about twice what one plane may use, and is an error rather than an allocation the header asks
 /// for. The same samples without the alpha channel decode.
diff --git a/crates/scenes/src/lib.rs b/crates/scenes/src/lib.rs
index 0b7ad016..1004b2ea 100644
--- a/crates/scenes/src/lib.rs
+++ b/crates/scenes/src/lib.rs
@@ -70,9 +70,20 @@ impl Scene {
 
     /// Render fitting within `max_edge` on the long side.
     pub fn render_fit(&self, max_edge: usize) -> Rgb32f {
+        let (w, h) = self.fit(max_edge);
+        self.render(w, h)
+    }
+
+    /// [`Scene::render_fit`] on the calling thread alone, without rayon (the same pixels).
+    pub fn render_fit_serial(&self, max_edge: usize) -> Rgb32f {
+        let (w, h) = self.fit(max_edge);
+        paint::render_serial(self.kind, self.seed, w, h)
+    }
+
+    fn fit(&self, max_edge: usize) -> (usize, usize) {
         let a = self.aspect();
         let (w, h) = if a >= 1.0 { (max_edge, (max_edge as f32 / a).round() as usize) } else { ((max_edge as f32 * a).round() as usize, max_edge) };
-        self.render(w.max(1), h.max(1))
+        (w.max(1), h.max(1))
     }
 }
 
@@ -203,6 +214,19 @@ mod tests {
         assert!(max > 2.0, "{max}");
     }
 
+    /// The serial render is the parallel one, pixel for pixel (both with and without supersampling), and
+    /// an empty size is an empty image.
+    #[test]
+    fn the_serial_render_is_the_same_picture() {
+        for s in demo_library().iter().take(3) {
+            for edge in [40, 700] {
+                assert_eq!(s.render_fit_serial(edge), s.render_fit(edge), "{} at {edge}", s.name);
+            }
+        }
+        assert!(paint::render_serial(Kind::Dunes, 1, 0, 5).data.is_empty());
+        assert!(demo_library()[0].render(0, 0).data.is_empty());
+    }
+
     #[test]
     fn resolution_independent() {
         let s = &demo_library()[1];
diff --git a/crates/scenes/src/paint.rs b/crates/scenes/src/paint.rs
index 5cfd61e3..4f3c4560 100644
--- a/crates/scenes/src/paint.rs
+++ b/crates/scenes/src/paint.rs
@@ -197,12 +197,25 @@ fn water(p: &P, x: f32, v: f32, wl: f32, calm: f32, above: &dyn Fn(f32, f32) ->
 }
 
 pub fn render(kind: Kind, seed: u32, w: usize, h: usize) -> Rgb32f {
+    render_rows(kind, seed, w, h, true)
+}
+
+/// [`render`] on the calling thread alone, without rayon: the same pixels, for a caller that must
+/// not run other queued work while it waits for rows (see `lightcraft_engine::demo`).
+pub fn render_serial(kind: Kind, seed: u32, w: usize, h: usize) -> Rgb32f {
+    render_rows(kind, seed, w, h, false)
+}
+
+fn render_rows(kind: Kind, seed: u32, w: usize, h: usize, parallel: bool) -> Rgb32f {
+    let mut img = Rgb32f::new(w, h);
+    if w == 0 || h == 0 {
+        return img;
+    }
     let aspect = w as f32 / h as f32;
     let p = P { seed, aspect };
     let ss = if w * h <= 300_000 { 2 } else { 1 };
     let to2020 = SRGB.to_space(&REC2020).to_f32();
-    let mut img = Rgb32f::new(w, h);
-    img.data.par_chunks_mut(w).enumerate().for_each(|(y, row)| {
+    let paint = |(y, row): (usize, &mut [[f32; 3]])| {
         for (xi, px) in row.iter_mut().enumerate() {
             let mut acc = [0.0f32; 3];
             for sy in 0..ss {
@@ -220,7 +233,12 @@ pub fn render(kind: Kind, seed: u32, w: usize, h: usize) -> Rgb32f {
                 (m[2][0] * c[0] + m[2][1] * c[1] + m[2][2] * c[2]).max(0.0),
             ];
         }
-    });
+    };
+    if parallel {
+        img.data.par_chunks_mut(w).enumerate().for_each(paint);
+    } else {
+        img.data.chunks_mut(w).enumerate().for_each(paint);
+    }
     img
 }
 
diff --git a/crates/tiff/src/tags.rs b/crates/tiff/src/tags.rs
index 5771316a..458aefe5 100644
--- a/crates/tiff/src/tags.rs
+++ b/crates/tiff/src/tags.rs
@@ -173,6 +173,11 @@ pub const OPCODE_LIST_3: u16 = 51022;
 pub const NOISE_PROFILE: u16 = 51041;
 pub const DEFAULT_USER_CROP: u16 = 51125;
 pub const PROFILE_GAIN_TABLE_MAP: u16 = 52525;
+/// DNG 1.7 row interleave: the stored raster holds this many interleaved row groups (each group is
+/// every `n`-th row of the image), so it must be un-interleaved before the data is a mosaic.
+pub const ROW_INTERLEAVE_FACTOR: u16 = 50975;
+/// DNG 1.7 column interleave, the column-wise counterpart of [`ROW_INTERLEAVE_FACTOR`].
+pub const COLUMN_INTERLEAVE_FACTOR: u16 = 52547;
 pub const CALIBRATION_ILLUMINANT_3: u16 = 52529;
 pub const CAMERA_CALIBRATION_3: u16 = 52530;
 pub const COLOR_MATRIX_3: u16 = 52531;
@@ -200,6 +205,8 @@ pub mod compression {
     /// DNG lossy JPEG (baseline DCT, 8-bit).
     pub const LOSSY_JPEG: u16 = 34892;
     pub const JPEG_XL: u16 = 52546;
+    /// SMPTE ST 2073 (VC-5) as written by GoPro's GPR files (the value measured in them).
+    pub const VC5: u16 = 9;
     /// Nikon NEF Huffman compression.
     pub const NIKON: u16 = 34713;
     /// Sony ARW compressed (the value used by ARW files).
diff --git a/crates/ui-egui/locales/de-formats.json b/crates/ui-egui/locales/de-formats.json
index 12672394..ea00ae3c 100644
--- a/crates/ui-egui/locales/de-formats.json
+++ b/crates/ui-egui/locales/de-formats.json
@@ -206,5 +206,20 @@
   "In line for AI Denoise ({ahead} ahead)…": "In line for AI Denoise ({ahead} ahead)…",
   "Running on {}.": "Running on {}.",
   "{file} · {size}": "{file} · {size}",
-  "•  {assumption}": "•  {assumption}"
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "In „{parent}“ einfügen",
+  "Delete the keyword “{name}”?": "Das Stichwort „{name}“ löschen?",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "Es wird von {count} Foto{} entfernt, mit den Stichwörtern darunter. Rückgängig stellt es wieder her.",
+  "Create Keyword Tag Inside “{name}”…": "Stichwort in „{name}“ erstellen…",
+  "“{parent}” has a “{name}” already. Merge the two?": "„{parent}“ enthält bereits „{name}“. Beide zusammenführen?",
+  "There is a “{name}” at the top level already. Merge the two?": "Auf der obersten Ebene gibt es bereits „{name}“. Beide zusammenführen?",
+  "Added “{keyword}” to {n} photo{}": "„{keyword}“ zu {n} Foto{} hinzugefügt",
+  "On {have} of {of} selected photos": "Auf {have} von {of} ausgewählten Fotos",
+  "Remove “{name}”": "„{name}“ entfernen",
+  "There is a keyword set “{name}” already": "Es gibt bereits einen Stichwortsatz „{name}“",
+  "Added {n} keyword{}": "Stichwörter hinzugefügt: {n}{:.0}",
+  "; {n} gained synonyms": "; mit neuen Synonymen: {n}",
+  "Exported {n} keyword{}": "Stichwörter exportiert: {n}{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — Capture One importiert keine Liste mit ; , < oder > in einem Stichwort: {names}",
+  " — left out, as a keyword list can't hold them: {names}": " — ausgelassen, weil eine Stichwortliste sie nicht aufnehmen kann: {names}"
 }
diff --git a/crates/ui-egui/locales/de.json b/crates/ui-egui/locales/de.json
index 64a485ed..c4bded93 100644
--- a/crates/ui-egui/locales/de.json
+++ b/crates/ui-egui/locales/de.json
@@ -1174,6 +1174,8 @@
   "Remove (H)": "Entfernen (H)",
   "Remove CA": "Chromatische Aberration entfernen",
   "Remove Chromatic Aberration": "Chromatische Aberration entfernen",
+  "Camera local tone mapping": "Lokale Tonwertzuordnung der Kamera",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "Die in der Raw-Datei gespeicherte lokale Tonwertzuordnung (Apple ProRAW) anwenden, wie die Kamera sie rendert",
   "Remove Disk from Library": "Datenträger aus Bibliothek entfernen",
   "Remove Disk from Library…": "Datenträger aus Bibliothek entfernen…",
   "Remove Face Box": "Gesichtsrahmen entfernen",
@@ -1887,5 +1889,132 @@
   "Pending photo action cancelled": "Pending photo action cancelled",
   "Pending photo action cancelled because its library or photo changed": "Pending photo action cancelled because its library or photo changed",
   "ONNX model": "ONNX model",
-  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions"
+  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions",
+  "Decrease Rating": "Bewertung verringern",
+  "Increase Rating": "Bewertung erhöhen",
+  "Click to type a value": "Klicken, um einen Wert einzugeben",
+  "Angle": "Winkel",
+  "Video": "Video",
+  "Copyrighted": "Urheberrechtlich geschützt",
+  "Public Domain": "Gemeinfrei",
+  "Unknown": "Unbekannt",
+  "Landscape (wide)": "Querformat",
+  "Portrait (tall)": "Hochformat",
+  "Square": "Quadratisch",
+  "In Color": "Farbig",
+  "No Label": "Ohne Markierung",
+  "Choose an album…": "Album wählen…",
+  "No albums yet": "Noch keine Alben",
+  "Fix the marked rules to save this album.": "Korrigiere die markierten Regeln, um dieses Album zu speichern.",
+  "Some rules need fixing (Edit Smart Album…):": "Einige Regeln müssen korrigiert werden (Smart-Album bearbeiten…):",
+  "isn't a field rules know": "ist kein bekanntes Feld",
+  "can't be tested that way": "lässt sich so nicht prüfen",
+  "is yes or no": "ist Ja oder Nein",
+  "needs a number": "braucht eine Zahl",
+  "needs a time like 1/250 or 2": "braucht eine Zeit wie 1/250 oder 2",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "braucht ein Datum wie 2026, 2026-08 oder 2026-08-14",
+  "has the first date after the second": "das erste Datum liegt nach dem zweiten",
+  "needs two values": "braucht zwei Werte",
+  "needs a number more than 0": "braucht eine Zahl größer als 0",
+  "needs hours, days, weeks, months or years": "braucht Stunden, Tage, Wochen, Monate oder Jahre",
+  "isn't one of the choices": "ist keine der Auswahlmöglichkeiten",
+  "needs something to look for (or use “is empty”)": "braucht einen Suchbegriff (oder „ist leer“)",
+  "needs something to look for (or use “isn't empty”)": "braucht einen Suchbegriff (oder „ist nicht leer“)",
+  "needs text": "braucht Text",
+  "can't match any rating from 0 to 5": "passt zu keiner Bewertung von 0 bis 5",
+  "needs an album": "braucht ein Album",
+  "names an album that no longer exists": "nennt ein Album, das es nicht mehr gibt",
+  "can't test a folder; choose an album in it": "kann keinen Ordner prüfen; wähle ein Album darin",
+  "This group is empty: add a rule or remove it.": "Diese Gruppe ist leer: Füge eine Regel hinzu oder entferne sie.",
+  "needs something to look for (or use “are empty”)": "braucht einen Suchbegriff (oder „sind leer“)",
+  "needs something to look for (or use “aren't empty”)": "braucht einen Suchbegriff (oder „sind nicht leer“)",
+  "Mo": "Mo",
+  "Tu": "Di",
+  "We": "Mi",
+  "Th": "Do",
+  "Fr": "Fr",
+  "Sa": "Sa",
+  "Su": "So",
+  "Pick a date": "Datum wählen",
+  "would make this album include itself through other smart albums": "würde dieses Album über andere Smart-Alben sich selbst enthalten lassen",
+  "Search albums": "Alben suchen",
+  "No albums match": "Kein Album passt",
+  "This is the album you're editing": "Das ist das Album, das du bearbeitest",
+  "It tests this album, so testing it back would loop": "Es prüft dieses Album; es zurückzuprüfen wäre ein Kreis",
+  "Copy Name": "Kopiename",
+  "In a Stack": "In einem Stapel",
+  "File Extension": "Dateiendung",
+  "Video Duration": "Videodauer",
+  "Keyword Count": "Anzahl Stichwörter",
+  "People Count": "Anzahl Personen",
+  "Shutter Speed": "Belichtungszeit",
+  "Cropped": "Zugeschnitten",
+  "Keywords & People": "Stichwörter & Personen",
+  "Description": "Beschreibung",
+  "Camera Info": "Kamera-Info",
+  "Develop": "Bearbeitung",
+  "Keyword List": "Stichwortliste",
+  "Filter Keywords": "Stichwörter filtern",
+  "No keywords yet": "Noch keine Stichwörter",
+  "No keywords match": "Keine passenden Stichwörter",
+  "Keyword Name": "Stichwortname",
+  "Synonyms": "Synonyme",
+  "Separated by commas": "Durch Kommas getrennt",
+  "Keyword Tag Options": "Stichwort-Optionen",
+  "Include on Export": "Beim Export einschließen",
+  "Export Containing Keywords": "Übergeordnete Stichwörter exportieren",
+  "Export Synonyms": "Synonyme exportieren",
+  "Create Keyword Tag": "Stichwort erstellen",
+  "Edit Keyword Tag": "Stichwort bearbeiten",
+  "Create": "Erstellen",
+  "No photo has it; the keywords below it go too.": "Kein Foto hat es; die Stichwörter darunter werden ebenfalls gelöscht.",
+  "Edit Keyword Tag…": "Stichwort bearbeiten…",
+  "Put New Keywords Inside This Keyword": "Neue Stichwörter in dieses Stichwort einfügen",
+  "Purge Unused Keywords": "Nicht verwendete Stichwörter löschen",
+  "Delete Keyword…": "Stichwort löschen…",
+  "Drop here for the top level": "Hier ablegen für die oberste Ebene",
+  "Their photos and the keywords below them come together under one keyword.": "Ihre Fotos und die Stichwörter darunter kommen unter einem Stichwort zusammen.",
+  "Select photos to give them keywords.": "Wählen Sie Fotos aus, um ihnen Stichwörter zu geben.",
+  "Add to All Selected Photos": "Allen ausgewählten Fotos hinzufügen",
+  "Will Export": "Wird exportiert",
+  "No keywords are exported": "Es werden keine Stichwörter exportiert",
+  "& Containing": "& Übergeordnete",
+  "Edit Set…": "Satz bearbeiten…",
+  "Edit Keyword Set": "Stichwortsatz bearbeiten",
+  "Keywords (⌥1–⌥9)": "Stichwörter (⌥1–⌥9)",
+  "A keyword set needs a name": "Ein Stichwortsatz braucht einen Namen",
+  "Save as a new set": "Als neuen Satz speichern",
+  "Recent Keywords is built in: choose another name": "„Letzte Stichwörter“ ist vorgegeben: Wählen Sie einen anderen Namen",
+  "Import Keywords…": "Stichwörter importieren…",
+  "Export Keywords…": "Stichwörter exportieren…",
+  "Import Keywords": "Stichwörter importieren",
+  "Export Keywords": "Stichwörter exportieren",
+  "Keyword Lists": "Stichwortlisten",
+  "Synchronize Folder…": "Ordner synchronisieren…",
+  "Synchronize Folder": "Ordner synchronisieren",
+  "Synchronize": "Synchronisieren",
+  "Scanning…": "Wird durchsucht…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "Fotos finden, die in diesem Ordner auf dem Datenträger hinzugekommen sind oder fehlen, und von anderen Apps geänderte XMP-Filialdateien",
+  "Bring the library up to date with this folder and the folders inside it:": "Die Bibliothek mit diesem Ordner und den Ordnern darin abgleichen:",
+  "Import new photos": "Neue Fotos importieren",
+  "Remove missing photos from the library": "Fehlende Fotos aus der Bibliothek entfernen",
+  "Read metadata updates from XMP sidecars": "Metadaten-Änderungen aus XMP-Filialdateien lesen",
+  "The library is up to date with this folder.": "Die Bibliothek ist mit diesem Ordner auf dem neuesten Stand.",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "Fehlende Fotos werden nach „Zuletzt gelöscht“ verschoben und können wiederhergestellt werden; keine Datei auf dem Datenträger wird verändert.",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "Beim Lesen einer Filialdatei werden Bewertung, Markierungen, Metadaten und Bearbeitungen des Fotos durch ihren Inhalt ersetzt.",
+  "Skipped: files already in the library elsewhere": "Übersprungen: Dateien, die bereits an anderer Stelle in der Bibliothek sind",
+  "Skipped: files that can't be read": "Übersprungen: Dateien, die nicht gelesen werden können",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "Dieser Ordner ist nicht vorhanden: Er wurde verschoben oder umbenannt, oder sein Datenträger ist nicht verbunden.",
+  "Relink photos whose file was renamed or moved": "Fotos neu verknüpfen, deren Datei umbenannt oder verschoben wurde",
+  "A folder is already being synchronized": "Es wird bereits ein Ordner synchronisiert",
+  "Synchronizing…": "Wird synchronisiert…",
+  "Relinked": "Neu verknüpft",
+  "Removed": "Entfernt",
+  "Metadata read": "Metadaten gelesen",
+  "Failed": "Fehlgeschlagen",
+  "Stopped": "Angehalten",
+  "Stopped by an error (see the log)": "Durch einen Fehler angehalten (siehe Protokoll)",
+  "Not saved": "Nicht gespeichert",
+  "A folder is being synchronized": "Ein Ordner wird gerade synchronisiert",
+  "Wait for the import to finish": "Warten Sie, bis der Import abgeschlossen ist"
 }
diff --git a/crates/ui-egui/locales/es-formats.json b/crates/ui-egui/locales/es-formats.json
index 54418c76..ce6ace8c 100644
--- a/crates/ui-egui/locales/es-formats.json
+++ b/crates/ui-egui/locales/es-formats.json
@@ -206,5 +206,20 @@
   "In line for AI Denoise ({ahead} ahead)…": "In line for AI Denoise ({ahead} ahead)…",
   "Running on {}.": "Running on {}.",
   "{file} · {size}": "{file} · {size}",
-  "•  {assumption}": "•  {assumption}"
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "Poner dentro de “{parent}”",
+  "Delete the keyword “{name}”?": "¿Eliminar la palabra clave “{name}”?",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "Se quita de {count} foto{}, con las palabras clave que contiene. Deshacer la recupera.",
+  "Create Keyword Tag Inside “{name}”…": "Crear palabra clave dentro de “{name}”…",
+  "“{parent}” has a “{name}” already. Merge the two?": "“{parent}” ya tiene “{name}”. ¿Combinar las dos?",
+  "There is a “{name}” at the top level already. Merge the two?": "Ya hay “{name}” en el nivel superior. ¿Combinar las dos?",
+  "Added “{keyword}” to {n} photo{}": "Se añadió “{keyword}” a {n} foto{}",
+  "On {have} of {of} selected photos": "En {have} de {of} fotos seleccionadas",
+  "Remove “{name}”": "Quitar “{name}”",
+  "There is a keyword set “{name}” already": "Ya hay un conjunto de palabras clave “{name}”",
+  "Added {n} keyword{}": "Palabras clave añadidas: {n}{:.0}",
+  "; {n} gained synonyms": "; con sinónimos nuevos: {n}",
+  "Exported {n} keyword{}": "Palabras clave exportadas: {n}{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — Capture One no importa una lista con ; , < o > en una palabra clave: {names}",
+  " — left out, as a keyword list can't hold them: {names}": " — omitidas, porque una lista de palabras clave no puede contenerlas: {names}"
 }
diff --git a/crates/ui-egui/locales/es.json b/crates/ui-egui/locales/es.json
index 461fa2f6..eb13321a 100644
--- a/crates/ui-egui/locales/es.json
+++ b/crates/ui-egui/locales/es.json
@@ -1126,6 +1126,8 @@
   "Remove (H)": "Eliminar (H)",
   "Remove CA": "Eliminar AC",
   "Remove Chromatic Aberration": "Eliminar aberración cromática",
+  "Camera local tone mapping": "Mapeo tonal local de la cámara",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "Aplicar el mapeo tonal local guardado en el raw (Apple ProRAW), como lo renderiza la cámara",
   "Remove Disk from Library": "Quitar disco de la biblioteca",
   "Remove Disk from Library…": "Quitar disco de la biblioteca…",
   "Remove Face Box": "Quitar recuadro de cara",
@@ -1732,5 +1734,132 @@
   "Pending photo action cancelled": "Pending photo action cancelled",
   "Pending photo action cancelled because its library or photo changed": "Pending photo action cancelled because its library or photo changed",
   "ONNX model": "ONNX model",
-  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions"
+  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions",
+  "Decrease Rating": "Reducir valoración",
+  "Increase Rating": "Aumentar valoración",
+  "Click to type a value": "Hacer clic para escribir un valor",
+  "Angle": "Ángulo",
+  "Video": "Vídeo",
+  "Copyrighted": "Con copyright",
+  "Public Domain": "Dominio público",
+  "Unknown": "Desconocido",
+  "Landscape (wide)": "Horizontal (apaisada)",
+  "Portrait (tall)": "Vertical (retrato)",
+  "Square": "Cuadrada",
+  "In Color": "En color",
+  "No Label": "Sin etiqueta",
+  "Choose an album…": "Elige un álbum…",
+  "No albums yet": "Aún no hay álbumes",
+  "Fix the marked rules to save this album.": "Corrige las reglas marcadas para guardar este álbum.",
+  "Some rules need fixing (Edit Smart Album…):": "Hay reglas que corregir (Editar álbum inteligente…):",
+  "isn't a field rules know": "no es un campo conocido",
+  "can't be tested that way": "no se puede comprobar así",
+  "is yes or no": "es Sí o No",
+  "needs a number": "necesita un número",
+  "needs a time like 1/250 or 2": "necesita un tiempo como 1/250 o 2",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "necesita una fecha como 2026, 2026-08 o 2026-08-14",
+  "has the first date after the second": "la primera fecha es posterior a la segunda",
+  "needs two values": "necesita dos valores",
+  "needs a number more than 0": "necesita un número mayor que 0",
+  "needs hours, days, weeks, months or years": "necesita horas, días, semanas, meses o años",
+  "isn't one of the choices": "no es ninguna de las opciones",
+  "needs something to look for (or use “is empty”)": "necesita algo que buscar (o usa «está vacío»)",
+  "needs something to look for (or use “isn't empty”)": "necesita algo que buscar (o usa «no está vacío»)",
+  "needs text": "necesita texto",
+  "can't match any rating from 0 to 5": "no coincide con ninguna valoración de 0 a 5",
+  "needs an album": "necesita un álbum",
+  "names an album that no longer exists": "indica un álbum que ya no existe",
+  "can't test a folder; choose an album in it": "no puede comprobar una carpeta; elige un álbum dentro",
+  "This group is empty: add a rule or remove it.": "Este grupo está vacío: añade una regla o quítalo.",
+  "needs something to look for (or use “are empty”)": "necesita algo que buscar (o usa «están vacíos»)",
+  "needs something to look for (or use “aren't empty”)": "necesita algo que buscar (o usa «no están vacíos»)",
+  "Mo": "Lu",
+  "Tu": "Ma",
+  "We": "Mi",
+  "Th": "Ju",
+  "Fr": "Vi",
+  "Sa": "Sá",
+  "Su": "Do",
+  "Pick a date": "Elegir una fecha",
+  "would make this album include itself through other smart albums": "haría que este álbum se incluyera a sí mismo a través de otros álbumes inteligentes",
+  "Search albums": "Buscar álbumes",
+  "No albums match": "Ningún álbum coincide",
+  "This is the album you're editing": "Es el álbum que estás editando",
+  "It tests this album, so testing it back would loop": "Comprueba este álbum, así que comprobarlo a su vez crearía un bucle",
+  "Copy Name": "Nombre de la copia",
+  "In a Stack": "En una pila",
+  "File Extension": "Extensión del archivo",
+  "Video Duration": "Duración del vídeo",
+  "Keyword Count": "Número de palabras clave",
+  "People Count": "Número de personas",
+  "Shutter Speed": "Velocidad de obturación",
+  "Cropped": "Recortada",
+  "Keywords & People": "Palabras clave y personas",
+  "Description": "Descripción",
+  "Camera Info": "Información de la cámara",
+  "Develop": "Edición",
+  "Keyword List": "Lista de palabras clave",
+  "Filter Keywords": "Filtrar palabras clave",
+  "No keywords yet": "Aún no hay palabras clave",
+  "No keywords match": "Ninguna palabra clave coincide",
+  "Keyword Name": "Nombre de la palabra clave",
+  "Synonyms": "Sinónimos",
+  "Separated by commas": "Separados por comas",
+  "Keyword Tag Options": "Opciones de palabra clave",
+  "Include on Export": "Incluir al exportar",
+  "Export Containing Keywords": "Exportar palabras clave contenedoras",
+  "Export Synonyms": "Exportar sinónimos",
+  "Create Keyword Tag": "Crear palabra clave",
+  "Edit Keyword Tag": "Editar palabra clave",
+  "Create": "Crear",
+  "No photo has it; the keywords below it go too.": "Ninguna foto la tiene; las palabras clave que contiene también se eliminan.",
+  "Edit Keyword Tag…": "Editar palabra clave…",
+  "Put New Keywords Inside This Keyword": "Poner las nuevas palabras clave dentro de esta",
+  "Purge Unused Keywords": "Eliminar palabras clave no usadas",
+  "Delete Keyword…": "Eliminar palabra clave…",
+  "Drop here for the top level": "Soltar aquí para el nivel superior",
+  "Their photos and the keywords below them come together under one keyword.": "Sus fotos y las palabras clave que contienen quedan bajo una sola palabra clave.",
+  "Select photos to give them keywords.": "Selecciona fotos para darles palabras clave.",
+  "Add to All Selected Photos": "Añadir a todas las fotos seleccionadas",
+  "Will Export": "Se exportará",
+  "No keywords are exported": "No se exporta ninguna palabra clave",
+  "& Containing": "y contenedoras",
+  "Edit Set…": "Editar conjunto…",
+  "Edit Keyword Set": "Editar conjunto de palabras clave",
+  "Keywords (⌥1–⌥9)": "Palabras clave (⌥1–⌥9)",
+  "A keyword set needs a name": "Un conjunto de palabras clave necesita un nombre",
+  "Save as a new set": "Guardar como conjunto nuevo",
+  "Recent Keywords is built in: choose another name": "“Palabras clave recientes” es fijo: elige otro nombre",
+  "Import Keywords…": "Importar palabras clave…",
+  "Export Keywords…": "Exportar palabras clave…",
+  "Import Keywords": "Importar palabras clave",
+  "Export Keywords": "Exportar palabras clave",
+  "Keyword Lists": "Listas de palabras clave",
+  "Synchronize Folder…": "Sincronizar carpeta…",
+  "Synchronize Folder": "Sincronizar carpeta",
+  "Synchronize": "Sincronizar",
+  "Scanning…": "Explorando…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "Buscar fotos añadidas a esta carpeta del disco o que faltan en ella, y archivos XMP complementarios cambiados por otras apps",
+  "Bring the library up to date with this folder and the folders inside it:": "Poner la biblioteca al día con esta carpeta y las carpetas que contiene:",
+  "Import new photos": "Importar fotos nuevas",
+  "Remove missing photos from the library": "Quitar de la biblioteca las fotos que faltan",
+  "Read metadata updates from XMP sidecars": "Leer cambios de metadatos de los archivos XMP complementarios",
+  "The library is up to date with this folder.": "La biblioteca está al día con esta carpeta.",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "Las fotos que faltan pasan a Eliminadas recientemente y se pueden restaurar; no se toca ningún archivo del disco.",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "Leer un archivo complementario sustituye la valoración, las etiquetas, los metadatos y las ediciones de la foto por lo que contiene.",
+  "Skipped: files already in the library elsewhere": "Omitidos: archivos que ya están en la biblioteca en otro lugar",
+  "Skipped: files that can't be read": "Omitidos: archivos que no se pueden leer",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "Esta carpeta no está: se movió o se le cambió el nombre, o su disco no está conectado.",
+  "Relink photos whose file was renamed or moved": "Volver a vincular fotos cuyo archivo se renombró o movió",
+  "A folder is already being synchronized": "Ya se está sincronizando una carpeta",
+  "Synchronizing…": "Sincronizando…",
+  "Relinked": "Revinculadas",
+  "Removed": "Quitadas",
+  "Metadata read": "Metadatos leídos",
+  "Failed": "Con errores",
+  "Stopped": "Detenido",
+  "Stopped by an error (see the log)": "Detenido por un error (ver el registro)",
+  "Not saved": "Sin guardar",
+  "A folder is being synchronized": "Se está sincronizando una carpeta",
+  "Wait for the import to finish": "Espera a que termine la importación"
 }
diff --git a/crates/ui-egui/locales/fr-formats.json b/crates/ui-egui/locales/fr-formats.json
new file mode 100644
index 00000000..6e609329
--- /dev/null
+++ b/crates/ui-egui/locales/fr-formats.json
@@ -0,0 +1,225 @@
+{
+  " ({unsure} with several look-alike files: use Locate)": " ({unsure} avec plusieurs fichiers similaires : utilisez Localiser)",
+  " ({} in Recently Deleted)": " ({} dans « Supprimés récemment »)",
+  " · {:.0}% clipped": " · {:.0}% écrêté",
+  " · {failed} couldn't be rendered": " · {failed} impossible(s) à afficher",
+  " · {skipped} skipped (file exists)": " · {skipped} ignoré(s) (le fichier existe)",
+  " · {} duplicate{} skipped": " · {} doublon{} ignoré(s)",
+  " · {} failed: {}": " · {} échec(s) : {}",
+  " · {} moved": " · {} déplacé(s)",
+  " · {} not readable": " · {} illisible(s)",
+  " · {} original{} left at the source": " · {} original/originaux{} conservé(s) à la source",
+  " · {} restored from Recently Deleted": " · {} restauré(s) depuis « Supprimés récemment »",
+  " — not carried over: {}{}": " — non transféré : {}{}",
+  "+{} more": "+{} de plus",
+  ", {failed} file{} not readable": ", {failed} fichier{} illisible(s)",
+  "; {kept} already had a location": " ; {kept} possédaient déjà un emplacement",
+  "; {outside} outside its time range": " ; {outside} hors de leur plage horaire",
+  "@{}: {} PRs, {} commits, +{} / −{} lines (Δ {}), +{} / −{} binary assets, {} – {}": "@{} : {} PR, {} commits, +{} / −{} lignes (Δ {}), +{} / −{} ressources binaires, {} – {}",
+  "Add {local_n} to My Photos": "Ajouter {local_n} à Mes photos",
+  "Add {} Photo{}": "Ajouter {} photo{}",
+  "Add {} Photo{}, restore {}": "Ajouter {} photo{}, restaurer {}",
+  "Add “{}” to Favorites": "Ajouter « {} » aux favoris",
+  "Added {n} photo{} to My Photos": "{n} photo{} ajoutée(s) à Mes photos",
+  "Added {n} photo{} to “{}”": "{n} photo{} ajoutée(s) à « {} »",
+  "Added {what} to {name}": "{what} ajouté à {name}",
+  "Adding photos… {} of {}": "Ajout des photos… {} sur {}",
+  "All {n} selected photos move by the same amount.": "Les {n} photos sélectionnées se déplacent de la même valeur.",
+  "Already in the library, in Recently Deleted: {} photo{} selected · right-click ▸ Restore, or Delete Permanently to import afresh": "Déjà dans la bibliothèque, dans « Supprimés récemment » : {} photo{} sélectionnée(s) · clic droit → Restaurer, ou Supprimer définitivement pour importer à nouveau",
+  "Already in the library: {} photo{} selected in All Photos": "Déjà dans la bibliothèque : {} photo{} sélectionnée(s) dans Toutes les photos",
+  "Auto ({})": "Automatique ({})",
+  "Auto Import: added {} photo{}": "Importation automatique : {} photo{} ajoutée(s)",
+  "Auto Sync: edits apply to {n} photos": "Synchronisation automatique : les modifications s’appliquent à {n} photos",
+  "Automatic ({} MB)": "Automatique ({} Mo)",
+  "Build 1:1 Previews ({scope})": "Créer les aperçus 1:1 ({scope})",
+  "Build Smart Previews ({scope})": "Créer les aperçus dynamiques ({scope})",
+  "Build Standard-Sized Previews ({scope})": "Créer les aperçus de taille standard ({scope})",
+  "Building previews for {} photos…": "Création des aperçus pour {} photos…",
+  "Click {}:1": "Cliquer sur {}:1",
+  "Couldn't open the editor: {e}": "Impossible d’ouvrir l’éditeur : {e}",
+  "Create {n} Virtual Copies": "Créer {n} copies virtuelles",
+  "Creates {} stacks from {} of {scope}": "Crée {} piles à partir de {} parmi {scope}",
+  "Decoder: {reason}": "Décodeur : {reason}",
+  "Delete \"{label}\"": "Supprimer « {label} »",
+  "Delete \"{label}\" (and the mask)": "Supprimer « {label} » (et le masque)",
+  "Delete {n} Photos": "Supprimer {n} photos",
+  "Delete “{current}”": "Supprimer « {current} »",
+  "Discard Smart Previews ({scope})": "Supprimer les aperçus dynamiques ({scope})",
+  "Done ({what}): {done} photo{plural}": "Terminé ({what}) : {done} photo{plural}",
+  "Duplicate \"{label}\"": "Dupliquer « {label} »",
+  "Example: {example}": "Exemple : {example}",
+  "Exported {n} photo{}": "{n} photo{} exportée(s)",
+  "Exported {ok} of {total} photo{}": "{ok} photo{} exportée(s) sur {total}",
+  "Exported {} point curve preset{}": "{} préréglage{} de courbe de points exporté(s)",
+  "Exported {} preset{}": "{} préréglage{} exporté(s)",
+  "Exporting {} of {total}": "Exportation : {} sur {total}",
+  "Filter bar — {active} active filter{}": "Barre de filtres — {active} filtre{} actif(s)",
+  "Focus {:.0}": "Mise au point {:.0}",
+  "Folder “{}” (and its subfolders)": "Dossier « {} » (et ses sous-dossiers)",
+  "Found {n} missing photo{}; {left} still missing{unsure}": "{n} photo{} manquante(s) retrouvée(s) ; {left} toujours manquante(s){unsure}",
+  "Healed {n} dust spot{}": "{n} tache{} de poussière corrigée(s)",
+  "Import cancelled · {} photo{} added": "Importation annulée · {} photo{} ajoutée(s)",
+  "Import failed: {e}": "Échec de l’importation : {e}",
+  "Imported {n} point curve preset{}": "{n} préréglage{} de courbe de points importé(s)",
+  "Imported {n} preset{}": "{n} préréglage{} importé(s)",
+  "Imported {n} preset{}, {f} file{} not readable": "{n} préréglage{} importé(s), {f} fichier{} illisible(s)",
+  "Imported {profiles} profile{} (Profile browser ▸ their groups)": "{profiles} profil{} importé(s) (Navigateur de profils → leurs groupes)",
+  "Imported {} photo{}": "{} photo{} importée(s)",
+  "Insert at the cursor (also written {})": "Insérer à la position du curseur (également écrit {})",
+  "Label Set: {name}": "Ensemble d’étiquettes : {name}",
+  "LightCraft could not open its window: {e}": "LightCraft n’a pas pu ouvrir sa fenêtre : {e}",
+  "LightCraft could not open its window: {e}\n\nThe log file has the details: {path}": "LightCraft n’a pas pu ouvrir sa fenêtre : {e}\n\nConsultez le fichier journal pour plus de détails : {path}",
+  "Lightroom catalog inspected: {photos} photos, {collections} collections, {missing} missing": "Catalogue Lightroom analysé : {photos} photos, {collections} collections, {missing} manquante(s)",
+  "Lightroom import complete: {imported} photos added": "Importation Lightroom terminée : {imported} photos ajoutées",
+  "Lightroom import complete: {imported} photos added, {failed} failed": "Importation Lightroom terminée : {imported} photos ajoutées, {failed} échec(s)",
+  "Lightroom import complete: {imported} photos added; index warning: {warning}": "Importation Lightroom terminée : {imported} photos ajoutées ; avertissement d’index : {warning}",
+  "Lightroom import failed: {e}{warning}": "Échec de l’importation Lightroom : {e}{warning}",
+  "Lightroom inspection failed: {e}{warning}": "Échec de l’analyse Lightroom : {e}{warning}",
+  "MIT OR Apache-2.0. Fonts: {} (OFL). Icons: original.": "MIT ou Apache-2.0. Polices : {} (OFL). Icônes : originales.",
+  "Matches: {}": "Correspondances : {}",
+  "Merging… {stage} {:.0}%": "Fusion… {stage} {:.0}%",
+  "Move {what} to Recently Deleted?": "Déplacer {what} vers « Supprimés récemment » ?",
+  "Named ({named_n})": "Nommés ({named_n})",
+  "Painting “{k}”: click photos to add or remove it · Esc stops": "Application de « {k} » : cliquez sur les photos pour l’ajouter ou le retirer · Échap pour arrêter",
+  "Paste into {n} photo{} — only settings that were copied are pasted": "Coller dans {n} photo{} — seuls les réglages copiés seront collés",
+  "Preset: {name}": "Préréglage : {name}",
+  "Preview only — editing the camera's embedded JPEG ({})": "Aperçu uniquement — modification du JPEG intégré de l’appareil photo ({})",
+  "Preview only — {}": "Aperçu uniquement — {}",
+  "Previews ready for {done} photo{plural}": "Aperçus prêts pour {done} photo{plural}",
+  "Profile: {}": "Profil : {}",
+  "Proof Copy ({})": "Copie d’épreuve ({})",
+  "Proof Preview · {}": "Aperçu d’épreuve · {}",
+  "Quick Develop · {n} photos": "Développement rapide · {n} photos",
+  "Quick Develop: {name}": "Développement rapide : {name}",
+  "Rated {}": "Noté {}",
+  "Reading Lightroom catalog… {done} of {total}": "Lecture du catalogue Lightroom… {done} sur {total}",
+  "Reading photos… {done} of {total}": "Lecture des photos… {done} sur {total}",
+  "Reading photos… {} of {}": "Lecture des photos… {} sur {}",
+  "Redo {}": "Rétablir {}",
+  "Remove “{name}” and its {count} photo{} from the library?": "Retirer « {name} » et ses {count} photo{} de la bibliothèque ?",
+  "Remove “{}” from Favorites": "Retirer « {} » des favoris",
+  "Removed from {}": "Retiré de {}",
+  "Removed {what} from {name}": "{what} retiré de {name}",
+  "Rename {n} Photos…": "Renommer {n} photos…",
+  "Rename “{name}”": "Renommer « {name} »",
+  "Renames “{from}” on {n} photo{} (keywords below it too). Use | for levels, e.g. Travel|Italy. An existing name merges the two.": "Renomme « {from} » sur {n} photo{} (ainsi que les mots-clés qui en dépendent). Utilisez | pour séparer les niveaux, par ex. Voyages|Italie. Si le nom existe déjà, les deux sont fusionnés.",
+  "Rendering on the CPU: {why}": "Rendu sur le processeur : {why}",
+  "Replace {} with:": "Remplacer {} par :",
+  "Reset {name}": "Réinitialiser {name}",
+  "Reset {} Channel": "Réinitialiser le canal {}",
+  "Restore {}": "Restaurer {}",
+  "Restore {} Photo{}": "Restaurer {} photo{}",
+  "Saved export preset “{}”": "Préréglage d’exportation « {} » enregistré",
+  "Scores {scope} for focus and exposure and finds similar shots taken within seconds of each other (bursts).": "Évalue la mise au point et l’exposition de {scope}, puis repère les prises similaires réalisées à quelques secondes d’intervalle (rafales).",
+  "Show {hidden} hidden location{}": "Afficher {hidden} emplacement{} masqué(s)",
+  "Showing {n} of {}": "Affichage de {n} sur {}",
+  "Smart album: {}": "Album dynamique : {}",
+  "Tagged {n} photo{} from the tracklog": "{n} photo{} géolocalisée(s) à partir du journal de trajet",
+  "The SAM 3 download failed: {e}": "Échec du téléchargement de SAM 3 : {e}",
+  "Undo {}": "Annuler {}",
+  "Unknown tag{s} {} stay{} as typed (see Tags)": "Les étiquettes inconnues{s} {} restent{} telles quelles (voir Étiquettes)",
+  "Updated “{name}”": "« {name} » mis à jour",
+  "Version {} — a clean-room, pure-Rust photo library and raw developer.": "Version {} — bibliothèque photo et développeur RAW en Rust pur, développés indépendamment.",
+  "Version: {}": "Version : {}",
+  "Virtual copy “{name}” of {of}": "Copie virtuelle « {name} » de {of}",
+  "Working on {what} for {} photos…": "Traitement de {what} pour {} photos…",
+  "none (CPU rendering): {why}": "aucun (rendu sur le processeur) : {why}",
+  "the {n} selected photos": "les {n} photos sélectionnées",
+  "the {} photos in view": "les {} photos affichées",
+  "these {count} photos": "ces {count} photos",
+  "{count} smart preview{} · {:.1} MB": "{count} aperçu{0} dynamique{0} · {1:.1} Mo",
+  "{f} folders (and their subfolders)": "{f} dossier(s) (et leurs sous-dossiers)",
+  "{label} Grading": "Étalonnage de {label}",
+  "{label} {d:+} on every selected photo": "{label} {d:+} sur chaque photo sélectionnée",
+  "{label} {index} of {n}": "{label} {index} sur {n}",
+  "{label}, {n} photos": "{label}, {n} photos",
+  "{matching} of {t} photos": "{matching} sur {t} photos",
+  "{matching} photos": "{matching} photos",
+  "{mode} spot {} of {}": "Tache {mode} {} sur {}",
+  "{month}": "{month:02}",
+  "{month} {year}": "{month:02}/{year}",
+  "{msg} ({failed} failed)": "{msg} ({failed} échec(s))",
+  "{name} Label": "Étiquette {name}",
+  "{name} Off": "{name} : désactivé",
+  "{name} On": "{name} : activé",
+  "{name} opened for editing; it is stacked with the original": "{name} ouvert pour modification ; il est empilé avec l’original",
+  "{name} — double-click to reset it": "{name} — double-cliquez pour réinitialiser",
+  "{n} change{} couldn't be written to disk: {e}\nIf you quit now, {} lost.": "Impossible d’écrire {n} modification{} sur le disque : {e}\nSi vous quittez maintenant, {} seront perdues.",
+  "{n} change{} saved in memory but not written to disk: {e}\nLightCraft retries automatically; quitting now would lose {}.": "{n} modification{} enregistrée(s) en mémoire mais non écrite(s) sur le disque : {e}\nLightCraft réessaiera automatiquement ; quitter maintenant entraînerait la perte de {}.",
+  "{n} change{} saved in memory but not written to disk: {e} — LightCraft will retry": "{n} modification{} enregistrée(s) en mémoire mais non écrite(s) sur le disque : {e} — LightCraft réessaiera.",
+  "{n} found · {sel} selected": "{n} trouvé(s) · {sel} sélectionné(s)",
+  "{n} photos": "{n} photos",
+  "{n} photos in {} are hidden by the filters above": "Les filtres ci-dessus masquent {n} photos dans {}",
+  "{n} photo{}": "{n} photo{}",
+  "{n} photo{} match · updates automatically as photos change": "{n} photo{} correspondante(s) · mise à jour automatique lorsque les photos changent",
+  "{n} photo{} now · updates automatically as photos change": "{n} photo{} actuellement · mise à jour automatique lorsque les photos changent",
+  "{pid} (missing)": "{pid} (manquant)",
+  "{sel_n} selected · {counted}": "{sel_n} sélectionné(s) · {counted}",
+  "{stage}… {:.0}%": "{stage}… {:.0}%",
+  "{verb} {n} Photo{}": "{verb} {n} photo{}",
+  "{weekday}, {day}": "{weekday} {day}",
+  "{weekday}, {day} {month} {year}": "{weekday} {day} {month} {year}",
+  "{what} merge added": "Fusion de {what} ajoutée",
+  "{what} merge failed: {e}": "Échec de la fusion de {what} : {e}",
+  "{year}": "{year}",
+  "{{date:…}} directives: {}": "Directives {{date:…}} : {}",
+  "{} and higher": "{} et plus",
+  "{} contributors · {} commits": "{} contributeurs · {} commits",
+  "{} failed": "{} échec(s)",
+  "{} files": "{} fichiers",
+  "{} files and {f} folder{}": "{} fichiers et {f} dossier{}",
+  "{} item{}": "{} élément{}",
+  "{} of 4 guides — drag along lines that should be vertical or horizontal.": "{} guides sur 4 — faites-les glisser le long des lignes qui doivent être verticales ou horizontales.",
+  "{} photos": "{} photos",
+  "{} photos · exposures {} EV": "{} photos · expositions {} EV",
+  "{} photos · {} · {:.0}° × {:.0}°": "{} photos · {} · {:.0}° × {:.0}°",
+  "{} photo{} not readable": "{} photo{} illisible(s)",
+  "{} sample{}": "{} échantillon{}",
+  "{} sec": "{} s",
+  "{} spot(s) on this photo": "{} tache(s) sur cette photo",
+  "{} — show their photos": "{} — afficher leurs photos",
+  "· {dups} already in the library": "· déjà dans la bibliothèque : {dups}",
+  "· {n} photo{}": "· {n} photo{}",
+  "… and {more} more": "… et {more} de plus",
+  "LightCraft can't decode this raw variant yet ({}). You're editing the camera's embedded JPEG preview, which already includes the camera's picture style (e.g. Monochrome) and white balance.": "LightCraft ne peut pas encore décoder cette variante RAW ({}). Vous modifiez l’aperçu JPEG intégré de l’appareil photo, qui inclut déjà le style d’image (par ex. monochrome) et la balance des blancs de l’appareil.",
+  "Filtered: {label}": "Filtré : {label}",
+  "{n} similar photo{} · View ▸ Clear Filters to see all": "{n} photo{} similaire(s) · Affichage → Effacer les filtres pour tout voir",
+  "Moved; {} photo(s) relinked": "Déplacé ; {} photo(s) de nouveau associée(s)",
+  "{} label (click more labels to show any of them)": "Étiquette {} (cliquez sur « autres étiquettes » pour afficher celles de votre choix)",
+  ", {} star{}": ", {} étoile{}",
+  ", {} label": ", étiquette {}",
+  "Downloads from {host}. Once it has arrived and checked out, LightCraft installs it, {after}.": "Téléchargement depuis {host}. Une fois le téléchargement terminé et vérifié, LightCraft l’installe, {after}.",
+  "{:.1} MB": "{:.1} Mo",
+  "Running on the processor: {}.": "Exécution sur le processeur : {}.",
+  "{} · {}. Kept in the library's “denoise” folder; the oldest ones that no photo uses go first when the limit is reached.": "{} · {}. Conservé dans le dossier « denoise » de la bibliothèque ; lorsque la limite est atteinte, les fichiers les plus anciens inutilisés par les photos sont supprimés en premier.",
+  "Denoising {name}: {done} of {total} tiles{}": "Réduction du bruit de {name} : {done} sur {total} tuile{}",
+  "{size} GB": "{size} Go",
+  "{} of {} from {host}": "{} sur {} depuis {host}",
+  "{} KB": "{} Ko",
+  "{} MB": "{} Mo",
+  "Making the denoised picture… {}%": "Création de l’image débruitée… {}%",
+  "{name} · {terms}": "{name} · {terms}",
+  "{n} {noun}": "{n} {noun}",
+  "Trained on: {provenance}": "Entraîné sur : {provenance}",
+  " · {queued} waiting": " · {queued} en attente",
+  "Shows the model's terms, then downloads {} from {host}, installs it and starts using it. Nothing else is sent.": "Affiche les conditions du modèle, puis télécharge {} depuis {host}, l’installe et commence à l’utiliser. Aucune autre donnée n’est envoyée.",
+  "In line for AI Denoise ({ahead} ahead)…": "En attente de la réduction du bruit par IA ({ahead} devant)…",
+  "Running on {}.": "En cours d’exécution sur {}.",
+  "{file} · {size}": "{file} · {size}",
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "Placer dans « {parent} »",
+  "Delete the keyword “{name}”?": "Supprimer le mot-clé « {name} » ?",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "Il est retiré de {count} photo{}, avec les mots-clés qu’il contient. Annuler le rétablit.",
+  "Create Keyword Tag Inside “{name}”…": "Créer un mot-clé dans « {name} »…",
+  "“{parent}” has a “{name}” already. Merge the two?": "« {parent} » contient déjà « {name} ». Fusionner les deux ?",
+  "There is a “{name}” at the top level already. Merge the two?": "Il existe déjà « {name} » au premier niveau. Fusionner les deux ?",
+  "Added “{keyword}” to {n} photo{}": "« {keyword} » ajouté à {n} photo{}",
+  "On {have} of {of} selected photos": "Sur {have} des {of} photos sélectionnées",
+  "Remove “{name}”": "Retirer « {name} »",
+  "There is a keyword set “{name}” already": "Un jeu de mots-clés « {name} » existe déjà",
+  "Added {n} keyword{}": "Mots-clés ajoutés : {n}{:.0}",
+  "; {n} gained synonyms": " ; avec de nouveaux synonymes : {n}",
+  "Exported {n} keyword{}": "Mots-clés exportés : {n}{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — Capture One n’importe pas une liste dont un mot-clé contient ; , < ou > : {names}",
+  " — left out, as a keyword list can't hold them: {names}": " — omis, car une liste de mots-clés ne peut pas les contenir : {names}"
+}
\ No newline at end of file
diff --git a/crates/ui-egui/locales/fr.json b/crates/ui-egui/locales/fr.json
new file mode 100644
index 00000000..a978e983
--- /dev/null
+++ b/crates/ui-egui/locales/fr.json
@@ -0,0 +1,1865 @@
+{
+  "  (library default)": "  (valeur par défaut de la bibliothèque)",
+  " (inverted)": " (inversée)",
+  " · best of its burst": " · la meilleure de sa rafale",
+  " · in a burst": " · dans une rafale",
+  "% of all commits": "% de tous les commits",
+  "+ Group": "+ Groupe",
+  "+ Rule": "+ Règle",
+  "0: nothing is rejected.": "0 : rien n'est rejeté.",
+  "1 day": "1 jour",
+  "2026-04 or 2026-04-12": "2026-04 ou 2026-04-12",
+  "=  exactly": "=  exactement",
+  "A blank template keeps the original names.": "Un modèle vide conserve les noms d'origine.",
+  "A filter is hiding this view's photos: change it, or clear it (View → Clear Filters)": "Un filtre masque les photos de cette vue : modifiez-le ou effacez-le (Affichage → Effacer les filtres)",
+  "A one-time download of about": "Un téléchargement unique d'environ",
+  "AI Mask Model Status": "État du modèle de masques IA",
+  "About": "À propos",
+  "About LightCraft": "À propos de LightCraft",
+  "Active": "Active",
+  "Activity": "Activité",
+  "Actual size": "Taille réelle",
+  "Add": "Ajouter",
+  "Add Catchlight": "Ajouter un reflet dans les yeux",
+  "Add Folder to Local": "Ajouter le dossier à Local",
+  "Add Mask": "Ajouter un masque",
+  "Add Object Click": "Ajouter un clic sur l'objet",
+  "Add Point Color Sample": "Ajouter un échantillon de couleur ponctuelle",
+  "Add Red Eye Correction": "Ajouter une correction des yeux rouges",
+  "Add Remove Spot": "Ajouter une suppression de tache",
+  "Add Selected Photos": "Ajouter les photos sélectionnées",
+  "Add a rule (⌥-click: a group)": "Ajouter une règle (⌥-clic : un groupe)",
+  "Add in place": "Ajouter sur place",
+  "Add in place: the library references the files where they are; nothing is copied or moved.": "Ajouter sur place : la bibliothèque référence les fichiers là où ils se trouvent ; rien n'est copié ni déplacé.",
+  "Add keyword": "Ajouter un mot-clé",
+  "Add number": "Ajouter un numéro",
+  "Add to": "Ajouter à",
+  "Add to Album": "Ajouter à l'album",
+  "Add to Favorites": "Ajouter aux favoris",
+  "Add to Local": "Ajouter à Local",
+  "Add to My Photos": "Ajouter à Mes photos",
+  "Add to Selected Photos": "Ajouter aux photos sélectionnées",
+  "Add to Target Album": "Ajouter à l'album cible",
+  "Add to this mask": "Ajouter à ce masque",
+  "Add/Subtract/Intersect Mask": "Ajouter/soustraire/intersecter un masque",
+  "Added to photos you import that don't already have it.": "Ajouté aux photos importées qui n'en ont pas déjà.",
+  "Adding": "Ajout en cours",
+  "Adding Lightroom photos…": "Ajout des photos Lightroom…",
+  "Advanced search…": "Recherche avancée…",
+  "After": "Après",
+  "After 30 days": "Après 30 jours",
+  "After 7 days": "Après 7 jours",
+  "After 90 days": "Après 90 jours",
+  "After a year": "Après un an",
+  "Album": "Album",
+  "Albums": "Albums",
+  "All": "Tout",
+  "All Metadata": "Toutes les métadonnées",
+  "All Metadata…": "Toutes les métadonnées…",
+  "All Photos": "Toutes les photos",
+  "All rights reserved": "Tous droits réservés",
+  "All the photos imported from this disk are included.": "Toutes les photos importées depuis ce disque sont incluses.",
+  "All types": "Tous les types",
+  "Alt Text": "Texte alternatif",
+  "Always": "Toujours",
+  "Amount": "Quantité",
+  "Analyzing the photo for AI masks…": "Analyse de la photo pour les masques IA…",
+  "Any Searchable Text": "N'importe quel texte pouvant être recherché",
+  "Aperture": "Ouverture",
+  "Application": "Application",
+  "Apply": "Appliquer",
+  "Apply Color Label Set": "Appliquer un jeu d'étiquettes de couleur",
+  "Apply Filter Preset": "Appliquer un préréglage de filtre",
+  "Apply Metadata Preset": "Appliquer un préréglage de métadonnées",
+  "Apply Point Curve Preset": "Appliquer un préréglage de courbe de points",
+  "Apply Preset": "Appliquer un préréglage",
+  "Apply Settings JSON": "Appliquer des réglages JSON",
+  "Approved": "Approuvée",
+  "Aqua": "Aigue-marine",
+  "Aqua Hue": "Teinte aigue-marine",
+  "Aqua Luminance": "Luminance aigue-marine",
+  "Aqua Saturation": "Saturation aigue-marine",
+  "ArtCraft Website": "Site web d'ArtCraft",
+  "ArtCraft — more creative apps": "ArtCraft : d'autres applications créatives",
+  "As Shot": "Tel quel",
+  "As shot": "Tel quel",
+  "Ascending": "Croissant",
+  "Aspect": "Format",
+  "Aspect Ratio": "Rapport d'aspect",
+  "Assisted Culling": "Tri assisté",
+  "Assisted Culling…": "Tri assisté…",
+  "Auto": "Auto",
+  "Auto Advance": "Avance automatique",
+  "Auto Advance Off": "Avance automatique désactivée",
+  "Auto Advance On": "Avance automatique activée",
+  "Auto Advance after rating or flagging": "Avance automatique après notation ou marquage",
+  "Auto Advance: move to the next photo after rating or flagging": "Avance automatique : passer à la photo suivante après notation ou marquage",
+  "Auto Align": "Alignement automatique",
+  "Auto B&W Mix": "Mixage N&B automatique",
+  "Auto Crop": "Recadrage automatique",
+  "Auto Import": "Importation automatique",
+  "Auto Import Now": "Importer automatiquement maintenant",
+  "Auto Import Settings": "Réglages d'importation automatique",
+  "Auto Mask": "Masque automatique",
+  "Auto Select": "Sélection automatique",
+  "Auto Settings": "Réglages automatiques",
+  "Auto Straighten": "Redressement automatique",
+  "Auto Sync": "Synchronisation automatique",
+  "Auto settings applied": "Réglages automatiques appliqués",
+  "Auto-Stack by Capture Time": "Empiler automatiquement par heure de prise de vue",
+  "Auto-Stack by Capture Time…": "Empiler automatiquement par heure de prise de vue…",
+  "Auto-Tag Photos from Tracklog": "Géolocaliser automatiquement les photos à partir d'une trace GPS",
+  "Auto-Tag from Tracklog": "Géolocaliser automatiquement à partir d'une trace GPS",
+  "Auto-Tag from Tracklog…": "Géolocaliser automatiquement à partir d'une trace GPS…",
+  "Automatic": "Automatique",
+  "Automatic renders the Detail view at the size it is shown, up to the photo's own pixels. Choose a size to cap it: smaller is faster.": "Automatique calcule la vue Détail à la taille affichée, jusqu'aux pixels de la photo elle-même. Choisissez une taille pour la plafonner : plus petit, c'est plus rapide.",
+  "Automatically Write Changes into XMP": "Écrire automatiquement les modifications dans XMP",
+  "Automatically write changes into XMP sidecars": "Écrire automatiquement les modifications dans les fichiers annexes XMP",
+  "Autumn Gold": "Or d'automne",
+  "B&W": "N&B",
+  "B&W Mix": "Mixage N&B",
+  "B&W Mixer": "Mélangeur N&B",
+  "Back": "Retour",
+  "Back Up Library…": "Sauvegarder la bibliothèque…",
+  "Back to Edit": "Retour à Modifier",
+  "Back to Edit (E)": "Retour à Modifier (E)",
+  "Back to Grid": "Retour à la grille",
+  "Background": "Arrière-plan",
+  "Balance": "Balance",
+  "Basic": "Base",
+  "Before": "Avant",
+  "Before/After (Y)": "Avant/Après (Y)",
+  "Before/After Settings": "Réglages Avant/Après",
+  "Before/After Split": "Avant/Après divisé",
+  "Before/After Split Top/Bottom": "Avant/Après divisé haut/bas",
+  "Before/After Top/Bottom": "Avant/Après haut/bas",
+  "Begin Interaction": "Commencer l'interaction",
+  "Best of Similar Shots": "Meilleure des prises similaires",
+  "Binary assets added": "Ressources binaires ajoutées",
+  "Binary assets removed": "Ressources binaires supprimées",
+  "Bit depth": "Profondeur de bits",
+  "Black & White": "Noir et blanc",
+  "Blacks": "Noirs",
+  "Bleach Bypass": "Bleach bypass",
+  "Bleached": "Délavé",
+  "Blending": "Fusion",
+  "Blue": "Bleu",
+  "Blue Hour Boost": "Boost heure bleue",
+  "Blue Hue": "Teinte bleue",
+  "Blue Luminance": "Luminance bleue",
+  "Blue Primary": "Primaire bleu",
+  "Blue Saturation": "Saturation bleue",
+  "Blue channel": "Canal bleu",
+  "Blue label": "Étiquette bleue",
+  "Blue/Yellow Fringe": "Frange bleue/jaune",
+  "Blurry photos below the score are flagged as rejects.": "Les photos floues en dessous du score sont marquées comme rejetées.",
+  "Boundary Warp": "Déformation des bords",
+  "Bright & Airy": "Lumineux et aérien",
+  "Bring All to Front": "Tout ramener au premier plan",
+  "Browse Folder": "Parcourir le dossier",
+  "Browse Folder…": "Parcourir le dossier…",
+  "Browse Profiles": "Parcourir les profils",
+  "Browse…": "Parcourir…",
+  "Brush": "Pinceau",
+  "Brush Settings": "Réglages du pinceau",
+  "Brush Stroke": "Coup de pinceau",
+  "Build Previews": "Générer les aperçus",
+  "Build Smart Previews": "Générer les aperçus dynamiques",
+  "By Date": "Par date",
+  "By day (YYYY/YYYY-MM-DD)": "Par jour (AAAA/AAAA-MM-JJ)",
+  "By month (YYYY/YYYY-MM)": "Par mois (AAAA/AAAA-MM)",
+  "CPU threads": "Threads du processeur",
+  "Calibration": "Calibrage",
+  "Camera": "Appareil photo",
+  "Camera make and model": "Marque et modèle de l'appareil photo",
+  "Cameras and Cards": "Appareils photo et cartes",
+  "Cancel": "Annuler",
+  "Cancel AI Mask Model Download": "Annuler le téléchargement du modèle de masques IA",
+  "Cancel Download": "Annuler le téléchargement",
+  "Cancel Interaction": "Annuler l'interaction",
+  "Cancel Preview Build": "Annuler la génération des aperçus",
+  "Candidate": "Candidate",
+  "Caption": "Légende",
+  "Capture Date": "Date de prise de vue",
+  "Capture date and time in your own format (directives below)": "Date et heure de prise de vue dans votre propre format (directives ci-dessous)",
+  "Capture date as YYYYMMDD": "Date de prise de vue au format AAAAMMJJ",
+  "Captured": "Prise de vue",
+  "Catalog Statistics": "Statistiques du catalogue",
+  "Catchlight": "Reflet dans les yeux",
+  "Change": "Modifier",
+  "Change Component Mode": "Changer le mode du composant",
+  "Characters not allowed in file names (/ \\ : * ? \" < > |) become -; an existing name gets -1, -2….": "Les caractères interdits dans les noms de fichiers (/ \\ : * ? \" < > |) deviennent - ; un nom existant reçoit -1, -2….",
+  "Check All": "Tout cocher",
+  "Check Output Path": "Vérifier le chemin de sortie",
+  "Check the files of this type": "Cocher les fichiers de ce type",
+  "Checking names…": "Vérification des noms…",
+  "Choose Another Library…": "Choisir une autre bibliothèque…",
+  "Choose Edit Settings to Copy": "Choisir les réglages de retouche à copier",
+  "Choose Edit Settings to Copy…": "Choisir les réglages de retouche à copier…",
+  "Choose Folder…": "Choisir un dossier…",
+  "Choose a photo in the grid or filmstrip": "Choisissez une photo dans la grille ou la pellicule",
+  "Choose…": "Choisir…",
+  "Cinematic": "Cinématographique",
+  "City": "Ville",
+  "Clarity": "Clarté",
+  "Clean Studio": "Studio épuré",
+  "Clear": "Effacer",
+  "Clear Cache": "Vider le cache",
+  "Clear Filters": "Effacer les filtres",
+  "Clear Guides": "Effacer les repères",
+  "Clear History": "Effacer l'historique",
+  "Clear Preview Cache": "Vider le cache des aperçus",
+  "Clear Quick Collection": "Vider la collection rapide",
+  "Clear Reference": "Effacer la référence",
+  "Clear all": "Tout effacer",
+  "Clear form": "Effacer le formulaire",
+  "Clear rating": "Effacer la note",
+  "Clear rating and advance": "Effacer la note et avancer",
+  "Cleared History": "Historique effacé",
+  "Click Zoom Ratio": "Rapport de zoom au clic",
+  "Click a shortcut, then press the new keys (Esc cancels).": "Cliquez sur un raccourci, puis appuyez sur les nouvelles touches (Échap annule).",
+  "Click a tag to insert it. Examples are for IMG_0042.CR3 taken 14 Jan 2026, 05:58:48.": "Cliquez sur une balise pour l'insérer. Les exemples correspondent à IMG_0042.CR3, prise le 14 janv. 2026 à 05:58:48.",
+  "Click photos in the grid to toggle the keyword; Esc stops": "Cliquez sur les photos de la grille pour activer/désactiver le mot-clé ; Échap pour arrêter",
+  "Click the object to select it · ⌥-click leaves a part out": "Cliquez sur l'objet pour le sélectionner · ⌥-clic exclut une partie",
+  "Click the photo to pick a colour · ⇧-click adds more": "Cliquez sur la photo pour choisir une couleur · ⇧-clic en ajoute d'autres",
+  "Click the photo to pick a colour; ⇧-click adds more (up to 5)": "Cliquez sur la photo pour choisir une couleur ; ⇧-clic en ajoute d'autres (jusqu'à 5)",
+  "Click to clear these filters": "Cliquez pour effacer ces filtres",
+  "Click to restore · double-click to rename": "Cliquez pour restaurer · double-cliquez pour renommer",
+  "Clone": "Cloner",
+  "Close": "Fermer",
+  "Close Panel": "Fermer le panneau",
+  "Close Window": "Fermer la fenêtre",
+  "Close all": "Tout fermer",
+  "Close file": "Fermer le fichier",
+  "Cloudy": "Nuageux",
+  "Collapse": "Réduire",
+  "Collapse All Stacks": "Réduire toutes les piles",
+  "Collapse Stack": "Réduire la pile",
+  "Color": "Couleur",
+  "Color Grading": "Étalonnage des couleurs",
+  "Color Label": "Étiquette de couleur",
+  "Color Label Names": "Noms des étiquettes de couleur",
+  "Color Label Sets": "Jeux d'étiquettes de couleur",
+  "Color Mixer": "Mélangeur de couleurs",
+  "Color Noise Reduction": "Réduction du bruit de couleur",
+  "Color Priority": "Priorité de couleur",
+  "Color Range": "Plage de couleurs",
+  "Color label cleared": "Étiquette de couleur supprimée",
+  "Color space": "Espace colorimétrique",
+  "Color space: sRGB (AVIF)": "Espace colorimétrique : sRGB (AVIF)",
+  "Colors": "Couleurs",
+  "Combine files…": "Combiner des fichiers…",
+  "Command Journal": "Journal des commandes",
+  "Comments panel": "Panneau des commentaires",
+  "Commits": "Commits",
+  "Company": "Société",
+  "Compare": "Comparer",
+  "Compare (Shift+C)": "Comparer (Maj+C)",
+  "Compare Before and After": "Comparer avant et après",
+  "Compare needs at least two photos": "Comparer nécessite au moins deux photos",
+  "Component options": "Options du composant",
+  "Compression": "Compression",
+  "Concrete Cool": "Béton froid",
+  "Confirm before deleting": "Confirmer avant de supprimer",
+  "Confirm before moving photos to Recently Deleted": "Confirmer avant de déplacer des photos vers Supprimées récemment",
+  "Constrain Crop": "Contraindre le recadrage",
+  "Continue": "Continuer",
+  "Continue Without Saving": "Continuer sans enregistrer",
+  "Contrast": "Contraste",
+  "Contributors": "Contributeurs",
+  "Convert to DNG": "Convertir en DNG",
+  "Cool Fade": "Fondu froid",
+  "Cool Morning": "Matin frais",
+  "Copy": "Copier",
+  "Copy After's Settings to Before": "Copier les réglages d'Après vers Avant",
+  "Copy Before to After": "Copier Avant vers Après",
+  "Copy Before's Settings to After": "Copier les réglages d'Avant vers Après",
+  "Copy Edit Settings": "Copier les réglages de retouche",
+  "Copy History Step Settings to Before": "Copier les réglages de l'étape d'historique vers Avant",
+  "Copy Metadata": "Copier les métadonnées",
+  "Copy as DNG": "Copier en DNG",
+  "Copy into the library (else use the files where they are)": "Copier dans la bibliothèque (sinon, utiliser les fichiers sur place)",
+  "Copy pages": "Copier les pages",
+  "Copy the files (into the library's Originals/, or a folder you choose)": "Copier les fichiers (dans Originals/ de la bibliothèque ou dans un dossier de votre choix)",
+  "Copy to": "Copier vers",
+  "Copy to Clipboard": "Copier dans le presse-papiers",
+  "Copy: the files are copied to the folder below and the library uses the copies; the originals are left as they are.": "Copier : les fichiers sont copiés dans le dossier ci-dessous et la bibliothèque utilise les copies ; les originaux restent intacts.",
+  "Copyright": "Copyright",
+  "Copyright Info URL": "URL d'informations sur le copyright",
+  "Copyright Status": "Statut du copyright",
+  "Country": "Pays",
+  "Create Album": "Créer un album",
+  "Create Album…": "Créer un album…",
+  "Create Folder": "Créer un dossier",
+  "Create Folder…": "Créer un dossier…",
+  "Create New Mask": "Créer un nouveau masque",
+  "Create PDF from clipboard": "Créer un PDF à partir du presse-papiers",
+  "Create PDF from file…": "Créer un PDF à partir d'un fichier…",
+  "Create PDF from images…": "Créer un PDF à partir d'images…",
+  "Create Preset": "Créer un préréglage",
+  "Create Preset…": "Créer un préréglage…",
+  "Create Proof Copy": "Créer une copie d'épreuve",
+  "Create Smart Album": "Créer un album intelligent",
+  "Create Smart Album from Filter…": "Créer un album intelligent à partir du filtre…",
+  "Create Smart Album…": "Créer un album intelligent…",
+  "Create Stack": "Créer une pile",
+  "Create Version": "Créer une version",
+  "Create Version from Step": "Créer une version à partir de l'étape",
+  "Create Virtual Copy": "Créer une copie virtuelle",
+  "Creator": "Créateur",
+  "Creator metadata": "Métadonnées du créateur",
+  "Crisp Landscape": "Paysage net",
+  "Crisp Vista": "Panorama net",
+  "Crop": "Recadrer",
+  "Crop & Rotate": "Recadrer et pivoter",
+  "Crop & Rotate (C)": "Recadrer et pivoter (C)",
+  "Crop Aspect": "Format du recadrage",
+  "Crop, Rotate, Geometry": "Recadrage, rotation, géométrie",
+  "Cross Process": "Traitement croisé",
+  "Culling": "Tri",
+  "Curve": "Courbe",
+  "Custom": "Personnalisé",
+  "Custom template…": "Modèle personnalisé…",
+  "Custom…": "Personnalisé…",
+  "Cut": "Couper",
+  "Cut pages": "Couper les pages",
+  "Cycle Crop Overlay": "Parcourir les incrustations de recadrage",
+  "Cycle Crop Overlay Orientation": "Parcourir les orientations de l'incrustation de recadrage",
+  "Cycle Info Overlay": "Parcourir les incrustations d'informations",
+  "Cycle Mask Overlay Color": "Parcourir les couleurs de l'incrustation du masque",
+  "Cycle Mask Overlay Mode": "Parcourir les modes d'incrustation du masque",
+  "Cylindrical": "Cylindrique",
+  "Dark & Moody": "Sombre et atmosphérique",
+  "Darken": "Assombrir",
+  "Darks": "Tons sombres",
+  "Date": "Date",
+  "Date Groups": "Groupes par date",
+  "Day": "Jour",
+  "Daylight": "Lumière du jour",
+  "Decrease Brush Feather": "Réduire le contour progressif du pinceau",
+  "Decrease Brush Size": "Réduire la taille du pinceau",
+  "Deep Sky": "Ciel profond",
+  "Defringe": "Supprimer les franges",
+  "Deghost Amount": "Quantité de suppression des images fantômes",
+  "Dehaze": "Correction du voile",
+  "Delete": "Supprimer",
+  "Delete (⌫)": "Supprimer (⌫)",
+  "Delete Album": "Supprimer l'album",
+  "Delete All Masks": "Supprimer tous les masques",
+  "Delete Color Label Set": "Supprimer le jeu d'étiquettes de couleur",
+  "Delete Component": "Supprimer le composant",
+  "Delete Export Preset": "Supprimer le préréglage d'exportation",
+  "Delete Filter Preset": "Supprimer le préréglage de filtre",
+  "Delete Imported Profile": "Supprimer le profil importé",
+  "Delete Keyword": "Supprimer le mot-clé",
+  "Delete Keyword Set": "Supprimer le jeu de mots-clés",
+  "Delete Mask": "Supprimer le masque",
+  "Delete Metadata Preset": "Supprimer le préréglage de métadonnées",
+  "Delete Permanently": "Supprimer définitivement",
+  "Delete Photo": "Supprimer la photo",
+  "Delete Photos": "Supprimer les photos",
+  "Delete Point Color": "Supprimer la couleur ponctuelle",
+  "Delete Point Color Sample": "Supprimer l'échantillon de couleur ponctuelle",
+  "Delete Point Curve Preset": "Supprimer le préréglage de courbe de points",
+  "Delete Preset": "Supprimer le préréglage",
+  "Delete Red Eye": "Supprimer les yeux rouges",
+  "Delete Red Eye Correction": "Supprimer la correction des yeux rouges",
+  "Delete Spot": "Supprimer la tache",
+  "Delete Version": "Supprimer la version",
+  "Delete all": "Tout supprimer",
+  "Delete all spots": "Supprimer toutes les taches",
+  "Delete mask": "Supprimer le masque",
+  "Delete them": "Les supprimer",
+  "Density": "Densité",
+  "Depth Range": "Plage de profondeur",
+  "Descending": "Décroissant",
+  "Describe": "Décrire",
+  "Describe what to keep": "Décrire ce qu'il faut conserver",
+  "Describe what to leave out": "Décrire ce qu'il faut exclure",
+  "Describe what to select": "Décrire ce qu'il faut sélectionner",
+  "Describe…": "Décrire…",
+  "Deselect": "Désélectionner",
+  "Deselect All": "Tout désélectionner",
+  "Desert Heat": "Chaleur du désert",
+  "Desert Warmth": "Douceur du désert",
+  "Desktop": "Bureau",
+  "Detail": "Détail",
+  "Detail (D)": "Détail (D)",
+  "Details": "Détails",
+  "Diagonal": "Diagonale",
+  "Discard Preview Cache": "Supprimer le cache des aperçus",
+  "Display P3": "Display P3",
+  "Display name": "Nom affiché",
+  "Display theme": "Thème d'affichage",
+  "Distortion": "Distorsion",
+  "Document properties…": "Propriétés du document…",
+  "Don't enlarge": "Ne pas agrandir",
+  "Done": "Terminé",
+  "Download": "Télécharger",
+  "Download AI Mask Model": "Télécharger le modèle de masques IA",
+  "Download the SAM 3 Model?": "Télécharger le modèle SAM 3 ?",
+  "Downloads": "Téléchargements",
+  "Drag along the horizon; double-click for Auto": "Faites glisser le long de l'horizon ; double-cliquez pour Auto",
+  "Drag over an eye on the photo; the pupil inside is found automatically.": "Faites glisser sur un œil de la photo ; la pupille est détectée automatiquement.",
+  "Draw Guides": "Tracer des repères",
+  "Duplicate": "Dupliquer",
+  "Duplicate Component": "Dupliquer le composant",
+  "Duplicate Mask": "Dupliquer le masque",
+  "Duplicate and Invert Mask": "Dupliquer et inverser le masque",
+  "Each / starts a folder level; tags are filled in per photo (a level with missing metadata is \"unknown\").": "Chaque / démarre un niveau de dossier ; les balises sont remplies pour chaque photo (un niveau sans métadonnées devient \"unknown\").",
+  "Edge": "Bord",
+  "Edit": "Modifier",
+  "Edit (E)": "Modifier (E)",
+  "Edit Capture Time": "Modifier l'heure de prise de vue",
+  "Edit Capture Time…": "Modifier l'heure de prise de vue…",
+  "Edit Color Label Names": "Modifier les noms des étiquettes de couleur",
+  "Edit Color Label Names…": "Modifier les noms des étiquettes de couleur…",
+  "Edit Copy for External Editor": "Modifier une copie pour l'éditeur externe",
+  "Edit Date": "Date de modification",
+  "Edit Info": "Modifier les informations",
+  "Edit Label Names": "Modifier les noms des étiquettes",
+  "Edit Label Names…": "Modifier les noms des étiquettes…",
+  "Edit Mask": "Modifier le masque",
+  "Edit Mask Component": "Modifier le composant du masque",
+  "Edit Sections": "Modifier les sections",
+  "Edit Smart Album": "Modifier l'album intelligent",
+  "Edit Smart Album…": "Modifier l'album intelligent…",
+  "Edit Spot": "Modifier la tache",
+  "Edit in External Editor": "Modifier dans l'éditeur externe",
+  "Edit settings copied": "Réglages de retouche copiés",
+  "Edited": "Retouchée",
+  "Edited or not": "Retouchées ou non",
+  "Editing": "Retouche",
+  "Effect": "Effet",
+  "Effects": "Effets",
+  "Empty Recently Deleted": "Vider Supprimées récemment",
+  "Enable Lens Corrections": "Activer les corrections d'objectif",
+  "Enable Profile Corrections": "Activer les corrections de profil",
+  "End Interaction": "Terminer l'interaction",
+  "English": "Anglais",
+  "Enter Full Screen": "Passer en plein écran",
+  "Enter a date as YYYY-MM-DD HH:MM:SS": "Saisissez une date au format AAAA-MM-JJ HH:MM:SS",
+  "Erase": "Effacer",
+  "Every EXIF, GPS and XMP field in the file": "Tous les champs EXIF, GPS et XMP du fichier",
+  "Existing previews": "Aperçus existants",
+  "Exit": "Quitter",
+  "Expand": "Développer",
+  "Expand All Stacks": "Développer toutes les piles",
+  "Expand Stack": "Développer la pile",
+  "Expand/Collapse Stack": "Développer/réduire la pile",
+  "Export": "Exporter",
+  "Export Album with Preset": "Exporter l'album avec un préréglage",
+  "Export Album…": "Exporter l'album…",
+  "Export As…": "Exporter sous…",
+  "Export Group…": "Exporter le groupe…",
+  "Export Now": "Exporter maintenant",
+  "Export Point Curve Presets": "Exporter les préréglages de courbe de points",
+  "Export Point Curve Presets…": "Exporter les préréglages de courbe de points…",
+  "Export Presets": "Exporter les préréglages",
+  "Export Presets…": "Exporter les préréglages…",
+  "Export User Presets…": "Exporter les préréglages utilisateur…",
+  "Export stopped unexpectedly": "L'exportation s'est arrêtée de façon inattendue",
+  "Export with Preset": "Exporter avec un préréglage",
+  "Export with Previous": "Exporter avec les réglages précédents",
+  "Exporting": "Exportation en cours",
+  "Export…": "Exporter…",
+  "Exposure": "Exposition",
+  "Exposure (shutter · aperture · ISO)": "Exposition (vitesse · ouverture · ISO)",
+  "Extended Description": "Description étendue",
+  "External Editor": "Éditeur externe",
+  "Face Boxes": "Cadres de visages",
+  "Face boxes": "Cadres de visages",
+  "Face names written to XMP by Lightroom and other apps show up here.": "Les noms de visages écrits dans XMP par Lightroom et d'autres applications apparaissent ici.",
+  "Faded Matte": "Mat délavé",
+  "Faded Slide": "Diapositive délavée",
+  "Faded Urban": "Urbain délavé",
+  "Favorite Preset": "Préréglage favori",
+  "Favorite Profile": "Profil favori",
+  "Favorites": "Favoris",
+  "Feather": "Contour progressif",
+  "File": "Fichier",
+  "File & date": "Fichier et date",
+  "File Format": "Format de fichier",
+  "File Name": "Nom de fichier",
+  "File Path": "Chemin du fichier",
+  "File Size": "Taille du fichier",
+  "File Type": "Type de fichier",
+  "File name": "Nom de fichier",
+  "File types:": "Types de fichiers :",
+  "Filename": "Nom de fichier",
+  "Fill": "Remplir",
+  "Fill Edges": "Remplir les bords",
+  "Film": "Pellicule",
+  "Filmstrip": "Pellicule",
+  "Filmstrip (/)": "Pellicule (/)",
+  "Filter": "Filtre",
+  "Filter Bar": "Barre de filtres",
+  "Filter Presets": "Préréglages de filtre",
+  "Filter bar": "Barre de filtres",
+  "Filter fields": "Champs de filtre",
+  "Find Dust Spots": "Rechercher les taches de poussière",
+  "Find Missing Photos": "Rechercher les photos manquantes",
+  "Find Missing Photos…": "Rechercher les photos manquantes…",
+  "Find Similar Photos": "Rechercher des photos similaires",
+  "Find tools and commands…": "Rechercher des outils et des commandes…",
+  "Find…": "Rechercher…",
+  "First": "Première",
+  "First commit": "Premier commit",
+  "Fit": "Ajuster",
+  "Fit (F)": "Ajuster (F)",
+  "Fit on Screen": "Ajuster à l'écran",
+  "Fit to width": "Ajuster à la largeur",
+  "Fit visible": "Ajuster à la zone visible",
+  "Five stars": "Cinq étoiles",
+  "Fixed keys": "Touches fixes",
+  "Flag": "Drapeau",
+  "Flag as Pick": "Marquer comme sélectionnée",
+  "Flag as Reject": "Marquer comme rejetée",
+  "Flagged as Pick": "Marquée comme sélectionnée",
+  "Flagged as Reject": "Marquée comme rejetée",
+  "Flash": "Flash",
+  "Flip H": "Miroir H",
+  "Flip Horizontal": "Retourner horizontalement",
+  "Flip Overlay (⇧O)": "Retourner l'incrustation (⇧O)",
+  "Flip V": "Miroir V",
+  "Flip Vertical": "Retourner verticalement",
+  "Flow": "Flux",
+  "Fluorescent": "Fluorescent",
+  "Focal Length": "Distance focale",
+  "Focal length": "Distance focale",
+  "Focus (assisted culling)": "Mise au point (tri assisté)",
+  "Folder": "Dossier",
+  "Folder name (renamed on disk; its photos follow)": "Nom du dossier (renommé sur le disque ; ses photos suivent)",
+  "Folders": "Dossiers",
+  "Folders and {date} use the capture time; a photo without one uses today's date.": "Les dossiers et {date} utilisent l'heure de prise de vue ; une photo qui n'en a pas utilise la date du jour.",
+  "Food": "Nourriture",
+  "Forget Unchanged Local Photos": "Oublier les photos locales inchangées",
+  "Forget unchanged photos": "Oublier les photos inchangées",
+  "Form fields panel": "Panneau des champs de formulaire",
+  "Format": "Format",
+  "Forward": "Avancer",
+  "Frame time": "Durée d'image",
+  "Frame update": "Mise à jour de l'image",
+  "Free": "Libre",
+  "Fresh & Bright": "Frais et lumineux",
+  "Friday": "Vendredi",
+  "Full": "Complet",
+  "Full Screen Preview": "Aperçu en plein écran",
+  "Full screen mode": "Mode plein écran",
+  "Full size": "Taille complète",
+  "GPS Track Log": "Trace GPS",
+  "GPU Rendering": "Rendu GPU",
+  "GPU rendering": "Rendu GPU",
+  "General": "Général",
+  "Generated demo photo": "Photo de démonstration générée",
+  "Geometry": "Géométrie",
+  "Get Develop Settings": "Obtenir les réglages de développement",
+  "Global Hue": "Teinte globale",
+  "Global Luminance": "Luminance globale",
+  "Global Saturation": "Saturation globale",
+  "Glossy": "Brillant",
+  "Go to History Step": "Aller à l'étape d'historique",
+  "Golden": "Doré",
+  "Golden Glow": "Lueur dorée",
+  "Golden Hour": "Heure dorée",
+  "Grab bag": "Liste de noms",
+  "Grain": "Grain",
+  "Graphic": "Graphique",
+  "Green": "Vert",
+  "Green Amount": "Quantité de vert",
+  "Green Hue": "Teinte verte",
+  "Green Hue High": "Teinte verte haute",
+  "Green Hue Low": "Teinte verte basse",
+  "Green Luminance": "Luminance verte",
+  "Green Primary": "Primaire vert",
+  "Green Saturation": "Saturation verte",
+  "Green channel": "Canal vert",
+  "Green label": "Étiquette verte",
+  "Grid": "Grille",
+  "Grid Info": "Informations de la grille",
+  "Gritty Street": "Rue brute",
+  "Group": "Groupe",
+  "Group by Date: Automatic": "Regrouper par date : automatique",
+  "Group by Day": "Regrouper par jour",
+  "Group by Month": "Regrouper par mois",
+  "Group by Year": "Regrouper par année",
+  "Group by date": "Regrouper par date",
+  "Group into Stack": "Regrouper en pile",
+  "Group name": "Nom du groupe",
+  "Guided": "Guidé",
+  "Guided Upright": "Upright guidé",
+  "Guided Upright Guides": "Repères de l'Upright guidé",
+  "HDR Merge": "Fusion HDR",
+  "HDR Merge Preview": "Aperçu de la fusion HDR",
+  "HDR Panorama Merge": "Fusion de panorama HDR",
+  "HDR Panorama Merge Preview": "Aperçu de la fusion de panorama HDR",
+  "HDR Panorama with Last Settings": "Panorama HDR avec les derniers réglages",
+  "HDR Panoramas": "Panoramas HDR",
+  "HDR Panorama…": "Panorama HDR…",
+  "HDR panorama": "Panorama HDR",
+  "HDR panoramas": "panoramas HDR",
+  "HDR with Last Settings": "HDR avec les derniers réglages",
+  "HDR…": "HDR…",
+  "Has Edits": "Avec retouches",
+  "Has GPS": "Avec GPS",
+  "Heal": "Correction",
+  "Heal the small, soft dark spots sensor dust leaves on smooth areas": "Corriger les petites taches sombres et floues que la poussière du capteur laisse sur les zones lisses",
+  "Height": "Hauteur",
+  "Height (px)": "Hauteur (px)",
+  "Help": "Aide",
+  "Hide LightCraft": "Masquer LightCraft",
+  "Hide Mask": "Masquer le masque",
+  "Hide Others": "Masquer les autres",
+  "Hides this shortcut only; the folder and its photos stay as they are": "Masque uniquement ce raccourci ; le dossier et ses photos restent intacts",
+  "High": "Élevé",
+  "High Contrast B&W": "N&B à fort contraste",
+  "Highlight": "Hautes lumières",
+  "Highlights": "Hautes lumières",
+  "Highlights Hue": "Teinte des hautes lumières",
+  "Highlights Luminance": "Luminance des hautes lumières",
+  "Highlights Saturation": "Saturation des hautes lumières",
+  "Highlights split": "Séparation des hautes lumières",
+  "Histogram": "Histogramme",
+  "History": "Historique",
+  "History & Activity (Y)": "Historique et activité (Y)",
+  "Home": "Dossier personnel",
+  "Horizontal": "Horizontal",
+  "Horizontal text": "Texte horizontal",
+  "Hours": "Heures",
+  "How to install the model": "Comment installer le modèle",
+  "Hue": "Teinte",
+  "Hue Range": "Plage de teintes",
+  "ISO Speed": "Sensibilité ISO",
+  "ISO speed": "Sensibilité ISO",
+  "If file exists": "Si le fichier existe",
+  "Image": "Image",
+  "Import": "Importer",
+  "Import Date": "Date d'importation",
+  "Import Lightroom Catalog": "Importer un catalogue Lightroom",
+  "Import Lightroom Catalog…": "Importer un catalogue Lightroom…",
+  "Import Photos": "Importer des photos",
+  "Import Photos…": "Importer des photos…",
+  "Import Point Curve Presets": "Importer des préréglages de courbe de points",
+  "Import Point Curve Presets…": "Importer des préréglages de courbe de points…",
+  "Import Presets": "Importer des préréglages",
+  "Import Presets…": "Importer des préréglages…",
+  "Import Profiles": "Importer des profils",
+  "Import Profiles & Presets…": "Importer des profils et des préréglages…",
+  "Import as new": "Importer comme nouvelles",
+  "Import from Device": "Importer depuis un appareil",
+  "Import from Folder…": "Importer depuis un dossier…",
+  "Import photos with File → Import Photos… (Cmd+Shift+I), or drop them here": "Importez des photos avec Fichier → Importer des photos… (Cmd+Maj+I) ou déposez-les ici",
+  "Imported": "Importées",
+  "Imported Photos": "Photos importées",
+  "Importing": "Importation en cours",
+  "Importing Lightroom Catalog": "Importation du catalogue Lightroom",
+  "Importing scans the source for photos; it doesn't add the folder to Local (use Local → Browse Folder… to work in a folder without importing).": "L'importation recherche des photos dans la source ; elle n'ajoute pas le dossier à Local (utilisez Local → Parcourir le dossier… pour travailler dans un dossier sans importer).",
+  "In Photo Grid and Square Grid: Flag as Pick and advance": "Dans la grille de photos et la grille carrée : marquer comme sélectionnée et avancer",
+  "In Photo Grid and Square Grid: expand or collapse the stack": "Dans la grille de photos et la grille carrée : développer ou réduire la pile",
+  "In Recently Deleted": "Dans Supprimées récemment",
+  "In library": "Dans la bibliothèque",
+  "In memory — nothing is saved": "En mémoire : rien n'est enregistré",
+  "In use": "Utilisé",
+  "In-memory session: these settings last until LightCraft quits.": "Session en mémoire : ces réglages durent jusqu'à la fermeture de LightCraft.",
+  "Include subfolders": "Inclure les sous-dossiers",
+  "Increase Brush Feather": "Augmenter le contour progressif du pinceau",
+  "Increase Brush Size": "Augmenter la taille du pinceau",
+  "Info": "Infos",
+  "Info (I)": "Infos (I)",
+  "Info Overlay Off": "Incrustation d'informations désactivée",
+  "Info Overlay: Exposure": "Incrustation d'informations : exposition",
+  "Info Overlay: File": "Incrustation d'informations : fichier",
+  "Info overlay": "Incrustation d'informations",
+  "Insert at the cursor": "Insérer au curseur",
+  "Inspect Lightroom Catalog": "Inspecter le catalogue Lightroom",
+  "Inspect Photo": "Inspecter la photo",
+  "Inspecting Lightroom Catalog": "Inspection du catalogue Lightroom",
+  "Install the SAM 3 Model": "Installer le modèle SAM 3",
+  "Instant ’70s": "Instantané années 70",
+  "Interface": "Interface",
+  "Interface language": "Langue de l'interface",
+  "Intersect": "Intersecter",
+  "Intersect with": "Intersecter avec",
+  "Into one folder": "Dans un seul dossier",
+  "Invert": "Inverser",
+  "Invert Component": "Inverser le composant",
+  "Invert Mask": "Inverser le masque",
+  "JPEG (Large)": "JPEG (grand)",
+  "JPEG (Small)": "JPEG (petit)",
+  "Join the ArtCraft Discord": "Rejoindre le Discord d'ArtCraft",
+  "Join the ArtCraft Discord…": "Rejoindre le Discord d'ArtCraft…",
+  "Join the ArtCraft community on Discord": "Rejoindre la communauté ArtCraft sur Discord",
+  "Keep in Local": "Conserver dans Local",
+  "Keep it on a drive with room: smart previews are about 1 MB per photo. The thumbnail cache stays in the library.": "Choisissez un disque avec de la place : les aperçus dynamiques font environ 1 Mo par photo. Le cache des miniatures reste dans la bibliothèque.",
+  "Keyboard Shortcuts": "Raccourcis clavier",
+  "Keyboard shortcuts": "Raccourcis clavier",
+  "Keyword": "Mot-clé",
+  "Keyword Painter": "Pinceau de mots-clés",
+  "Keyword Set": "Jeu de mots-clés",
+  "Keyword Sets": "Jeux de mots-clés",
+  "Keyword Suggestions": "Suggestions de mots-clés",
+  "Keyword to paint": "Mot-clé à appliquer",
+  "Keywords": "Mots-clés",
+  "Keywords (K)": "Mots-clés (K)",
+  "Keywords you add appear here; ⌥1–⌥9 apply them.": "Les mots-clés que vous ajoutez apparaissent ici ; ⌥1–⌥9 les appliquent.",
+  "Label": "Étiquette",
+  "Landscape": "Paysage",
+  "Language": "Langue",
+  "Last": "Dernière",
+  "Last GPU fallback": "Dernier repli du GPU",
+  "Last commit": "Dernier commit",
+  "Last loupe render": "Dernier rendu de la loupe",
+  "Last view": "Dernière vue",
+  "Lateral Chromatic Aberration": "Aberration chromatique latérale",
+  "Layer": "Calque",
+  "Layers": "Calques",
+  "Leave them": "Les laisser",
+  "Lens": "Objectif",
+  "Lens Blur": "Flou de l'objectif",
+  "Lens Corrections": "Corrections de l'objectif",
+  "Level": "Niveau",
+  "Library": "Bibliothèque",
+  "Library Info": "Informations sur la bibliothèque",
+  "Library Originals": "Originaux de la bibliothèque",
+  "Library Preferences": "Préférences de la bibliothèque",
+  "Library State": "État de la bibliothèque",
+  "Library saved": "Bibliothèque enregistrée",
+  "Licence:": "Licence :",
+  "Light": "Lumière",
+  "LightCraft Default": "Valeurs par défaut de LightCraft",
+  "LightCraft Help": "Aide de LightCraft",
+  "LightCraft Preset": "Préréglage LightCraft",
+  "LightCraft Presets": "Préréglages LightCraft",
+  "LightCraft Website": "Site web de LightCraft",
+  "LightCraft could not start": "LightCraft n'a pas pu démarrer",
+  "LightCraft couldn't find where to keep your library.": "LightCraft n'a pas trouvé où conserver votre bibliothèque.",
+  "LightCraft couldn't open the library at": "LightCraft n'a pas pu ouvrir la bibliothèque à l'emplacement",
+  "LightCraft on GitHub": "LightCraft sur GitHub",
+  "LightCraft website": "Site web de LightCraft",
+  "LightCraft — Second Window": "LightCraft : deuxième fenêtre",
+  "Lightroom Classic Catalog": "Catalogue Lightroom Classic",
+  "Lightroom import cancelled": "Importation Lightroom annulée",
+  "Lightroom inspection cancelled": "Inspection Lightroom annulée",
+  "Lights": "Tons clairs",
+  "Limit file size (KB, 0 = off)": "Limiter la taille du fichier (Ko, 0 = désactivé)",
+  "Line delta": "Différence de lignes",
+  "Linear": "Linéaire",
+  "Linear Gradient": "Dégradé linéaire",
+  "Lines +/−": "Lignes +/−",
+  "Lines added": "Lignes ajoutées",
+  "Lines deleted": "Lignes supprimées",
+  "List Albums": "Lister les albums",
+  "List Develop Controls": "Lister les commandes de développement",
+  "List History": "Lister l'historique",
+  "List Presets": "Lister les préréglages",
+  "List Profiles": "Lister les profils",
+  "List this folder in Local from now on": "Afficher désormais ce dossier dans Local",
+  "Local": "Local",
+  "Local folders": "Dossiers locaux",
+  "Local library — no cloud account needed": "Bibliothèque locale : aucun compte cloud nécessaire",
+  "Locate Missing File…": "Localiser le fichier manquant…",
+  "Locate Photo": "Localiser la photo",
+  "Location": "Lieu",
+  "Lock": "Verrouiller",
+  "Lock Crop Aspect": "Verrouiller le format du recadrage",
+  "Locked": "Verrouillée",
+  "Long Edge": "Grand côté",
+  "Looking for photos…": "Recherche de photos…",
+  "Lossless": "Sans perte",
+  "Low": "Faible",
+  "Luminance": "Luminance",
+  "Luminance Range": "Plage de luminance",
+  "Lush Greens": "Verts luxuriants",
+  "Magenta": "Magenta",
+  "Magenta Hue": "Teinte magenta",
+  "Magenta Luminance": "Luminance magenta",
+  "Magenta Saturation": "Saturation magenta",
+  "Make Candidate the Select": "Faire de la candidate la sélection",
+  "Manual": "Manuel",
+  "Marquee zoom": "Zoom par rectangle",
+  "Mask Adjustment": "Réglage du masque",
+  "Masking": "Masquage",
+  "Masking (M)": "Masquage (M)",
+  "Masks": "Masques",
+  "Match": "Correspondre à",
+  "Match Total Exposures": "Égaliser les expositions totales",
+  "Matte": "Mat",
+  "Matte Soft": "Mat doux",
+  "Med": "Moyen",
+  "Medium Contrast": "Contraste moyen",
+  "Megapixels": "Mégapixels",
+  "Memory Budget": "Budget mémoire",
+  "Memory Usage": "Utilisation de la mémoire",
+  "Memory budget": "Budget mémoire",
+  "Memory for caches": "Mémoire pour les caches",
+  "Menu": "Menu",
+  "Merge": "Fusionner",
+  "Merge Keywords": "Fusionner les mots-clés",
+  "Merge into…": "Fusionner dans…",
+  "Merged": "Fusionnées",
+  "Merged PRs": "PR fusionnées",
+  "Merging…": "Fusion en cours…",
+  "Meta's terms, not LightCraft's. Downloading it means accepting them.": "Conditions de Meta, pas de LightCraft. Le télécharger implique de les accepter.",
+  "Metadata": "Métadonnées",
+  "Metadata Preset": "Préréglage de métadonnées",
+  "Metadata Presets": "Préréglages de métadonnées",
+  "Metadata preset": "Préréglage de métadonnées",
+  "Midpoint": "Point central",
+  "Midtones": "Tons moyens",
+  "Midtones Hue": "Teinte des tons moyens",
+  "Midtones Luminance": "Luminance des tons moyens",
+  "Midtones Saturation": "Saturation des tons moyens",
+  "Midtones split": "Séparation des tons moyens",
+  "Minimize": "Réduire",
+  "Missing Photos": "Photos manquantes",
+  "Missing metadata ({camera}, {title}…) leaves an empty gap; a name that comes out empty keeps the original name.": "Des métadonnées manquantes ({camera}, {title}…) laissent un vide ; un nom qui se retrouve vide conserve le nom d'origine.",
+  "Misty Morning": "Matin brumeux",
+  "Mode": "Mode",
+  "Model": "Modèle",
+  "Models": "Modèles",
+  "Modified Date": "Date de modification",
+  "Monday": "Lundi",
+  "Mono Red Filter": "Mono filtre rouge",
+  "Mono Rich": "Mono riche",
+  "Mono Soft": "Mono doux",
+  "Monochrome": "Monochrome",
+  "Month": "Mois",
+  "Moody": "Atmosphérique",
+  "Moody Portrait": "Portrait atmosphérique",
+  "More": "Plus",
+  "More preset options": "Plus d'options de préréglages",
+  "Move": "Déplacer",
+  "Move Album": "Déplacer l'album",
+  "Move Down": "Descendre",
+  "Move Down in Stack": "Descendre dans la pile",
+  "Move Folder": "Déplacer le dossier",
+  "Move Folder To…": "Déplacer le dossier vers…",
+  "Move Mask": "Déplacer le masque",
+  "Move Preset to Group": "Déplacer le préréglage vers un groupe",
+  "Move Preset to New Group": "Déplacer le préréglage vers un nouveau groupe",
+  "Move Up": "Monter",
+  "Move Up in Stack": "Monter dans la pile",
+  "Move in Stack": "Déplacer dans la pile",
+  "Move the files (into the library's Originals/, or a folder you choose), removing them from the source": "Déplacer les fichiers (dans Originals/ de la bibliothèque ou dans un dossier de votre choix) en les retirant de la source",
+  "Move them": "Les déplacer",
+  "Move to": "Déplacer vers",
+  "Move to Group": "Déplacer vers un groupe",
+  "Move: the files are moved to the folder below; each original (and its XMP sidecar) is removed from the source only after its copy is verified. Duplicates and files that fail stay where they are.": "Déplacer : les fichiers sont déplacés dans le dossier ci-dessous ; chaque original (et son fichier annexe XMP) n'est retiré de la source qu'après vérification de sa copie. Les doublons et les fichiers en échec restent à leur place.",
+  "Moves every photo imported from this disk to Recently Deleted; no file is touched": "Déplace toutes les photos importées depuis ce disque vers Supprimées récemment ; aucun fichier n'est touché",
+  "Moves the photos imported from this folder to Recently Deleted; no file is touched": "Déplace les photos importées depuis ce dossier vers Supprimées récemment ; aucun fichier n'est touché",
+  "Muted": "Sourdine",
+  "Muted Film": "Film atténué",
+  "My Photos": "Mes photos",
+  "My Photos Panel": "Panneau Mes photos",
+  "Name": "Nom",
+  "Name (A–Z)": "Nom (A–Z)",
+  "Name of the folder the original is in": "Nom du dossier contenant l'original",
+  "Named": "Nommées",
+  "Named People": "Personnes nommées",
+  "Names appear in the label menu, the filter bar and the Info panel, and are written to XMP. Empty = the colour's name.": "Les noms apparaissent dans le menu des étiquettes, la barre de filtres et le panneau Infos, et sont écrits dans XMP. Vide = le nom de la couleur.",
+  "Navigator": "Navigateur",
+  "Needs Work": "À retravailler",
+  "Neon Dusk": "Crépuscule néon",
+  "Neon Night": "Nuit néon",
+  "Nested group": "Groupe imbriqué",
+  "Neutral": "Neutre",
+  "Never": "Jamais",
+  "New": "Nouveau",
+  "New Album": "Nouvel album",
+  "New Album…": "Nouvel album…",
+  "New Folder…": "Nouveau dossier…",
+  "New Group…": "Nouveau groupe…",
+  "New Smart Album": "Nouvel album intelligent",
+  "New Smart Album from Filter…": "Nouvel album intelligent à partir du filtre…",
+  "New Smart Album…": "Nouvel album intelligent…",
+  "New album": "Nouvel album",
+  "New album…": "Nouvel album…",
+  "New blank PDF": "Nouveau PDF vierge",
+  "New name": "Nouveau nom",
+  "New time": "Nouvelle heure",
+  "New…": "Nouveau…",
+  "Next Photo": "Photo suivante",
+  "Night Blue": "Bleu nuit",
+  "No": "Non",
+  "No Camera or Card Found": "Aucun appareil photo ni carte trouvé",
+  "No Date Groups": "Aucun groupe par date",
+  "No Stars": "Aucune étoile",
+  "No Tool": "Aucun outil",
+  "No automatic versions.": "Aucune version automatique.",
+  "No camera": "Aucun appareil photo",
+  "No contributor data was built into this copy.": "Aucune donnée de contributeurs n'est incluse dans cette copie.",
+  "No date": "Sans date",
+  "No dust spots found": "Aucune tache de poussière trouvée",
+  "No edits yet.": "Aucune retouche pour l'instant.",
+  "No exposure information": "Aucune information d'exposition",
+  "No filter presets yet": "Aucun préréglage de filtre pour l'instant",
+  "No lens data embedded in this file (DNG lens opcodes only).": "Aucune donnée d'objectif intégrée à ce fichier (opcodes d'objectif DNG uniquement).",
+  "No masks yet. Choose a mask type above.": "Aucun masque pour l'instant. Choisissez un type de masque ci-dessus.",
+  "No matching commands": "Aucune commande correspondante",
+  "No matching photos": "Aucune photo correspondante",
+  "No metadata found": "Aucune métadonnée trouvée",
+  "No model credits were built into this copy.": "Aucun crédit de modèle n'est inclus dans cette copie.",
+  "No named people in these photos": "Aucune personne nommée dans ces photos",
+  "No named people yet": "Aucune personne nommée pour l'instant",
+  "No new presets": "Aucun nouveau préréglage",
+  "No photo selected": "Aucune photo sélectionnée",
+  "No photos": "Aucune photo",
+  "No photos found": "Aucune photo trouvée",
+  "No photos in this folder": "Aucune photo dans ce dossier",
+  "No photos match the active filters": "Aucune photo ne correspond aux filtres actifs",
+  "No photos match the filters (View → Clear Filters)": "Aucune photo ne correspond aux filtres (Affichage → Effacer les filtres)",
+  "No raw photos yet: cameras appear here once their photos are in the library.": "Aucune photo RAW pour l'instant : les appareils photo apparaîtront ici dès que leurs photos seront dans la bibliothèque.",
+  "No reference photo": "Aucune photo de référence",
+  "No usable GPU found: rendering on the CPU": "Aucun GPU utilisable trouvé : rendu sur le processeur",
+  "No versions yet. Create one to keep this look.": "Aucune version pour l'instant. Créez-en une pour conserver ce rendu.",
+  "Noise": "Bruit",
+  "Noise Reduction": "Réduction du bruit",
+  "Non-raw photos": "Photos non RAW",
+  "None": "Aucun",
+  "Not Now": "Pas maintenant",
+  "Nothing to compare": "Rien à comparer",
+  "Nothing to survey": "Rien à afficher dans la vue multiple",
+  "Nudge Develop Value": "Ajuster légèrement la valeur de développement",
+  "OK": "OK",
+  "Object": "Objet",
+  "Object Mask": "Masque d'objet",
+  "Object and Describe masks use SAM 3, Meta's segmentation model. It isn't part of LightCraft, and everything else works without it.": "Les masques Objet et Décrire utilisent SAM 3, le modèle de segmentation de Meta. Il ne fait pas partie de LightCraft, et tout le reste fonctionne sans lui.",
+  "October 2026": "octobre 2026",
+  "Off": "Désactivé",
+  "Offset X": "Décalage X",
+  "Offset Y": "Décalage Y",
+  "Opacity": "Opacité",
+  "Opacity (%)": "Opacité (%)",
+  "Open Library": "Ouvrir la bibliothèque",
+  "Open Library…": "Ouvrir la bibliothèque…",
+  "Open in": "Ouvrir dans",
+  "Open in Detail": "Ouvrir dans Détail",
+  "Open the place in OpenStreetMap": "Ouvrir le lieu dans OpenStreetMap",
+  "Open…": "Ouvrir…",
+  "Optics": "Optique",
+  "Optimize Library": "Optimiser la bibliothèque",
+  "Optional name": "Nom facultatif",
+  "Options": "Options",
+  "Orange": "Orange",
+  "Orange Hue": "Teinte orange",
+  "Orange Luminance": "Luminance orange",
+  "Orange Saturation": "Saturation orange",
+  "Orientation": "Orientation",
+  "Original": "Original",
+  "Original + Settings": "Original + réglages",
+  "Original extension without the dot": "Extension d'origine sans le point",
+  "Original file name without its extension": "Nom du fichier d'origine sans son extension",
+  "Original files": "Fichiers originaux",
+  "Original offline · editing the smart preview": "Original hors ligne · modification de l'aperçu dynamique",
+  "Original offline · no smart preview": "Original hors ligne · aucun aperçu dynamique",
+  "Originals": "Originaux",
+  "Other images (JPEG, PNG, TIFF, HEIC…)": "Autres images (JPEG, PNG, TIFF, HEIC…)",
+  "Overlay": "Incrustation",
+  "Overwrite": "Écraser",
+  "Pages": "Pages",
+  "Paint": "Peindre",
+  "Paint only areas like the one under the brush": "Peindre uniquement les zones similaires à celle sous le pinceau",
+  "Paint over a distraction on the photo to remove it.": "Peignez sur un élément gênant de la photo pour le supprimer.",
+  "Paint overlay": "Incrustation de peinture",
+  "Panorama": "Panorama",
+  "Panorama Merge": "Fusion de panorama",
+  "Panorama Merge Preview": "Aperçu de la fusion de panorama",
+  "Panorama with Last Settings": "Panorama avec les derniers réglages",
+  "Panoramas": "Panoramas",
+  "Panorama…": "Panorama…",
+  "Parametric curve": "Courbe paramétrique",
+  "Paste": "Coller",
+  "Paste Edit Settings": "Coller les réglages de retouche",
+  "Paste Metadata": "Coller les métadonnées",
+  "Paste Selected Settings": "Coller les réglages sélectionnés",
+  "Paste Selected Settings…": "Coller les réglages sélectionnés…",
+  "Paste Settings": "Coller les réglages",
+  "Paste Settings from Previous": "Coller les réglages de la précédente",
+  "Paste from Previous": "Coller depuis la précédente",
+  "Paste pages": "Coller les pages",
+  "Pastel Haze": "Brume pastel",
+  "People": "Personnes",
+  "Percent": "Pourcentage",
+  "Percentage": "Pourcentage",
+  "Performance": "Performances",
+  "Person": "Personne",
+  "Perspective": "Perspective",
+  "Pet Eye": "Yeux d'animal",
+  "Pet Eye Catchlight": "Reflet dans les yeux d'animal",
+  "Photo": "Photo",
+  "Photo Grid": "Grille de photos",
+  "Photo Grid (G)": "Grille de photos (G)",
+  "Photo Merge": "Fusion de photos",
+  "Photo ▸ Edit in External Editor (⇧⌘E) renders a 16-bit TIFF copy, stacks it with the original and opens it here (an app name on macOS, a program path elsewhere).": "Photo → Modifier dans l'éditeur externe (⇧⌘E) génère une copie TIFF 16 bits, l'empile avec l'original et l'ouvre ici (un nom d'application sur macOS, un chemin de programme ailleurs).",
+  "Photos": "Photos",
+  "Photos per bracket (0 = auto)": "Photos par bracketing (0 = auto)",
+  "Photos seen in Local but never added or changed leave the catalog when their folder hasn't been browsed for this long (checked when the library opens). Files stay on disk; browsing the folder shows them again.": "Les photos vues dans Local mais jamais ajoutées ni modifiées quittent le catalogue lorsque leur dossier n'a pas été parcouru depuis cette durée (vérifié à l'ouverture de la bibliothèque). Les fichiers restent sur le disque ; parcourir le dossier les fait réapparaître.",
+  "Photos that arrive in this folder (tethering, a scanner, a sync app) are added as soon as they're complete.": "Les photos qui arrivent dans ce dossier (capture connectée, scanner, application de synchronisation) sont ajoutées dès qu'elles sont complètes.",
+  "Pick": "Sélectionnée",
+  "Pick Flag": "Drapeau de sélection",
+  "Pick a colour on the photo with the eyedropper.": "Choisissez une couleur sur la photo avec la pipette.",
+  "Pick the sharpest photo of each burst": "Choisir la photo la plus nette de chaque rafale",
+  "Picked": "Sélectionnée",
+  "Picks": "Sélectionnées",
+  "Pictures": "Images",
+  "Pixels": "Pixels",
+  "Point Color": "Couleur ponctuelle",
+  "Point Curve": "Courbe de points",
+  "Point Curve Presets": "Préréglages de courbe de points",
+  "Point curve": "Courbe de points",
+  "Portrait": "Portrait",
+  "Position": "Position",
+  "Preferences": "Préférences",
+  "Preferences…": "Préférences…",
+  "Prepare AI Masks": "Préparer les masques IA",
+  "Preset": "Préréglage",
+  "Preset name": "Nom du préréglage",
+  "Presets": "Préréglages",
+  "Presets & Profiles": "Préréglages et profils",
+  "Presets (Shift+P)": "Préréglages (Maj+P)",
+  "Presets and profiles": "Préréglages et profils",
+  "Presets ▾": "Préréglages ⌄",
+  "Press keys…": "Appuyez sur les touches…",
+  "Preview": "Aperçu",
+  "Preview Build Progress": "Progression de la génération des aperçus",
+  "Preview only": "Aperçu uniquement",
+  "Preview size": "Taille de l'aperçu",
+  "Previews": "Aperçus",
+  "Previous Photo": "Photo précédente",
+  "Print": "Imprimer",
+  "Print…": "Imprimer…",
+  "Profile": "Profil",
+  "Profile Browser": "Navigateur de profils",
+  "Profile Distortion": "Distorsion du profil",
+  "Profile Menu": "Menu des profils",
+  "Profile Vignetting": "Vignetage du profil",
+  "Profile:": "Profil :",
+  "Profiles": "Profils",
+  "Projection": "Projection",
+  "Proof copy created": "Copie d'épreuve créée",
+  "Properties": "Propriétés",
+  "Public domain": "Domaine public",
+  "Pupil Size": "Taille de la pupille",
+  "Purple": "Violet",
+  "Purple Amount": "Quantité de violet",
+  "Purple Hue": "Teinte violette",
+  "Purple Hue High": "Teinte violette haute",
+  "Purple Hue Low": "Teinte violette basse",
+  "Purple Luminance": "Luminance violette",
+  "Purple Saturation": "Saturation violette",
+  "Put the locations you removed from Local back (no files change)": "Remettre dans Local les emplacements que vous en avez retirés (aucun fichier n'est modifié)",
+  "Quality": "Qualité",
+  "Query Photos": "Interroger les photos",
+  "Quick Collection": "Collection rapide",
+  "Quick Develop": "Développement rapide",
+  "Quiet Green": "Vert calme",
+  "Quit": "Quitter",
+  "Quit Anyway": "Quitter quand même",
+  "Quit LightCraft": "Quitter LightCraft",
+  "Quit with unsaved changes?": "Quitter avec des modifications non enregistrées ?",
+  "RAW decoding": "Décodage RAW",
+  "Radial": "Radial",
+  "Radial Gradient": "Dégradé radial",
+  "Radius": "Rayon",
+  "Random": "Aléatoire",
+  "Range": "Plage",
+  "Rate ★": "Noter ★",
+  "Rate ★ and advance": "Noter ★ et avancer",
+  "Rate ★★": "Noter ★★",
+  "Rate ★★ and advance": "Noter ★★ et avancer",
+  "Rate ★★★": "Noter ★★★",
+  "Rate ★★★ and advance": "Noter ★★★ et avancer",
+  "Rate ★★★★": "Noter ★★★★",
+  "Rate ★★★★ and advance": "Noter ★★★★ et avancer",
+  "Rate ★★★★★": "Noter ★★★★★",
+  "Rate ★★★★★ and advance": "Noter ★★★★★ et avancer",
+  "Rating": "Note",
+  "Rating cleared": "Note effacée",
+  "Ratings & flags": "Notes et drapeaux",
+  "Raw": "RAW",
+  "Raw default": "Valeur par défaut RAW",
+  "Raw defaults": "Valeurs par défaut RAW",
+  "Raw files": "Fichiers RAW",
+  "Raw photos": "Photos RAW",
+  "Raw photos as DNG, with the edits embedded. Size, color and output options don't apply.": "Photos RAW au format DNG, avec les retouches intégrées. Les options de taille, de couleur et de sortie ne s'appliquent pas.",
+  "Read Metadata from File": "Lire les métadonnées du fichier",
+  "Read mode": "Mode lecture",
+  "Read the SAM License": "Lire la licence SAM",
+  "Reading": "Lecture en cours",
+  "Reading Lightroom catalog…": "Lecture du catalogue Lightroom…",
+  "Reading folder…": "Lecture du dossier…",
+  "Real name": "Nom réel",
+  "Recent": "Récents",
+  "Recent Keywords": "Mots-clés récents",
+  "Recently Added": "Ajoutées récemment",
+  "Recently Deleted": "Supprimées récemment",
+  "Red": "Rouge",
+  "Red Eye": "Yeux rouges",
+  "Red Hue": "Teinte rouge",
+  "Red Luminance": "Luminance rouge",
+  "Red Primary": "Primaire rouge",
+  "Red Saturation": "Saturation rouge",
+  "Red channel": "Canal rouge",
+  "Red label": "Étiquette rouge",
+  "Red/Cyan Fringe": "Frange rouge/cyan",
+  "Redo": "Rétablir",
+  "Reference": "Référence",
+  "Reference View": "Vue de référence",
+  "Reference the files where they are": "Référencer les fichiers sur place",
+  "Refine": "Affiner",
+  "Refine AI Mask Detail": "Affiner le détail du masque IA",
+  "Refine Edges": "Affiner les bords",
+  "Refine Mask Edges": "Affiner les bords du masque",
+  "Refine Saturation": "Affiner la saturation",
+  "Refining the mask's detail…": "Affinage du détail du masque…",
+  "Refresh Source": "Actualiser la source",
+  "Refresh Source (/)": "Actualiser la source (/)",
+  "Reject": "Rejeter",
+  "Reject below focus": "Rejeter en dessous de la netteté",
+  "Rejected": "Rejetée",
+  "Rejects": "Rejetées",
+  "Reliability": "Fiabilité",
+  "Relink Photo": "Relier à nouveau la photo",
+  "Reload Changed Files": "Recharger les fichiers modifiés",
+  "Reload from Disk": "Recharger depuis le disque",
+  "Remove": "Retirer",
+  "Remove (H)": "Supprimer (H)",
+  "Remove CA": "Supprimer l'AC",
+  "Remove Chromatic Aberration": "Supprimer l'aberration chromatique",
+  "Remove Disk from Library": "Retirer le disque de la bibliothèque",
+  "Remove Disk from Library…": "Retirer le disque de la bibliothèque…",
+  "Remove Face Box": "Retirer le cadre de visage",
+  "Remove Folder from Library": "Retirer le dossier de la bibliothèque",
+  "Remove a filter above, or choose Clear all": "Retirez un filtre ci-dessus ou choisissez Tout effacer",
+  "Remove from Album": "Retirer de l'album",
+  "Remove from Favorites": "Retirer des favoris",
+  "Remove from Library…": "Retirer de la bibliothèque…",
+  "Remove from Local": "Retirer de Local",
+  "Remove from Photo": "Retirer de la photo",
+  "Remove from Selected Photos": "Retirer des photos sélectionnées",
+  "Remove from Stack": "Retirer de la pile",
+  "Remove from Target Album": "Retirer de l'album cible",
+  "Remove from survey": "Retirer de la vue multiple",
+  "Remove location info": "Supprimer les informations de lieu",
+  "Remove shortcut": "Supprimer le raccourci",
+  "Remove this face box (undo with Edit ▸ Undo)": "Retirer ce cadre de visage (annuler avec Édition → Annuler)",
+  "Remove this filter": "Retirer ce filtre",
+  "Remove this group": "Retirer ce groupe",
+  "Remove this rule": "Retirer cette règle",
+  "Rename": "Renommer",
+  "Rename Album": "Renommer l'album",
+  "Rename Component": "Renommer le composant",
+  "Rename Folder": "Renommer le dossier",
+  "Rename Folder…": "Renommer le dossier…",
+  "Rename Keyword": "Renommer le mot-clé",
+  "Rename Keyword…": "Renommer le mot-clé…",
+  "Rename Mask": "Renommer le masque",
+  "Rename Photos": "Renommer les photos",
+  "Rename Photos…": "Renommer les photos…",
+  "Rename Preset": "Renommer le préréglage",
+  "Rename Preview": "Aperçu du renommage",
+  "Rename Template Tags": "Balises du modèle de renommage",
+  "Rename Version": "Renommer la version",
+  "Rename…": "Renommer…",
+  "Rendering": "Rendu",
+  "Rendering…": "Rendu en cours…",
+  "Reorder Masks": "Réorganiser les masques",
+  "Reset": "Réinitialiser",
+  "Reset All": "Tout réinitialiser",
+  "Reset All Curves": "Réinitialiser toutes les courbes",
+  "Reset All Keyboard Shortcuts": "Réinitialiser tous les raccourcis clavier",
+  "Reset Before to Import State": "Réinitialiser Avant à l'état d'importation",
+  "Reset Control": "Réinitialiser la commande",
+  "Reset Crop": "Réinitialiser le recadrage",
+  "Reset Edits": "Réinitialiser les retouches",
+  "Reset Parametric Curve": "Réinitialiser la courbe paramétrique",
+  "Reset Section": "Réinitialiser la section",
+  "Reset Tone Curve": "Réinitialiser la courbe des tonalités",
+  "Reset all curves: point curves (all channels) and parametric (double-click a channel to reset only that one)": "Réinitialiser toutes les courbes : courbes de points (tous les canaux) et paramétrique (double-cliquez sur un canal pour réinitialiser uniquement celui-ci)",
+  "Reset all edits (Cmd+Shift+R)": "Réinitialiser toutes les retouches (Cmd+Maj+R)",
+  "Reshuffle": "Mélanger à nouveau",
+  "Resize Face Box": "Redimensionner le cadre de visage",
+  "Resize to": "Redimensionner à",
+  "Resolution (ppi)": "Résolution (ppp)",
+  "Restore": "Restaurer",
+  "Restore (no shortcut)": "Restaurer (sans raccourci)",
+  "Restore Library from Backup…": "Restaurer la bibliothèque depuis une sauvegarde…",
+  "Restore Version": "Restaurer la version",
+  "Restore keeps their edits; Import as new deletes the old record first.": "Restaurer conserve leurs retouches ; Importer comme nouvelles supprime d'abord l'ancien enregistrement.",
+  "Restore them": "Les restaurer",
+  "Retouch": "Retouche",
+  "Reverse the order": "Inverser l'ordre",
+  "Revert": "Rétablir l'original",
+  "Review": "Révision",
+  "Review Import": "Vérifier l'importation",
+  "Right-click a photo ▸ Set as Reference Photo, then View → Reference View (Shift+R)": "Clic droit sur une photo → Définir comme photo de référence, puis Affichage → Vue de référence (Maj+R)",
+  "Right-click a preset to delete it": "Clic droit sur un préréglage pour le supprimer",
+  "Rights Usage Terms": "Conditions d'utilisation des droits",
+  "Rotate": "Pivoter",
+  "Rotate Crop": "Pivoter le recadrage",
+  "Rotate Crop Aspect": "Pivoter le format du recadrage",
+  "Rotate Left": "Pivoter à gauche",
+  "Rotate Right": "Pivoter à droite",
+  "Roughness": "Rugosité",
+  "Roundness": "Arrondi",
+  "Rules": "Règles",
+  "SAM 3 download stopped: it resumes where it left off next time.": "Téléchargement de SAM 3 interrompu : il reprendra là où il s'est arrêté la prochaine fois.",
+  "Same as raw default": "Identique à la valeur par défaut RAW",
+  "Sample Mask Color": "Échantillonner la couleur du masque",
+  "Sample a colour on the photo": "Échantillonner une couleur sur la photo",
+  "Saturation": "Saturation",
+  "Saturation Range": "Plage de saturation",
+  "Saturday": "Samedi",
+  "Save": "Enregistrer",
+  "Save As…": "Enregistrer sous…",
+  "Save Color Label Set": "Enregistrer le jeu d'étiquettes de couleur",
+  "Save Current Filter as Preset…": "Enregistrer le filtre actuel comme préréglage…",
+  "Save Current Keywords as Set…": "Enregistrer les mots-clés actuels comme jeu…",
+  "Save Export Preset": "Enregistrer le préréglage d'exportation",
+  "Save Filter Preset": "Enregistrer le préréglage de filtre",
+  "Save Keyword Set": "Enregistrer le jeu de mots-clés",
+  "Save Metadata Preset": "Enregistrer le préréglage de métadonnées",
+  "Save Metadata Preset…": "Enregistrer le préréglage de métadonnées…",
+  "Save Metadata to File": "Enregistrer les métadonnées dans le fichier",
+  "Save Point Curve Preset": "Enregistrer le préréglage de courbe de points",
+  "Save Point Curve…": "Enregistrer la courbe de points…",
+  "Save as Preset": "Enregistrer comme préréglage",
+  "Save as Set…": "Enregistrer comme jeu…",
+  "Save as Smart Album…": "Enregistrer comme album intelligent…",
+  "Save as set": "Enregistrer comme jeu",
+  "Save as…": "Enregistrer sous…",
+  "Save preset": "Enregistrer le préréglage",
+  "Saving Lightroom import index…": "Enregistrement de l'index d'importation Lightroom…",
+  "Scale": "Échelle",
+  "Scan failed": "Échec de l'analyse",
+  "Scanning": "Analyse en cours",
+  "Scores stay on the photos: filter or make smart albums with Focus and Best of Similar Shots.": "Les scores restent sur les photos : filtrez ou créez des albums intelligents avec Mise au point et Meilleure des prises similaires.",
+  "Screen": "Écran",
+  "Scroll menu down": "Faire défiler le menu vers le bas",
+  "Scroll menu up": "Faire défiler le menu vers le haut",
+  "Search": "Rechercher",
+  "Search Photos": "Rechercher des photos",
+  "Search commands or keys": "Rechercher des commandes ou des touches",
+  "Search…": "Rechercher…",
+  "Seasons": "Saisons",
+  "Second Window": "Deuxième fenêtre",
+  "Select": "Sélectionner",
+  "Select All": "Tout sélectionner",
+  "Select Luminance Range": "Sélectionner une plage de luminance",
+  "Select Mask": "Sélectionner le masque",
+  "Select Photos": "Sélectionner des photos",
+  "Select Spot": "Sélectionner la tache",
+  "Select a photo to edit": "Sélectionnez une photo à modifier",
+  "Select by": "Sélectionner par",
+  "Select by Flag, Rating or Label": "Sélectionner par drapeau, note ou étiquette",
+  "Select photos, then choose View → Survey (N)": "Sélectionnez des photos, puis choisissez Affichage → Vue multiple (N)",
+  "Select two photos, then choose View → Compare (Shift+C)": "Sélectionnez deux photos, puis choisissez Affichage → Comparer (Maj+C)",
+  "Selected": "Sélectionnée",
+  "Selecting…": "Sélection en cours…",
+  "Selenium Tone": "Virage au sélénium",
+  "Send Feedback…": "Envoyer des commentaires…",
+  "Sepia Tone": "Virage sépia",
+  "Sequence number zero-padded to N digits (1–9)": "Numéro de séquence complété par des zéros sur N chiffres (1–9)",
+  "Sequence number, counting from the start number": "Numéro de séquence, à partir du numéro de départ",
+  "Services": "Services",
+  "Set": "Définir",
+  "Set Album Cover": "Définir la couverture de l'album",
+  "Set Before": "Définir Avant",
+  "Set Color Label": "Définir l'étiquette de couleur",
+  "Set Crop": "Définir le recadrage",
+  "Set Develop Values": "Définir les valeurs de développement",
+  "Set Flag": "Définir le drapeau",
+  "Set Image Zoom and Pan": "Définir le zoom et le déplacement de l'image",
+  "Set Keyboard Shortcut": "Définir le raccourci clavier",
+  "Set Mask Adjustments": "Définir les réglages du masque",
+  "Set Point Curve": "Définir la courbe de points",
+  "Set Profile": "Définir le profil",
+  "Set Rating": "Définir la note",
+  "Set Top of Stack": "Définir le haut de la pile",
+  "Set as Album Cover": "Définir comme couverture de l'album",
+  "Set as Before": "Définir comme Avant",
+  "Set as Reference Photo": "Définir comme photo de référence",
+  "Set as Target Album": "Définir comme album cible",
+  "Set as Target Album (B adds to it)": "Définir comme album cible (B y ajoute)",
+  "Set as Top of Stack": "Définir comme haut de la pile",
+  "Set date & time": "Définir la date et l'heure",
+  "Set name": "Nom du jeu",
+  "Set the mix from the photo's colours": "Définir le mixage à partir des couleurs de la photo",
+  "Settings": "Réglages",
+  "Settings file problem": "Problème avec le fichier de réglages",
+  "Settings new raw photos start from. Changing them doesn't touch photos already in the library.": "Réglages de départ des nouvelles photos RAW. Les modifier n'affecte pas les photos déjà présentes dans la bibliothèque.",
+  "Settings pasted": "Réglages collés",
+  "Settings to include": "Réglages à inclure",
+  "Settings…": "Réglages…",
+  "Shade": "Ombre",
+  "Shadow": "Ombre",
+  "Shadows": "Ombres",
+  "Shadows Hue": "Teinte des ombres",
+  "Shadows Luminance": "Luminance des ombres",
+  "Shadows Saturation": "Saturation des ombres",
+  "Shadows Tint": "Nuance des ombres",
+  "Shadows split": "Séparation des ombres",
+  "Sharpen": "Accentuer",
+  "Sharpening": "Accentuation",
+  "Sharpness": "Netteté",
+  "Shift": "Décaler",
+  "Shift by": "Décaler de",
+  "Short Edge": "Petit côté",
+  "Show": "Afficher",
+  "Show All": "Tout afficher",
+  "Show Clipping": "Afficher l'écrêtage",
+  "Show Deghost Overlay": "Afficher l'incrustation de suppression des images fantômes",
+  "Show Hidden Local Locations": "Afficher les emplacements Local masqués",
+  "Show Luminance Map": "Afficher la carte de luminance",
+  "Show Mask": "Afficher le masque",
+  "Show Mask Overlay": "Afficher l'incrustation du masque",
+  "Show Mask Pins": "Afficher les épingles de masque",
+  "Show Original": "Afficher l'original",
+  "Show Photo Counts": "Afficher le nombre de photos",
+  "Show Photos with Keyword": "Afficher les photos avec le mot-clé",
+  "Show Pins": "Afficher les épingles",
+  "Show Source": "Afficher la source",
+  "Show Thumbnails": "Afficher les miniatures",
+  "Show commands without a shortcut": "Afficher les commandes sans raccourci",
+  "Show destination gamut warning": "Afficher l'avertissement de gamut de destination",
+  "Show display gamut warning": "Afficher l'avertissement de gamut de l'écran",
+  "Show file names": "Afficher les noms de fichiers",
+  "Show in Explorer": "Afficher dans l'Explorateur",
+  "Show in File Manager": "Afficher dans le gestionnaire de fichiers",
+  "Show in Finder": "Afficher dans le Finder",
+  "Show on Map": "Afficher sur la carte",
+  "Show overlay (O)": "Afficher l'incrustation (O)",
+  "Show ratings, flags and edit badges": "Afficher les notes, les drapeaux et les pastilles de retouche",
+  "Show the Navigator while zoomed in": "Afficher le Navigateur lors du zoom",
+  "Show the template tags; click one to insert it": "Afficher les balises du modèle ; cliquez sur l'une d'elles pour l'insérer",
+  "Show/Hide Mask": "Afficher/masquer le masque",
+  "Show/hide My Photos panel": "Afficher/masquer le panneau Mes photos",
+  "Shutter speed": "Vitesse d'obturation",
+  "Side panels": "Panneaux latéraux",
+  "Sidecar names": "Noms des fichiers annexes",
+  "Size": "Taille",
+  "Size (% of short edge)": "Taille (% du petit côté)",
+  "Size limit": "Limite de taille",
+  "Skip": "Ignorer",
+  "Sky": "Ciel",
+  "Slideshow": "Diaporama",
+  "Slideshow paused": "Diaporama en pause",
+  "Slideshow resumed": "Diaporama repris",
+  "Slideshow · Space pauses · Esc ends": "Diaporama · Espace pour mettre en pause · Échap pour terminer",
+  "Smart Album": "Album intelligent",
+  "Smart Album Rule Fields": "Champs de règles d'album intelligent",
+  "Smart Preview Status": "État des aperçus dynamiques",
+  "Smart Previews Location": "Emplacement des aperçus dynamiques",
+  "Smart preview available": "Aperçu dynamique disponible",
+  "Smart previews": "Aperçus dynamiques",
+  "Smart previews folder changed": "Dossier des aperçus dynamiques modifié",
+  "Smoothness": "Lissage",
+  "Soft B&W": "N&B doux",
+  "Soft Pastel": "Pastel doux",
+  "Soft Proofing": "Épreuvage à l'écran",
+  "Soft Skin": "Peau douce",
+  "Sort": "Trier",
+  "Sort by": "Trier par",
+  "Source": "Source",
+  "Source code on GitHub": "Code source sur GitHub",
+  "Spherical": "Sphérique",
+  "Spiral": "Spirale",
+  "Split Stack": "Scinder la pile",
+  "Spring Fresh": "Fraîcheur printanière",
+  "Square Grid": "Grille carrée",
+  "Square Grid (G toggles)": "Grille carrée (G pour basculer)",
+  "Square Grid: show file names and formats": "Grille carrée : afficher les noms et formats de fichiers",
+  "Stack": "Pile",
+  "Stack photos taken within this time of each other:": "Empiler les photos prises à moins de cet intervalle les unes des autres :",
+  "Stacks": "Piles",
+  "Standard": "Standard",
+  "Star rating (0–5)": "Note en étoiles (0–5)",
+  "Start at": "Commencer à",
+  "Start number": "Numéro de départ",
+  "Starting": "Démarrage",
+  "Startup": "Démarrage",
+  "State / Province": "État / province",
+  "Stop": "Arrêter",
+  "Stop Building Previews": "Arrêter la génération des aperçus",
+  "Stop Using as Target Album": "Ne plus utiliser comme album cible",
+  "Stopping…": "Arrêt en cours…",
+  "Straighten": "Redresser",
+  "Straighten Tool": "Outil Redresser",
+  "Strong Contrast": "Contraste fort",
+  "Style": "Style",
+  "Subfolder": "Sous-dossier",
+  "Subfolder name": "Nom du sous-dossier",
+  "Subject": "Sujet",
+  "Subtract": "Soustraire",
+  "Subtract from this mask": "Soustraire de ce masque",
+  "Suggestions": "Suggestions",
+  "Summer Haze": "Brume estivale",
+  "Sunday": "Dimanche",
+  "Survey": "Vue multiple",
+  "Survey (N)": "Vue multiple (N)",
+  "Swap": "Permuter",
+  "Swap Aspect (X)": "Permuter le format (X)",
+  "Swap Before and After": "Permuter Avant et Après",
+  "Swap Before and After Settings": "Permuter les réglages Avant et Après",
+  "Swap Compare Photos": "Permuter les photos comparées",
+  "Switch light / dark theme": "Basculer entre thème clair / sombre",
+  "Sync Settings": "Synchroniser les réglages",
+  "System": "Système",
+  "System Info": "Informations système",
+  "System Info…": "Informations système…",
+  "System default": "Valeur par défaut du système",
+  "Table": "Table",
+  "Tags": "Balises",
+  "Tags: see Tags beside the template. Files are renamed on disk (with their XMP sidecars); existing names get -1, -2…": "Balises : voir Balises à côté du modèle. Les fichiers sont renommés sur le disque (avec leurs fichiers annexes XMP) ; les noms existants reçoivent -1, -2…",
+  "Take a snapshot": "Créer un instantané",
+  "Targeted Adjustment": "Réglage ciblé",
+  "Targeted adjustment: drag up/down on the photo to adjust the colours there": "Réglage ciblé : faites glisser vers le haut/bas sur la photo pour ajuster les couleurs à cet endroit",
+  "Targeted adjustment: drag up/down on the photo to adjust the curve there": "Réglage ciblé : faites glisser vers le haut/bas sur la photo pour ajuster la courbe à cet endroit",
+  "Teal & Amber": "Bleu-vert et ambre",
+  "Teal & Orange": "Bleu-vert et orange",
+  "Temp": "Temp.",
+  "Temperature": "Température",
+  "Template": "Modèle",
+  "Temporary session — your library isn't open, and nothing you do here is saved.": "Session temporaire : votre bibliothèque n'est pas ouverte et rien de ce que vous faites ici n'est enregistré.",
+  "Text": "Texte",
+  "Text direction": "Sens du texte",
+  "Texture": "Texture",
+  "That includes the photos in the folders inside it.": "Cela inclut les photos des dossiers qu'il contient.",
+  "That key can't be used as a shortcut": "Cette touche ne peut pas servir de raccourci",
+  "The SAM 3 model is installed: Object and Describe masks are ready.": "Le modèle SAM 3 est installé : les masques Objet et Décrire sont prêts.",
+  "The download didn't work:": "Le téléchargement a échoué :",
+  "The number at the end of the original name (IMG_0042 → 0042)": "Le numéro à la fin du nom d'origine (IMG_0042 → 0042)",
+  "The original extension is always added; {ext} only puts it inside the name as well.": "L'extension d'origine est toujours ajoutée ; {ext} la place aussi à l'intérieur du nom.",
+  "The original files, unchanged, each with an XMP sidecar holding its edits.": "Les fichiers originaux, inchangés, chacun avec un fichier annexe XMP contenant ses retouches.",
+  "The photo has these settings": "La photo a ces réglages",
+  "Theme": "Thème",
+  "They can be restored from Recently Deleted until it is emptied.": "Elles peuvent être restaurées depuis Supprimées récemment tant que cet espace n'est pas vidé.",
+  "They move to Recently Deleted and can be restored; no file on disk is touched.": "Elles passent dans Supprimées récemment et peuvent être restaurées ; aucun fichier sur le disque n'est touché.",
+  "Thirds": "Tiers",
+  "This Computer": "Cet ordinateur",
+  "This build can't download the model yet. To install it by hand, put model.safetensors, vocab.json and merges.txt from Meta's facebook/sam3 in the folder above: Object and Describe work as soon as they are there.": "Cette version ne peut pas encore télécharger le modèle. Pour l'installer à la main, placez model.safetensors, vocab.json et merges.txt de facebook/sam3 (Meta) dans le dossier ci-dessus : Objet et Décrire fonctionnent dès qu'ils s'y trouvent.",
+  "This folder is not available (drive disconnected?). Smart previews are not built or used until it is back or you choose another folder.": "Ce dossier n'est pas disponible (disque déconnecté ?). Les aperçus dynamiques ne sont ni générés ni utilisés tant qu'il n'est pas de retour ou que vous n'avez pas choisi un autre dossier.",
+  "This photo can't be opened": "Cette photo ne peut pas être ouverte",
+  "Threshold": "Seuil",
+  "Thumbnail cache": "Cache des miniatures",
+  "Thursday": "Jeudi",
+  "Time zone": "Fuseau horaire",
+  "Tint": "Nuance",
+  "Title": "Titre",
+  "Title metadata": "Métadonnées du titre",
+  "Toggle Keyword from Set": "Activer/désactiver un mot-clé du jeu",
+  "Toggle Mask": "Activer/désactiver le masque",
+  "Toggle Section": "Activer/désactiver la section",
+  "Toggle Zoom": "Basculer le zoom",
+  "Tone Curve": "Courbe des tonalités",
+  "Tools": "Outils",
+  "Top Level": "Niveau supérieur",
+  "Transfer": "Transfert",
+  "Treatment": "Traitement",
+  "Triangle": "Triangle",
+  "Try Again": "Réessayer",
+  "Try Saving Again": "Réessayer d'enregistrer",
+  "Tuesday": "Mardi",
+  "Tungsten": "Tungstène",
+  "Turn Off": "Désactiver",
+  "Turn on Include subfolders, or pick another folder under Local": "Activez Inclure les sous-dossiers ou choisissez un autre dossier dans Local",
+  "Type": "Type",
+  "Uncheck All": "Tout décocher",
+  "Uncheck the files of this type": "Décocher les fichiers de ce type",
+  "Undo": "Annuler",
+  "Unedited": "Non retouchées",
+  "Unedited raws": "RAW non retouchés",
+  "Unflag": "Retirer le drapeau",
+  "Unflagged": "Sans drapeau",
+  "Ungroup Stack": "Dissocier la pile",
+  "Unknown Date": "Date inconnue",
+  "Unknown tags stay as typed — check the preview for a {typo}.": "Les balises inconnues restent telles que saisies : vérifiez l'aperçu pour repérer une {typo}.",
+  "Unrated": "Non notée",
+  "Unreadable": "Illisible",
+  "Update": "Mettre à jour",
+  "Update Mask Shape": "Mettre à jour la forme du masque",
+  "Update Preset with Current Settings": "Mettre à jour le préréglage avec les réglages actuels",
+  "Update Rules from Current Filter": "Mettre à jour les règles à partir du filtre actuel",
+  "Update Version": "Mettre à jour la version",
+  "Update Version with Current Settings": "Mettre à jour la version avec les réglages actuels",
+  "Update with Current Settings": "Mettre à jour avec les réglages actuels",
+  "Updated the edits saved in the external editor": "Retouches enregistrées dans l'éditeur externe mises à jour",
+  "Upright": "Upright",
+  "Urban": "Urbain",
+  "Use Keyword Set": "Utiliser le jeu de mots-clés",
+  "Use Library Folder": "Utiliser le dossier de la bibliothèque",
+  "Use camera-specific defaults": "Utiliser les valeurs par défaut propres à l'appareil photo",
+  "Use the GPU for rendering": "Utiliser le GPU pour le rendu",
+  "User Presets": "Préréglages utilisateur",
+  "Username": "Nom d'utilisateur",
+  "Value": "Valeur",
+  "Variance": "Variance",
+  "Version": "Version",
+  "Version name": "Nom de la version",
+  "Versions": "Versions",
+  "Versions (Shift+V)": "Versions (Maj+V)",
+  "Vertical": "Vertical",
+  "Vertical text": "Texte vertical",
+  "Vibrance": "Vibrance",
+  "Videos": "Vidéos",
+  "View": "Affichage",
+  "Viewing and sharing": "Affichage et partage",
+  "Vignette": "Vignette",
+  "Vignetting": "Vignetage",
+  "Vintage": "Vintage",
+  "Virtual Copy": "Copie virtuelle",
+  "Visible": "Visible",
+  "Visualize Spots": "Visualiser les taches",
+  "Visualize Spots (A)": "Visualiser les taches (A)",
+  "Visualize range": "Visualiser la plage",
+  "Vivid": "Éclatant",
+  "Vivid Pop": "Couleurs éclatantes",
+  "Warm Film": "Film chaud",
+  "Warm Glow": "Lueur chaude",
+  "Warm Print": "Tirage chaud",
+  "Warm Table": "Table chaleureuse",
+  "Watched folder": "Dossier surveillé",
+  "Watermark": "Filigrane",
+  "Wednesday": "Mercredi",
+  "What's New": "Nouveautés",
+  "When rated or hovered": "Lors de la notation ou du survol",
+  "White Balance": "Balance des blancs",
+  "White Balance Selector": "Sélecteur de balance des blancs",
+  "White Balance Selector (W)": "Sélecteur de balance des blancs (W)",
+  "Whites": "Blancs",
+  "Width": "Largeur",
+  "Width (% of photo)": "Largeur (% de la photo)",
+  "Width (px)": "Largeur (px)",
+  "Width × Height": "Largeur × hauteur",
+  "Will be replaced": "Sera remplacée",
+  "Will be restored": "Sera restaurée",
+  "Window": "Fenêtre",
+  "Winter Blue": "Bleu hivernal",
+  "XMP Sidecar Preferences": "Préférences des fichiers annexes XMP",
+  "XMP sidecars": "Fichiers annexes XMP",
+  "Year": "Année",
+  "Yellow": "Jaune",
+  "Yellow Hue": "Teinte jaune",
+  "Yellow Luminance": "Luminance jaune",
+  "Yellow Saturation": "Saturation jaune",
+  "Yellow label": "Étiquette jaune",
+  "Yes": "Oui",
+  "You can close this: the download continues, and resumes if interrupted.": "Vous pouvez fermer cette fenêtre : le téléchargement continue et reprend s'il est interrompu.",
+  "Your Name": "Votre nom",
+  "Your library couldn't be opened": "Votre bibliothèque n'a pas pu être ouverte",
+  "Zoom": "Zoom",
+  "Zoom 100%": "Zoom 100 %",
+  "Zoom In": "Zoom avant",
+  "Zoom Out": "Zoom arrière",
+  "Zoom to Fit": "Zoom pour ajuster",
+  "Zoom to page level": "Zoom au niveau de la page",
+  "a literal %": "un % littéral",
+  "a removed photo": "une photo supprimée",
+  "all": "toutes",
+  "and": "et",
+  "any": "au moins une",
+  "are empty": "sont vides",
+  "aren't empty": "ne sont pas vides",
+  "blue": "bleu",
+  "comma, separated": "séparés, par des virgules",
+  "contains": "contient",
+  "copyrighted": "protégée par copyright",
+  "day 01–31": "jour 01–31",
+  "days": "jours",
+  "discarding smart previews": "suppression des aperçus dynamiques",
+  "doesn't contain": "ne contient pas",
+  "e.g. sky · the red car · car, road": "p. ex. sky · the red car · car, road (en anglais)",
+  "ends with": "se termine par",
+  "false": "non",
+  "green": "vert",
+  "hour 00–23": "heure 00–23",
+  "hours": "heures",
+  "image": "image",
+  "includes the folders inside it": "inclut les dossiers qu'il contient",
+  "is": "est",
+  "is <": "est <",
+  "is >": "est >",
+  "is after": "est postérieur à",
+  "is before": "est antérieur à",
+  "is between": "est compris entre",
+  "is empty": "est vide",
+  "is in the last": "est dans les derniers",
+  "is unknown": "est inconnu",
+  "is ≤": "est ≤",
+  "is ≥": "est ≥",
+  "isn't": "n'est pas",
+  "isn't empty": "n'est pas vide",
+  "isn't in the last": "n'est pas dans les derniers",
+  "keep names — or e.g. {date}_{seq:3}": "conserver les noms, ou p. ex. {date}_{seq:3}",
+  "latitude, longitude": "latitude, longitude",
+  "memory only": "mémoire uniquement",
+  "minute": "minute",
+  "month 01–12": "mois 01–12",
+  "months": "mois",
+  "none": "aucune",
+  "none (CPU rendering)": "aucun (rendu par le processeur)",
+  "none of": "aucune des",
+  "not available here": "non disponible ici",
+  "of the following rules:": "des règles suivantes :",
+  "or": "ou",
+  "pick": "sélectionnée",
+  "previews": "aperçus",
+  "publicDomain": "domaine public",
+  "purple": "violet",
+  "raw": "RAW",
+  "red": "rouge",
+  "reject": "rejetée",
+  "saved in": "enregistré dans",
+  "second": "seconde",
+  "smart previews": "aperçus dynamiques",
+  "starts with": "commence par",
+  "the photos in view": "les photos de la vue",
+  "the selected photos": "les photos sélectionnées",
+  "this photo": "cette photo",
+  "true": "oui",
+  "unknown": "inconnu",
+  "video": "vidéo",
+  "weeks": "semaines",
+  "year, 2 digits": "année, 2 chiffres",
+  "year, 4 digits": "année, 4 chiffres",
+  "years": "années",
+  "yellow": "jaune",
+  "{date} is the capture time; a photo without one uses the time it was imported.": "{date} est l'heure de prise de vue ; une photo qui n'en a pas utilise l'heure d'importation.",
+  "© 2026 Your Name": "© 2026 Votre nom",
+  "© Your Name": "© Votre nom",
+  "− harder border · + softer border": "− bord plus dur · + bord plus doux",
+  "≤  at most": "≤  au plus",
+  "≥  at least": "≥  au moins",
+  "日本語": "日本語",
+  "繁體中文（台灣）": "繁體中文（台灣）",
+  "Any camera": "N'importe quel appareil photo",
+  "Any lens": "N'importe quel objectif",
+  "Any keyword": "N'importe quel mot-clé",
+  "Label Set": "Jeu d'étiquettes",
+  ", picked": ", sélectionnée",
+  ", rejected": ", rejetée",
+  "Preview only: editing the camera's embedded JPEG": "Aperçu uniquement : modification du JPEG intégré de l'appareil photo",
+  "Captured from": "Prises à partir du",
+  "Captured until": "Prises jusqu'au",
+  "Only": "Uniquement",
+  "Open Log Folder": "Ouvrir le dossier des journaux",
+  "Back to this person": "Retour à cette personne",
+  "AI Denoise": "Débruitage IA",
+  "AI Denoise Model": "Modèle de débruitage IA",
+  "AI Denoise is off: press Use on a model.": "Le débruitage IA est désactivé : appuyez sur Utiliser sur un modèle.",
+  "AI Denoise needs a model. Install one in Settings.": "Le débruitage IA nécessite un modèle. Installez-en un dans les Réglages.",
+  "Accept & Download": "Accepter et télécharger",
+  "Already installed. Remove it before installing a replacement.": "Déjà installé. Supprimez-le avant d'installer un remplaçant.",
+  "Automatic uses the graphics card where it is faster than the processor: both are timed on this computer the first time a photo is made.": "Automatique utilise la carte graphique lorsqu'elle est plus rapide que le processeur : les deux sont chronométrés sur cet ordinateur la première fois qu'une photo est générée.",
+  "Cache": "Cache",
+  "Checking and installing the model…": "Vérification et installation du modèle…",
+  "Checking…": "Vérification…",
+  "Clear cache": "Vider le cache",
+  "Denoise Models": "Modèles de débruitage",
+  "Denoise Settings": "Réglages de débruitage",
+  "Denoise all photos with an Amount": "Débruiter toutes les photos ayant une Quantité",
+  "Downloaded and checked. Installing…": "Téléchargé et vérifié. Installation en cours…",
+  "Failed its last test": "Échec lors de son dernier test",
+  "Graphics card": "Carte graphique",
+  "I have read these terms and accept them for my own use": "J'ai lu ces conditions et je les accepte pour mon propre usage",
+  "Inspect Denoise Model": "Inspecter le modèle de débruitage",
+  "Install Denoise Model": "Installer le modèle de débruitage",
+  "Install from file…": "Installer à partir d'un fichier…",
+  "Install your own ONNX model with denoise-model.json beside it. This build offers no model downloads.": "Installez votre propre modèle ONNX avec denoise-model.json à côté. Cette version ne propose aucun téléchargement de modèle.",
+  "Its denoised picture is not made yet, and pictures are not made on their own (Settings, AI Denoise).": "Son image débruitée n'est pas encore générée, et les images ne sont pas générées automatiquement (Réglages, Débruitage IA).",
+  "LightCraft does not know this model, so it assumed:": "LightCraft ne connaît pas ce modèle ; il a donc supposé :",
+  "Limit": "Limite",
+  "Make it now": "La générer maintenant",
+  "Make the denoised picture of the photos I am looking at": "Générer l'image débruitée des photos que je regarde",
+  "Next up for AI Denoise…": "Prochaines photos pour le débruitage IA…",
+  "Nothing is fetched until you accept. The model is kept on this computer only; LightCraft never uploads or shares it.": "Rien n'est récupéré tant que vous n'avez pas accepté. Le modèle est conservé uniquement sur cet ordinateur ; LightCraft ne le téléverse ni ne le partage jamais.",
+  "Only photos whose AI Denoise amount is above 0 are made. Exports always make theirs if it is missing.": "Seules les photos dont la quantité de débruitage IA est supérieure à 0 sont générées. Les exportations génèrent toujours la leur si elle manque.",
+  "Open page": "Ouvrir la page",
+  "Open the model's page": "Ouvrir la page du modèle",
+  "Opens the model's own page in your browser, to read about it or get the file yourself.": "Ouvre la page du modèle dans votre navigateur, pour vous renseigner ou récupérer le fichier vous-même.",
+  "Processor": "Processeur",
+  "Set up AI Denoise…": "Configurer le débruitage IA…",
+  "Speed": "Vitesse",
+  "Starting…": "Démarrage…",
+  "Tested and works on this computer": "Testé et fonctionnel sur cet ordinateur",
+  "The denoise model is installed and in use: the AI Denoise Amount slider under Detail now works": "Le modèle de débruitage est installé et utilisé : le curseur Quantité de débruitage IA sous Détail fonctionne désormais",
+  "The graphics card is set up when the next photo is made.": "La carte graphique est configurée lors de la génération de la prochaine photo.",
+  "The model is kept on this computer only. LightCraft never uploads or shares it.": "Le modèle est conservé uniquement sur cet ordinateur. LightCraft ne le téléverse ni ne le partage jamais.",
+  "The processor does the work.": "Le processeur effectue le travail.",
+  "There is no model file to install": "Il n'y a aucun fichier de modèle à installer",
+  "This build cannot run denoise models.": "Cette version ne peut pas exécuter de modèles de débruitage.",
+  "This build has nowhere to keep denoise models, so AI Denoise is not available. (The desktop app has.)": "Cette version n'a aucun endroit où conserver les modèles de débruitage ; le débruitage IA n'est donc pas disponible. (L'application de bureau en a un.)",
+  "This file cannot be used yet": "Ce fichier ne peut pas encore être utilisé",
+  "Tick the box to accept the model's terms first": "Cochez d'abord la case pour accepter les conditions du modèle",
+  "Try again": "Réessayer",
+  "Try the graphics card again": "Réessayer la carte graphique",
+  "Turn off": "Désactiver",
+  "Unknown licence": "Licence inconnue",
+  "Use": "Utiliser",
+  "Waiting to start…": "En attente de démarrage…",
+  "Works on raw files from cameras with a standard (Bayer) sensor. Other files keep their normal noise reduction.": "Fonctionne sur les fichiers RAW des appareils photo dotés d'un capteur standard (Bayer). Les autres fichiers conservent leur réduction de bruit normale.",
+  "cached picture": "image en cache",
+  "cached pictures": "images en cache",
+  "commercial use allowed": "usage commercial autorisé",
+  "denoiseModel.accept": "denoiseModel.accept",
+  "in use": "utilisé",
+  "installed": "installé",
+  "makes AI Denoise available": "rend le débruitage IA disponible",
+  "non-commercial use only": "usage non commercial uniquement",
+  "photo has its denoised picture.": "photo a son image débruitée.",
+  "photo waiting": "photo en attente",
+  "photos have their denoised picture.": "photos ont leur image débruitée.",
+  "photos waiting": "photos en attente",
+  "starts using it for AI Denoise": "commence à l'utiliser pour le débruitage IA",
+  "terms unclear": "conditions peu claires",
+  "the graphics card": "la carte graphique",
+  "the graphics card is not used": "la carte graphique n'est pas utilisée",
+  "Cancel Denoise": "Annuler le débruitage",
+  "Cancel Denoise Model Download": "Annuler le téléchargement du modèle de débruitage",
+  "Choose Denoise Model": "Choisir le modèle de débruitage",
+  "Clear Denoise Cache": "Vider le cache de débruitage",
+  "Denoise Model Downloads": "Téléchargements de modèles de débruitage",
+  "Denoise Photos": "Débruiter les photos",
+  "Denoise Pump": "Pompe de débruitage",
+  "Denoise Status": "État du débruitage",
+  "Download Denoise Model": "Télécharger le modèle de débruitage",
+  "Remove Denoise Model": "Supprimer le modèle de débruitage",
+  "Test Denoise Model": "Tester le modèle de débruitage",
+  "AI Denoise is enabled on the requesting photo": "Le débruitage IA est activé sur la photo à l'origine de la demande",
+  "After installation, AI Denoise will turn on for the requesting photo.": "Après l'installation, le débruitage IA sera activé pour la photo à l'origine de la demande.",
+  "Cancel pending action": "Annuler l'action en attente",
+  "Install a denoise model to enable AI Denoise on this photo": "Installez un modèle de débruitage pour activer le débruitage IA sur cette photo",
+  "Pending photo action cancelled": "Action de photo en attente annulée",
+  "Pending photo action cancelled because its library or photo changed": "Action de photo en attente annulée car sa bibliothèque ou sa photo a changé",
+  "ONNX model": "Modèle ONNX",
+  "commercial use subject to GPL conditions": "usage commercial soumis aux conditions de la GPL",
+  "Camera local tone mapping": "Mappage local des tons de l’appareil",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "Appliquer le mappage local des tons enregistré dans le fichier raw (Apple ProRAW), comme le rend l’appareil",
+  "Decrease Rating": "Diminuer la note",
+  "Increase Rating": "Augmenter la note",
+  "Click to type a value": "Cliquez pour saisir une valeur",
+  "Angle": "Angle",
+  "Video": "Vidéo",
+  "Copyrighted": "Protégé par copyright",
+  "Public Domain": "Domaine public",
+  "Unknown": "Inconnu",
+  "Landscape (wide)": "Paysage (large)",
+  "Portrait (tall)": "Portrait (haut)",
+  "Square": "Carré",
+  "In Color": "En couleur",
+  "No Label": "Sans étiquette",
+  "Choose an album…": "Choisir un album…",
+  "No albums yet": "Aucun album pour l'instant",
+  "Fix the marked rules to save this album.": "Corrigez les règles signalées pour enregistrer cet album.",
+  "Some rules need fixing (Edit Smart Album…):": "Certaines règles sont à corriger (Modifier l'album intelligent…) :",
+  "isn't a field rules know": "n'est pas un champ connu des règles",
+  "can't be tested that way": "ne peut pas être testé ainsi",
+  "is yes or no": "vaut oui ou non",
+  "needs a number": "demande un nombre",
+  "needs a time like 1/250 or 2": "demande une durée comme 1/250 ou 2",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "demande une date comme 2026, 2026-08 ou 2026-08-14",
+  "has the first date after the second": "a la première date après la seconde",
+  "needs two values": "demande deux valeurs",
+  "needs a number more than 0": "demande un nombre supérieur à 0",
+  "needs hours, days, weeks, months or years": "demande des heures, jours, semaines, mois ou années",
+  "isn't one of the choices": "ne fait pas partie des choix",
+  "needs something to look for (or use “is empty”)": "demande quelque chose à chercher (ou utilisez « est vide »)",
+  "needs something to look for (or use “isn't empty”)": "demande quelque chose à chercher (ou utilisez « n'est pas vide »)",
+  "needs text": "demande du texte",
+  "can't match any rating from 0 to 5": "ne peut correspondre à aucune note de 0 à 5",
+  "needs an album": "demande un album",
+  "names an album that no longer exists": "désigne un album qui n'existe plus",
+  "can't test a folder; choose an album in it": "ne peut pas tester un dossier ; choisissez un album qu'il contient",
+  "This group is empty: add a rule or remove it.": "Ce groupe est vide : ajoutez une règle ou supprimez-le.",
+  "needs something to look for (or use “are empty”)": "demande quelque chose à chercher (ou utilisez « sont vides »)",
+  "needs something to look for (or use “aren't empty”)": "demande quelque chose à chercher (ou utilisez « ne sont pas vides »)",
+  "Mo": "Lu",
+  "Tu": "Ma",
+  "We": "Me",
+  "Th": "Je",
+  "Fr": "Ve",
+  "Sa": "Sa",
+  "Su": "Di",
+  "Pick a date": "Choisir une date",
+  "would make this album include itself through other smart albums": "ferait que cet album s'inclue lui-même via d'autres albums intelligents",
+  "Search albums": "Rechercher des albums",
+  "No albums match": "Aucun album ne correspond",
+  "This is the album you're editing": "C'est l'album que vous modifiez",
+  "It tests this album, so testing it back would loop": "Il teste cet album : le tester en retour créerait une boucle",
+  "Copy Name": "Nom de la copie",
+  "In a Stack": "Dans une pile",
+  "File Extension": "Extension de fichier",
+  "Video Duration": "Durée de la vidéo",
+  "Keyword Count": "Nombre de mots-clés",
+  "People Count": "Nombre de personnes",
+  "Shutter Speed": "Vitesse d'obturation",
+  "Cropped": "Recadrée",
+  "Keywords & People": "Mots-clés et personnes",
+  "Description": "Description",
+  "Camera Info": "Infos de l'appareil",
+  "Develop": "Développement",
+  "Keyword List": "Liste des mots-clés",
+  "Filter Keywords": "Filtrer les mots-clés",
+  "No keywords yet": "Aucun mot-clé pour l'instant",
+  "No keywords match": "Aucun mot-clé ne correspond",
+  "Keyword Name": "Nom du mot-clé",
+  "Synonyms": "Synonymes",
+  "Separated by commas": "Séparés par des virgules",
+  "Keyword Tag Options": "Options du mot-clé",
+  "Include on Export": "Inclure à l'exportation",
+  "Export Containing Keywords": "Exporter les mots-clés parents",
+  "Export Synonyms": "Exporter les synonymes",
+  "Create Keyword Tag": "Créer un mot-clé",
+  "Edit Keyword Tag": "Modifier le mot-clé",
+  "Create": "Créer",
+  "No photo has it; the keywords below it go too.": "Aucune photo ne l'a ; les mots-clés qu'il contient sont aussi supprimés.",
+  "Edit Keyword Tag…": "Modifier le mot-clé…",
+  "Put New Keywords Inside This Keyword": "Placer les nouveaux mots-clés dans celui-ci",
+  "Purge Unused Keywords": "Purger les mots-clés inutilisés",
+  "Delete Keyword…": "Supprimer le mot-clé…",
+  "Drop here for the top level": "Déposez ici pour le niveau supérieur",
+  "Their photos and the keywords below them come together under one keyword.": "Leurs photos et les mots-clés qu'ils contiennent sont réunis sous un seul mot-clé.",
+  "Select photos to give them keywords.": "Sélectionnez des photos pour leur attribuer des mots-clés.",
+  "Add to All Selected Photos": "Ajouter à toutes les photos sélectionnées",
+  "Will Export": "Sera exporté",
+  "No keywords are exported": "Aucun mot-clé n'est exporté",
+  "& Containing": "et parents",
+  "Edit Set…": "Modifier le jeu…",
+  "Edit Keyword Set": "Modifier le jeu de mots-clés",
+  "Keywords (⌥1–⌥9)": "Mots-clés (⌥1–⌥9)",
+  "A keyword set needs a name": "Un jeu de mots-clés doit avoir un nom",
+  "Save as a new set": "Enregistrer comme nouveau jeu",
+  "Recent Keywords is built in: choose another name": "Mots-clés récents est intégré : choisissez un autre nom",
+  "Import Keywords…": "Importer des mots-clés…",
+  "Export Keywords…": "Exporter les mots-clés…",
+  "Import Keywords": "Importer des mots-clés",
+  "Export Keywords": "Exporter les mots-clés",
+  "Keyword Lists": "Listes de mots-clés",
+  "Synchronize Folder…": "Synchroniser le dossier…",
+  "Synchronize Folder": "Synchroniser le dossier",
+  "Synchronize": "Synchroniser",
+  "Scanning…": "Analyse…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "Trouver les photos ajoutées à ce dossier sur le disque ou qui en manquent, et les fichiers annexes XMP modifiés par d'autres applications",
+  "Bring the library up to date with this folder and the folders inside it:": "Mettre la bibliothèque à jour avec ce dossier et ses sous-dossiers :",
+  "Import new photos": "Importer les nouvelles photos",
+  "Remove missing photos from the library": "Retirer les photos manquantes de la bibliothèque",
+  "Read metadata updates from XMP sidecars": "Lire les métadonnées mises à jour dans les fichiers annexes XMP",
+  "The library is up to date with this folder.": "La bibliothèque est à jour avec ce dossier.",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "Les photos manquantes vont dans Supprimées récemment et peuvent être restaurées ; aucun fichier sur le disque n'est touché.",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "Lire un fichier annexe remplace la note, les étiquettes, les métadonnées et les retouches de la photo par son contenu.",
+  "Skipped: files already in the library elsewhere": "Ignorés : fichiers déjà ailleurs dans la bibliothèque",
+  "Skipped: files that can't be read": "Ignorés : fichiers illisibles",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "Ce dossier est introuvable : il a été déplacé ou renommé, ou son disque n'est pas connecté.",
+  "Relink photos whose file was renamed or moved": "Relier les photos dont le fichier a été renommé ou déplacé",
+  "A folder is already being synchronized": "Un dossier est déjà en cours de synchronisation",
+  "Synchronizing…": "Synchronisation…",
+  "Relinked": "Reliées",
+  "Removed": "Retirées",
+  "Metadata read": "Métadonnées lues",
+  "Failed": "Échecs",
+  "Stopped": "Arrêté",
+  "Stopped by an error (see the log)": "Arrêté par une erreur (voir le journal)",
+  "Not saved": "Non enregistré",
+  "A folder is being synchronized": "Un dossier est en cours de synchronisation",
+  "Wait for the import to finish": "Attendez la fin de l'importation"
+}
diff --git a/crates/ui-egui/locales/ja-formats.json b/crates/ui-egui/locales/ja-formats.json
index b0e0f2f9..e4976420 100644
--- a/crates/ui-egui/locales/ja-formats.json
+++ b/crates/ui-egui/locales/ja-formats.json
@@ -206,5 +206,20 @@
   "In line for AI Denoise ({ahead} ahead)…": "In line for AI Denoise ({ahead} ahead)…",
   "Running on {}.": "Running on {}.",
   "{file} · {size}": "{file} · {size}",
-  "•  {assumption}": "•  {assumption}"
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "「{parent}」の中に入れる",
+  "Delete the keyword “{name}”?": "キーワード「{name}」を削除しますか？",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "写真{count}枚から下位のキーワードとともに削除されます。取り消すと元に戻ります。{:.0}",
+  "Create Keyword Tag Inside “{name}”…": "「{name}」の中にキーワードタグを作成…",
+  "“{parent}” has a “{name}” already. Merge the two?": "「{parent}」にはすでに「{name}」があります。統合しますか？",
+  "There is a “{name}” at the top level already. Merge the two?": "最上位にはすでに「{name}」があります。統合しますか？",
+  "Added “{keyword}” to {n} photo{}": "写真{n}枚に「{keyword}」を追加しました{:.0}",
+  "On {have} of {of} selected photos": "選択した写真{of}枚のうち{have}枚",
+  "Remove “{name}”": "「{name}」を削除",
+  "There is a keyword set “{name}” already": "キーワードセット「{name}」はすでにあります",
+  "Added {n} keyword{}": "{n}件のキーワードを追加しました{:.0}",
+  "; {n} gained synonyms": "。{n}件に同義語を追加",
+  "Exported {n} keyword{}": "{n}件のキーワードを書き出しました{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — Capture One は ; , < > を含むキーワードがあるリストを読み込みません: {names}",
+  " — left out, as a keyword list can't hold them: {names}": " — キーワードリストに書けないため省略: {names}"
 }
diff --git a/crates/ui-egui/locales/ja.json b/crates/ui-egui/locales/ja.json
index 49f2ef80..4d9c8ae7 100644
--- a/crates/ui-egui/locales/ja.json
+++ b/crates/ui-egui/locales/ja.json
@@ -503,8 +503,8 @@
   "HDR panorama": "HDRパノラマ",
   "HDR panoramas": "HDRパノラマ",
   "HDR with Last Settings": "前回の設定でHDR合成",
-  "Has Edits": "編集あり",
-  "Has GPS": "GPS情報あり",
+  "Has Edits": "編集",
+  "Has GPS": "GPS情報",
   "High Contrast B&W": "ハイコントラスト白黒",
   "Home": "ホーム",
   "Hours": "時間",
@@ -1087,6 +1087,8 @@
   "Remove (H)": "除去（H）",
   "Remove CA": "色収差を除去",
   "Remove Chromatic Aberration": "色収差を除去",
+  "Camera local tone mapping": "カメラのローカルトーンマッピング",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "RAW に保存されたローカルトーンマッピング（Apple ProRAW）をカメラと同じように適用",
   "Remove from Album": "アルバムから削除",
   "Remove from Favorites": "お気に入りから削除",
   "Remove from Local": "ローカルから除く",
@@ -1732,5 +1734,134 @@
   "Pending photo action cancelled": "Pending photo action cancelled",
   "Pending photo action cancelled because its library or photo changed": "Pending photo action cancelled because its library or photo changed",
   "ONNX model": "ONNX model",
-  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions"
+  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions",
+  "Decrease Rating": "評価を下げる",
+  "Increase Rating": "評価を上げる",
+  "Click to type a value": "クリックして値を入力",
+  "Angle": "角度",
+  "Video": "動画",
+  "Copyrighted": "著作権あり",
+  "Public Domain": "パブリックドメイン",
+  "Unknown": "不明",
+  "Landscape (wide)": "横長",
+  "Portrait (tall)": "縦長",
+  "Square": "正方形",
+  "In Color": "カラー",
+  "No Label": "ラベルなし",
+  "smart album value|Yes": "あり",
+  "smart album value|No": "なし",
+  "In a Stack": "スタック",
+  "Cropped": "切り抜き",
+  "Choose an album…": "アルバムを選択…",
+  "No albums yet": "アルバムはまだありません",
+  "Fix the marked rules to save this album.": "このアルバムを保存するには、印の付いた条件を修正してください。",
+  "Some rules need fixing (Edit Smart Album…):": "修正が必要な条件があります（スマートアルバムを編集…）：",
+  "isn't a field rules know": "不明な項目です",
+  "can't be tested that way": "この方法では判定できません",
+  "is yes or no": "「あり」か「なし」を選んでください",
+  "needs a number": "数値が必要です",
+  "needs a time like 1/250 or 2": "1/250 や 2 のようなシャッター速度が必要です",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "2026、2026-08、2026-08-14 のような日付が必要です",
+  "has the first date after the second": "最初の日付が2番目の日付より後です",
+  "needs two values": "2つの値が必要です",
+  "needs a number more than 0": "0より大きい数値が必要です",
+  "needs hours, days, weeks, months or years": "時間・日・週・月・年のいずれかが必要です",
+  "isn't one of the choices": "選択肢にありません",
+  "needs something to look for (or use “is empty”)": "検索する語句が必要です（または「が空」を使用）",
+  "needs something to look for (or use “isn't empty”)": "検索する語句が必要です（または「が空でない」を使用）",
+  "needs text": "文字列が必要です",
+  "can't match any rating from 0 to 5": "0〜5 のどの評価にも一致しません",
+  "needs an album": "アルバムを選択してください",
+  "names an album that no longer exists": "存在しないアルバムが指定されています",
+  "can't test a folder; choose an album in it": "フォルダーは判定できません。中のアルバムを選択してください",
+  "This group is empty: add a rule or remove it.": "このグループは空です。条件を追加するか、グループを削除してください。",
+  "needs something to look for (or use “are empty”)": "検索する語句が必要です（または「が空」を使用）",
+  "needs something to look for (or use “aren't empty”)": "検索する語句が必要です（または「が空でない」を使用）",
+  "Mo": "月",
+  "Tu": "火",
+  "We": "水",
+  "Th": "木",
+  "Fr": "金",
+  "Sa": "土",
+  "Su": "日",
+  "Pick a date": "日付を選択",
+  "would make this album include itself through other smart albums": "ほかのスマートアルバムを通じて、このアルバム自身を含むことになります",
+  "Search albums": "アルバムを検索",
+  "No albums match": "一致するアルバムはありません",
+  "This is the album you're editing": "編集中のアルバムです",
+  "It tests this album, so testing it back would loop": "このアルバムを条件にしているため、逆に指定すると循環します",
+  "Copy Name": "コピー名",
+  "File Extension": "拡張子",
+  "Video Duration": "ビデオの長さ",
+  "Keyword Count": "キーワード数",
+  "People Count": "人数",
+  "Shutter Speed": "シャッター速度",
+  "Keywords & People": "キーワードと人物",
+  "Description": "説明",
+  "Camera Info": "カメラ情報",
+  "Develop": "編集",
+  "Keyword List": "キーワードリスト",
+  "Filter Keywords": "キーワードを絞り込む",
+  "No keywords yet": "キーワードはまだありません",
+  "No keywords match": "一致するキーワードはありません",
+  "Keyword Name": "キーワード名",
+  "Synonyms": "同義語",
+  "Separated by commas": "カンマ区切り",
+  "Keyword Tag Options": "キーワードタグのオプション",
+  "Include on Export": "書き出し時に含める",
+  "Export Containing Keywords": "親キーワードを書き出す",
+  "Export Synonyms": "同義語を書き出す",
+  "Create Keyword Tag": "キーワードタグを作成",
+  "Edit Keyword Tag": "キーワードタグを編集",
+  "Create": "作成",
+  "No photo has it; the keywords below it go too.": "このキーワードを持つ写真はありません。下位のキーワードも削除されます。",
+  "Edit Keyword Tag…": "キーワードタグを編集…",
+  "Put New Keywords Inside This Keyword": "新しいキーワードをこのキーワードの中に入れる",
+  "Purge Unused Keywords": "使用されていないキーワードを削除",
+  "Delete Keyword…": "キーワードを削除…",
+  "Drop here for the top level": "ここにドロップすると最上位に移動",
+  "Their photos and the keywords below them come together under one keyword.": "写真と下位のキーワードが1つのキーワードにまとめられます。",
+  "Select photos to give them keywords.": "写真を選択するとキーワードを付けられます。",
+  "Add to All Selected Photos": "選択したすべての写真に追加",
+  "Will Export": "書き出されるキーワード",
+  "No keywords are exported": "書き出されるキーワードはありません",
+  "& Containing": "と親キーワード",
+  "Edit Set…": "セットを編集…",
+  "Edit Keyword Set": "キーワードセットを編集",
+  "Keywords (⌥1–⌥9)": "キーワード (⌥1–⌥9)",
+  "A keyword set needs a name": "キーワードセットには名前が必要です",
+  "Save as a new set": "新しいセットとして保存",
+  "Recent Keywords is built in: choose another name": "「最近使用したキーワード」は組み込みです。別の名前を選んでください",
+  "Import Keywords…": "キーワードを読み込み…",
+  "Export Keywords…": "キーワードを書き出し…",
+  "Import Keywords": "キーワードを読み込み",
+  "Export Keywords": "キーワードを書き出し",
+  "Keyword Lists": "キーワードリスト",
+  "Synchronize Folder…": "フォルダを同期…",
+  "Synchronize Folder": "フォルダを同期",
+  "Synchronize": "同期",
+  "Scanning…": "スキャン中…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "ディスク上のこのフォルダに追加された写真や見つからない写真、ほかのアプリで変更された XMP サイドカーを探します",
+  "Bring the library up to date with this folder and the folders inside it:": "このフォルダとその中のフォルダに合わせてライブラリを最新にします:",
+  "Import new photos": "新しい写真を読み込む",
+  "Remove missing photos from the library": "見つからない写真をライブラリから除去",
+  "Read metadata updates from XMP sidecars": "XMP サイドカーからメタデータの更新を読み込む",
+  "The library is up to date with this folder.": "ライブラリはこのフォルダと一致しています。",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "見つからない写真は「最近削除した写真」に移動し、復元できます。ディスク上のファイルには手を加えません",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "サイドカーを読み込むと、写真のレーティング、ラベル、メタデータ、編集内容がその内容に置き換わります。",
+  "Skipped: files already in the library elsewhere": "スキップ: 別の場所ですでにライブラリにあるファイル",
+  "Skipped: files that can't be read": "スキップ: 読み込めないファイル",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "このフォルダが見つかりません。移動または名前の変更がされたか、ディスクが接続されていません。",
+  "Relink photos whose file was renamed or moved": "ファイル名の変更や移動があった写真をリンクし直す",
+  "A folder is already being synchronized": "すでにフォルダを同期中です",
+  "Synchronizing…": "同期中…",
+  "Relinked": "リンクし直し",
+  "Removed": "除去",
+  "Metadata read": "メタデータ読み込み",
+  "Failed": "失敗",
+  "Stopped": "停止しました",
+  "Stopped by an error (see the log)": "エラーで停止しました（ログを参照）",
+  "Not saved": "保存されていません",
+  "A folder is being synchronized": "フォルダを同期中です",
+  "Wait for the import to finish": "読み込みが終わるまでお待ちください"
 }
diff --git a/crates/ui-egui/locales/pt-br-formats.json b/crates/ui-egui/locales/pt-br-formats.json
index ab64e082..b6c1c23b 100644
--- a/crates/ui-egui/locales/pt-br-formats.json
+++ b/crates/ui-egui/locales/pt-br-formats.json
@@ -206,5 +206,20 @@
   "In line for AI Denoise ({ahead} ahead)…": "In line for AI Denoise ({ahead} ahead)…",
   "Running on {}.": "Running on {}.",
   "{file} · {size}": "{file} · {size}",
-  "•  {assumption}": "•  {assumption}"
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "Colocar dentro de “{parent}”",
+  "Delete the keyword “{name}”?": "Excluir a palavra-chave “{name}”?",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "Ela é removida de {count} foto{}, com as palavras-chave abaixo dela. Desfazer a traz de volta.",
+  "Create Keyword Tag Inside “{name}”…": "Criar palavra-chave dentro de “{name}”…",
+  "“{parent}” has a “{name}” already. Merge the two?": "“{parent}” já tem “{name}”. Mesclar as duas?",
+  "There is a “{name}” at the top level already. Merge the two?": "Já existe “{name}” no nível superior. Mesclar as duas?",
+  "Added “{keyword}” to {n} photo{}": "“{keyword}” adicionada a {n} foto{}",
+  "On {have} of {of} selected photos": "Em {have} de {of} fotos selecionadas",
+  "Remove “{name}”": "Remover “{name}”",
+  "There is a keyword set “{name}” already": "Já existe um conjunto de palavras-chave “{name}”",
+  "Added {n} keyword{}": "Palavras-chave adicionadas: {n}{:.0}",
+  "; {n} gained synonyms": "; {n} receberam sinônimos",
+  "Exported {n} keyword{}": "Palavras-chave exportadas: {n}{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — O Capture One não importa uma lista com ; , < ou > em uma palavra-chave: {names}",
+  " — left out, as a keyword list can't hold them: {names}": " — omitidas, pois uma lista de palavras-chave não pode contê-las: {names}"
 }
diff --git a/crates/ui-egui/locales/pt-br.json b/crates/ui-egui/locales/pt-br.json
index 81e331c5..318120d8 100644
--- a/crates/ui-egui/locales/pt-br.json
+++ b/crates/ui-egui/locales/pt-br.json
@@ -1137,6 +1137,8 @@
   "Remove (H)": "Remover (H)",
   "Remove CA": "Remover AC",
   "Remove Chromatic Aberration": "Remover aberração cromática",
+  "Camera local tone mapping": "Mapeamento tonal local da câmera",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "Aplicar o mapeamento tonal local salvo no raw (Apple ProRAW), como a câmera o renderiza",
   "Remove Disk from Library": "Remover disco da biblioteca",
   "Remove Disk from Library…": "Remover disco da biblioteca…",
   "Remove Face Box": "Remover caixa de rosto",
@@ -1732,5 +1734,132 @@
   "Pending photo action cancelled": "Pending photo action cancelled",
   "Pending photo action cancelled because its library or photo changed": "Pending photo action cancelled because its library or photo changed",
   "ONNX model": "ONNX model",
-  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions"
+  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions",
+  "Decrease Rating": "Diminuir avaliação",
+  "Increase Rating": "Aumentar avaliação",
+  "Click to type a value": "Clique para digitar um valor",
+  "Angle": "Ângulo",
+  "Video": "Vídeo",
+  "Copyrighted": "Protegido por direitos autorais",
+  "Public Domain": "Domínio público",
+  "Unknown": "Desconhecido",
+  "Landscape (wide)": "Paisagem (horizontal)",
+  "Portrait (tall)": "Retrato (vertical)",
+  "Square": "Quadrada",
+  "In Color": "Colorida",
+  "No Label": "Sem rótulo",
+  "Choose an album…": "Escolha um álbum…",
+  "No albums yet": "Ainda não há álbuns",
+  "Fix the marked rules to save this album.": "Corrija as regras marcadas para salvar este álbum.",
+  "Some rules need fixing (Edit Smart Album…):": "Algumas regras precisam ser corrigidas (Editar álbum inteligente…):",
+  "isn't a field rules know": "não é um campo conhecido",
+  "can't be tested that way": "não pode ser testado assim",
+  "is yes or no": "é Sim ou Não",
+  "needs a number": "precisa de um número",
+  "needs a time like 1/250 or 2": "precisa de um tempo como 1/250 ou 2",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "precisa de uma data como 2026, 2026-08 ou 2026-08-14",
+  "has the first date after the second": "a primeira data é posterior à segunda",
+  "needs two values": "precisa de dois valores",
+  "needs a number more than 0": "precisa de um número maior que 0",
+  "needs hours, days, weeks, months or years": "precisa de horas, dias, semanas, meses ou anos",
+  "isn't one of the choices": "não é nenhuma das opções",
+  "needs something to look for (or use “is empty”)": "precisa de algo para procurar (ou use “está vazio”)",
+  "needs something to look for (or use “isn't empty”)": "precisa de algo para procurar (ou use “não está vazio”)",
+  "needs text": "precisa de texto",
+  "can't match any rating from 0 to 5": "não corresponde a nenhuma avaliação de 0 a 5",
+  "needs an album": "precisa de um álbum",
+  "names an album that no longer exists": "indica um álbum que não existe mais",
+  "can't test a folder; choose an album in it": "não pode testar uma pasta; escolha um álbum dentro dela",
+  "This group is empty: add a rule or remove it.": "Este grupo está vazio: adicione uma regra ou remova-o.",
+  "needs something to look for (or use “are empty”)": "precisa de algo para procurar (ou use “estão vazios”)",
+  "needs something to look for (or use “aren't empty”)": "precisa de algo para procurar (ou use “não estão vazios”)",
+  "Mo": "Seg",
+  "Tu": "Ter",
+  "We": "Qua",
+  "Th": "Qui",
+  "Fr": "Sex",
+  "Sa": "Sáb",
+  "Su": "Dom",
+  "Pick a date": "Escolher uma data",
+  "would make this album include itself through other smart albums": "faria este álbum incluir a si mesmo por meio de outros álbuns inteligentes",
+  "Search albums": "Pesquisar álbuns",
+  "No albums match": "Nenhum álbum corresponde",
+  "This is the album you're editing": "É o álbum que você está editando",
+  "It tests this album, so testing it back would loop": "Ele testa este álbum, então testá-lo de volta criaria um ciclo",
+  "Copy Name": "Nome da cópia",
+  "In a Stack": "Em uma pilha",
+  "File Extension": "Extensão do arquivo",
+  "Video Duration": "Duração do vídeo",
+  "Keyword Count": "Número de palavras-chave",
+  "People Count": "Número de pessoas",
+  "Shutter Speed": "Velocidade do obturador",
+  "Cropped": "Recortada",
+  "Keywords & People": "Palavras-chave e pessoas",
+  "Description": "Descrição",
+  "Camera Info": "Informações da câmera",
+  "Develop": "Edição",
+  "Keyword List": "Lista de palavras-chave",
+  "Filter Keywords": "Filtrar palavras-chave",
+  "No keywords yet": "Ainda não há palavras-chave",
+  "No keywords match": "Nenhuma palavra-chave corresponde",
+  "Keyword Name": "Nome da palavra-chave",
+  "Synonyms": "Sinônimos",
+  "Separated by commas": "Separados por vírgulas",
+  "Keyword Tag Options": "Opções da palavra-chave",
+  "Include on Export": "Incluir na exportação",
+  "Export Containing Keywords": "Exportar palavras-chave que a contêm",
+  "Export Synonyms": "Exportar sinônimos",
+  "Create Keyword Tag": "Criar palavra-chave",
+  "Edit Keyword Tag": "Editar palavra-chave",
+  "Create": "Criar",
+  "No photo has it; the keywords below it go too.": "Nenhuma foto a tem; as palavras-chave abaixo dela também são excluídas.",
+  "Edit Keyword Tag…": "Editar palavra-chave…",
+  "Put New Keywords Inside This Keyword": "Colocar novas palavras-chave dentro desta",
+  "Purge Unused Keywords": "Excluir palavras-chave não usadas",
+  "Delete Keyword…": "Excluir palavra-chave…",
+  "Drop here for the top level": "Solte aqui para o nível superior",
+  "Their photos and the keywords below them come together under one keyword.": "Suas fotos e as palavras-chave abaixo delas ficam sob uma só palavra-chave.",
+  "Select photos to give them keywords.": "Selecione fotos para dar palavras-chave a elas.",
+  "Add to All Selected Photos": "Adicionar a todas as fotos selecionadas",
+  "Will Export": "Será exportado",
+  "No keywords are exported": "Nenhuma palavra-chave é exportada",
+  "& Containing": "e as que as contêm",
+  "Edit Set…": "Editar conjunto…",
+  "Edit Keyword Set": "Editar conjunto de palavras-chave",
+  "Keywords (⌥1–⌥9)": "Palavras-chave (⌥1–⌥9)",
+  "A keyword set needs a name": "Um conjunto de palavras-chave precisa de um nome",
+  "Save as a new set": "Salvar como novo conjunto",
+  "Recent Keywords is built in: choose another name": "“Palavras-chave recentes” é fixo: escolha outro nome",
+  "Import Keywords…": "Importar palavras-chave…",
+  "Export Keywords…": "Exportar palavras-chave…",
+  "Import Keywords": "Importar palavras-chave",
+  "Export Keywords": "Exportar palavras-chave",
+  "Keyword Lists": "Listas de palavras-chave",
+  "Synchronize Folder…": "Sincronizar pasta…",
+  "Synchronize Folder": "Sincronizar pasta",
+  "Synchronize": "Sincronizar",
+  "Scanning…": "Verificando…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "Encontrar fotos adicionadas a esta pasta no disco ou ausentes dela, e arquivos XMP auxiliares alterados por outros apps",
+  "Bring the library up to date with this folder and the folders inside it:": "Atualizar a biblioteca com esta pasta e as pastas dentro dela:",
+  "Import new photos": "Importar fotos novas",
+  "Remove missing photos from the library": "Remover fotos ausentes da biblioteca",
+  "Read metadata updates from XMP sidecars": "Ler atualizações de metadados dos arquivos XMP auxiliares",
+  "The library is up to date with this folder.": "A biblioteca está atualizada com esta pasta.",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "As fotos ausentes vão para Excluídos recentemente e podem ser restauradas; nenhum arquivo no disco é alterado.",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "Ler um arquivo auxiliar substitui a classificação, os rótulos, os metadados e as edições da foto pelo que ele contém.",
+  "Skipped: files already in the library elsewhere": "Ignorados: arquivos que já estão na biblioteca em outro lugar",
+  "Skipped: files that can't be read": "Ignorados: arquivos que não podem ser lidos",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "Esta pasta não está lá: foi movida ou renomeada, ou o disco dela não está conectado.",
+  "Relink photos whose file was renamed or moved": "Vincular de novo fotos cujo arquivo foi renomeado ou movido",
+  "A folder is already being synchronized": "Uma pasta já está sendo sincronizada",
+  "Synchronizing…": "Sincronizando…",
+  "Relinked": "Revinculadas",
+  "Removed": "Removidas",
+  "Metadata read": "Metadados lidos",
+  "Failed": "Com falha",
+  "Stopped": "Interrompido",
+  "Stopped by an error (see the log)": "Interrompido por um erro (veja o log)",
+  "Not saved": "Não salvo",
+  "A folder is being synchronized": "Uma pasta está sendo sincronizada",
+  "Wait for the import to finish": "Aguarde a importação terminar"
 }
diff --git a/crates/ui-egui/locales/ru-formats.json b/crates/ui-egui/locales/ru-formats.json
index f3a0f647..cd55e708 100644
--- a/crates/ui-egui/locales/ru-formats.json
+++ b/crates/ui-egui/locales/ru-formats.json
@@ -206,5 +206,20 @@
   "In line for AI Denoise ({ahead} ahead)…": "In line for AI Denoise ({ahead} ahead)…",
   "Running on {}.": "Running on {}.",
   "{file} · {size}": "{file} · {size}",
-  "•  {assumption}": "•  {assumption}"
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "Поместить в «{parent}»",
+  "Delete the keyword “{name}”?": "Удалить ключевое слово «{name}»?",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "Оно будет снято с фото ({count}){:.0} вместе с вложенными ключевыми словами. Отмена вернёт его.",
+  "Create Keyword Tag Inside “{name}”…": "Создать ключевое слово в «{name}»…",
+  "“{parent}” has a “{name}” already. Merge the two?": "В «{parent}» уже есть «{name}». Объединить их?",
+  "There is a “{name}” at the top level already. Merge the two?": "На верхнем уровне уже есть «{name}». Объединить их?",
+  "Added “{keyword}” to {n} photo{}": "«{keyword}» добавлено к фото ({n}){:.0}",
+  "On {have} of {of} selected photos": "На {have} из {of} выбранных фото",
+  "Remove “{name}”": "Убрать «{name}»",
+  "There is a keyword set “{name}” already": "Набор ключевых слов «{name}» уже есть",
+  "Added {n} keyword{}": "Добавлено ключевых слов: {n}{:.0}",
+  "; {n} gained synonyms": "; синонимы добавлены к {n}",
+  "Exported {n} keyword{}": "Экспортировано ключевых слов: {n}{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — Capture One не импортирует список, где в ключевом слове есть ; , < или >: {names}",
+  " — left out, as a keyword list can't hold them: {names}": " — пропущены: список ключевых слов не может их содержать: {names}"
 }
diff --git a/crates/ui-egui/locales/ru.json b/crates/ui-egui/locales/ru.json
index 382bfc05..b51355c7 100644
--- a/crates/ui-egui/locales/ru.json
+++ b/crates/ui-egui/locales/ru.json
@@ -939,6 +939,8 @@
   "Remove (H)": "Удалить (H)",
   "Remove CA": "Убрать ХА",
   "Remove Chromatic Aberration": "Убрать хроматические аберрации",
+  "Camera local tone mapping": "Локальная тональная коррекция камеры",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "Применить локальную тональную коррекцию, сохранённую в raw (Apple ProRAW), как её рендерит камера",
   "Remove from Album": "Удалить из альбома",
   "Remove from Favorites": "Удалить из избранного",
   "Remove from Local": "Убрать из «Локального»",
@@ -1103,6 +1105,8 @@
   "Show destination gamut warning": "Показывать предупреждение о выходе за гамму устройства вывода",
   "Show display gamut warning": "Показывать предупреждение о выходе за гамму дисплея",
   "Show file names": "Показывать имена файлов",
+  "Show in Explorer": "Показать в Проводнике",
+  "Show in File Manager": "Показать в файловом менеджере",
   "Show in Finder": "Показать в Finder",
   "Show on Map": "Показать на карте",
   "Show overlay (O)": "Показать наложение (O)",
@@ -1403,5 +1407,172 @@
   "Pending photo action cancelled": "Pending photo action cancelled",
   "Pending photo action cancelled because its library or photo changed": "Pending photo action cancelled because its library or photo changed",
   "ONNX model": "ONNX model",
-  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions"
+  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions",
+  "Decrease Rating": "Уменьшить оценку",
+  "Increase Rating": "Увеличить оценку",
+  "Click to type a value": "Щёлкните, чтобы ввести значение",
+  "Angle": "Угол",
+  "Raw": "RAW",
+  "Video": "Видео",
+  "Copyrighted": "Защищено авторским правом",
+  "Public Domain": "Общественное достояние",
+  "Unknown": "Неизвестно",
+  "Landscape (wide)": "Альбомная",
+  "Portrait (tall)": "Книжная",
+  "Square": "Квадратная",
+  "In Color": "Цветное",
+  "No Label": "Без метки",
+  "Choose an album…": "Выберите альбом…",
+  "No albums yet": "Альбомов пока нет",
+  "Fix the marked rules to save this album.": "Исправьте отмеченные условия, чтобы сохранить альбом.",
+  "Some rules need fixing (Edit Smart Album…):": "Некоторые условия нужно исправить (Изменить смарт-альбом…):",
+  "isn't a field rules know": "неизвестное поле",
+  "can't be tested that way": "так проверить нельзя",
+  "is yes or no": "только «Да» или «Нет»",
+  "needs a number": "нужно число",
+  "needs a time like 1/250 or 2": "нужна выдержка вроде 1/250 или 2",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "нужна дата вроде 2026, 2026-08 или 2026-08-14",
+  "has the first date after the second": "первая дата позже второй",
+  "needs two values": "нужны два значения",
+  "needs a number more than 0": "нужно число больше 0",
+  "needs hours, days, weeks, months or years": "нужны часы, дни, недели, месяцы или годы",
+  "isn't one of the choices": "нет среди вариантов",
+  "needs something to look for (or use “is empty”)": "нужно указать, что искать (или выберите «пусто»)",
+  "needs something to look for (or use “isn't empty”)": "нужно указать, что искать (или выберите «не пусто»)",
+  "needs text": "нужен текст",
+  "can't match any rating from 0 to 5": "не подходит ни к одной оценке от 0 до 5",
+  "needs an album": "нужен альбом",
+  "names an album that no longer exists": "указан альбом, которого больше нет",
+  "can't test a folder; choose an album in it": "нельзя проверять папку; выберите альбом в ней",
+  "This group is empty: add a rule or remove it.": "Эта группа пуста: добавьте условие или удалите её.",
+  "needs something to look for (or use “are empty”)": "нужно указать, что искать (или выберите «пусты»)",
+  "needs something to look for (or use “aren't empty”)": "нужно указать, что искать (или выберите «не пусты»)",
+  "are empty": "пусты",
+  "aren't empty": "не пусты",
+  "contains": "содержит",
+  "doesn't contain": "не содержит",
+  "ends with": "заканчивается на",
+  "is": "равно",
+  "is <": "меньше",
+  "is >": "больше",
+  "is after": "после",
+  "is before": "до",
+  "is between": "между",
+  "is empty": "пусто",
+  "is in the last": "за последние",
+  "is unknown": "неизвестна",
+  "is ≤": "не больше",
+  "is ≥": "не меньше",
+  "isn't": "не равно",
+  "isn't empty": "не пусто",
+  "isn't in the last": "не за последние",
+  "starts with": "начинается с",
+  "Mo": "Пн",
+  "Tu": "Вт",
+  "We": "Ср",
+  "Th": "Чт",
+  "Fr": "Пт",
+  "Sa": "Сб",
+  "Su": "Вс",
+  "Pick a date": "Выбрать дату",
+  "would make this album include itself through other smart albums": "альбом включал бы сам себя через другие смарт-альбомы",
+  "Search albums": "Поиск альбомов",
+  "No albums match": "Нет подходящих альбомов",
+  "This is the album you're editing": "Это альбом, который вы изменяете",
+  "It tests this album, so testing it back would loop": "Он проверяет этот альбом, поэтому обратная проверка создаст цикл",
+  "Copy Name": "Имя копии",
+  "In a Stack": "В стопке",
+  "File Extension": "Расширение файла",
+  "Video Duration": "Длительность видео",
+  "Keyword Count": "Число ключевых слов",
+  "People Count": "Число людей",
+  "Shutter Speed": "Выдержка",
+  "Cropped": "Кадрировано",
+  "Keywords & People": "Ключевые слова и люди",
+  "Description": "Описание",
+  "Camera Info": "Сведения о камере",
+  "Develop": "Обработка",
+  "Pick Flag": "Флаг",
+  "Any Searchable Text": "Любой текст для поиска",
+  "Filename": "Имя файла",
+  "File Type": "Тип файла",
+  "File Format": "Формат файла",
+  "Edit Date": "Дата изменения",
+  "People": "Люди",
+  "Focal Length": "Фокусное расстояние",
+  "ISO Speed": "ISO",
+  "Has GPS": "Есть GPS",
+  "Has Edits": "Есть правки",
+  "Focus (assisted culling)": "Резкость (помощь в отборе)",
+  "Best of Similar Shots": "Лучший из похожих снимков",
+  "Date": "Дата",
+  "Color Label": "Цветовая метка",
+  "Keyword List": "Список ключевых слов",
+  "Filter Keywords": "Фильтр ключевых слов",
+  "No keywords yet": "Ключевых слов пока нет",
+  "No keywords match": "Нет подходящих ключевых слов",
+  "Keyword Name": "Название ключевого слова",
+  "Synonyms": "Синонимы",
+  "Separated by commas": "Через запятую",
+  "Keyword Tag Options": "Параметры ключевого слова",
+  "Include on Export": "Включать при экспорте",
+  "Export Containing Keywords": "Экспортировать родительские ключевые слова",
+  "Export Synonyms": "Экспортировать синонимы",
+  "Create Keyword Tag": "Создать ключевое слово",
+  "Edit Keyword Tag": "Изменить ключевое слово",
+  "Create": "Создать",
+  "No photo has it; the keywords below it go too.": "Ни у одного фото его нет; вложенные ключевые слова тоже будут удалены.",
+  "Edit Keyword Tag…": "Изменить ключевое слово…",
+  "Put New Keywords Inside This Keyword": "Помещать новые ключевые слова в это",
+  "Purge Unused Keywords": "Удалить неиспользуемые ключевые слова",
+  "Delete Keyword…": "Удалить ключевое слово…",
+  "Drop here for the top level": "Отпустите здесь для верхнего уровня",
+  "Their photos and the keywords below them come together under one keyword.": "Их фото и вложенные ключевые слова объединятся под одним ключевым словом.",
+  "Select photos to give them keywords.": "Выберите фото, чтобы назначить им ключевые слова.",
+  "Person": "Человек",
+  "Add to All Selected Photos": "Добавить ко всем выбранным фото",
+  "Will Export": "Будет экспортировано",
+  "No keywords are exported": "Ключевые слова не экспортируются",
+  "& Containing": "и родительские",
+  "Edit Set…": "Изменить набор…",
+  "Edit Keyword Set": "Изменить набор ключевых слов",
+  "Keywords (⌥1–⌥9)": "Ключевые слова (⌥1–⌥9)",
+  "A keyword set needs a name": "Набору ключевых слов нужно название",
+  "Set name": "Название набора",
+  "Save as a new set": "Сохранить как новый набор",
+  "Recent Keywords is built in: choose another name": "«Недавние ключевые слова» — встроенный набор: выберите другое название",
+  "Recent Keywords": "Недавние ключевые слова",
+  "Import Keywords…": "Импорт ключевых слов…",
+  "Export Keywords…": "Экспорт ключевых слов…",
+  "Import Keywords": "Импорт ключевых слов",
+  "Export Keywords": "Экспорт ключевых слов",
+  "Keyword Lists": "Списки ключевых слов",
+  "Synchronize Folder…": "Синхронизировать папку…",
+  "Synchronize Folder": "Синхронизация папки",
+  "Synchronize": "Синхронизировать",
+  "Scanning…": "Сканирование…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "Найти фото, добавленные в эту папку на диске или пропавшие из неё, и файлы XMP, изменённые другими приложениями",
+  "Bring the library up to date with this folder and the folders inside it:": "Привести медиатеку в соответствие с этой папкой и вложенными папками:",
+  "Import new photos": "Импортировать новые фото",
+  "Remove missing photos from the library": "Убрать отсутствующие фото из медиатеки",
+  "Read metadata updates from XMP sidecars": "Прочитать изменения метаданных из файлов XMP",
+  "The library is up to date with this folder.": "Медиатека соответствует этой папке.",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "Отсутствующие фото перемещаются в «Недавно удалённые» и могут быть восстановлены; файлы на диске не затрагиваются.",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "Чтение файла XMP заменяет рейтинг, метки, метаданные и правки фото его содержимым.",
+  "Skipped: files already in the library elsewhere": "Пропущено: файлы, которые уже есть в медиатеке в другом месте",
+  "Skipped: files that can't be read": "Пропущено: файлы, которые не удаётся прочитать",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "Этой папки нет: её переместили или переименовали, или её диск не подключён.",
+  "Relink photos whose file was renamed or moved": "Заново связать фото, файл которых переименован или перемещён",
+  "A folder is already being synchronized": "Папка уже синхронизируется",
+  "Synchronizing…": "Синхронизация…",
+  "Imported": "Импортировано",
+  "Relinked": "Связано заново",
+  "Removed": "Убрано",
+  "Metadata read": "Метаданные прочитаны",
+  "Failed": "Ошибки",
+  "Stopped": "Остановлено",
+  "Stopped by an error (see the log)": "Остановлено из-за ошибки (см. журнал)",
+  "Not saved": "Не сохранено",
+  "A folder is being synchronized": "Идёт синхронизация папки",
+  "Wait for the import to finish": "Дождитесь окончания импорта"
 }
diff --git a/crates/ui-egui/locales/uk-formats.json b/crates/ui-egui/locales/uk-formats.json
new file mode 100644
index 00000000..2196c6ba
--- /dev/null
+++ b/crates/ui-egui/locales/uk-formats.json
@@ -0,0 +1,225 @@
+{
+  " ({unsure} with several look-alike files: use Locate)": " ({unsure} із кількома схожими файлами: використайте «Знайти»)",
+  " ({} in Recently Deleted)": " ({} у нещодавно видалених)",
+  " · {:.0}% clipped": " · {:.0}% відсічено",
+  " · {failed} couldn't be rendered": " · не вдалося відтворити: {failed}",
+  " · {skipped} skipped (file exists)": " · пропущено: {skipped} (файл існує)",
+  " · {} duplicate{} skipped": " · дублікатів пропущено: {}{:.0}",
+  " · {} failed: {}": " · помилок: {}: {}",
+  " · {} moved": " · переміщено: {}",
+  " · {} not readable": " · не читається: {}",
+  " · {} original{} left at the source": " · оригіналів залишено в джерелі: {}{:.0}",
+  " · {} restored from Recently Deleted": " · відновлено з нещодавно видалених: {}",
+  " — not carried over: {}{}": " — не перенесено: {}{}",
+  "+{} more": "+{} ще",
+  ", {failed} file{} not readable": ", файлів не читається: {failed}{:.0}",
+  "; {kept} already had a location": "; уже мали розташування: {kept}",
+  "; {outside} outside its time range": "; поза часовим діапазоном маршруту: {outside}",
+  "@{}: {} PRs, {} commits, +{} / −{} lines (Δ {}), +{} / −{} binary assets, {} – {}": "@{}: PR: {}, комітів: {}, рядків: +{} / −{} (Δ {}), двійкових ресурсів: +{} / −{}, {} – {}",
+  "Add {local_n} to My Photos": "Додати до моїх фото: {local_n}",
+  "Add {} Photo{}": "Додати фото: {}{:.0}",
+  "Add {} Photo{}, restore {}": "Додати фото: {}{:.0}, відновити: {}",
+  "Add “{}” to Favorites": "Додати «{}» до улюблених",
+  "Added {n} photo{} to My Photos": "До моїх фото додано: {n}{:.0}",
+  "Added {n} photo{} to “{}”": "До «{1}» додано фото: {n}{0:.0}",
+  "Added {what} to {name}": "{what}: додано до {name}",
+  "Adding photos… {} of {}": "Додавання фото… {} з {}",
+  "All {n} selected photos move by the same amount.": "Усі вибрані фото ({n}) зміщуються на однакове значення.",
+  "Already in the library, in Recently Deleted: {} photo{} selected · right-click ▸ Restore, or Delete Permanently to import afresh": "Уже в бібліотеці, у нещодавно видалених: вибрано фото: {}{:.0} · права кнопка → Відновити або Видалити назавжди, щоб імпортувати заново",
+  "Already in the library: {} photo{} selected in All Photos": "Уже в бібліотеці: вибрано фото в усіх фото: {}{:.0}",
+  "Auto ({})": "Автоматично ({})",
+  "Auto Import: added {} photo{}": "Автоімпорт: додано фото: {}{:.0}",
+  "Auto Sync: edits apply to {n} photos": "Автосинхронізація: зміни застосовуються до фото: {n}",
+  "Automatic ({} MB)": "Автоматично ({} МБ)",
+  "Build 1:1 Previews ({scope})": "Створити перегляди 1:1 ({scope})",
+  "Build Smart Previews ({scope})": "Створити смарт-перегляди ({scope})",
+  "Build Standard-Sized Previews ({scope})": "Створити перегляди стандартного розміру ({scope})",
+  "Building previews for {} photos…": "Створення переглядів для фото: {}…",
+  "Click {}:1": "Клацання {}:1",
+  "Couldn't open the editor: {e}": "Не вдалося відкрити редактор: {e}",
+  "Create {n} Virtual Copies": "Створити віртуальні копії: {n}",
+  "Creates {} stacks from {} of {scope}": "Буде створено стосів: {} із {} ({scope})",
+  "Decoder: {reason}": "Декодер: {reason}",
+  "Delete \"{label}\"": "Видалити «{label}»",
+  "Delete \"{label}\" (and the mask)": "Видалити «{label}» (і маску)",
+  "Delete {n} Photos": "Видалити фото: {n}",
+  "Delete “{current}”": "Видалити «{current}»",
+  "Discard Smart Previews ({scope})": "Видалити смарт-перегляди ({scope})",
+  "Done ({what}): {done} photo{plural}": "Готово ({what}): фото: {done}{plural:.0}",
+  "Duplicate \"{label}\"": "Дублювати «{label}»",
+  "Example: {example}": "Приклад: {example}",
+  "Exported {n} photo{}": "Експортовано фото: {n}{:.0}",
+  "Exported {ok} of {total} photo{}": "Експортовано фото: {ok} із {total}{:.0}",
+  "Exported {} point curve preset{}": "Експортовано наборів налаштувань точкової кривої: {}{:.0}",
+  "Exported {} preset{}": "Експортовано наборів налаштувань: {}{:.0}",
+  "Exporting {} of {total}": "Експорт: {} із {total}",
+  "Filter bar — {active} active filter{}": "Панель фільтрів — активних фільтрів: {active}{:.0}",
+  "Focus {:.0}": "Фокус {:.0}",
+  "Folder “{}” (and its subfolders)": "Тека «{}» (і вкладені теки)",
+  "Found {n} missing photo{}; {left} still missing{unsure}": "Знайдено відсутніх фото: {n}{:.0}; усе ще відсутні: {left}{unsure}",
+  "Healed {n} dust spot{}": "Усунено пилових плям: {n}{:.0}",
+  "Import cancelled · {} photo{} added": "Імпорт скасовано · додано фото: {}{:.0}",
+  "Import failed: {e}": "Помилка імпорту: {e}",
+  "Imported {n} point curve preset{}": "Імпортовано наборів налаштувань точкової кривої: {n}{:.0}",
+  "Imported {n} preset{}": "Імпортовано наборів налаштувань: {n}{:.0}",
+  "Imported {n} preset{}, {f} file{} not readable": "Імпортовано наборів налаштувань: {n}{:.0}, файлів не читається: {f}{:.0}",
+  "Imported {profiles} profile{} (Profile browser ▸ their groups)": "Імпортовано профілів: {profiles}{:.0} (Оглядач профілів → їхні групи)",
+  "Imported {} photo{}": "Імпортовано фото: {}{:.0}",
+  "Insert at the cursor (also written {})": "Вставити в позицію курсора (також записується як {})",
+  "Label Set: {name}": "Набір міток: {name}",
+  "LightCraft could not open its window: {e}": "LightCraft не вдалося відкрити вікно: {e}",
+  "LightCraft could not open its window: {e}\n\nThe log file has the details: {path}": "LightCraft не вдалося відкрити вікно: {e}\n\nПодробиці у файлі журналу: {path}",
+  "Lightroom catalog inspected: {photos} photos, {collections} collections, {missing} missing": "Каталог Lightroom перевірено: фото — {photos}, колекцій — {collections}, відсутні — {missing}",
+  "Lightroom import complete: {imported} photos added": "Імпорт Lightroom завершено: додано фото — {imported}",
+  "Lightroom import complete: {imported} photos added, {failed} failed": "Імпорт Lightroom завершено: додано фото — {imported}, помилок — {failed}",
+  "Lightroom import complete: {imported} photos added; index warning: {warning}": "Імпорт Lightroom завершено: додано фото — {imported}; попередження індексу: {warning}",
+  "Lightroom import failed: {e}{warning}": "Помилка імпорту Lightroom: {e}{warning}",
+  "Lightroom inspection failed: {e}{warning}": "Помилка перевірки Lightroom: {e}{warning}",
+  "MIT OR Apache-2.0. Fonts: {} (OFL). Icons: original.": "MIT OR Apache-2.0. Шрифти: {} (OFL). Значки: оригінальні.",
+  "Matches: {}": "Збігів: {}",
+  "Merging… {stage} {:.0}%": "Об’єднання… {stage} {:.0}%",
+  "Move {what} to Recently Deleted?": "Перемістити {what} до нещодавно видалених?",
+  "Named ({named_n})": "З іменами ({named_n})",
+  "Painting “{k}”: click photos to add or remove it · Esc stops": "Призначення «{k}»: клацайте фото, щоб додати або вилучити його · Esc завершує",
+  "Paste into {n} photo{} — only settings that were copied are pasted": "Вставка у фото: {n}{:.0} — вставляються лише скопійовані налаштування",
+  "Preset: {name}": "Набір налаштувань: {name}",
+  "Preview only — editing the camera's embedded JPEG ({})": "Лише перегляд — редагування вбудованого JPEG камери ({})",
+  "Preview only — {}": "Лише перегляд — {}",
+  "Previews ready for {done} photo{plural}": "Перегляди готові для фото: {done}{plural:.0}",
+  "Profile: {}": "Профіль: {}",
+  "Proof Copy ({})": "Пробна копія ({})",
+  "Proof Preview · {}": "Пробний перегляд · {}",
+  "Quick Develop · {n} photos": "Швидка обробка · фото: {n}",
+  "Quick Develop: {name}": "Швидка обробка: {name}",
+  "Rated {}": "Оцінено: {}",
+  "Reading Lightroom catalog… {done} of {total}": "Читання каталогу Lightroom… {done} із {total}",
+  "Reading photos… {done} of {total}": "Читання фото… {done} із {total}",
+  "Reading photos… {} of {}": "Читання фото… {} із {}",
+  "Redo {}": "Повторити {}",
+  "Remove “{name}” and its {count} photo{} from the library?": "Вилучити «{name}» і фото ({count}){:.0} з бібліотеки?",
+  "Remove “{}” from Favorites": "Вилучити «{}» з улюблених",
+  "Removed from {}": "Вилучено з {}",
+  "Removed {what} from {name}": "{what}: вилучено з {name}",
+  "Rename {n} Photos…": "Перейменувати фото: {n}…",
+  "Rename “{name}”": "Перейменувати «{name}»",
+  "Renames “{from}” on {n} photo{} (keywords below it too). Use | for levels, e.g. Travel|Italy. An existing name merges the two.": "Перейменовує «{from}» на фото ({n}){:.0} (також вкладені ключові слова). Використовуйте | для рівнів, наприклад Подорожі|Італія. Наявна назва об’єднує обидва слова.",
+  "Rendering on the CPU: {why}": "Рендеринг на ЦП: {why}",
+  "Replace {} with:": "Замінити {} на:",
+  "Reset {name}": "Скинути: {name}",
+  "Reset {} Channel": "Скинути канал: {}",
+  "Restore {}": "Відновити {}",
+  "Restore {} Photo{}": "Відновити фото: {}{:.0}",
+  "Saved export preset “{}”": "Набір налаштувань експорту «{}» збережено",
+  "Scores {scope} for focus and exposure and finds similar shots taken within seconds of each other (bursts).": "Оцінює фокус і експозицію ({scope}) та знаходить подібні знімки з різницею в кілька секунд (серії).",
+  "Show {hidden} hidden location{}": "Показати приховані розташування: {hidden}{:.0}",
+  "Showing {n} of {}": "Показано {n} із {}",
+  "Smart album: {}": "Смарт-альбом: {}",
+  "Tagged {n} photo{} from the tracklog": "Позначено за журналом маршруту фото: {n}{:.0}",
+  "The SAM 3 download failed: {e}": "Не вдалося завантажити SAM 3: {e}",
+  "Undo {}": "Скасувати {}",
+  "Unknown tag{s} {} stay{} as typed (see Tags)": "Невідомі теги{s:.0} {} залишаються як введено{:.0} (див. «Теги»)",
+  "Updated “{name}”": "«{name}» оновлено",
+  "Version {} — a clean-room, pure-Rust photo library and raw developer.": "Версія {} — незалежно розроблена бібліотека фото й обробка RAW на чистому Rust.",
+  "Version: {}": "Версія: {}",
+  "Virtual copy “{name}” of {of}": "Віртуальна копія «{name}» з {of}",
+  "Working on {what} for {} photos…": "{what}: обробка фото ({})…",
+  "none (CPU rendering): {why}": "немає (рендеринг на ЦП): {why}",
+  "the {n} selected photos": "вибрані фото: {n}",
+  "the {} photos in view": "фото в поданні: {}",
+  "these {count} photos": "ці фото ({count})",
+  "{count} smart preview{} · {:.1} MB": "Смарт-переглядів: {count}{:.0} · {:.1} МБ",
+  "{f} folders (and their subfolders)": "Тек: {f} (і їхніх вкладених тек)",
+  "{label} Grading": "Колірне тонування: {label}",
+  "{label} {d:+} on every selected photo": "{label} {d:+} на кожному вибраному фото",
+  "{label} {index} of {n}": "{label} {index} із {n}",
+  "{label}, {n} photos": "{label}, фото: {n}",
+  "{matching} of {t} photos": "Фото: {matching} із {t}",
+  "{matching} photos": "Фото: {matching}",
+  "{mode} spot {} of {}": "{mode}: ділянка {} із {}",
+  "{month}": "{month}",
+  "{month} {year}": "{month:02}.{year}",
+  "{msg} ({failed} failed)": "{msg} (помилок: {failed})",
+  "{name} Label": "Мітка: {name}",
+  "{name} Off": "{name}: вимкнено",
+  "{name} On": "{name}: увімкнено",
+  "{name} opened for editing; it is stacked with the original": "{name} відкрито для редагування й об’єднано в стос з оригіналом",
+  "{name} — double-click to reset it": "{name} — подвійне клацання для скидання",
+  "{n} change{} couldn't be written to disk: {e}\nIf you quit now, {} lost.": "Змін не вдалося записати на диск: {n}{0:.0}: {e}\nЯкщо вийти зараз, їх буде втрачено.{1:.0}",
+  "{n} change{} saved in memory but not written to disk: {e}\nLightCraft retries automatically; quitting now would lose {}.": "Змін збережено в пам’яті, але не записано на диск: {n}{:.0}: {e}\nLightCraft повторює спроби автоматично; вихід зараз призведе до їхньої втрати.{:.0}",
+  "{n} change{} saved in memory but not written to disk: {e} — LightCraft will retry": "Змін збережено в пам’яті, але не записано на диск: {n}{:.0}: {e} — LightCraft повторить спробу",
+  "{n} found · {sel} selected": "Знайдено: {n} · вибрано: {sel}",
+  "{n} photos": "Фото: {n}",
+  "{n} photos in {} are hidden by the filters above": "Фільтри вище приховують фото в «{}»: {n}",
+  "{n} photo{}": "Фото: {n}{:.0}",
+  "{n} photo{} match · updates automatically as photos change": "Відповідних фото: {n}{:.0} · оновлюється автоматично зі зміною фото",
+  "{n} photo{} now · updates automatically as photos change": "Зараз фото: {n}{:.0} · оновлюється автоматично зі зміною фото",
+  "{pid} (missing)": "{pid} (відсутній)",
+  "{sel_n} selected · {counted}": "Вибрано: {sel_n} · {counted}",
+  "{stage}… {:.0}%": "{stage}… {:.0}%",
+  "{verb} {n} Photo{}": "{verb} (фото: {n}){:.0}",
+  "{weekday}, {day}": "{weekday}, {day}",
+  "{weekday}, {day} {month} {year}": "{weekday}, {day:02}.{month:02}.{year}",
+  "{what} merge added": "{what}: об’єднання додано",
+  "{what} merge failed: {e}": "{what}: помилка об’єднання: {e}",
+  "{year}": "{year}",
+  "{{date:…}} directives: {}": "Директиви {{date:…}}: {}",
+  "{} and higher": "{} і вище",
+  "{} contributors · {} commits": "Учасників: {} · комітів: {}",
+  "{} failed": "Помилок: {}",
+  "{} files": "Файлів: {}",
+  "{} files and {f} folder{}": "Файлів: {}, тек: {f}{:.0}",
+  "{} item{}": "Елементів: {}{:.0}",
+  "{} of 4 guides — drag along lines that should be vertical or horizontal.": "Напрямних: {} із 4 — проведіть уздовж ліній, які мають бути вертикальними або горизонтальними.",
+  "{} photos": "Фото: {}",
+  "{} photos · exposures {} EV": "Фото: {} · експозиції {} EV",
+  "{} photos · {} · {:.0}° × {:.0}°": "Фото: {} · {} · {:.0}° × {:.0}°",
+  "{} photo{} not readable": "Не читається фото: {}{:.0}",
+  "{} sample{}": "Зразків: {}{:.0}",
+  "{} sec": "{} с",
+  "{} spot(s) on this photo": "Ділянок на цьому фото: {}",
+  "{} — show their photos": "{} — показати фото цієї особи",
+  "· {dups} already in the library": "· уже в бібліотеці: {dups}",
+  "· {n} photo{}": "· фото: {n}{:.0}",
+  "… and {more} more": "… і ще {more}",
+  "LightCraft can't decode this raw variant yet ({}). You're editing the camera's embedded JPEG preview, which already includes the camera's picture style (e.g. Monochrome) and white balance.": "LightCraft ще не може декодувати цей варіант RAW ({}). Ви редагуєте вбудований JPEG-перегляд камери, який уже містить її стиль зображення (наприклад, монохромний) і баланс білого.",
+  "Filtered: {label}": "Відфільтровано: {label}",
+  "{n} similar photo{} · View ▸ Clear Filters to see all": "Подібних фото: {n}{:.0} · Вигляд → Скинути фільтри, щоб побачити всі",
+  "Moved; {} photo(s) relinked": "Переміщено; повторно пов’язано фото: {}",
+  "{} label (click more labels to show any of them)": "Мітка «{}» (клацніть інші мітки, щоб показати фото з будь-якою з них)",
+  ", {} star{}": ", зірок: {}{:.0}",
+  ", {} label": ", мітка: {}",
+  "Downloads from {host}. Once it has arrived and checked out, LightCraft installs it, {after}.": "Завантажується з {host}. Після отримання й перевірки LightCraft установлює модель, {after}.",
+  "{:.1} MB": "{:.1} МБ",
+  "Running on the processor: {}.": "Працює на процесорі: {}.",
+  "{} · {}. Kept in the library's “denoise” folder; the oldest ones that no photo uses go first when the limit is reached.": "{} · {}. Зберігається в теці «denoise» бібліотеки; після досягнення ліміту першими видаляються найстаріші зображення, які не використовуються жодним фото.",
+  "Denoising {name}: {done} of {total} tiles{}": "Усунення шуму {name}: ділянки — {done} із {total}{}",
+  "{size} GB": "{size} ГБ",
+  "{} of {} from {host}": "{} із {} з {host}",
+  "{} KB": "{} КБ",
+  "{} MB": "{} МБ",
+  "Making the denoised picture… {}%": "Створення зображення з усуненим шумом… {}%",
+  "{name} · {terms}": "{name} · {terms}",
+  "{n} {noun}": "{noun}: {n}",
+  "Trained on: {provenance}": "Навчено на: {provenance}",
+  " · {queued} waiting": " · очікують: {queued}",
+  "Shows the model's terms, then downloads {} from {host}, installs it and starts using it. Nothing else is sent.": "Показує умови моделі, потім завантажує {} з {host}, установлює й починає використовувати її. Більше нічого не надсилається.",
+  "In line for AI Denoise ({ahead} ahead)…": "У черзі на усунення шуму ШІ (попереду: {ahead})…",
+  "Running on {}.": "Працює на {}.",
+  "{file} · {size}": "{file} · {size}",
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "Помістити в «{parent}»",
+  "Delete the keyword “{name}”?": "Видалити ключове слово «{name}»?",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "Його буде знято з фото (кількість: {count}{:.0}) разом із вкладеними ключовими словами. Скасування поверне його.",
+  "Create Keyword Tag Inside “{name}”…": "Створити ключове слово в «{name}»…",
+  "“{parent}” has a “{name}” already. Merge the two?": "«{parent}» уже містить «{name}». Об’єднати їх?",
+  "There is a “{name}” at the top level already. Merge the two?": "На верхньому рівні вже є «{name}». Об’єднати їх?",
+  "Added “{keyword}” to {n} photo{}": "«{keyword}» додано до фото: {n}{:.0}",
+  "On {have} of {of} selected photos": "На {have} з {of} вибраних фото",
+  "Remove “{name}”": "Вилучити «{name}»",
+  "There is a keyword set “{name}” already": "Набір ключових слів «{name}» уже існує",
+  "Added {n} keyword{}": "Додано ключових слів: {n}{:.0}",
+  "; {n} gained synonyms": "; отримали синоніми: {n}",
+  "Exported {n} keyword{}": "Експортовано ключових слів: {n}{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — Capture One не імпортує список, у якому ключове слово містить ; , < або >: {names}",
+  " — left out, as a keyword list can't hold them: {names}": " — пропущено, бо список ключових слів не може їх містити: {names}"
+}
diff --git a/crates/ui-egui/locales/uk.json b/crates/ui-egui/locales/uk.json
new file mode 100644
index 00000000..52a30fb7
--- /dev/null
+++ b/crates/ui-egui/locales/uk.json
@@ -0,0 +1,2059 @@
+{
+  "% of all commits": "% усіх комітів",
+  "About": "Про програму",
+  "Add": "Додати",
+  "Add to": "Додати до",
+  "All": "Усе",
+  "Always": "Завжди",
+  "Amount": "Інтенсивність",
+  "Aperture": "Діафрагма",
+  "Apply": "Застосувати",
+  "Aqua": "Бірюзовий",
+  "ArtCraft Website": "Вебсайт ArtCraft",
+  "Aspect Ratio": "Співвідношення сторін",
+  "Auto": "Авто",
+  "Automatic": "Автоматично",
+  "Background": "Фон",
+  "Balance": "Баланс",
+  "Basic": "Основні",
+  "Binary assets added": "Додані двійкові ресурси",
+  "Binary assets removed": "Вилучені двійкові ресурси",
+  "Bit depth": "Бітова глибина",
+  "Black & White": "Чорно-біле",
+  "Blacks": "Чорні тони",
+  "Bleach Bypass": "Пропуск відбілювання",
+  "Blending": "Змішування",
+  "Blue": "Синій",
+  "Bring All to Front": "Усі вікна на передній план",
+  "Browse…": "Огляд…",
+  "Brush": "Пензель",
+  "Cancel": "Скасувати",
+  "Caption": "Підпис",
+  "Change": "Змінити",
+  "Choose…": "Вибрати…",
+  "City": "Місто",
+  "Clarity": "Чіткість",
+  "Clear": "Очистити",
+  "Clear Guides": "Очистити напрямні",
+  "Clear History": "Очистити історію",
+  "Clone": "Клонування",
+  "Close": "Закрити",
+  "Color": "Колір",
+  "Color Grading": "Колірне тонування",
+  "Color Mixer": "Змішувач кольорів",
+  "Color Noise Reduction": "Зменшення колірного шуму",
+  "Color Priority": "Пріоритет кольору",
+  "Color Range": "Колірний діапазон",
+  "Color space": "Колірний простір",
+  "Colors": "Кольори",
+  "Commits": "Коміти",
+  "Company": "Компанія",
+  "Compression": "Стиснення",
+  "Contrast": "Контрастність",
+  "Contributors": "Учасники",
+  "Copy": "Копіювати",
+  "Copyright": "Авторське право",
+  "Copyright Info URL": "URL інформації про авторське право",
+  "Copyright Status": "Статус авторського права",
+  "Country": "Країна",
+  "Crop": "Кадрування",
+  "Cross Process": "Перехресна обробка",
+  "Curve": "Крива",
+  "Custom": "Довільний",
+  "Custom…": "Довільний…",
+  "Darken": "Затемнення",
+  "Darks": "Темні тони",
+  "Defringe": "Прибрати облямівку",
+  "Dehaze": "Усунення серпанку",
+  "Delete": "Видалити",
+  "Delete Preset": "Видалити набір налаштувань",
+  "Density": "Щільність",
+  "Deselect All": "Зняти всі виділення",
+  "Detail": "Деталі",
+  "Details": "Подробиці",
+  "Display P3": "Display P3",
+  "Display name": "Відображуване ім’я",
+  "Distortion": "Спотворення",
+  "Done": "Готово",
+  "Download": "Завантажити",
+  "Duplicate": "Дублювати",
+  "Edge": "Край",
+  "Edit": "Редагування",
+  "Editing": "Редагування",
+  "Effects": "Ефекти",
+  "English": "English",
+  "Erase": "Стирання",
+  "Export": "Експорт",
+  "Export Presets": "Експортувати набори налаштувань",
+  "Export…": "Експортувати…",
+  "Exposure": "Експозиція",
+  "Favorites": "Улюблені",
+  "Feather": "Розтушовування",
+  "File": "Файл",
+  "Fill": "Заливка",
+  "First": "Перший",
+  "First commit": "Перший коміт",
+  "Focal Length": "Фокусна відстань",
+  "Grab bag": "Випадкова добірка",
+  "Group name": "Назва групи",
+  "Home": "Домашня тека",
+  "ISO Speed": "Чутливість ISO",
+  "Imported": "Імпортовані",
+  "Join the ArtCraft Discord": "Приєднатися до Discord ArtCraft",
+  "Join the ArtCraft Discord…": "Приєднатися до Discord ArtCraft…",
+  "Label": "Мітка",
+  "Last commit": "Останній коміт",
+  "Lens Blur": "Розмиття об’єктива",
+  "Line delta": "Різниця рядків",
+  "Linear": "Лінійний",
+  "Lines +/−": "Рядки +/−",
+  "Lines added": "Додані рядки",
+  "Lines deleted": "Видалені рядки",
+  "Lock": "Заблокувати",
+  "Merged PRs": "Об’єднані PR",
+  "Model": "Модель",
+  "Models": "Моделі",
+  "Move Down": "Перемістити вниз",
+  "Move Up": "Перемістити вгору",
+  "Name (A–Z)": "Ім’я (А–Я)",
+  "No contributor data was built into this copy.": "У цю копію не вбудовано дані про учасників.",
+  "No matching commands": "Немає відповідних команд",
+  "No model credits were built into this copy.": "У цю копію не вбудовано дані про використані моделі.",
+  "Press keys…": "Натисніть клавіші…",
+  "Radial": "Радіальний",
+  "Random": "Випадковий",
+  "Real name": "Справжнє ім’я",
+  "Recent": "Нещодавні",
+  "Filter": "Фільтр",
+  "Fit": "Умістити",
+  "Flag": "Прапорець",
+  "Flash": "Спалах",
+  "Flip Horizontal": "Віддзеркалити горизонтально",
+  "Flip Vertical": "Віддзеркалити вертикально",
+  "Flow": "Потік",
+  "Folder": "Тека",
+  "Format": "Формат",
+  "Free": "Довільно",
+  "Full": "Повне",
+  "General": "Загальні",
+  "Glossy": "Глянцеве",
+  "Grain": "Зерно",
+  "Graphic": "Графіка",
+  "Green": "Зелений",
+  "Grid": "Сітка",
+  "Group": "Група",
+  "Heal": "Відновлення",
+  "Height": "Висота",
+  "Help": "Довідка",
+  "Hide Others": "Приховати інші",
+  "High": "Висока",
+  "Highlight": "Світла ділянка",
+  "Highlights": "Світлі ділянки",
+  "Histogram": "Гістограма",
+  "History": "Історія",
+  "Horizontal": "Горизонтальна",
+  "Hue": "Тон",
+  "Import": "Імпорт",
+  "Import Presets": "Імпортувати набори налаштувань",
+  "Info": "Інформація",
+  "Interface": "Інтерфейс",
+  "Intersect": "Перетин",
+  "Intersect with": "Перетнути з",
+  "Invert": "Інвертувати",
+  "Invert Mask": "Інвертувати маску",
+  "Keyboard Shortcuts": "Клавіатурні скорочення",
+  "Keywords": "Ключові слова",
+  "Landscape": "Пейзаж",
+  "Language": "Мова",
+  "Last": "Останній",
+  "Lens": "Об’єктив",
+  "Lens Corrections": "Корекція об’єктива",
+  "Level": "Рівень",
+  "Library": "Бібліотека",
+  "Light": "Світло",
+  "Lights": "Світлі тони",
+  "Linear Gradient": "Лінійний градієнт",
+  "Location": "Розташування",
+  "Lossless": "Без втрат",
+  "Low": "Низька",
+  "Luminance": "Яскравість",
+  "Magenta": "Пурпуровий",
+  "Masking": "Маскування",
+  "Matte": "Матове",
+  "Merge": "Об’єднати",
+  "Metadata": "Метадані",
+  "Midpoint": "Середня точка",
+  "Midtones": "Середні тони",
+  "Minimize": "Згорнути",
+  "Mode": "Режим",
+  "Monochrome": "Монохромний",
+  "More": "Більше",
+  "Move": "Переміщення",
+  "Move to": "Перемістити до",
+  "Name": "Назва",
+  "Navigator": "Навігатор",
+  "Never": "Ніколи",
+  "No": "Ні",
+  "Noise": "Шум",
+  "Noise Reduction": "Зменшення шуму",
+  "None": "Немає",
+  "OK": "Гаразд",
+  "Object": "Об’єкт",
+  "Off": "Вимкнено",
+  "Offset X": "Зміщення X",
+  "Opacity": "Непрозорість",
+  "Orange": "Оранжевий",
+  "Original": "Оригінал",
+  "Overlay": "Накладання",
+  "Overwrite": "Перезаписати",
+  "Percent": "Відсотки",
+  "Performance": "Продуктивність",
+  "Perspective": "Перспектива",
+  "Photo": "Фото",
+  "Pixels": "Пікселі",
+  "Point Curve": "Точкова крива",
+  "Portrait": "Портрет",
+  "Position": "Положення",
+  "Preset": "Набір налаштувань",
+  "Presets": "Набори налаштувань",
+  "Preview": "Попередній перегляд",
+  "Print": "Друк",
+  "Profile": "Профіль",
+  "Profile:": "Профіль:",
+  "Pupil Size": "Розмір зіниці",
+  "Purple": "Фіолетовий",
+  "Quality": "Якість",
+  "Radial Gradient": "Радіальний градієнт",
+  "Radius": "Радіус",
+  "Range": "Діапазон",
+  "Reading": "Читання",
+  "Red": "Червоний",
+  "Red Eye": "Червоні очі",
+  "Redo": "Повторити",
+  "Remove": "Видалити",
+  "Rename": "Перейменувати",
+  "Rename…": "Перейменувати…",
+  "Reset": "Скинути",
+  "Reset Section": "Скинути розділ",
+  "Restore": "Відновити",
+  "Reverse the order": "Зворотний порядок",
+  "Review": "Перевірка",
+  "Rotate": "Повернути",
+  "Roughness": "Шорсткість",
+  "Roundness": "Округлість",
+  "Saturation": "Насиченість",
+  "Save": "Зберегти",
+  "Scale": "Масштаб",
+  "Screen": "Екран",
+  "Search": "Пошук",
+  "Select": "Вибрати",
+  "Select All": "Виділити все",
+  "Services": "Служби",
+  "Set Keyboard Shortcut": "Задати клавіші",
+  "Settings": "Налаштування",
+  "Settings…": "Налаштування…",
+  "Shadow": "Тінь",
+  "Shadows": "Тіні",
+  "Sharpen": "Підвищення різкості",
+  "Sharpening": "Підвищення різкості",
+  "Sharpness": "Різкість",
+  "Shift": "Shift",
+  "Show": "Показати",
+  "Show All": "Показати всі",
+  "Show Mask": "Показати маску",
+  "Show Thumbnails": "Показати мініатюри",
+  "Size": "Розмір",
+  "Sky": "Небо",
+  "Smoothness": "Плавність",
+  "Sort": "Сортування",
+  "Source": "Джерело",
+  "Source code on GitHub": "Вихідний код GitHub",
+  "Spiral": "Спіраль",
+  "Standard": "Стандартний",
+  "Stop": "Зупинити",
+  "Straighten": "Випрямити",
+  "Style": "Стиль",
+  "Subject": "Об’єкт",
+  "Subtract": "Відняти",
+  "System": "Система",
+  "System Info": "Інформація про систему",
+  "System Info…": "Інформація про систему…",
+  "Table": "Таблиця",
+  "Temperature": "Температура",
+  "Template": "Шаблон",
+  "Text": "Текст",
+  "Texture": "Текстура",
+  "Threshold": "Поріг",
+  "Tint": "Відтінок",
+  "Tone Curve": "Тональна крива",
+  "Tools": "Інструменти",
+  "Transfer": "Передавання",
+  "Triangle": "Трикутник",
+  "Undo": "Скасувати",
+  "Username": "Ім’я користувача",
+  "Variance": "Дисперсія",
+  "Version": "Версія",
+  "Vertical": "Вертикальна",
+  "Vibrance": "Соковитість",
+  "View": "Вигляд",
+  "Vignetting": "Віньєтування",
+  "Visible": "Видимий",
+  "Whites": "Білі тони",
+  "Width": "Ширина",
+  "Window": "Вікно",
+  "Yellow": "Жовтий",
+  "Yes": "Так",
+  "Zoom": "Масштаб",
+  "Zoom In": "Збільшити",
+  "Zoom Out": "Зменшити",
+  "Effect": "Ефект",
+  "Image": "Зображення",
+  "Layer": "Шар",
+  "Type": "Тип",
+  "Save As…": "Зберегти як…",
+  "Exit": "Вийти",
+  "New…": "Створити…",
+  "New": "Створити",
+  "Orientation": "Орієнтація",
+  "Layers": "Шари",
+  "Properties": "Властивості",
+  "Brush Settings": "Налаштування пензля",
+  "Options": "Параметри",
+  "Fit on Screen": "Умістити на екрані",
+  "Cut": "Вирізати",
+  "Paste": "Вставити",
+  "Deselect": "Зняти виділення",
+  "Export As…": "Експортувати як…",
+  "Search…": "Пошук…",
+  "Theme": "Тема",
+  "Pages": "Сторінки",
+  "Preferences": "Налаштування",
+  "Preferences…": "Налаштування…",
+  "Open…": "Відкрити…",
+  "Revert": "Повернути до збереженого",
+  "Print…": "Друк…",
+  "Find…": "Знайти…",
+  "Collapse": "Згорнути",
+  "Expand": "Розгорнути",
+  "Speed": "Швидкість",
+  "  (library default)": "  (типове для бібліотеки)",
+  " (inverted)": " (інвертовано)",
+  " · best of its burst": " · найкраще в серії",
+  " · in a burst": " · у серії",
+  "+ Group": "+ Група",
+  "+ Rule": "+ Правило",
+  ", picked": ", відібрано",
+  ", rejected": ", відхилено",
+  "0: nothing is rejected.": "0: нічого не відхиляти.",
+  "1 day": "1 день",
+  "2026-04 or 2026-04-12": "2026-04 або 2026-04-12",
+  "=  exactly": "=  точно",
+  "A blank template keeps the original names.": "Порожній шаблон зберігає початкові назви.",
+  "A filter is hiding this view's photos: change it, or clear it (View → Clear Filters)": "Фільтр приховує фото в цьому поданні: змініть або скиньте його (Вигляд → Скинути фільтри)",
+  "A one-time download of about": "Одноразове завантаження приблизно",
+  "AI Mask Model Status": "Стан моделі масок ШІ",
+  "About LightCraft": "Про LightCraft",
+  "Active": "Активне",
+  "Activity": "Дії",
+  "Add Catchlight": "Додати відблиск в оці",
+  "Add Folder to Local": "Додати теку до локальних",
+  "Add Mask": "Додати маску",
+  "Add Object Click": "Додати об’єкт клацанням",
+  "Add Point Color Sample": "Додати зразок точкового кольору",
+  "Add Red Eye Correction": "Додати корекцію червоних очей",
+  "Add Remove Spot": "Додати ділянку видалення",
+  "Add Selected Photos": "Додати вибрані фото",
+  "Add a rule (⌥-click: a group)": "Додати правило (⌥-клацання: група)",
+  "Add in place": "Додати на місці",
+  "Add in place: the library references the files where they are; nothing is copied or moved.": "Додати на місці: бібліотека посилається на файли в їхньому розташуванні; нічого не копіюється й не переміщується.",
+  "Add keyword": "Додати ключове слово",
+  "Add number": "Додати число",
+  "Add to Album": "Додати до альбому",
+  "Add to Favorites": "Додати до улюблених",
+  "Add to Local": "Додати до локальних",
+  "Add to My Photos": "Додати до моїх фото",
+  "Add to Selected Photos": "Додати до вибраних фото",
+  "Add to Target Album": "Додати до цільового альбому",
+  "Add to this mask": "Додати до цієї маски",
+  "Add/Subtract/Intersect Mask": "Додати/відняти/перетнути маску",
+  "Added to photos you import that don't already have it.": "Додається до імпортованих фото, які ще не мають цього значення.",
+  "Adding": "Додавання",
+  "Adding Lightroom photos…": "Додавання фото Lightroom…",
+  "After": "Після",
+  "After 30 days": "Через 30 днів",
+  "After 7 days": "Через 7 днів",
+  "After 90 days": "Через 90 днів",
+  "After a year": "Через рік",
+  "Album": "Альбом",
+  "Albums": "Альбоми",
+  "All Metadata": "Усі метадані",
+  "All Metadata…": "Усі метадані…",
+  "All Photos": "Усі фото",
+  "All rights reserved": "Усі права захищено",
+  "All types": "Усі типи",
+  "Alt Text": "Альтернативний текст",
+  "Analyzing the photo for AI masks…": "Аналіз фото для масок ШІ…",
+  "Any Searchable Text": "Будь-який текст для пошуку",
+  "Any camera": "Будь-яка камера",
+  "Any keyword": "Будь-яке ключове слово",
+  "Any lens": "Будь-який об’єктив",
+  "Application": "Застосунок",
+  "Apply Color Label Set": "Застосувати набір кольорових міток",
+  "Apply Filter Preset": "Застосувати набір налаштувань фільтра",
+  "Apply Metadata Preset": "Застосувати набір налаштувань метаданих",
+  "Apply Point Curve Preset": "Застосувати набір налаштувань точкової кривої",
+  "Apply Preset": "Застосувати набір налаштувань",
+  "Apply Settings JSON": "Застосувати налаштування JSON",
+  "Approved": "Схвалено",
+  "Aqua Hue": "Тон бірюзового",
+  "Aqua Luminance": "Яскравість бірюзового",
+  "Aqua Saturation": "Насиченість бірюзового",
+  "ArtCraft — more creative apps": "ArtCraft — інші творчі застосунки",
+  "As Shot": "Як під час знімання",
+  "As shot": "Як під час знімання",
+  "Ascending": "За зростанням",
+  "Aspect": "Пропорції",
+  "Assisted Culling": "Допоміжний відбір",
+  "Assisted Culling…": "Допоміжний відбір…",
+  "Auto Advance": "Автоперехід",
+  "Auto Advance Off": "Вимкнути автоперехід",
+  "Auto Advance On": "Увімкнути автоперехід",
+  "Auto Advance after rating or flagging": "Автоперехід після оцінювання або позначення",
+  "Auto Advance: move to the next photo after rating or flagging": "Автоперехід: перейти до наступного фото після оцінювання або позначення",
+  "Auto Align": "Автовирівнювання",
+  "Auto B&W Mix": "Автоматичне змішування чорно-білого",
+  "Auto Crop": "Автоматичне кадрування",
+  "Auto Import": "Автоімпорт",
+  "Auto Import Now": "Виконати автоімпорт зараз",
+  "Auto Import Settings": "Налаштування автоімпорту",
+  "Auto Mask": "Автоматична маска",
+  "Auto Select": "Автоматичне виділення",
+  "Auto Settings": "Автоматичні налаштування",
+  "Auto Straighten": "Автоматичне випрямлення",
+  "Auto Sync": "Автосинхронізація",
+  "Auto settings applied": "Автоматичні налаштування застосовано",
+  "Auto-Stack by Capture Time": "Автоматично об’єднати в стоси за часом знімання",
+  "Auto-Stack by Capture Time…": "Автоматично об’єднати в стоси за часом знімання…",
+  "Auto-Tag Photos from Tracklog": "Автоматично позначити фото за журналом маршруту",
+  "Auto-Tag from Tracklog": "Автоматично позначити за журналом маршруту",
+  "Auto-Tag from Tracklog…": "Автоматично позначити за журналом маршруту…",
+  "Automatically Write Changes into XMP": "Автоматично записувати зміни в XMP",
+  "Automatically write changes into XMP sidecars": "Автоматично записувати зміни в супровідні файли XMP",
+  "Autumn Gold": "Осіннє золото",
+  "B&W": "Чорно-біле",
+  "B&W Mix": "Змішування чорно-білого",
+  "B&W Mixer": "Мікшер чорно-білого",
+  "Back": "Назад",
+  "Back to Edit": "Назад до редагування",
+  "Back to Edit (E)": "Назад до редагування (E)",
+  "Back to Grid": "Назад до сітки",
+  "Before": "До",
+  "Before/After (Y)": "До/після (Y)",
+  "Before/After Settings": "Налаштування до/після",
+  "Before/After Split": "Розділення до/після",
+  "Before/After Split Top/Bottom": "Розділення до/після зверху/знизу",
+  "Before/After Top/Bottom": "До/після зверху/знизу",
+  "Begin Interaction": "Почати взаємодію",
+  "Best of Similar Shots": "Найкращі з подібних знімків",
+  "Bleached": "Вибілене",
+  "Blue Hour Boost": "Посилення синьої години",
+  "Blue Hue": "Тон синього",
+  "Blue Luminance": "Яскравість синього",
+  "Blue Primary": "Основний синій",
+  "Blue Saturation": "Насиченість синього",
+  "Blue channel": "Синій канал",
+  "Blue label": "Синя мітка",
+  "Blue/Yellow Fringe": "Синя/жовта облямівка",
+  "Blurry photos below the score are flagged as rejects.": "Розмиті фото з оцінкою нижче порога позначаються як відхилені.",
+  "Boundary Warp": "Деформація меж",
+  "Bright & Airy": "Світле й легке",
+  "Browse Folder": "Оглянути теку",
+  "Browse Folder…": "Оглянути теку…",
+  "Browse Profiles": "Оглянути профілі",
+  "Brush Stroke": "Мазок пензля",
+  "Build Previews": "Створити попередні перегляди",
+  "Build Smart Previews": "Створити смарт-перегляди",
+  "By Date": "За датою",
+  "By day (YYYY/YYYY-MM-DD)": "За днем (YYYY/YYYY-MM-DD)",
+  "By month (YYYY/YYYY-MM)": "За місяцем (YYYY/YYYY-MM)",
+  "CPU threads": "Потоки ЦП",
+  "Calibration": "Калібрування",
+  "Camera": "Камера",
+  "Camera make and model": "Виробник і модель камери",
+  "Cameras and Cards": "Камери й карти",
+  "Cancel AI Mask Model Download": "Скасувати завантаження моделі масок ШІ",
+  "Cancel Download": "Скасувати завантаження",
+  "Cancel Interaction": "Скасувати взаємодію",
+  "Cancel Preview Build": "Скасувати створення переглядів",
+  "Candidate": "Кандидат",
+  "Capture Date": "Дата знімання",
+  "Capture date and time in your own format (directives below)": "Дата й час знімання у власному форматі (директиви нижче)",
+  "Capture date as YYYYMMDD": "Дата знімання як YYYYMMDD",
+  "Captured": "Знято",
+  "Captured from": "Знято від",
+  "Captured until": "Знято до",
+  "Catalog Statistics": "Статистика каталогу",
+  "Catchlight": "Відблиск в оці",
+  "Change Component Mode": "Змінити режим компонента",
+  "Characters not allowed in file names (/ \\ : * ? \" < > |) become -; an existing name gets -1, -2….": "Недозволені в назвах файлів символи (/ \\ : * ? \" < > |) замінюються на -; до наявної назви додається -1, -2….",
+  "Check All": "Позначити все",
+  "Check Output Path": "Перевірити шлях виведення",
+  "Check the files of this type": "Перевірити файли цього типу",
+  "Checking names…": "Перевірка назв…",
+  "Choose Edit Settings to Copy": "Вибрати налаштування редагування для копіювання",
+  "Choose Edit Settings to Copy…": "Вибрати налаштування редагування для копіювання…",
+  "Choose Folder…": "Вибрати теку…",
+  "Choose a photo in the grid or filmstrip": "Виберіть фото в сітці або на стрічці",
+  "Cinematic": "Кінематографічне",
+  "Clean Studio": "Чиста студія",
+  "Clear Cache": "Очистити кеш",
+  "Clear Filters": "Скинути фільтри",
+  "Clear Preview Cache": "Очистити кеш переглядів",
+  "Clear Quick Collection": "Очистити швидку колекцію",
+  "Clear Reference": "Очистити еталон",
+  "Clear all": "Очистити все",
+  "Clear rating": "Скинути оцінку",
+  "Clear rating and advance": "Скинути оцінку й перейти далі",
+  "Cleared History": "Історію очищено",
+  "Click Zoom Ratio": "Масштаб клацання",
+  "Click a shortcut, then press the new keys (Esc cancels).": "Клацніть скорочення, а потім натисніть нові клавіші (Esc скасовує).",
+  "Click a tag to insert it. Examples are for IMG_0042.CR3 taken 14 Jan 2026, 05:58:48.": "Клацніть тег, щоб вставити його. Приклади для IMG_0042.CR3, знятого 14 січня 2026 о 05:58:48.",
+  "Click photos in the grid to toggle the keyword; Esc stops": "Клацайте фото в сітці, щоб перемикати ключове слово; Esc завершує",
+  "Click the object to select it · ⌥-click leaves a part out": "Клацніть об’єкт, щоб виділити його · ⌥-клацання виключає частину",
+  "Click the photo to pick a colour · ⇧-click adds more": "Клацніть фото, щоб вибрати колір · ⇧-клацання додає ще",
+  "Click the photo to pick a colour; ⇧-click adds more (up to 5)": "Клацніть фото, щоб вибрати колір; ⇧-клацання додає ще (до 5)",
+  "Click to clear these filters": "Клацніть, щоб скинути ці фільтри",
+  "Click to restore · double-click to rename": "Клацніть, щоб відновити · подвійне клацання перейменовує",
+  "Close Panel": "Закрити панель",
+  "Close Window": "Закрити вікно",
+  "Cloudy": "Хмарно",
+  "Collapse All Stacks": "Згорнути всі стоси",
+  "Collapse Stack": "Згорнути стос",
+  "Color Label": "Кольорова мітка",
+  "Color Label Names": "Назви кольорових міток",
+  "Color Label Sets": "Набори кольорових міток",
+  "Color label cleared": "Кольорову мітку скинуто",
+  "Color space: sRGB (AVIF)": "Колірний простір: sRGB (AVIF)",
+  "Command Journal": "Журнал команд",
+  "Compare": "Порівняти",
+  "Compare (Shift+C)": "Порівняти (Shift+C)",
+  "Compare Before and After": "Порівняти до й після",
+  "Compare needs at least two photos": "Для порівняння потрібно щонайменше два фото",
+  "Component options": "Параметри компонента",
+  "Concrete Cool": "Холодний бетон",
+  "Confirm before deleting": "Підтверджувати перед видаленням",
+  "Confirm before moving photos to Recently Deleted": "Підтверджувати перед переміщенням фото до нещодавно видалених",
+  "Constrain Crop": "Обмежити кадрування",
+  "Continue": "Продовжити",
+  "Convert to DNG": "Перетворити на DNG",
+  "Cool Fade": "Холодне згасання",
+  "Cool Morning": "Холодний ранок",
+  "Copy After's Settings to Before": "Копіювати налаштування «після» до «до»",
+  "Copy Before to After": "Копіювати «до» до «після»",
+  "Copy Before's Settings to After": "Копіювати налаштування «до» до «після»",
+  "Copy Edit Settings": "Копіювати налаштування редагування",
+  "Copy History Step Settings to Before": "Копіювати налаштування кроку історії до «до»",
+  "Copy Metadata": "Копіювати метадані",
+  "Copy as DNG": "Копіювати як DNG",
+  "Copy into the library (else use the files where they are)": "Копіювати до бібліотеки (інакше використовувати файли на місці)",
+  "Copy the files (into the library's Originals/, or a folder you choose)": "Копіювати файли (до Originals/ бібліотеки або вибраної теки)",
+  "Copy to": "Копіювати до",
+  "Copy to Clipboard": "Копіювати до буфера обміну",
+  "Copy: the files are copied to the folder below and the library uses the copies; the originals are left as they are.": "Копіювати: файли копіюються до теки нижче, а бібліотека використовує копії; оригінали залишаються незмінними.",
+  "Create Album": "Створити альбом",
+  "Create Album…": "Створити альбом…",
+  "Create Folder": "Створити теку",
+  "Create Folder…": "Створити теку…",
+  "Create New Mask": "Створити нову маску",
+  "Create Preset": "Створити набір налаштувань",
+  "Create Preset…": "Створити набір налаштувань…",
+  "Create Proof Copy": "Створити пробну копію",
+  "Create Smart Album": "Створити смарт-альбом",
+  "Create Smart Album from Filter…": "Створити смарт-альбом із фільтра…",
+  "Create Smart Album…": "Створити смарт-альбом…",
+  "Create Stack": "Створити стос",
+  "Create Version": "Створити версію",
+  "Create Version from Step": "Створити версію з кроку",
+  "Create Virtual Copy": "Створити віртуальну копію",
+  "Creator": "Автор",
+  "Creator metadata": "Метадані автора",
+  "Crisp Landscape": "Чіткий пейзаж",
+  "Crisp Vista": "Чітка панорама",
+  "Crop & Rotate": "Кадрування й обертання",
+  "Crop & Rotate (C)": "Кадрування й обертання (C)",
+  "Crop Aspect": "Пропорції кадрування",
+  "Crop, Rotate, Geometry": "Кадрування, обертання, геометрія",
+  "Culling": "Відбір",
+  "Custom template…": "Власний шаблон…",
+  "Cycle Crop Overlay": "Перемкнути накладання кадрування",
+  "Cycle Crop Overlay Orientation": "Перемкнути орієнтацію накладання кадрування",
+  "Cycle Info Overlay": "Перемкнути накладання інформації",
+  "Cycle Mask Overlay Color": "Перемкнути колір накладання маски",
+  "Cycle Mask Overlay Mode": "Перемкнути режим накладання маски",
+  "Cylindrical": "Циліндрична",
+  "Dark & Moody": "Темне й похмуре",
+  "Date": "Дата",
+  "Date Groups": "Групи дат",
+  "Day": "День",
+  "Daylight": "Денне світло",
+  "Decrease Brush Feather": "Зменшити розтушовування пензля",
+  "Decrease Brush Size": "Зменшити розмір пензля",
+  "Deep Sky": "Глибоке небо",
+  "Deghost Amount": "Ступінь усунення двоїння",
+  "Delete (⌫)": "Видалити (⌫)",
+  "Delete Album": "Видалити альбом",
+  "Delete All Masks": "Видалити всі маски",
+  "Delete Color Label Set": "Видалити набір кольорових міток",
+  "Delete Component": "Видалити компонент",
+  "Delete Export Preset": "Видалити набір налаштувань експорту",
+  "Delete Filter Preset": "Видалити набір налаштувань фільтра",
+  "Delete Imported Profile": "Видалити імпортований профіль",
+  "Delete Keyword": "Видалити ключове слово",
+  "Delete Keyword Set": "Видалити набір ключових слів",
+  "Delete Mask": "Видалити маску",
+  "Delete Metadata Preset": "Видалити набір налаштувань метаданих",
+  "Delete Permanently": "Видалити назавжди",
+  "Delete Photo": "Видалити фото",
+  "Delete Photos": "Видалити фото",
+  "Delete Point Color": "Видалити точковий колір",
+  "Delete Point Color Sample": "Видалити зразок точкового кольору",
+  "Delete Point Curve Preset": "Видалити набір налаштувань точкової кривої",
+  "Delete Red Eye": "Видалити червоне око",
+  "Delete Red Eye Correction": "Видалити корекцію червоних очей",
+  "Delete Spot": "Видалити ділянку",
+  "Delete Version": "Видалити версію",
+  "Delete all": "Видалити все",
+  "Delete all spots": "Видалити всі ділянки",
+  "Delete mask": "Видалити маску",
+  "Delete them": "Видалити їх",
+  "Depth Range": "Діапазон глибини",
+  "Descending": "За спаданням",
+  "Describe": "Описати",
+  "Describe what to keep": "Опишіть, що залишити",
+  "Describe what to leave out": "Опишіть, що виключити",
+  "Describe what to select": "Опишіть, що виділити",
+  "Describe…": "Описати…",
+  "Desert Heat": "Спека пустелі",
+  "Desert Warmth": "Тепло пустелі",
+  "Desktop": "Стільниця",
+  "Detail (D)": "Деталі (D)",
+  "Diagonal": "Діагональна",
+  "Discard Preview Cache": "Видалити кеш переглядів",
+  "Don't enlarge": "Не збільшувати",
+  "Download AI Mask Model": "Завантажити модель масок ШІ",
+  "Download the SAM 3 Model?": "Завантажити модель SAM 3?",
+  "Downloads": "Завантаження",
+  "Drag along the horizon; double-click for Auto": "Проведіть уздовж горизонту; подвійне клацання — автоматично",
+  "Drag over an eye on the photo; the pupil inside is found automatically.": "Проведіть по оку на фото; зіниця всередині знаходиться автоматично.",
+  "Draw Guides": "Намалювати напрямні",
+  "Duplicate Component": "Дублювати компонент",
+  "Duplicate Mask": "Дублювати маску",
+  "Duplicate and Invert Mask": "Дублювати й інвертувати маску",
+  "Each / starts a folder level; tags are filled in per photo (a level with missing metadata is \"unknown\").": "Кожен / починає рівень теки; теги заповнюються для кожного фото (рівень без метаданих — \"unknown\").",
+  "Edit (E)": "Редагування (E)",
+  "Edit Capture Time": "Редагувати час знімання",
+  "Edit Capture Time…": "Редагувати час знімання…",
+  "Edit Color Label Names": "Редагувати назви кольорових міток",
+  "Edit Color Label Names…": "Редагувати назви кольорових міток…",
+  "Edit Copy for External Editor": "Редагувати копію в зовнішньому редакторі",
+  "Edit Date": "Дата редагування",
+  "Edit Info": "Редагувати інформацію",
+  "Edit Label Names": "Редагувати назви міток",
+  "Edit Label Names…": "Редагувати назви міток…",
+  "Edit Mask": "Редагувати маску",
+  "Edit Mask Component": "Редагувати компонент маски",
+  "Edit Sections": "Розділи редагування",
+  "Edit Smart Album": "Редагувати смарт-альбом",
+  "Edit Smart Album…": "Редагувати смарт-альбом…",
+  "Edit Spot": "Редагувати ділянку",
+  "Edit in External Editor": "Редагувати в зовнішньому редакторі",
+  "Edit settings copied": "Налаштування редагування скопійовано",
+  "Edited": "Відредаговано",
+  "Edited or not": "Відредаговано чи ні",
+  "Empty Recently Deleted": "Очистити нещодавно видалені",
+  "Enable Lens Corrections": "Увімкнути корекцію об’єктива",
+  "Enable Profile Corrections": "Увімкнути корекцію профілю",
+  "End Interaction": "Завершити взаємодію",
+  "Enter Full Screen": "Увійти в повноекранний режим",
+  "Enter a date as YYYY-MM-DD HH:MM:SS": "Введіть дату як YYYY-MM-DD HH:MM:SS",
+  "Every EXIF, GPS and XMP field in the file": "Усі поля EXIF, GPS і XMP у файлі",
+  "Existing previews": "Наявні перегляди",
+  "Expand All Stacks": "Розгорнути всі стоси",
+  "Expand Stack": "Розгорнути стос",
+  "Expand/Collapse Stack": "Розгорнути/згорнути стос",
+  "Export Album with Preset": "Експортувати альбом із набором налаштувань",
+  "Export Album…": "Експортувати альбом…",
+  "Export Group…": "Експортувати групу…",
+  "Export Now": "Експортувати зараз",
+  "Export Point Curve Presets": "Експортувати набори налаштувань точкової кривої",
+  "Export Point Curve Presets…": "Експортувати набори налаштувань точкової кривої…",
+  "Export Presets…": "Експортувати набори налаштувань…",
+  "Export User Presets…": "Експортувати власні набори налаштувань…",
+  "Export stopped unexpectedly": "Експорт несподівано зупинився",
+  "Export with Preset": "Експортувати з набором налаштувань",
+  "Export with Previous": "Експортувати з попередніми налаштуваннями",
+  "Exporting": "Експорт",
+  "Exposure (shutter · aperture · ISO)": "Експозиція (витримка · діафрагма · ISO)",
+  "Extended Description": "Розширений опис",
+  "External Editor": "Зовнішній редактор",
+  "Face Boxes": "Рамки облич",
+  "Face boxes": "Рамки облич",
+  "Face names written to XMP by Lightroom and other apps show up here.": "Імена облич, записані до XMP у Lightroom та інших застосунках, з’являються тут.",
+  "Faded Matte": "Вицвіле матове",
+  "Faded Slide": "Вицвілий слайд",
+  "Faded Urban": "Вицвіле місто",
+  "Favorite Preset": "Додати набір налаштувань до улюблених",
+  "Favorite Profile": "Додати профіль до улюблених",
+  "File & date": "Файл і дата",
+  "File Format": "Формат файлу",
+  "File Name": "Назва файлу",
+  "File Path": "Шлях до файлу",
+  "File Size": "Розмір файлу",
+  "File Type": "Тип файлу",
+  "File types:": "Типи файлів:",
+  "Filename": "Назва файлу",
+  "Film": "Плівка",
+  "Filmstrip (/)": "Стрічка (/)",
+  "Find Missing Photos": "Знайти відсутні фото",
+  "Five stars": "П’ять зірок",
+  "Fixed keys": "Фіксовані клавіші",
+  "Flagged as Pick": "Позначено як відібране",
+  "Flagged as Reject": "Позначено як відхилене",
+  "Focus (assisted culling)": "Фокус (допоміжний відбір)",
+  "Food": "Їжа",
+  "Forget Unchanged Local Photos": "Забути незмінені локальні фото",
+  "Frame time": "Час кадру",
+  "Frame update": "Оновлення кадру",
+  "Fresh & Bright": "Свіже й яскраве",
+  "GPU Rendering": "Рендеринг на ГП",
+  "GPU rendering": "Рендеринг на ГП",
+  "Generated demo photo": "Згенероване демонстраційне фото",
+  "Get Develop Settings": "Отримати налаштування обробки",
+  "Go to History Step": "Перейти до кроку історії",
+  "Golden Glow": "Золотисте сяйво",
+  "Golden Hour": "Золота година",
+  "Green label": "Зелена мітка",
+  "Gritty Street": "Груба вулиця",
+  "Group by Date: Automatic": "Групування за датою: автоматично",
+  "Guided Upright Guides": "Напрямні керованого випрямлення",
+  "HDR Merge Preview": "Попередній перегляд об’єднання HDR",
+  "HDR Panorama Merge Preview": "Попередній перегляд об’єднання HDR-панорами",
+  "HDR Panorama with Last Settings": "HDR-панорама з останніми налаштуваннями",
+  "HDR Panoramas": "HDR-панорами",
+  "HDR panorama": "HDR-панорама",
+  "HDR panoramas": "HDR-панорами",
+  "HDR with Last Settings": "HDR з останніми налаштуваннями",
+  "Has Edits": "Має зміни",
+  "Has GPS": "Має GPS",
+  "High Contrast B&W": "Контрастне чорно-біле",
+  "Hours": "Години",
+  "ISO speed": "Чутливість ISO",
+  "Import Lightroom Catalog": "Імпортувати каталог Lightroom",
+  "Import Lightroom Catalog…": "Імпортувати каталог Lightroom…",
+  "Import Point Curve Presets…": "Імпортувати набори налаштувань точкової кривої…",
+  "Import Profiles": "Імпортувати профілі",
+  "Import as new": "Імпортувати як нове",
+  "Importing Lightroom Catalog": "Імпорт каталогу Lightroom",
+  "In Photo Grid and Square Grid: Flag as Pick and advance": "У сітці фото й квадратній сітці: позначити як відібране й перейти далі",
+  "In Photo Grid and Square Grid: expand or collapse the stack": "У сітці фото й квадратній сітці: розгорнути або згорнути стос",
+  "Increase Brush Feather": "Збільшити розтушовування пензля",
+  "Increase Brush Size": "Збільшити розмір пензля",
+  "Info Overlay Off": "Вимкнути накладання інформації",
+  "Info Overlay: Exposure": "Накладання інформації: експозиція",
+  "Info Overlay: File": "Накладання інформації: файл",
+  "Insert at the cursor": "Вставити в позицію курсора",
+  "Inspect Lightroom Catalog": "Перевірити каталог Lightroom",
+  "Inspect Photo": "Перевірити фото",
+  "Inspecting Lightroom Catalog": "Перевірка каталогу Lightroom",
+  "Instant ’70s": "Миттєві 70-ті",
+  "Invert Component": "Інвертувати компонент",
+  "JPEG (Large)": "JPEG (великий)",
+  "JPEG (Small)": "JPEG (малий)",
+  "Join the ArtCraft community on Discord": "Приєднатися до спільноти ArtCraft у Discord",
+  "Keywords (K)": "Ключові слова (K)",
+  "Label Set": "Набір міток",
+  "Last GPU fallback": "Останній перехід із ГП",
+  "Last loupe render": "Останній рендеринг лупи",
+  "Library Info": "Інформація про бібліотеку",
+  "Library Preferences": "Налаштування бібліотеки",
+  "Library State": "Стан бібліотеки",
+  "Library saved": "Бібліотеку збережено",
+  "Licence:": "Ліцензія:",
+  "LightCraft could not start": "Не вдалося запустити LightCraft",
+  "Lightroom Classic Catalog": "Каталог Lightroom Classic",
+  "Lightroom import cancelled": "Імпорт Lightroom скасовано",
+  "Lightroom inspection cancelled": "Перевірку Lightroom скасовано",
+  "List Albums": "Список альбомів",
+  "List Develop Controls": "Список елементів обробки",
+  "List History": "Список історії",
+  "List Presets": "Список наборів налаштувань",
+  "List Profiles": "Список профілів",
+  "Locate Photo": "Знайти фото",
+  "Lock Crop Aspect": "Зафіксувати пропорції кадрування",
+  "Locked": "Заблоковано",
+  "Lush Greens": "Пишна зелень",
+  "Mask Adjustment": "Корекція маски",
+  "Match Total Exposures": "Узгодити загальну експозицію",
+  "Matte Soft": "М’яке матове",
+  "Medium Contrast": "Середній контраст",
+  "Memory Budget": "Ліміт пам’яті",
+  "Memory Usage": "Використання пам’яті",
+  "Memory budget": "Ліміт пам’яті",
+  "Merged": "Об’єднано",
+  "Meta's terms, not LightCraft's. Downloading it means accepting them.": "Умови Meta, а не LightCraft. Завантажуючи модель, ви приймаєте їх.",
+  "Missing metadata ({camera}, {title}…) leaves an empty gap; a name that comes out empty keeps the original name.": "Відсутні метадані ({camera}, {title}…) залишають порожнє місце; порожня отримана назва зберігає початкову.",
+  "Misty Morning": "Туманний ранок",
+  "Mono Red Filter": "Монохромний червоний фільтр",
+  "Mono Rich": "Насичений монохром",
+  "Mono Soft": "М’який монохром",
+  "Moody": "Похмуре",
+  "Moody Portrait": "Похмурий портрет",
+  "Move Album": "Перемістити альбом",
+  "Move Folder": "Перемістити теку",
+  "Move Mask": "Перемістити маску",
+  "Move Preset to Group": "Перемістити набір налаштувань до групи",
+  "Move Preset to New Group": "Перемістити набір налаштувань до нової групи",
+  "Move in Stack": "Перемістити в стосі",
+  "Muted": "Приглушене",
+  "Muted Film": "Приглушена плівка",
+  "My Photos Panel": "Панель моїх фото",
+  "Name of the folder the original is in": "Назва теки з оригіналом",
+  "Named People": "Люди з іменами",
+  "Neon Dusk": "Неонові сутінки",
+  "Neon Night": "Неонова ніч",
+  "Nested group": "Вкладена група",
+  "New Album": "Новий альбом",
+  "New time": "Новий час",
+  "Next Photo": "Наступне фото",
+  "Night Blue": "Нічна синява",
+  "No named people in these photos": "На цих фото немає людей з іменами",
+  "No named people yet": "Поки немає людей з іменами",
+  "Not Now": "Не зараз",
+  "Nudge Develop Value": "Змінити значення обробки на крок",
+  "Object Mask": "Маска об’єкта",
+  "Object and Describe masks use SAM 3, Meta's segmentation model. It isn't part of LightCraft, and everything else works without it.": "Маски «Об’єкт» і «Описати» використовують SAM 3, модель сегментації Meta. Вона не є частиною LightCraft, а решта функцій працює без неї.",
+  "October 2026": "Жовтень 2026",
+  "Only": "Лише",
+  "Optimize Library": "Оптимізувати бібліотеку",
+  "Original + Settings": "Оригінал + налаштування",
+  "Original extension without the dot": "Початкове розширення без крапки",
+  "Original file name without its extension": "Початкова назва файлу без розширення",
+  "Panorama": "Панорама",
+  "Panorama Merge Preview": "Попередній перегляд об’єднання панорами",
+  "Panorama with Last Settings": "Панорама з останніми налаштуваннями",
+  "Panoramas": "Панорами",
+  "Paste Settings": "Вставити налаштування",
+  "Paste Settings from Previous": "Вставити налаштування з попереднього",
+  "Paste from Previous": "Вставити з попереднього",
+  "Pastel Haze": "Пастельний серпанок",
+  "People": "Люди",
+  "Person": "Особа",
+  "Pet Eye Catchlight": "Відблиск в оці тварини",
+  "Photos per bracket (0 = auto)": "Фото в серії експозицій (0 = автоматично)",
+  "Pick Flag": "Прапорець відбору",
+  "Pictures": "Зображення",
+  "Prepare AI Masks": "Підготувати маски ШІ",
+  "Presets and profiles": "Набори налаштувань і профілі",
+  "Preview Build Progress": "Перебіг створення переглядів",
+  "Preview only: editing the camera's embedded JPEG": "Лише перегляд: редагування вбудованого JPEG камери",
+  "Previous Photo": "Попереднє фото",
+  "Profile Browser": "Оглядач профілів",
+  "Profile Menu": "Меню профілів",
+  "Proof copy created": "Пробну копію створено",
+  "Query Photos": "Запит фото",
+  "Quiet Green": "Спокійна зелень",
+  "Quit Anyway": "Усе одно вийти",
+  "Quit with unsaved changes?": "Вийти з незбереженими змінами?",
+  "RAW decoding": "Декодування RAW",
+  "Rate ★": "Оцінити ★",
+  "Rate ★ and advance": "Оцінити ★ і перейти далі",
+  "Rate ★★": "Оцінити ★★",
+  "Rate ★★ and advance": "Оцінити ★★ і перейти далі",
+  "Rate ★★★": "Оцінити ★★★",
+  "Rate ★★★ and advance": "Оцінити ★★★ і перейти далі",
+  "Rate ★★★★": "Оцінити ★★★★",
+  "Rate ★★★★ and advance": "Оцінити ★★★★ і перейти далі",
+  "Rate ★★★★★": "Оцінити ★★★★★",
+  "Rate ★★★★★ and advance": "Оцінити ★★★★★ і перейти далі",
+  "Rating cleared": "Оцінку скинуто",
+  "Raw": "RAW",
+  "Read the SAM License": "Прочитати ліцензію SAM",
+  "Reading Lightroom catalog…": "Читання каталогу Lightroom…",
+  "Recent Keywords": "Останні ключові слова",
+  "Red label": "Червона мітка",
+  "Refine": "Уточнити",
+  "Refine AI Mask Detail": "Уточнити деталі маски ШІ",
+  "Refine Edges": "Уточнити краї",
+  "Refine Mask Edges": "Уточнити краї маски",
+  "Refine Saturation": "Уточнити насиченість",
+  "Refining the mask's detail…": "Уточнення деталей маски…",
+  "Refresh Source": "Оновити джерело",
+  "Reject": "Відхилити",
+  "Reliability": "Надійність",
+  "Relink Photo": "Повторно пов’язати фото",
+  "Reload Changed Files": "Перезавантажити змінені файли",
+  "Remove Face Box": "Видалити рамку обличчя",
+  "Remove a filter above, or choose Clear all": "Видаліть фільтр вище або виберіть «Очистити все»",
+  "Remove from Target Album": "Вилучити з цільового альбому",
+  "Remove shortcut": "Видалити скорочення",
+  "Remove this face box (undo with Edit ▸ Undo)": "Видалити цю рамку обличчя (скасувати через Редагування → Скасувати)",
+  "Rename Component": "Перейменувати компонент",
+  "Rename Folder": "Перейменувати теку",
+  "Rename Mask": "Перейменувати маску",
+  "Rename Preset": "Перейменувати набір налаштувань",
+  "Rename Preview": "Попередній перегляд перейменування",
+  "Rename Template Tags": "Теги шаблону перейменування",
+  "Reorder Masks": "Змінити порядок масок",
+  "Reset All": "Скинути все",
+  "Reset All Keyboard Shortcuts": "Скинути всі клавіатурні скорочення",
+  "Reshuffle": "Перемішати",
+  "File name": "Назва файлу",
+  "Fill Edges": "Заповнити краї",
+  "Filmstrip": "Стрічка",
+  "Filter Bar": "Панель фільтрів",
+  "Filter Presets": "Набори налаштувань фільтрів",
+  "Filter bar": "Панель фільтрів",
+  "Filter fields": "Поля фільтрів",
+  "Find Dust Spots": "Знайти пилові плями",
+  "Find Missing Photos…": "Знайти відсутні фото…",
+  "Find Similar Photos": "Знайти подібні фото",
+  "Fit (F)": "Умістити (F)",
+  "Flag as Pick": "Позначити як відібране",
+  "Flag as Reject": "Позначити як відхилене",
+  "Flip H": "Віддзеркалити горизонтально",
+  "Flip Overlay (⇧O)": "Перевернути накладання (⇧O)",
+  "Flip V": "Віддзеркалити вертикально",
+  "Fluorescent": "Люмінесцентне",
+  "Focal length": "Фокусна відстань",
+  "Folder name (renamed on disk; its photos follow)": "Назва теки (перейменовується на диску разом із посиланнями на фото)",
+  "Folders": "Теки",
+  "Folders and {date} use the capture time; a photo without one uses today's date.": "Теки й {date} використовують час знімання; фото без нього використовує сьогоднішню дату.",
+  "Forget unchanged photos": "Забути незмінені фото",
+  "Forward": "Уперед",
+  "Full Screen Preview": "Повноекранний перегляд",
+  "Full size": "Повний розмір",
+  "GPS Track Log": "Журнал маршруту GPS",
+  "Geometry": "Геометрія",
+  "Global Hue": "Загальний тон",
+  "Global Luminance": "Загальна яскравість",
+  "Global Saturation": "Загальна насиченість",
+  "Golden": "Золотисте",
+  "Green Amount": "Кількість зеленого",
+  "Green Hue": "Тон зеленого",
+  "Green Hue High": "Верхня межа тону зеленого",
+  "Green Hue Low": "Нижня межа тону зеленого",
+  "Green Luminance": "Яскравість зеленого",
+  "Green Primary": "Основний зелений",
+  "Green Saturation": "Насиченість зеленого",
+  "Green channel": "Зелений канал",
+  "Grid Info": "Інформація в сітці",
+  "Group by Day": "Групувати за днем",
+  "Group by Month": "Групувати за місяцем",
+  "Group by Year": "Групувати за роком",
+  "Group by date": "Групувати за датою",
+  "Group into Stack": "Об’єднати в стос",
+  "Guided": "Кероване",
+  "Guided Upright": "Кероване випрямлення",
+  "HDR Merge": "Об’єднання HDR",
+  "HDR Panorama Merge": "Об’єднання HDR-панорами",
+  "HDR Panorama…": "HDR-панорама…",
+  "HDR…": "HDR…",
+  "Heal the small, soft dark spots sensor dust leaves on smooth areas": "Усунути дрібні м’які темні плями, які пил на сенсорі залишає на однорідних ділянках",
+  "Height (px)": "Висота (пікселів)",
+  "Hide LightCraft": "Приховати LightCraft",
+  "Hide Mask": "Приховати маску",
+  "Hides this shortcut only; the folder and its photos stay as they are": "Приховує лише це скорочення; тека та її фото залишаються незмінними",
+  "Highlights Hue": "Тон світлих ділянок",
+  "Highlights Luminance": "Яскравість світлих ділянок",
+  "Highlights Saturation": "Насиченість світлих ділянок",
+  "Highlights split": "Розділення світлих ділянок",
+  "History & Activity (Y)": "Історія й дії (Y)",
+  "Hue Range": "Діапазон тону",
+  "If file exists": "Якщо файл існує",
+  "Import Date": "Дата імпорту",
+  "Import Photos": "Імпортувати фото",
+  "Import Photos…": "Імпортувати фото…",
+  "Import Point Curve Presets": "Імпортувати набори налаштувань точкової кривої",
+  "Import Presets…": "Імпортувати набори налаштувань…",
+  "Import Profiles & Presets…": "Імпортувати профілі й набори налаштувань…",
+  "Import from Device": "Імпортувати з пристрою",
+  "Import from Folder…": "Імпортувати з теки…",
+  "Import photos with File → Import Photos… (Cmd+Shift+I), or drop them here": "Імпортуйте фото через Файл → Імпортувати фото… (Cmd+Shift+I) або перетягніть їх сюди",
+  "Imported Photos": "Імпортовані фото",
+  "Importing": "Імпорт",
+  "Importing scans the source for photos; it doesn't add the folder to Local (use Local → Browse Folder… to work in a folder without importing).": "Імпорт сканує джерело фото; він не додає теку до локальних (використовуйте Локальні → Оглянути теку…, щоб працювати в теці без імпорту).",
+  "In library": "У бібліотеці",
+  "In memory — nothing is saved": "У пам’яті — нічого не збережено",
+  "In use": "Використовується",
+  "In-memory session: these settings last until LightCraft quits.": "Сеанс у пам’яті: ці налаштування діють до виходу з LightCraft.",
+  "Include subfolders": "Включати вкладені теки",
+  "Info (I)": "Інформація (I)",
+  "Info overlay": "Накладання інформації",
+  "Into one folder": "До однієї теки",
+  "Keep in Local": "Залишити в локальних",
+  "Keep it on a drive with room: smart previews are about 1 MB per photo. The thumbnail cache stays in the library.": "Зберігайте на диску з вільним місцем: смарт-перегляд займає приблизно 1 МБ на фото. Кеш мініатюр залишається в бібліотеці.",
+  "Keyboard shortcuts": "Клавіатурні скорочення",
+  "Keyword": "Ключове слово",
+  "Keyword Painter": "Призначення ключових слів",
+  "Keyword Set": "Набір ключових слів",
+  "Keyword Sets": "Набори ключових слів",
+  "Keyword Suggestions": "Пропозиції ключових слів",
+  "Keyword to paint": "Ключове слово для призначення",
+  "Keywords you add appear here; ⌥1–⌥9 apply them.": "Додані ключові слова з’являються тут; ⌥1–⌥9 застосовують їх.",
+  "Automatic renders the Detail view at the size it is shown, up to the photo's own pixels. Choose a size to cap it: smaller is faster.": "Автоматичний режим відтворює подання «Деталі» у відображуваному розмірі, до власних пікселів фото. Виберіть розмір для обмеження: менший працює швидше.",
+  "Last view": "Останнє подання",
+  "Lateral Chromatic Aberration": "Поперечна хроматична аберація",
+  "Leave them": "Залишити їх",
+  "Library Originals": "Оригінали бібліотеки",
+  "LightCraft Default": "Типові налаштування LightCraft",
+  "LightCraft Help": "Довідка LightCraft",
+  "LightCraft Preset": "Набір налаштувань LightCraft",
+  "LightCraft Presets": "Набори налаштувань LightCraft",
+  "LightCraft Website": "Сайт LightCraft",
+  "LightCraft on GitHub": "LightCraft на GitHub",
+  "LightCraft website": "Сайт LightCraft",
+  "LightCraft — Second Window": "LightCraft — друге вікно",
+  "Limit file size (KB, 0 = off)": "Обмежити розмір файлу (КБ, 0 = вимкнено)",
+  "List this folder in Local from now on": "Відтепер показувати цю теку в локальних",
+  "Local": "Локальні",
+  "Local folders": "Локальні теки",
+  "Local library — no cloud account needed": "Локальна бібліотека — хмарний обліковий запис не потрібен",
+  "Locate Missing File…": "Знайти відсутній файл…",
+  "Long Edge": "Довгий край",
+  "Looking for photos…": "Пошук фото…",
+  "Luminance Range": "Діапазон яскравості",
+  "Magenta Hue": "Тон пурпурового",
+  "Magenta Luminance": "Яскравість пурпурового",
+  "Magenta Saturation": "Насиченість пурпурового",
+  "Make Candidate the Select": "Зробити кандидата вибраним",
+  "Manual": "Вручну",
+  "Masking (M)": "Маскування (M)",
+  "Masks": "Маски",
+  "Match": "Збіг",
+  "Med": "Середнє",
+  "Megapixels": "Мегапікселі",
+  "Memory for caches": "Пам’ять для кешування",
+  "Menu": "Меню",
+  "Merge Keywords": "Об’єднати ключові слова",
+  "Merge into…": "Об’єднати з…",
+  "Merging…": "Об’єднання…",
+  "Metadata Preset": "Набір налаштувань метаданих",
+  "Metadata Presets": "Набори налаштувань метаданих",
+  "Metadata preset": "Набір налаштувань метаданих",
+  "Midtones Hue": "Тон середніх тонів",
+  "Midtones Luminance": "Яскравість середніх тонів",
+  "Midtones Saturation": "Насиченість середніх тонів",
+  "Midtones split": "Розділення середніх тонів",
+  "Missing Photos": "Відсутні фото",
+  "Modified Date": "Дата зміни",
+  "Month": "Місяць",
+  "More preset options": "Інші параметри набору налаштувань",
+  "Move Down in Stack": "Перемістити нижче в стосі",
+  "Move Folder To…": "Перемістити теку до…",
+  "Move Up in Stack": "Перемістити вище в стосі",
+  "Move the files (into the library's Originals/, or a folder you choose), removing them from the source": "Перемістити файли (до Originals/ бібліотеки або вибраної теки), видаливши їх із джерела",
+  "Move them": "Перемістити їх",
+  "Move to Group": "Перемістити до групи",
+  "Move: the files are moved to the folder below; each original (and its XMP sidecar) is removed from the source only after its copy is verified. Duplicates and files that fail stay where they are.": "Перемістити: файли переміщуються до теки нижче; кожен оригінал (і його супровідний XMP) видаляється з джерела лише після перевірки копії. Дублікати й файли з помилками залишаються на місці.",
+  "My Photos": "Мої фото",
+  "Named": "З іменами",
+  "Names appear in the label menu, the filter bar and the Info panel, and are written to XMP. Empty = the colour's name.": "Назви з’являються в меню міток, панелі фільтрів і панелі інформації та записуються до XMP. Порожнє значення = назва кольору.",
+  "Needs Work": "Потребує роботи",
+  "Neutral": "Нейтральне",
+  "New Album…": "Новий альбом…",
+  "New Folder…": "Нова тека…",
+  "New Group…": "Нова група…",
+  "New Smart Album": "Новий смарт-альбом",
+  "New Smart Album from Filter…": "Новий смарт-альбом із фільтра…",
+  "New Smart Album…": "Новий смарт-альбом…",
+  "New album": "Новий альбом",
+  "New album…": "Новий альбом…",
+  "New name": "Нова назва",
+  "No Camera or Card Found": "Камеру або карту не знайдено",
+  "No Date Groups": "Без групування за датою",
+  "No Stars": "Без зірок",
+  "No Tool": "Без інструмента",
+  "No automatic versions.": "Немає автоматичних версій.",
+  "No camera": "Без камери",
+  "No date": "Без дати",
+  "No dust spots found": "Пилових плям не знайдено",
+  "No edits yet.": "Змін поки немає.",
+  "No exposure information": "Немає інформації про експозицію",
+  "No filter presets yet": "Наборів налаштувань фільтрів поки немає",
+  "No lens data embedded in this file (DNG lens opcodes only).": "У цьому файлі немає даних об’єктива (лише інструкції об’єктива DNG).",
+  "No masks yet. Choose a mask type above.": "Масок поки немає. Виберіть тип маски вище.",
+  "No matching photos": "Немає відповідних фото",
+  "No metadata found": "Метаданих не знайдено",
+  "No new presets": "Немає нових наборів налаштувань",
+  "No photo selected": "Фото не вибрано",
+  "No photos": "Немає фото",
+  "No photos found": "Фото не знайдено",
+  "No photos in this folder": "У цій теці немає фото",
+  "No photos match the active filters": "Жодне фото не відповідає активним фільтрам",
+  "No photos match the filters (View → Clear Filters)": "Жодне фото не відповідає фільтрам (Вигляд → Скинути фільтри)",
+  "No raw photos yet: cameras appear here once their photos are in the library.": "Фото RAW поки немає: камери з’являться тут, коли їхні фото будуть у бібліотеці.",
+  "No reference photo": "Немає еталонного фото",
+  "No usable GPU found: rendering on the CPU": "Придатного ГП не знайдено: рендеринг на ЦП",
+  "No versions yet. Create one to keep this look.": "Версій поки немає. Створіть версію, щоб зберегти цей вигляд.",
+  "Non-raw photos": "Фото не у форматі RAW",
+  "Nothing to compare": "Нічого порівнювати",
+  "Nothing to survey": "Нічого оглядати",
+  "Offset Y": "Зсув Y",
+  "Opacity (%)": "Непрозорість (%)",
+  "Open Library": "Відкрити бібліотеку",
+  "Open Library…": "Відкрити бібліотеку…",
+  "Open in": "Відкрити в",
+  "Open in Detail": "Відкрити в деталях",
+  "Open the place in OpenStreetMap": "Відкрити місце в OpenStreetMap",
+  "Optics": "Оптика",
+  "Optional name": "Необов’язкова назва",
+  "Orange Hue": "Тон оранжевого",
+  "Orange Luminance": "Яскравість оранжевого",
+  "Orange Saturation": "Насиченість оранжевого",
+  "Original files": "Початкові файли",
+  "Original offline · editing the smart preview": "Оригінал недоступний · редагування смарт-перегляду",
+  "Original offline · no smart preview": "Оригінал недоступний · немає смарт-перегляду",
+  "Originals": "Оригінали",
+  "Other images (JPEG, PNG, TIFF, HEIC…)": "Інші зображення (JPEG, PNG, TIFF, HEIC…)",
+  "Paint": "Малювати",
+  "Paint only areas like the one under the brush": "Малювати лише ділянки, подібні до ділянки під пензлем",
+  "Paint over a distraction on the photo to remove it.": "Замалюйте зайвий об’єкт на фото, щоб видалити його.",
+  "Paint overlay": "Накладання малювання",
+  "Panorama Merge": "Об’єднання панорами",
+  "Panorama…": "Панорама…",
+  "Parametric curve": "Параметрична крива",
+  "Paste Edit Settings": "Вставити налаштування редагування",
+  "Paste Metadata": "Вставити метадані",
+  "Paste Selected Settings": "Вставити вибрані налаштування",
+  "Paste Selected Settings…": "Вставити вибрані налаштування…",
+  "Percentage": "Відсоток",
+  "Pet Eye": "Око тварини",
+  "Photo Grid": "Сітка фото",
+  "Photo Grid (G)": "Сітка фото (G)",
+  "Photo Merge": "Об’єднання фото",
+  "Photo ▸ Edit in External Editor (⇧⌘E) renders a 16-bit TIFF copy, stacks it with the original and opens it here (an app name on macOS, a program path elsewhere).": "Фото → Редагувати в зовнішньому редакторі (⇧⌘E) створює 16-бітну копію TIFF, додає її до стосу з оригіналом і відкриває тут (назва застосунку в macOS, шлях до програми в інших системах).",
+  "Photos": "Фото",
+  "Photos seen in Local but never added or changed leave the catalog when their folder hasn't been browsed for this long (checked when the library opens). Files stay on disk; browsing the folder shows them again.": "Фото, переглянуті в локальних, але ніколи не додані й не змінені, вилучаються з каталогу, якщо їхню теку не оглядали протягом цього часу (перевіряється під час відкриття бібліотеки). Файли залишаються на диску; огляд теки знову їх показує.",
+  "Photos that arrive in this folder (tethering, a scanner, a sync app) are added as soon as they're complete.": "Фото, що надходять до цієї теки (камерне підключення, сканер, застосунок синхронізації), додаються одразу після завершення запису.",
+  "Pick": "Відібрати",
+  "Pick a colour on the photo with the eyedropper.": "Виберіть колір на фото піпеткою.",
+  "Pick the sharpest photo of each burst": "Відібрати найчіткіше фото кожної серії",
+  "Picked": "Відібрано",
+  "Picks": "Відібрані",
+  "Point Color": "Точковий колір",
+  "Point Curve Presets": "Набори налаштувань точкової кривої",
+  "Point curve": "Точкова крива",
+  "Preset name": "Назва набору налаштувань",
+  "Presets & Profiles": "Набори налаштувань і профілі",
+  "Presets (Shift+P)": "Набори налаштувань (Shift+P)",
+  "Presets ▾": "Набори налаштувань ⌄",
+  "Preview only": "Лише перегляд",
+  "Preview size": "Розмір перегляду",
+  "Previews": "Перегляди",
+  "Profile Distortion": "Профіль дисторсії",
+  "Profile Vignetting": "Профіль віньєтування",
+  "Profiles": "Профілі",
+  "Projection": "Проєкція",
+  "Public domain": "Суспільне надбання",
+  "Purple Amount": "Кількість фіолетового",
+  "Purple Hue": "Тон фіолетового",
+  "Purple Hue High": "Верхня межа тону фіолетового",
+  "Purple Hue Low": "Нижня межа тону фіолетового",
+  "Purple Luminance": "Яскравість фіолетового",
+  "Purple Saturation": "Насиченість фіолетового",
+  "Put the locations you removed from Local back (no files change)": "Повернути вилучені з локальних розташування (файли не змінюються)",
+  "Quick Collection": "Швидка колекція",
+  "Quick Develop": "Швидка обробка",
+  "Quit LightCraft": "Вийти з LightCraft",
+  "Rating": "Оцінка",
+  "Ratings & flags": "Оцінки й прапорці",
+  "Raw default": "Типові налаштування RAW",
+  "Raw defaults": "Типові налаштування RAW",
+  "Raw files": "Файли RAW",
+  "Raw photos": "Фото RAW",
+  "Raw photos as DNG, with the edits embedded. Size, color and output options don't apply.": "Фото RAW як DNG із вбудованими змінами. Параметри розміру, кольору й виведення не застосовуються.",
+  "Read Metadata from File": "Прочитати метадані з файлу",
+  "Reading folder…": "Читання теки…",
+  "Recently Added": "Нещодавно додані",
+  "Recently Deleted": "Нещодавно видалені",
+  "Red Hue": "Тон червоного",
+  "Red Luminance": "Яскравість червоного",
+  "Red Primary": "Основний червоний",
+  "Red Saturation": "Насиченість червоного",
+  "Red channel": "Червоний канал",
+  "Red/Cyan Fringe": "Червона/блакитна облямівка",
+  "Reference": "Еталон",
+  "Reference View": "Еталонне подання",
+  "Reference the files where they are": "Посилатися на файли в їхньому розташуванні",
+  "Refresh Source (/)": "Оновити джерело (/)",
+  "Reject below focus": "Відхиляти нижче порога фокуса",
+  "Rejected": "Відхилено",
+  "Rejects": "Відхилені",
+  "Remove (H)": "Видалення (H)",
+  "Remove CA": "Усунути хроматичну аберацію",
+  "Remove Chromatic Aberration": "Усунути хроматичну аберацію",
+  "Camera local tone mapping": "Локальне тональне відображення камери",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "Застосувати локальне тональне відображення, збережене в RAW (Apple ProRAW), як його відтворює камера",
+  "Remove from Album": "Вилучити з альбому",
+  "Remove from Favorites": "Вилучити з улюблених",
+  "Remove from Local": "Вилучити з локальних",
+  "Remove from Photo": "Вилучити з фото",
+  "Remove from Selected Photos": "Вилучити з вибраних фото",
+  "Remove from Stack": "Вилучити зі стосу",
+  "Remove from survey": "Вилучити з огляду",
+  "Remove location info": "Видалити інформацію про розташування",
+  "Remove this filter": "Видалити цей фільтр",
+  "Remove this group": "Видалити цю групу",
+  "Remove this rule": "Видалити це правило",
+  "Rename Album": "Перейменувати альбом",
+  "Rename Folder…": "Перейменувати теку…",
+  "Rename Keyword": "Перейменувати ключове слово",
+  "Rename Keyword…": "Перейменувати ключове слово…",
+  "Rename Photos": "Перейменувати фото",
+  "Rename Photos…": "Перейменувати фото…",
+  "Rename Version": "Перейменувати версію",
+  "Rendering": "Рендеринг",
+  "Rendering…": "Рендеринг…",
+  "Reset All Curves": "Скинути всі криві",
+  "Reset Before to Import State": "Скинути «до» до стану імпорту",
+  "Reset Control": "Скинути елемент керування",
+  "Reset Crop": "Скинути кадрування",
+  "Reset Edits": "Скинути зміни",
+  "Reset Parametric Curve": "Скинути параметричну криву",
+  "Reset Tone Curve": "Скинути тональну криву",
+  "Reset all curves: point curves (all channels) and parametric (double-click a channel to reset only that one)": "Скинути всі криві: точкові криві (усі канали) і параметричну (подвійне клацання каналу скидає лише його)",
+  "Reset all edits (Cmd+Shift+R)": "Скинути всі зміни (Cmd+Shift+R)",
+  "Resize Face Box": "Змінити розмір рамки обличчя",
+  "Resize to": "Змінити розмір до",
+  "Resolution (ppi)": "Роздільність (ppi)",
+  "Restore (no shortcut)": "Відновити (без скорочення)",
+  "Restore Version": "Відновити версію",
+  "Restore keeps their edits; Import as new deletes the old record first.": "Відновлення зберігає зміни; імпорт як нове спочатку видаляє старий запис.",
+  "Restore them": "Відновити їх",
+  "Retouch": "Ретушування",
+  "Review Import": "Перевірити імпорт",
+  "Right-click a photo ▸ Set as Reference Photo, then View → Reference View (Shift+R)": "Клацніть фото правою кнопкою → Задати як еталонне фото, потім Вигляд → Еталонне подання (Shift+R)",
+  "Right-click a preset to delete it": "Клацніть набір налаштувань правою кнопкою, щоб видалити його",
+  "Rights Usage Terms": "Умови використання прав",
+  "Rotate Crop": "Обертати кадрування",
+  "Rotate Crop Aspect": "Повернути пропорції кадрування",
+  "Rotate Left": "Повернути ліворуч",
+  "Rotate Right": "Повернути праворуч",
+  "Rules": "Правила",
+  "SAM 3 download stopped: it resumes where it left off next time.": "Завантаження SAM 3 зупинено: наступного разу воно продовжиться з того самого місця.",
+  "Same as raw default": "Як у типових налаштуваннях RAW",
+  "Sample Mask Color": "Взяти зразок кольору маски",
+  "Sample a colour on the photo": "Взяти зразок кольору на фото",
+  "Saturation Range": "Діапазон насиченості",
+  "Save Color Label Set": "Зберегти набір кольорових міток",
+  "Save Current Filter as Preset…": "Зберегти поточний фільтр як набір налаштувань…",
+  "Save Current Keywords as Set…": "Зберегти поточні ключові слова як набір…",
+  "Save Export Preset": "Зберегти набір налаштувань експорту",
+  "Save Filter Preset": "Зберегти набір налаштувань фільтра",
+  "Save Keyword Set": "Зберегти набір ключових слів",
+  "Save Metadata Preset": "Зберегти набір налаштувань метаданих",
+  "Save Metadata Preset…": "Зберегти набір налаштувань метаданих…",
+  "Save Metadata to File": "Зберегти метадані до файлу",
+  "Save Point Curve Preset": "Зберегти набір налаштувань точкової кривої",
+  "Save Point Curve…": "Зберегти точкову криву…",
+  "Save as Preset": "Зберегти як набір налаштувань",
+  "Save as Set…": "Зберегти як набір…",
+  "Save as Smart Album…": "Зберегти як смарт-альбом…",
+  "Save as set": "Зберегти як набір",
+  "Save preset": "Зберегти набір налаштувань",
+  "Saving Lightroom import index…": "Збереження індексу імпорту Lightroom…",
+  "Scan failed": "Сканування не вдалося",
+  "Scanning": "Сканування",
+  "Scores stay on the photos: filter or make smart albums with Focus and Best of Similar Shots.": "Оцінки залишаються на фото: фільтруйте або створюйте смарт-альбоми за фокусом і найкращими з подібних знімків.",
+  "Scroll menu down": "Прокрутити меню вниз",
+  "Scroll menu up": "Прокрутити меню вгору",
+  "Search Photos": "Пошук фото",
+  "Search commands or keys": "Пошук команд або клавіш",
+  "Seasons": "Пори року",
+  "Second Window": "Друге вікно",
+  "Select Luminance Range": "Вибрати діапазон яскравості",
+  "Select Mask": "Вибрати маску",
+  "Select Photos": "Вибрати фото",
+  "Select Spot": "Вибрати ділянку",
+  "Select a photo to edit": "Виберіть фото для редагування",
+  "Select by": "Вибрати за",
+  "Select by Flag, Rating or Label": "Вибрати за прапорцем, оцінкою або міткою",
+  "Select photos, then choose View → Survey (N)": "Виберіть фото, а потім Вигляд → Огляд (N)",
+  "Select two photos, then choose View → Compare (Shift+C)": "Виберіть два фото, а потім Вигляд → Порівняти (Shift+C)",
+  "Selected": "Вибрано",
+  "Selecting…": "Виділення…",
+  "Selenium Tone": "Селенове тонування",
+  "Send Feedback…": "Надіслати відгук…",
+  "Sepia Tone": "Тон сепії",
+  "Sequence number zero-padded to N digits (1–9)": "Порядковий номер із нулями до N цифр (1–9)",
+  "Sequence number, counting from the start number": "Порядковий номер, починаючи з початкового числа",
+  "Set": "Задати",
+  "Set Album Cover": "Задати обкладинку альбому",
+  "Set Before": "Задати «до»",
+  "Set Color Label": "Задати кольорову мітку",
+  "Set Crop": "Задати кадрування",
+  "Set Develop Values": "Задати значення обробки",
+  "Set Flag": "Задати прапорець",
+  "Set Image Zoom and Pan": "Задати масштаб і панорамування зображення",
+  "Set Mask Adjustments": "Задати корекції маски",
+  "Set Point Curve": "Задати точкову криву",
+  "Set Profile": "Задати профіль",
+  "Set Rating": "Задати оцінку",
+  "Set Top of Stack": "Задати верхнє фото стосу",
+  "Set as Album Cover": "Задати як обкладинку альбому",
+  "Set as Before": "Задати як «до»",
+  "Set as Reference Photo": "Задати як еталонне фото",
+  "Set as Target Album": "Задати як цільовий альбом",
+  "Set as Target Album (B adds to it)": "Задати як цільовий альбом (B додає до нього)",
+  "Set as Top of Stack": "Задати як верхнє фото стосу",
+  "Set date & time": "Задати дату й час",
+  "Set name": "Назва набору",
+  "Set the mix from the photo's colours": "Задати змішування за кольорами фото",
+  "Settings file problem": "Проблема файлу налаштувань",
+  "Settings new raw photos start from. Changing them doesn't touch photos already in the library.": "Початкові налаштування нових фото RAW. Їхня зміна не впливає на фото, які вже є в бібліотеці.",
+  "Settings pasted": "Налаштування вставлено",
+  "Settings to include": "Налаштування для включення",
+  "Shade": "Тінь",
+  "Shadows Hue": "Тон тіней",
+  "Shadows Luminance": "Яскравість тіней",
+  "Shadows Saturation": "Насиченість тіней",
+  "Shadows Tint": "Відтінок тіней",
+  "Shadows split": "Розділення тіней",
+  "Shift by": "Зсунути на",
+  "Short Edge": "Короткий край",
+  "Show Clipping": "Показати відсікання",
+  "Show Deghost Overlay": "Показати накладання усунення двоїння",
+  "Show Hidden Local Locations": "Показати приховані локальні розташування",
+  "Show Luminance Map": "Показати карту яскравості",
+  "Show Mask Overlay": "Показати накладання маски",
+  "Show Mask Pins": "Показати маркери масок",
+  "Show Original": "Показати оригінал",
+  "Show Photo Counts": "Показати кількість фото",
+  "Show Photos with Keyword": "Показати фото з ключовим словом",
+  "Show Pins": "Показати маркери",
+  "Show Source": "Показати джерело",
+  "Show commands without a shortcut": "Показати команди без скорочення",
+  "Show destination gamut warning": "Показати попередження про гаму призначення",
+  "Show display gamut warning": "Показати попередження про гаму дисплея",
+  "Show file names": "Показати назви файлів",
+  "Show in Explorer": "Показати в Провіднику",
+  "Show in File Manager": "Показати у файловому менеджері",
+  "Show in Finder": "Показати у Finder",
+  "Show on Map": "Показати на карті",
+  "Show overlay (O)": "Показати накладання (O)",
+  "Show ratings, flags and edit badges": "Показати оцінки, прапорці й позначки змін",
+  "Show the Navigator while zoomed in": "Показувати навігатор під час збільшення",
+  "Show the template tags; click one to insert it": "Показати теги шаблону; клацніть тег, щоб вставити його",
+  "Show/Hide Mask": "Показати/приховати маску",
+  "Show/hide My Photos panel": "Показати/приховати панель моїх фото",
+  "Shutter speed": "Витримка",
+  "Sidecar names": "Назви супровідних файлів",
+  "Size (% of short edge)": "Розмір (% короткого краю)",
+  "Size limit": "Обмеження розміру",
+  "Skip": "Пропустити",
+  "Slideshow": "Показ слайдів",
+  "Slideshow paused": "Показ слайдів призупинено",
+  "Slideshow resumed": "Показ слайдів відновлено",
+  "Slideshow · Space pauses · Esc ends": "Показ слайдів · Space призупиняє · Esc завершує",
+  "Smart Album": "Смарт-альбом",
+  "Smart Album Rule Fields": "Поля правил смарт-альбому",
+  "Smart Preview Status": "Стан смарт-перегляду",
+  "Smart Previews Location": "Розташування смарт-переглядів",
+  "Smart preview available": "Смарт-перегляд доступний",
+  "Smart previews": "Смарт-перегляди",
+  "Smart previews folder changed": "Теку смарт-переглядів змінено",
+  "Soft B&W": "М’яке чорно-біле",
+  "Soft Pastel": "М’яка пастель",
+  "Soft Proofing": "Екранна кольоропроба",
+  "Soft Skin": "М’яка шкіра",
+  "Sort by": "Сортувати за",
+  "Spherical": "Сферична",
+  "Split Stack": "Розділити стос",
+  "Spring Fresh": "Весняна свіжість",
+  "Square Grid": "Квадратна сітка",
+  "Square Grid (G toggles)": "Квадратна сітка (G перемикає)",
+  "Square Grid: show file names and formats": "Квадратна сітка: показувати назви й формати файлів",
+  "Stack": "Стос",
+  "Stack photos taken within this time of each other:": "Об’єднати в стос фото, зняті з такою різницею в часі:",
+  "Stacks": "Стоси",
+  "Star rating (0–5)": "Оцінка зірками (0–5)",
+  "Start at": "Почати з",
+  "Start number": "Початкове число",
+  "Starting": "Запуск",
+  "Startup": "Запуск",
+  "State / Province": "Область / провінція",
+  "Stop Building Previews": "Зупинити створення переглядів",
+  "Stop Using as Target Album": "Не використовувати як цільовий альбом",
+  "Stopping…": "Зупинення…",
+  "Straighten Tool": "Інструмент випрямлення",
+  "Strong Contrast": "Сильний контраст",
+  "Subfolder": "Вкладена тека",
+  "Subfolder name": "Назва вкладеної теки",
+  "Subtract from this mask": "Відняти від цієї маски",
+  "Suggestions": "Пропозиції",
+  "Summer Haze": "Літній серпанок",
+  "Survey": "Огляд",
+  "Survey (N)": "Огляд (N)",
+  "Swap": "Поміняти місцями",
+  "Swap Aspect (X)": "Поміняти пропорції (X)",
+  "Swap Before and After": "Поміняти місцями «до» й «після»",
+  "Swap Before and After Settings": "Поміняти місцями налаштування «до» й «після»",
+  "Swap Compare Photos": "Поміняти місцями порівнювані фото",
+  "Sync Settings": "Синхронізувати налаштування",
+  "System default": "Типові системні налаштування",
+  "Tags": "Теги",
+  "Tags: see Tags beside the template. Files are renamed on disk (with their XMP sidecars); existing names get -1, -2…": "Теги: див. «Теги» біля шаблону. Файли перейменовуються на диску (разом із супровідними XMP); до наявних назв додається -1, -2…",
+  "Targeted Adjustment": "Цільова корекція",
+  "Targeted adjustment: drag up/down on the photo to adjust the colours there": "Цільова корекція: тягніть угору/вниз на фото, щоб змінити кольори в цьому місці",
+  "Targeted adjustment: drag up/down on the photo to adjust the curve there": "Цільова корекція: тягніть угору/вниз на фото, щоб змінити криву в цьому місці",
+  "Teal & Amber": "Бірюза й бурштин",
+  "Teal & Orange": "Бірюза й оранжевий",
+  "Temp": "Температура",
+  "That key can't be used as a shortcut": "Цю клавішу не можна використовувати як скорочення",
+  "The SAM 3 model is installed: Object and Describe masks are ready.": "Модель SAM 3 встановлено: маски «Об’єкт» і «Описати» готові.",
+  "The download didn't work:": "Завантаження не вдалося:",
+  "The number at the end of the original name (IMG_0042 → 0042)": "Число в кінці початкової назви (IMG_0042 → 0042)",
+  "The original extension is always added; {ext} only puts it inside the name as well.": "Початкове розширення завжди додається; {ext} лише вставляє його також усередину назви.",
+  "The original files, unchanged, each with an XMP sidecar holding its edits.": "Початкові файли без змін, кожен із супровідним XMP зі змінами.",
+  "The photo has these settings": "Фото має ці налаштування",
+  "They can be restored from Recently Deleted until it is emptied.": "Їх можна відновити з нещодавно видалених до очищення цього розділу.",
+  "Thirds": "Третини",
+  "This folder is not available (drive disconnected?). Smart previews are not built or used until it is back or you choose another folder.": "Ця тека недоступна (диск від’єднано?). Смарт-перегляди не створюються й не використовуються, доки вона не стане доступною або ви не виберете іншу теку.",
+  "This photo can't be opened": "Не вдалося відкрити це фото",
+  "Thumbnail cache": "Кеш мініатюр",
+  "Time zone": "Часовий пояс",
+  "Title": "Заголовок",
+  "Title metadata": "Метадані заголовка",
+  "Toggle Keyword from Set": "Перемкнути ключове слово з набору",
+  "Toggle Mask": "Перемкнути маску",
+  "Toggle Section": "Перемкнути розділ",
+  "Toggle Zoom": "Перемкнути масштаб",
+  "Top Level": "Верхній рівень",
+  "Treatment": "Обробка",
+  "Try Saving Again": "Спробувати зберегти знову",
+  "Tungsten": "Лампа розжарювання",
+  "Turn Off": "Вимкнути",
+  "Turn on Include subfolders, or pick another folder under Local": "Увімкніть включення вкладених тек або виберіть іншу теку в локальних",
+  "Uncheck All": "Зняти всі позначки",
+  "Uncheck the files of this type": "Зняти позначки з файлів цього типу",
+  "Unedited": "Без змін",
+  "Unedited raws": "Незмінені RAW",
+  "Unflag": "Зняти прапорець",
+  "Unflagged": "Без прапорця",
+  "Ungroup Stack": "Розгрупувати стос",
+  "Unknown tags stay as typed — check the preview for a {typo}.": "Невідомі теги залишаються як введено — перевірте перегляд на {typo}.",
+  "Unrated": "Без оцінки",
+  "Unreadable": "Нечитабельне",
+  "Update": "Оновити",
+  "Update Mask Shape": "Оновити форму маски",
+  "Update Preset with Current Settings": "Оновити набір налаштувань поточними значеннями",
+  "Update Rules from Current Filter": "Оновити правила з поточного фільтра",
+  "Update Version": "Оновити версію",
+  "Update Version with Current Settings": "Оновити версію поточними налаштуваннями",
+  "Update with Current Settings": "Оновити поточними налаштуваннями",
+  "Updated the edits saved in the external editor": "Зміни, збережені в зовнішньому редакторі, оновлено",
+  "Upright": "Випрямлення",
+  "Urban": "Міське",
+  "Use Keyword Set": "Використовувати набір ключових слів",
+  "Use Library Folder": "Використовувати теку бібліотеки",
+  "Use camera-specific defaults": "Використовувати типові налаштування для камери",
+  "Use the GPU for rendering": "Використовувати ГП для рендерингу",
+  "User Presets": "Власні набори налаштувань",
+  "Value": "Значення",
+  "Version name": "Назва версії",
+  "Versions": "Версії",
+  "Versions (Shift+V)": "Версії (Shift+V)",
+  "Videos": "Відео",
+  "Viewing and sharing": "Перегляд і поширення",
+  "Vignette": "Віньєтка",
+  "Vintage": "Вінтажне",
+  "Virtual Copy": "Віртуальна копія",
+  "Visualize Spots": "Показати плями",
+  "Visualize Spots (A)": "Показати плями (A)",
+  "Visualize range": "Показати діапазон",
+  "Vivid": "Яскраве",
+  "Vivid Pop": "Виразна яскравість",
+  "Warm Film": "Тепла плівка",
+  "Warm Glow": "Тепле сяйво",
+  "Warm Print": "Теплий відбиток",
+  "Warm Table": "Теплий стіл",
+  "Watched folder": "Відстежувана тека",
+  "Watermark": "Водяний знак",
+  "What's New": "Що нового",
+  "When rated or hovered": "Після оцінювання або наведення",
+  "White Balance": "Баланс білого",
+  "White Balance Selector": "Вибір балансу білого",
+  "White Balance Selector (W)": "Вибір балансу білого (W)",
+  "Width (% of photo)": "Ширина (% фото)",
+  "Width (px)": "Ширина (пікселів)",
+  "Width × Height": "Ширина × висота",
+  "Will be replaced": "Буде замінено",
+  "Will be restored": "Буде відновлено",
+  "Winter Blue": "Зимова синява",
+  "XMP Sidecar Preferences": "Налаштування супровідних файлів XMP",
+  "XMP sidecars": "Супровідні файли XMP",
+  "Year": "Рік",
+  "Yellow Hue": "Тон жовтого",
+  "Yellow Luminance": "Яскравість жовтого",
+  "Yellow Saturation": "Насиченість жовтого",
+  "Yellow label": "Жовта мітка",
+  "You can close this: the download continues, and resumes if interrupted.": "Можна закрити це вікно: завантаження триває й відновиться після переривання.",
+  "Your Name": "Ваше ім’я",
+  "Zoom 100%": "Масштаб 100%",
+  "Zoom to Fit": "Масштабувати до вміщення",
+  "a literal %": "буквальний %",
+  "a removed photo": "вилучене фото",
+  "all": "усі",
+  "and": "і",
+  "any": "будь-яке",
+  "are empty": "порожні",
+  "aren't empty": "не порожні",
+  "blue": "синій",
+  "comma, separated": "розділені комами",
+  "contains": "містить",
+  "copyrighted": "захищено авторським правом",
+  "day 01–31": "день 01–31",
+  "days": "днів",
+  "discarding smart previews": "видалення смарт-переглядів",
+  "doesn't contain": "не містить",
+  "e.g. sky · the red car · car, road": "наприклад, небо · червона машина · машина, дорога",
+  "ends with": "закінчується на",
+  "false": "хибне",
+  "green": "зелений",
+  "hour 00–23": "година 00–23",
+  "hours": "годин",
+  "image": "зображення",
+  "is": "дорівнює",
+  "is <": "<",
+  "is >": ">",
+  "is after": "після",
+  "is before": "до",
+  "is between": "між",
+  "is empty": "порожнє",
+  "is in the last": "за останні",
+  "is unknown": "невідоме",
+  "is ≤": "≤",
+  "is ≥": "≥",
+  "isn't": "не дорівнює",
+  "isn't empty": "не порожнє",
+  "isn't in the last": "не за останні",
+  "keep names — or e.g. {date}_{seq:3}": "залишити назви — або, наприклад, {date}_{seq:3}",
+  "latitude, longitude": "широта, довгота",
+  "memory only": "лише в пам’яті",
+  "minute": "хвилина",
+  "month 01–12": "місяць 01–12",
+  "months": "місяців",
+  "none": "немає",
+  "none (CPU rendering)": "немає (рендеринг на ЦП)",
+  "none of": "жодне з",
+  "not available here": "недоступно тут",
+  "of the following rules:": "таких правил:",
+  "Interface language": "Мова інтерфейсу",
+  "New blank PDF": "Новий порожній PDF",
+  "Create PDF from file…": "Створити PDF з файлу…",
+  "Create PDF from images…": "Створити PDF із зображень…",
+  "Create PDF from clipboard": "Створити PDF з буфера обміну",
+  "Combine files…": "Об’єднати файли…",
+  "Save as…": "Зберегти як…",
+  "Close file": "Закрити файл",
+  "Close all": "Закрити всі",
+  "Document properties…": "Властивості документа…",
+  "Advanced search…": "Розширений пошук…",
+  "Copy pages": "Копіювати сторінки",
+  "Cut pages": "Вирізати сторінки",
+  "Paste pages": "Вставити сторінки",
+  "Fit visible": "Умістити видиме",
+  "Marquee zoom": "Збільшення рамкою",
+  "Take a snapshot": "Зробити знімок",
+  "Full screen mode": "Повноекранний режим",
+  "Read mode": "Режим читання",
+  "Switch light / dark theme": "Перемкнути світлу / темну тему",
+  "Comments panel": "Панель коментарів",
+  "Form fields panel": "Панель полів форми",
+  "Clear form": "Очистити форму",
+  "Find tools and commands…": "Знайти інструменти й команди…",
+  "Actual size": "Фактичний розмір",
+  "Zoom to page level": "Масштаб до рівня сторінки",
+  "Fit to width": "Умістити за шириною",
+  "Display theme": "Тема відображення",
+  "Side panels": "Бічні панелі",
+  "Text direction": "Напрямок тексту",
+  "Horizontal text": "Горизонтальний текст",
+  "Vertical text": "Вертикальний текст",
+  "Your library couldn't be opened": "Не вдалося відкрити вашу бібліотеку",
+  "LightCraft couldn't find where to keep your library.": "LightCraft не вдалося знайти місце для бібліотеки.",
+  "LightCraft couldn't open the library at": "LightCraft не вдалося відкрити бібліотеку в",
+  "Try Again": "Спробувати знову",
+  "Choose Another Library…": "Вибрати іншу бібліотеку…",
+  "Continue Without Saving": "Продовжити без збереження",
+  "Quit": "Вийти",
+  "Temporary session — your library isn't open, and nothing you do here is saved.": "Тимчасовий сеанс — бібліотеку не відкрито, і жодна дія тут не зберігається.",
+  "Back Up Library…": "Створити резервну копію бібліотеки…",
+  "Restore Library from Backup…": "Відновити бібліотеку з резервної копії…",
+  "In Recently Deleted": "У нещодавно видалених",
+  "Reload from Disk": "Перезавантажити з диска",
+  "Monday": "Понеділок",
+  "Tuesday": "Вівторок",
+  "Wednesday": "Середа",
+  "Thursday": "Четвер",
+  "Friday": "П’ятниця",
+  "Saturday": "Субота",
+  "Sunday": "Неділя",
+  "Unknown Date": "Невідома дата",
+  "Remove Folder from Library": "Вилучити теку з бібліотеки",
+  "Remove from Library…": "Вилучити з бібліотеки…",
+  "This Computer": "Цей комп’ютер",
+  "includes the folders inside it": "включає вкладені теки",
+  "They move to Recently Deleted and can be restored; no file on disk is touched.": "Вони переміщуються до нещодавно видалених і можуть бути відновлені; файли на диску не змінюються.",
+  "Moves the photos imported from this folder to Recently Deleted; no file is touched": "Переміщує імпортовані з цієї теки фото до нещодавно видалених; файли не змінюються",
+  "Remove Disk from Library…": "Вилучити диск із бібліотеки…",
+  "Moves every photo imported from this disk to Recently Deleted; no file is touched": "Переміщує всі імпортовані з цього диска фото до нещодавно видалених; файли не змінюються",
+  "Remove Disk from Library": "Вилучити диск із бібліотеки",
+  "All the photos imported from this disk are included.": "Включаються всі імпортовані з цього диска фото.",
+  "That includes the photos in the folders inside it.": "Також включаються фото у вкладених теках.",
+  "or": "або",
+  "pick": "відібране",
+  "previews": "перегляди",
+  "publicDomain": "суспільне надбання",
+  "purple": "фіолетовий",
+  "raw": "RAW",
+  "red": "червоний",
+  "reject": "відхилене",
+  "saved in": "збережено в",
+  "second": "секунда",
+  "smart previews": "смарт-перегляди",
+  "starts with": "починається з",
+  "the photos in view": "фото в поданні",
+  "the selected photos": "вибрані фото",
+  "this photo": "це фото",
+  "true": "істинне",
+  "unknown": "невідоме",
+  "video": "відео",
+  "weeks": "тижнів",
+  "year, 2 digits": "рік, 2 цифри",
+  "year, 4 digits": "рік, 4 цифри",
+  "years": "років",
+  "yellow": "жовтий",
+  "{date} is the capture time; a photo without one uses the time it was imported.": "{date} — час знімання; фото без нього використовує час імпорту.",
+  "© 2026 Your Name": "© 2026 Ваше ім’я",
+  "© Your Name": "© Ваше ім’я",
+  "− harder border · + softer border": "− твердіша межа · + м’якша межа",
+  "≤  at most": "≤  щонайбільше",
+  "≥  at least": "≥  щонайменше",
+  "日本語": "日本語",
+  "繁體中文（台灣）": "繁體中文（台灣）",
+  "How to install the model": "Як установити модель",
+  "Install the SAM 3 Model": "Установити модель SAM 3",
+  "This build can't download the model yet. To install it by hand, put model.safetensors, vocab.json and merges.txt from Meta's facebook/sam3 in the folder above: Object and Describe work as soon as they are there.": "Ця збірка ще не може завантажити модель. Щоб установити її вручну, покладіть model.safetensors, vocab.json і merges.txt із facebook/sam3 від Meta до теки вище: «Об’єкт» і «Описати» працюватимуть одразу після цього.",
+  "Open Log Folder": "Відкрити теку журналів",
+  "Back to this person": "Повернутися до цієї особи",
+  "AI Denoise": "ШІ: усунення шуму",
+  "AI Denoise Model": "Модель усунення шуму ШІ",
+  "AI Denoise is off: press Use on a model.": "Усунення шуму ШІ вимкнено: натисніть «Використовувати» на моделі.",
+  "AI Denoise needs a model. Install one in Settings.": "Для усунення шуму ШІ потрібна модель. Установіть її в налаштуваннях.",
+  "Accept & Download": "Прийняти й завантажити",
+  "Already installed. Remove it before installing a replacement.": "Уже встановлено. Видаліть перед установленням заміни.",
+  "Automatic uses the graphics card where it is faster than the processor: both are timed on this computer the first time a photo is made.": "Автоматичний режим використовує відеокарту, коли вона швидша за процесор: час обох вимірюється на цьому комп’ютері під час першої обробки фото.",
+  "Cache": "Кеш",
+  "Checking and installing the model…": "Перевірка й установлення моделі…",
+  "Checking…": "Перевірка…",
+  "Clear cache": "Очистити кеш",
+  "Denoise Models": "Моделі усунення шуму",
+  "Denoise Settings": "Налаштування усунення шуму",
+  "Denoise all photos with an Amount": "Обробити всі фото зі значенням усунення шуму",
+  "Downloaded and checked. Installing…": "Завантажено й перевірено. Установлення…",
+  "Failed its last test": "Останню перевірку не пройдено",
+  "Graphics card": "Відеокарта",
+  "I have read these terms and accept them for my own use": "Я прочитав ці умови й приймаю їх для власного використання",
+  "Inspect Denoise Model": "Перевірити модель усунення шуму",
+  "Install Denoise Model": "Установити модель усунення шуму",
+  "Install from file…": "Установити з файлу…",
+  "Install your own ONNX model with denoise-model.json beside it. This build offers no model downloads.": "Установіть власну модель ONNX із denoise-model.json поруч. Ця збірка не пропонує завантаження моделей.",
+  "Its denoised picture is not made yet, and pictures are not made on their own (Settings, AI Denoise).": "Зображення з усуненим шумом ще не створено, а автоматичне створення вимкнено (Налаштування, ШІ: усунення шуму).",
+  "LightCraft does not know this model, so it assumed:": "LightCraft не знає цю модель, тому припускає:",
+  "Limit": "Обмеження",
+  "Make it now": "Створити зараз",
+  "Make the denoised picture of the photos I am looking at": "Створити зображення з усуненим шумом для фото, які я переглядаю",
+  "Next up for AI Denoise…": "Наступне на усунення шуму ШІ…",
+  "Nothing is fetched until you accept. The model is kept on this computer only; LightCraft never uploads or shares it.": "Нічого не завантажується до вашої згоди. Модель зберігається лише на цьому комп’ютері; LightCraft ніколи не вивантажує й не поширює її.",
+  "Only photos whose AI Denoise amount is above 0 are made. Exports always make theirs if it is missing.": "Обробляються лише фото зі значенням усунення шуму ШІ понад 0. Експорт завжди створює потрібне зображення, якщо його немає.",
+  "Open page": "Відкрити сторінку",
+  "Open the model's page": "Відкрити сторінку моделі",
+  "Opens the model's own page in your browser, to read about it or get the file yourself.": "Відкриває сторінку моделі в браузері, щоб прочитати про неї або отримати файл самостійно.",
+  "Processor": "Процесор",
+  "Set up AI Denoise…": "Налаштувати усунення шуму ШІ…",
+  "Starting…": "Запуск…",
+  "Tested and works on this computer": "Перевірено й працює на цьому комп’ютері",
+  "The denoise model is installed and in use: the AI Denoise Amount slider under Detail now works": "Модель усунення шуму встановлено й використовується: повзунок інтенсивності усунення шуму ШІ в деталях тепер працює",
+  "The graphics card is set up when the next photo is made.": "Відеокарта налаштовується під час обробки наступного фото.",
+  "The model is kept on this computer only. LightCraft never uploads or shares it.": "Модель зберігається лише на цьому комп’ютері. LightCraft ніколи не вивантажує й не поширює її.",
+  "The processor does the work.": "Роботу виконує процесор.",
+  "There is no model file to install": "Немає файлу моделі для встановлення",
+  "This build cannot run denoise models.": "Ця збірка не може запускати моделі усунення шуму.",
+  "This build has nowhere to keep denoise models, so AI Denoise is not available. (The desktop app has.)": "Ця збірка не має місця для моделей усунення шуму, тому ця функція ШІ недоступна. (Настільний застосунок має.)",
+  "This file cannot be used yet": "Цей файл поки не можна використовувати",
+  "Tick the box to accept the model's terms first": "Спочатку позначте прийняття умов моделі",
+  "Try again": "Спробувати знову",
+  "Try the graphics card again": "Спробувати відеокарту знову",
+  "Turn off": "Вимкнути",
+  "Unknown licence": "Невідома ліцензія",
+  "Use": "Використовувати",
+  "Waiting to start…": "Очікування запуску…",
+  "Works on raw files from cameras with a standard (Bayer) sensor. Other files keep their normal noise reduction.": "Працює з файлами RAW від камер зі стандартним сенсором (Баєра). Інші файли зберігають звичайне зменшення шуму.",
+  "cached picture": "Кешовані зображення",
+  "cached pictures": "Кешовані зображення",
+  "commercial use allowed": "комерційне використання дозволено",
+  "denoiseModel.accept": "denoiseModel.accept",
+  "in use": "використовується",
+  "installed": "встановлено",
+  "makes AI Denoise available": "надає доступ до усунення шуму ШІ",
+  "non-commercial use only": "лише некомерційне використання",
+  "photo has its denoised picture.": "Фото із зображенням з усуненим шумом",
+  "photo waiting": "Фото в черзі",
+  "photos have their denoised picture.": "Фото із зображенням з усуненим шумом",
+  "photos waiting": "Фото в черзі",
+  "starts using it for AI Denoise": "починає використовувати модель для усунення шуму ШІ",
+  "terms unclear": "умови незрозумілі",
+  "the graphics card": "відеокарта",
+  "the graphics card is not used": "відеокарта не використовується",
+  "Cancel Denoise": "Скасувати усунення шуму",
+  "Cancel Denoise Model Download": "Скасувати завантаження моделі усунення шуму",
+  "Choose Denoise Model": "Вибрати модель усунення шуму",
+  "Clear Denoise Cache": "Очистити кеш усунення шуму",
+  "Denoise Model Downloads": "Завантаження моделей усунення шуму",
+  "Denoise Photos": "Обробити фото з усуненням шуму",
+  "Denoise Pump": "Запустити чергу усунення шуму",
+  "Denoise Status": "Стан усунення шуму",
+  "Download Denoise Model": "Завантажити модель усунення шуму",
+  "Remove Denoise Model": "Видалити модель усунення шуму",
+  "Test Denoise Model": "Перевірити модель усунення шуму",
+  "AI Denoise is enabled on the requesting photo": "Усунення шуму ШІ ввімкнено для фото, що запросило дію",
+  "After installation, AI Denoise will turn on for the requesting photo.": "Після встановлення усунення шуму ШІ ввімкнеться для фото, що запросило дію.",
+  "Cancel pending action": "Скасувати відкладену дію",
+  "Install a denoise model to enable AI Denoise on this photo": "Установіть модель усунення шуму, щоб увімкнути його для цього фото",
+  "Pending photo action cancelled": "Відкладену дію фото скасовано",
+  "Pending photo action cancelled because its library or photo changed": "Відкладену дію фото скасовано, оскільки змінилася бібліотека або фото",
+  "ONNX model": "Модель ONNX",
+  "commercial use subject to GPL conditions": "комерційне використання за умов GPL",
+  "\"saved in memory but not written to disk\", the top bar shows a warning, and LightCraft keeps retrying until the": "«збережено в пам’яті, але не записано на диск», верхня панель показує попередження, а LightCraft повторює спроби, доки",
+  "#106): a DNG is checked against the raw data, written to a temp file, synced and read back before it gets its": "#106): DNG перевіряється за даними RAW, записується до тимчасового файлу, синхронізується й перечитується, перш ніж отримати",
+  "(`gpuReason`, `gpuFallback`), Help ▸ System Info and Settings ▸ Performance say why the GPU isn't": "(`gpuReason`, `gpuFallback`), Довідка → Інформація про систему й Налаштування → Продуктивність пояснюють, чому ГП не",
+  "(e.g. D750, D780, D850, D7500, Z 50) no longer render nearly black or with crushed shadows: their black level was": "(наприклад, D750, D780, D850, D7500, Z 50) більше не відтворюються майже чорними або зі знищеними тінями: їхній рівень чорного",
+  "(issue #94): an HTTP request from a web page can no longer carry a command in its body. Lines are capped at": "(проблема #94): HTTP-запит із вебсторінки більше не може містити команду в тілі. Рядки обмежено",
+  "123 on studio-mac)\") instead of letting both write and silently drop each other's edits. A crash never leaves the": "123 на studio-mac)»), замість того щоб дозволити обом писати й непомітно втрачати зміни одне одного. Аварія ніколи не залишає",
+  "1620 × 1080 preview, and import with their metadata: capture time, camera, lens, exposure, GPS and XMP. Their raw": "перегляд 1620 × 1080 та імпортуються з метаданими: час знімання, камера, об’єктив, експозиція, GPS і XMP. Їхні дані RAW",
+  "23 new built-in presets: Portrait, Landscape, Urban, Food, Seasons, Vintage and B&W toners.": "23 нові вбудовані набори налаштувань: портрет, пейзаж, місто, їжа, пори року, вінтаж і чорно-біле тонування.",
+  "4 MiB and connections at 16.": "4 МіБ, а кількість з’єднань — 16.",
+  "630 drivers): on Windows the window and GPU rendering use DirectX 12 only and never load the Vulkan driver unless": "630): у Windows вікно й рендеринг на ГП використовують лише DirectX 12 і не завантажують драйвер Vulkan, доки ви",
+  "A change that can't be saved to disk (full or unplugged drive) is no longer silent: the command reports": "Зміна, яку не можна зберегти на диск (заповнений або від’єднаний), більше не залишається непомітною: команда повідомляє",
+  "A library is open in one program at a time (issue #99): opening a library that LightCraft or `lightcraft-cli` already": "Бібліотека відкрита лише в одній програмі одночасно (проблема #99): відкриття бібліотеки, яку LightCraft або `lightcraft-cli` уже",
+  "A save that fails part-way (a full disk, a network share that drops) no longer looks like a damaged catalog": "Невдале часткове збереження (повний диск, розрив мережевого підключення) більше не виглядає як пошкоджений каталог",
+  "A sleeping NAS, a dropped network share or a USB drive spinning up no longer freezes the window (issue #104):": "Сплячий NAS, розірване мережеве підключення або USB-диск, що розкручується, більше не заморожують вікно (проблема #104):",
+  "AI masks with SAM 3 (Object and Describe in the Masking panel): click an object to select it (⌥-click leaves a": "Маски ШІ із SAM 3 («Об’єкт» і «Описати» на панелі маскування): клацніть об’єкт, щоб виділити його (⌥-клацання виключає",
+  "Auto Sync: edits apply to every selected photo. Auto B&W mix. Automatic versions.": "Автосинхронізація: зміни застосовуються до кожного вибраного фото. Автоматичне змішування чорно-білого. Автоматичні версії.",
+  "Auto-Tag from Tracklog: GPS locations for your photos from a GPX track log, matched by capture time.": "Автоматичне позначення за журналом маршруту: розташування GPS для фото з журналу GPX за часом знімання.",
+  "Browser version (experimental), keeping a library safe (issue #107): File ▸ Back Up Library… downloads the catalog": "Браузерна версія (експериментальна), захист бібліотеки (проблема #107): Файл → Створити резервну копію бібліотеки… завантажує каталог",
+  "Canon CR2 photos from the EOS 7D, 50D, 60D, 550D, 600D, 1200D, 1300D, 5D Mark II and 1D Mark IV (and other": "Фото Canon CR2 з EOS 7D, 50D, 60D, 550D, 600D, 1200D, 1300D, 5D Mark II та 1D Mark IV (та інших",
+  "Canon CR3 files show their full-size embedded JPEG (e.g. 6960 × 4640 on an EOS R6 Mark III) instead of the": "Файли Canon CR3 показують повнорозмірний вбудований JPEG (наприклад, 6960 × 4640 на EOS R6 Mark III) замість",
+  "Cmd+Shift+R, keeps the photo and clears its edits.)": "Cmd+Shift+R, зберігає фото й скидає його зміни.)",
+  "Colour-label filter with several labels at once; expandable folder tree in Local.": "Фільтр кольорових міток із кількома мітками одночасно; дерево тек у локальних із розгортанням.",
+  "Colour-range masks: click the photo to sample. Luminance ranges: range bar, smoothness, luminance map.": "Маски колірного діапазону: клацніть фото для зразка. Діапазони яскравості: смуга діапазону, плавність, карта яскравості.",
+  "Compressed Nikon NEFs (lossless and lossy compressed, 12- and 14-bit — e.g. D3200, D5100, D7000, D750, D850, Z 50)": "Стиснені Nikon NEF (без втрат і з втратами, 12- і 14-бітні — наприклад, D3200, D5100, D7000, D750, D850, Z 50)",
+  "Convert to DNG, Copy as DNG, Photo Merge and smart previews no longer write straight to the final file (issue": "Перетворення на DNG, копіювання як DNG, об’єднання фото й смарт-перегляди більше не пишуть прямо до кінцевого файлу (проблема",
+  "Copyright status, rights usage terms and copyright info URL in Info, metadata presets and exports.": "Статус авторського права, умови використання прав і URL інформації про авторське право в інформації, наборах метаданих і експорті.",
+  "Edge setting, and get a sharper zoomed-in pass in the background. The model runs inside LightCraft in pure Rust": "налаштування краю й отримують чіткіший збільшений результат у фоні. Модель працює всередині LightCraft на чистому Rust",
+  "Edit in External Editor (⇧⌘E): a 16-bit TIFF copy, stacked, refreshed when you come back.": "Редагування в зовнішньому редакторі (⇧⌘E): 16-бітна копія TIFF у стосі, оновлена після повернення.",
+  "Export file names use the Rename Photos tokens ({title}, {seq:2}, {date:%Y-%m-%d}…), plus new {num}, {folder}, {lens}, {iso}, {rating}, {creator}.": "Назви експортованих файлів використовують теги перейменування фото ({title}, {seq:2}, {date:%Y-%m-%d}…), а також нові {num}, {folder}, {lens}, {iso}, {rating}, {creator}.",
+  "Exported files are written to a temp file and then renamed into place, so a full disk or an unplugged drive": "Експортовані файли пишуться до тимчасового файлу, а потім перейменовуються на місце, тому заповнений або від’єднаний диск",
+  "Exports and renders never write over a photo's original (issue #93): exporting into the photo's own folder with": "Експорт і рендеринг ніколи не перезаписують оригінал фото (проблема #93): експорт до власної теки фото з",
+  "Exports are never black because of the GPU (issue #78): a GPU render that runs out of device": "Експорт ніколи не стає чорним через ГП (проблема #78): рендеринг на ГП, який вичерпує пам’ять пристрою,",
+  "Faster exports and card imports, with the same protection for what can't be recreated (issue #134): exports,": "Швидші експорт та імпорт із карт, із тим самим захистом невідтворюваних даних (проблема #134): експорт,",
+  "If your library can't be opened at launch (open in another program, unreadable, on a drive that isn't connected,": "Якщо бібліотеку неможливо відкрити під час запуску (відкрита в іншій програмі, не читається, на непідключеному диску,",
+  "Import presets from other editors: XMP presets, classic `.lrtemplate` files, \"DNG presets\" from mobile apps and `.zip`": "Імпорт наборів налаштувань з інших редакторів: XMP, класичні `.lrtemplate`, «набори DNG» із мобільних застосунків і `.zip`",
+  "Import ▸ Copy verifies every copy, like Move (issue #96): each file is written as a new file, synced to disk and": "Імпорт → Копіювати перевіряє кожну копію, як і переміщення (проблема #96): кожен файл створюється як новий, синхронізується на диск і",
+  "Import ▸ Move: photos go into the destination (with the same folders and renaming as Copy, e.g.": "Імпорт → Перемістити: фото переходять до призначення (із тими самими теками й перейменуванням, що й копіювання, наприклад",
+  "Import: copy to any folder, by day / by month / one folder, rename on import, metadata preset, Copy as DNG.": "Імпорт: копіювання до будь-якої теки, за днем / місяцем / до однієї теки, перейменування під час імпорту, набір метаданих, копіювання як DNG.",
+  "JPEG with the same name (`IMG_0001.CR3` + `IMG_0001.JPG`) no longer share one sidecar: the raw keeps `IMG_0001.xmp`,": "JPEG із тією самою назвою (`IMG_0001.CR3` + `IMG_0001.JPG`) більше не мають спільного супровідного файлу: RAW зберігає `IMG_0001.xmp`,",
+  "LightCraft 0.2.0 and older refuse it (\"unsupported format … v2\").": "LightCraft 0.2.0 і старіші відмовляються його відкрити («непідтримуваний формат … v2»).",
+  "LightCraft no longer crashes at launch on Windows PCs whose Vulkan driver is broken (issue #136, e.g. some Intel UHD": "LightCraft більше не падає під час запуску на ПК Windows із несправним драйвером Vulkan (проблема #136, наприклад, деякі Intel UHD",
+  "Lossy DNG files and Smart Previews open as raw photos.": "DNG із втратами й смарт-перегляди відкриваються як фото RAW.",
+  "Luminar looks: `.lmp` files and `.mplumpack` collections import as presets (grouped by collection); the sliders": "Стилі Luminar: файли `.lmp` і колекції `.mplumpack` імпортуються як набори налаштувань (згруповані за колекцією); повзунки",
+  "Nikon NEFs start from a colour and tone look fitted to the camera's own JPEG, as Sony ARWs do, instead of a muted,": "Nikon NEF починають із кольору й тону, підігнаних до власного JPEG камери, як і Sony ARW, замість приглушеного",
+  "Nikon splits into two differently compressed halves still use the preview for now.)": "Nikon із двома половинами різного стиснення поки використовують перегляд.)",
+  "Panasonic and Leica raws (RW2, RWL and the older RAW files, DMC-LX1 to DC-S1R II) develop from the raw data in": "Panasonic і Leica RAW (RW2, RWL і старі RAW, від DMC-LX1 до DC-S1R II) обробляються з даних RAW у",
+  "Photo menu. The filmstrip has the photo context menu too. Adding a file again that is in Recently Deleted no": "меню «Фото». Стрічка також має контекстне меню фото. Повторне додавання файлу з нещодавно видалених більше не",
+  "Photos in Recently Deleted can be restored from the app: right-click ▸ Restore (or Delete Permanently), also in the": "Фото в нещодавно видалених можна відновити із застосунку: права кнопка → Відновити (або Видалити назавжди), також у",
+  "Photos); importing (also by drag and drop), Find Missing Photos, Build / Discard Smart Previews, the Rename preview,": "Фото); імпорт (зокрема перетягування), пошук відсутніх фото, створення / видалення смарт-переглядів, перегляд перейменування,",
+  "Quick Collection and target album (B in the grid), keyword sets (⌥1–⌥9), colour-label sets.": "Швидка колекція й цільовий альбом (B у сітці), набори ключових слів (⌥1–⌥9), набори кольорових міток.",
+  "Rename Folder… and Move Folder To… (Local) can be undone and redone (issue #97): the folder moves back on disk with": "Перейменування теки… й переміщення теки до… (Локальні) можна скасувати й повторити (проблема #97): тека повертається на диску разом із",
+  "Rename Photos never overwrites another photo when only the letter case changes (issue #95): on case-sensitive": "Перейменування фото ніколи не перезаписує інше фото, коли змінюється лише регістр літер (проблема #95): на томах із чутливістю",
+  "Rename Photos reports files it could not move back after a failure (issue #105), e.g. when a network share drops": "Перейменування фото повідомляє про файли, які не вдалося повернути після помилки (проблема #105), наприклад, розриву мережевого підключення",
+  "Saving metadata to an XMP sidecar another application wrote no longer replaces it (issue #92): LightCraft merges its": "Збереження метаданих до XMP, написаного іншим застосунком, більше не замінює його (проблема #92): LightCraft додає свої",
+  "Settings files are never quietly reset (issue #103): a damaged `prefs.json`, `presets.json` or `view.json` is kept": "Файли налаштувань ніколи не скидаються непомітно (проблема #103): пошкоджені `prefs.json`, `presets.json` або `view.json` зберігаються",
+  "Slideshow, second window, All Metadata, System Info.": "Показ слайдів, друге вікно, усі метадані, інформація про систему.",
+  "Smaller, faster catalogs: photos you only looked at in Local (never added, rated or edited) are forgotten once": "Менші й швидші каталоги: фото, які ви лише переглядали в локальних (ніколи не додавали, не оцінювали й не редагували), забуваються, коли",
+  "Smart albums with a rule editor: match all / any / none, nested groups, 26 fields.": "Смарт-альбоми з редактором правил: усі / будь-які / жодні, вкладені групи, 26 полів.",
+  "Sony ARWs from before about 2017 (RX100, RX100 II–V, RX10, NEX, SLT, ILCE-6000, A7 / A7 II / A7R II and their": "Sony ARW приблизно до 2017 року (RX100, RX100 II–V, RX10, NEX, SLT, ILCE-6000, A7 / A7 II / A7R II та споріднені",
+  "Sony ILCE-7M4 downsized lossless ARWs now decode subsampled YCbCr tiles into linear RGB,": "Sony ILCE-7M4 ARW зменшеного розміру без втрат тепер декодують ділянки YCbCr зі зменшеною дискретизацією в лінійний RGB,",
+  "TZ/ZS series, Leica D-Lux, V-Lux and C-Lux, and the GH6, GH7, G9 II, S5 II and S9 generation. They start from a": "серії TZ/ZS, Leica D-Lux, V-Lux і C-Lux та покоління GH6, GH7, G9 II, S5 II і S9. Вони починають із",
+  "The catalog has a format version (issue #102). Opening a library from an older LightCraft upgrades it; a library": "Каталог має версію формату (проблема #102). Відкриття бібліотеки старішого LightCraft оновлює її; бібліотека,",
+  "The control port (`--control`) closes a connection as soon as it receives anything that isn't a JSON request": "Порт керування (`--control`) закриває з’єднання, щойно отримує щось, що не є запитом JSON",
+  "The thumbnail cache only ever counts and deletes its own files (issue #98): a library opened on a folder that": "Кеш мініатюр завжди рахує й видаляє лише власні файли (проблема #98): бібліотека, відкрита в теці, яка",
+  "Watched-folder auto import; Convert to DNG; Duplicate; Build Standard / 1:1 / Smart Previews.": "Автоімпорт із відстежуваної теки; перетворення на DNG; дублювання; створення стандартних переглядів / 1:1 / смарт-переглядів.",
+  "Without Saving and Quit (issue #100). It no longer quietly starts a demo session that looked like a reset library and": "без збереження й вихід (проблема #100). Більше не запускається непомітний демонстраційний сеанс, схожий на скинуту бібліотеку, який",
+  "`Photos/2026/20260114/20260114_001.jpg`) together with their XMP sidecars; each original leaves the card only after its": "`Photos/2026/20260114/20260114_001.jpg`) разом із супровідними XMP; кожен оригінал залишає карту лише після",
+  "`img_1-1.JPG`; on case-insensitive volumes the case change still goes through.": "`img_1-1.JPG`; на томах без чутливості до регістру зміна регістру виконується.",
+  "a full drive) no longer counts as built and Build Smart Previews replaces it.": "повний диск) більше не вважається створеним, а створення смарт-переглядів замінює його.",
+  "afterwards (issue #101): the partial write is cut off before LightCraft retries, so the next launch replays every": "після цього (проблема #101): частковий запис обрізається перед повторною спробою LightCraft, тому наступний запуск відтворює кожну",
+  "again. Change the period (or turn it off) in Settings → Performance.": "знову. Змініть період (або вимкніть) у Налаштування → Продуктивність.",
+  "against the library's originals no longer scans the whole library when nothing is at that path.": "за оригіналами бібліотеки більше не сканує всю бібліотеку, коли за цим шляхом нічого немає.",
+  "already has a `thumbs/` folder of other pictures no longer loses them when the cache is trimmed or cleared.": "вже має теку `thumbs/` з іншими зображеннями, більше не втрачає їх під час скорочення або очищення кешу.",
+  "and checks the file before using it. Masks keep their selection, so they render and export without the model.": "і перевіряє файл перед використанням. Маски зберігають виділення, тому рендеряться й експортуються без моделі.",
+  "and every imported photo as one zip, and File ▸ Restore Library from Backup… brings it back (the current library": "й кожне імпортоване фото як один zip, а Файл → Відновити бібліотеку з резервної копії… повертає його (поточна бібліотека",
+  "and never freezes the window. It is optional and not part of LightCraft (Meta's SAM License, about 3.4 GB): the": "і ніколи не заморожує вікно. Вона необов’язкова й не є частиною LightCraft (ліцензія SAM від Meta, приблизно 3,4 ГБ):",
+  "as `<name>.corrupt-<time>` and you're told; one that can't be read (e.g. locked by another program) is left alone": "як `<name>.corrupt-<time>`, про що повідомляється; файл, який не можна прочитати (наприклад, заблокований іншою програмою), залишається незмінним",
+  "asked to. `LIGHTCRAFT_GPU_BACKEND=dx12 | vulkan | metal | off` (or wgpu's `WGPU_BACKEND`, which GPU rendering": "цього не попросите. `LIGHTCRAFT_GPU_BACKEND=dx12 | vulkan | metal | off` (або `WGPU_BACKEND` wgpu, який рендеринг на ГП",
+  "bundles of any of these — whole folders at once, grouped by pack. Masks inside presets come along.": "пакети будь-яких із них — цілі теки одночасно, згруповані за пакетом. Маски всередині наборів також переносяться.",
+  "camera no longer gets baked in. Photos already imported as \"preview only\" switch over on Reload. (Files that": "камері більше не вбудовується в результат. Фото, уже імпортовані як «лише перегляд», переходять на RAW після перезавантаження. (Файли, чиї",
+  "change. Catalogs already holding such a fragment load in full. Quitting while the catalog log can't be written": "зміну. Каталоги, які вже містять такий фрагмент, завантажуються повністю. Вихід, коли журнал каталогу не можна записати,",
+  "changes couldn't be saved tries once more, then asks: Try Saving Again, Quit Anyway or Cancel.": "зміни не вдалося зберегти, виконує ще одну спробу, а потім запитує: Спробувати зберегти знову, Усе одно вийти або Скасувати.",
+  "channel or MCP, a merge preview path or `lightcraft-cli render IMG.jpg -o IMG.jpg` is refused with a clear": "каналу або MCP, шлях перегляду об’єднання чи `lightcraft-cli render IMG.jpg -o IMG.jpg` відхиляються з чітким",
+  "checked against the content read from the card. A copy that fails or differs is removed and reported as a failed": "перевіряється за вмістом, прочитаним із карти. Невдала або відмінна копія видаляється й позначається як невдалий",
+  "colour and tone look fitted to the camera's own JPEG, as Nikon and Sony raws do, framed in the aspect ratio set in": "кольору й тону, підігнаних до власного JPEG камери, як у Nikon і Sony RAW, у пропорціях, установлених у",
+  "copy is verified and in the library. Duplicates and files that fail stay where they were.": "копію перевірено й додано до бібліотеки. Дублікати й файли з помилками залишаються на місці.",
+  "data is not decoded yet, so they stay preview-only. For CR3s imported earlier, Photo ▸ Reload from Disk (now in": "дані ще не декодуються, тому залишаються лише переглядом. Для CR3, імпортованих раніше, Фото → Перезавантажити з диска (тепер у",
+  "edge are cropped away, and \"12-bit uncompressed\" files are no longer clipped. The RX100 series renders much closer": "краю обрізаються, а «12-бітні нестиснені» файли більше не обрізають значення. Серія RX100 відтворює значно ближче",
+  "every format the cameras write. Most bodies opened as preview only before: GH1–GH5, the G, GX, GF, GM, FZ, LX and": "кожному форматі, який записують камери. Більшість корпусів раніше відкривалися лише як перегляд: GH1–GH5, G, GX, GF, GM, FZ, LX та",
+  "export. The catalog, XMP sidecars, settings, DNGs, merges, smart previews and the copies an import makes are still": "експорт. Каталог, супровідні XMP, налаштування, DNG, об’єднання, смарт-перегляди й копії під час імпорту й далі",
+  "fields in and keeps the rest — e.g. that application's develop settings and edit history — byte for byte. A": "поля й зберігає решту — наприклад, налаштування обробки й історію редагування того застосунку — байт у байт. Супровідний",
+  "file (Sony stores them only in scrambled maker-note data on these bodies), the few columns of padding at the right": "файлу (Sony зберігає їх лише в зашифрованих даних приміток виробника на цих моделях), кілька стовпців заповнення справа",
+  "first time you use an AI mask, LightCraft asks before downloading it, shows the progress, can cancel and resume,": "під час першого використання маски ШІ LightCraft запитує перед завантаженням, показує перебіг, може скасувати й відновити,",
+  "for the session instead of being overwritten with defaults. The app settings (`ui.json`, which remembers your": "на час сеансу, замість перезаписування типовими значеннями. Налаштування застосунку (`ui.json`, який пам’ятає вашу",
+  "gets -1, -2… instead of being replaced.": "отримує -1, -2… замість заміни.",
+  "greenish neutral rendering (issue #150); white balance is adjusted relative to the as-shot look. 12-bit NEFs": "зеленуватого нейтрального відтворення (проблема #150); баланс білого змінюється відносно вигляду під час знімання. 12-бітні NEF",
+  "has open — on this computer or another one sharing the folder — says who has it (\"already open in LightCraft (process": "відкрив — на цьому комп’ютері або іншому зі спільною текою — повідомляє, хто її використовує («вже відкрито в LightCraft (процес",
+  "how to restore it or delete it permanently and import it afresh. (For a fresh start on a photo, Reset Edits,": "як відновити його або видалити назавжди й імпортувати заново. (Для нового початку на фото «Скинути зміни»,",
+  "ignored before) chooses the graphics backend; `off` renders on the CPU. The GPU now starts after the window": "раніше ігнорувався) вибирає графічний механізм; `off` відтворює на ЦП. ГП тепер запускається після появи вікна",
+  "immutable, and HOSTING.md describes the actual build.": "незмінними, а HOSTING.md описує фактичну збірку.",
+  "import — so \"import complete\" means the copies are good before you format the card — and a name that is taken": "імпорт — тому «імпорт завершено» означає, що копії перевірено перед форматуванням карти — а зайнята назва",
+  "imported as \"preview only\" switch over on Reload.": "імпортовані як «лише перегляд», переходять на RAW після перезавантаження.",
+  "in short pieces so slow integrated GPUs aren't reset by their watchdog. `ui.inspect` → `perf`": "невеликими частинами, щоб повільні інтегровані ГП не перезапускалися через перевищення часу. `ui.inspect` → `perf`",
+  "incomplete is redone on the CPU — the file is the same image either way. Work is sent to the GPU": "неповний, повторюється на ЦП — файл містить те саме зображення в обох випадках. Робота надсилається на ГП",
+  "is kept). A failed save (storage full) now shows the unsaved warning and is retried, a photo that can't be stored": "зберігається). Невдале збереження (повне сховище) тепер показує попередження й повторюється; фото, яке неможливо зберегти,",
+  "is refused and nothing is overwritten.": "відхиляється, і нічого не перезаписується.",
+  "is up, and only when Settings ▸ Performance ▸ Use the GPU for rendering is on; if LightCraft ever dies while": "й лише коли Налаштування → Продуктивність → Використовувати ГП для рендерингу ввімкнено; якщо LightCraft завершується під час",
+  "isn't added, a second tab shows a message instead of overwriting the first, `?reset` asks first, and the page says": "не додається, друга вкладка показує повідомлення замість перезаписування першої, `?reset` спочатку запитує, а сторінка повідомляє,",
+  "it away from the other (issue #92). Find Missing Photos also finds renamed files by their content, prefers a content match": "його від іншого (проблема #92). Пошук відсутніх фото також знаходить перейменовані файли за вмістом, надає перевагу збігу вмісту",
+  "its photos and XMP sidecars, and the photos point at it again. If something now occupies the old place, the undo": "своїми фото й супровідними XMP, а фото знову посилаються на неї. Якщо старе місце тепер зайняте, скасування",
+  "layout is read from each file instead of assumed.": "структура читається з кожного файлу, а не припускається.",
+  "leaves no DNG and keeps the raw. Smart previews are written the same way; a damaged one (cut short by a crash or": "не залишає DNG і зберігає RAW. Смарт-перегляди пишуться так само; пошкоджений (обрізаний через аварію або",
+  "library locked: the lock is the operating system's and goes away with the program.": "бібліотеку заблокованою: блокування належить операційній системі й зникає разом із програмою.",
+  "library) are written atomically and saved as soon as you open another library, not only at quit. Quitting while": "бібліотеку) записуються атомарно й зберігаються щойно відкривається інша бібліотека, а не лише під час виходу. Вихід, коли",
+  "longer just says \"duplicate skipped\": it opens the side panel on Recently Deleted with the photo selected and says": "каже лише «дублікат пропущено»: він відкриває бічну панель нещодавно видалених із вибраним фото й пояснює,",
+  "lost everything at quit; a temporary session shows a banner the whole time and never writes to your library.": "втрачав усе після виходу; тимчасовий сеанс постійно показує банер і ніколи не записує до вашої бібліотеки.",
+  "memory, exceeds the GPU's buffer limits, hits a driver error or reset, or comes back": "перевищує обмеження буферів ГП, стикається з помилкою чи перезапуском драйвера або повертає",
+  "message, and the original is left byte for byte. Ordinary earlier exports are still overwritten when asked.": "повідомленням, а оригінал залишається байт у байт. Звичайні попередні експорти й далі перезаписуються за запитом.",
+  "mid-batch: the error lists them (old → new) and the library points at their new names (an undoable partial rename),": "посеред серії: помилка перелічує їх (старе → нове), а бібліотека посилається на нові назви (часткове перейменування можна скасувати),",
+  "models whose sensor starts on a green-blue row) no longer come out magenta (issue #85): the colour-filter": "моделей із сенсором, що починається із зелено-синього рядка) більше не стають пурпуровими (проблема #85): структура колірного фільтра",
+  "name (never replacing a file), and only then is the photo relinked or the raw copy removed — a failed write": "назву (ніколи не замінюючи файл), і лише тоді фото повторно пов’язується або копія RAW видаляється — невдалий запис",
+  "never leaves a truncated file; the XMP sidecar of an \"Original\" export follows the \"If file exists\" choice too.": "ніколи не залишає обрізаний файл; супровідний XMP експорту «Оригінал» також дотримується вибору «Якщо файл існує».",
+  "now develop from the raw data instead of the camera's embedded JPEG, so a B&W or other picture style set in the": "тепер обробляються з даних RAW, а не з вбудованого JPEG камери, тому чорно-білий або інший стиль зображення, заданий у",
+  "on the card after Review Import is reported instead of being imported with stale details. Checking an export path": "на карті після перевірки імпорту, позначається замість імпорту із застарілими даними. Перевірка шляху експорту",
+  "one by one — they can always be exported again, and on a USB drive or a NAS that per-file sync dominated a large": "по одному — їх завжди можна експортувати знову, а на USB-диску чи NAS синхронізація кожного файлу сповільнювала великий",
+  "over a same-name same-size look-alike, and skips (and reports) photos it can't tell apart instead of guessing.": "перед схожим файлом із такою самою назвою й розміром і пропускає (та повідомляє) фото, які не може розрізнити, замість припущень.",
+  "part out), or type what to select (\"sky\", \"the red car\", \"car, road\"); both combine with other masks, have an": "частину), або введіть, що виділити («небо», «червона машина», «машина, дорога»); обидві поєднуються з іншими масками, мають",
+  "preserving RAW editing & full-resolution export instead of using embedded JPEG previews.": "зберігаючи редагування RAW та експорт у повній роздільності замість вбудованих переглядів JPEG.",
+  "read in the wrong units.": "читався в неправильних одиницях.",
+  "reading the card a third time (Move still compares byte for byte before it deletes a source); a file that changed": "третього читання карти (переміщення й далі порівнює байт у байт перед видаленням джерела); файл, змінений",
+  "renders and screenshots are still written to a temp file and renamed into place, but no longer forced to disk": "рендеринг і знімки екрана й далі пишуться до тимчасового файлу й перейменовуються на місце, але більше не примусово записуються на диск",
+  "save goes through.": "збереження завершиться.",
+  "siblings) no longer open bright green (issue #148): their as-shot white balance and black level are read from the": "моделей) більше не відкриваються яскраво-зеленими (проблема #148): баланс білого під час знімання й рівень чорного читаються з",
+  "sidecar that isn't valid XMP is copied to `<name>.xmp.bak-<time>` first. With the default stem naming, a raw and a": "невалідний XMP спочатку копіюється до `<name>.xmp.bak-<time>`. За типовими назвами основи RAW та",
+  "so none shows as missing. Renaming one of a raw + JPEG pair copies their shared `IMG_0001.xmp` instead of taking": "тому жодне не позначається як відсутнє. Перейменування одного з пари RAW + JPEG копіює спільний `IMG_0001.xmp`, замість відбирання",
+  "starting the GPU, the next launch starts with GPU rendering off and says how to turn it back on.": "запуску ГП, наступний запуск вимикає рендеринг на ГП і пояснює, як увімкнути його знову.",
+  "still saves your queued changes in the closing snapshot.": "усе одно зберігає чергу змін у завершальному знімку.",
+  "synced. Import ▸ Copy now checks each copy against the content hash taken while scanning the card instead of": "синхронізується. Імпорт → Копіювати тепер перевіряє кожну копію за хешем вмісту, отриманим під час сканування карти, замість",
+  "the JPEG uses `IMG_0001.JPG.xmp`.": "JPEG використовує `IMG_0001.JPG.xmp`.",
+  "the Local folder tree and Auto Import read the disk on worker threads too. The import progress window has Cancel.": "дерево локальних тек і автоімпорт також читають диск у робочих потоках. Вікно перебігу імпорту має «Скасувати».",
+  "the Photo menu and the photo context menu) picks up the full-size preview and fills in the camera metadata they": "меню «Фото» й контекстному меню фото) отримує повнорозмірний перегляд і заповнює метадані камери, яких",
+  "the camera; mapped-out sensor defects are filled in. `.rwl` and `.raw` files are imported too. Photos already": "камері; дефекти сенсора заповнюються. Файли `.rwl` і `.raw` також імпортуються. Фото, уже",
+  "the same name and \"Overwrite\" (or Export with Previous repeating it), an exact output path from the control": "тією самою назвою й «Перезаписати» (або повторний експорт із попередніми налаштуваннями), точний шлях виведення з каналу",
+  "their folder has not been browsed for 30 days — your files and sidecars stay, and browsing the folder shows them": "їхню теку не оглядали 30 днів — файли й супровідні дані залишаються, а огляд теки знову їх показує",
+  "to the camera's own JPEG.": "до власного JPEG камери.",
+  "untouched — older versions no longer read part of it as a damaged log. Once this version has opened a library,": "незмінною — старіші версії більше не читають її частину як пошкоджений журнал. Коли ця версія відкрила бібліотеку,",
+  "used (e.g. a skipped software adapter such as llvmpipe) and why the last render fell back.": "використовується (наприклад, пропущений програмний адаптер llvmpipe) і чому останній рендеринг перейшов на ЦП.",
+  "volumes (Linux, case-sensitive APFS) `img_1.JPG` next to `IMG_1.JPG` is a different photo and the renamed one gets": "до регістру (Linux, APFS із чутливістю до регістру) `img_1.JPG` поруч із `IMG_1.JPG` є іншим фото, а перейменоване отримує",
+  "were missing, without touching anything already set.": "не вистачало, не змінюючи вже заданих.",
+  "when the browser may evict the library. Hosting: the sample cache headers no longer mark the (unhashed) files": "коли браузер може вилучити бібліотеку. Хостинг: приклади заголовків кешу більше не позначають файли (без хешу)",
+  "whether originals are there is checked on a worker thread (grid thumbnails, the Info panel, the photo menu, Missing": "наявність оригіналів перевіряється в робочому потоці (мініатюри сітки, панель інформації, меню «Фото», відсутні",
+  "with a counterpart here come along, the rest is listed.": "з відповідником тут переносяться, решта перелічується.",
+  "written by a newer LightCraft is refused with \"this library was written by a newer version of LightCraft\" and left": "створена новішим LightCraft, відхиляється з повідомленням «цю бібліотеку створено новішою версією LightCraft» і залишається",
+  "written by a newer LightCraft), LightCraft says so and why, and offers Try Again, Choose Another Library…, Continue": "створена новішим LightCraft), LightCraft пояснює причину й пропонує Спробувати знову, Вибрати іншу бібліотеку…, Продовжити",
+  "⌘-drag to straighten, ⇧G Guided Upright, a grid while transforming.": "⌘-перетягування для випрямлення, ⇧G для керованого випрямлення, сітка під час трансформування.",
+  "Sort Albums A–Z": "Сортувати альбоми А–Я",
+  "Go back to listing them by name": "Повернутися до списку за назвою",
+  "Sort Contents A–Z": "Сортувати вміст А–Я",
+  "Cancel Pending Photo Action": "Скасувати відкладену дію фото",
+  "Show Person": "Показати особу",
+  "Add Face Model…": "Додати модель облич…",
+  "Cancel Face Model Download": "Скасувати завантаження моделі облич",
+  "Choose Face Recognition Model": "Вибрати модель розпізнавання облич",
+  "Detect Faces": "Виявити обличчя",
+  "Download Face Model": "Завантажити модель облич",
+  "Drag Crop Handle": "Перетягнути маркер кадрування",
+  "Evaluate Face Recognition": "Оцінити розпізнавання облич",
+  "Face Model Downloads": "Завантаження моделей облич",
+  "Face Models": "Моделі облич",
+  "Face Recognition On/Off": "Увімкнути/вимкнути розпізнавання облич",
+  "Faces of a Person": "Обличчя особи",
+  "Index Faces": "Індексувати обличчя",
+  "Index Faces in the Background": "Індексувати обличчя у фоні",
+  "Inspect Face Model File": "Перевірити файл моделі облич",
+  "Install Face Model": "Установити модель облич",
+  "Library Folders": "Теки бібліотеки",
+  "Name Face": "Дати ім’я обличчю",
+  "Name Faces": "Дати імена обличчям",
+  "Remove Face Model": "Видалити модель облич",
+  "Reorder Album": "Змінити порядок альбому",
+  "Sort Albums by Name": "Сортувати альбоми за назвою",
+  "Suggest Names for Faces": "Запропонувати імена облич",
+  "Test Face Model": "Перевірити модель облич",
+  "Unnamed Faces": "Обличчя без імен",
+  "Faces": "Обличчя",
+  "Face recognition": "Розпізнавання облич",
+  "This build has nowhere to keep face models, so the model list is not available. (The desktop app has.)": "Ця збірка не має місця для моделей облич, тому їхній список недоступний. (Настільний застосунок має.)",
+  "Recognise faces (experimental)": "Розпізнавати обличчя (експериментально)",
+  "Suggests who is in a photo from the faces you have named. Everything stays on your computer.": "Пропонує імена людей на фото за обличчями, яким ви вже дали імена. Усе залишається на вашому комп’ютері.",
+  "This build cannot run recognition models: they can be added and chosen, not used.": "Ця збірка не може запускати моделі розпізнавання: їх можна додати й вибрати, але не використовувати.",
+  "Choose a model below (Use) to start.": "Виберіть модель нижче («Використовувати»), щоб почати.",
+  "Face detector": "Детектор облич",
+  "Detect Faces (Photo menu) needs it: a small one-time download.": "Для виявлення облич (меню «Фото») потрібне невелике одноразове завантаження.",
+  "Recognition models": "Моделі розпізнавання",
+  "Decrease Rating": "Зменшити оцінку",
+  "Increase Rating": "Збільшити оцінку",
+  "Click to type a value": "Клацніть, щоб ввести значення",
+  "Angle": "Кут",
+  "Video": "Відео",
+  "Copyrighted": "Захищено авторським правом",
+  "Public Domain": "Суспільне надбання",
+  "Unknown": "Невідомо",
+  "Landscape (wide)": "Альбомна (широка)",
+  "Portrait (tall)": "Портретна (висока)",
+  "Square": "Квадрат",
+  "In Color": "Кольорове",
+  "No Label": "Без мітки",
+  "Choose an album…": "Виберіть альбом…",
+  "No albums yet": "Альбомів ще немає",
+  "Fix the marked rules to save this album.": "Виправте позначені правила, щоб зберегти цей альбом.",
+  "Some rules need fixing (Edit Smart Album…):": "Деякі правила треба виправити (Редагувати смарт-альбом…):",
+  "isn't a field rules know": "не є полем, яке знають правила",
+  "can't be tested that way": "не можна перевірити так",
+  "is yes or no": "має бути так або ні",
+  "needs a number": "потребує числа",
+  "needs a time like 1/250 or 2": "потребує часу, як-от 1/250 або 2",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "потребує дати, як-от 2026, 2026-08 або 2026-08-14",
+  "has the first date after the second": "має першу дату після другої",
+  "needs two values": "потребує двох значень",
+  "needs a number more than 0": "потребує числа, більшого за 0",
+  "needs hours, days, weeks, months or years": "потребує годин, днів, тижнів, місяців або років",
+  "isn't one of the choices": "не є одним із варіантів",
+  "needs something to look for (or use “is empty”)": "потребує того, що шукати (або використайте «порожнє»)",
+  "needs something to look for (or use “isn't empty”)": "потребує того, що шукати (або використайте «не порожнє»)",
+  "needs text": "потребує тексту",
+  "can't match any rating from 0 to 5": "не може збігтися з жодною оцінкою від 0 до 5",
+  "needs an album": "потребує альбому",
+  "names an album that no longer exists": "вказує на альбом, якого вже немає",
+  "can't test a folder; choose an album in it": "не може перевірити теку; виберіть альбом у ній",
+  "This group is empty: add a rule or remove it.": "Ця група порожня: додайте правило або видаліть її.",
+  "needs something to look for (or use “are empty”)": "потребує того, що шукати (або використайте «порожні»)",
+  "needs something to look for (or use “aren't empty”)": "потребує того, що шукати (або використайте «не порожні»)",
+  "Mo": "Пн",
+  "Tu": "Вт",
+  "We": "Ср",
+  "Th": "Чт",
+  "Fr": "Пт",
+  "Sa": "Сб",
+  "Su": "Нд",
+  "Pick a date": "Виберіть дату",
+  "would make this album include itself through other smart albums": "змусило б цей альбом включати сам себе через інші смарт-альбоми",
+  "Search albums": "Пошук альбомів",
+  "No albums match": "Немає відповідних альбомів",
+  "This is the album you're editing": "Це альбом, який ви редагуєте",
+  "It tests this album, so testing it back would loop": "Він перевіряє цей альбом, тож зворотна перевірка зациклилася б",
+  "Copy Name": "Назва копії",
+  "In a Stack": "У стосі",
+  "File Extension": "Розширення файлу",
+  "Video Duration": "Тривалість відео",
+  "Keyword Count": "Кількість ключових слів",
+  "People Count": "Кількість людей",
+  "Shutter Speed": "Витримка",
+  "Cropped": "Кадровано",
+  "Keywords & People": "Ключові слова та люди",
+  "Description": "Опис",
+  "Camera Info": "Дані камери",
+  "Develop": "Обробка",
+  "Keyword List": "Список ключових слів",
+  "Filter Keywords": "Фільтрувати ключові слова",
+  "No keywords yet": "Ключових слів ще немає",
+  "No keywords match": "Немає відповідних ключових слів",
+  "Keyword Name": "Назва ключового слова",
+  "Synonyms": "Синоніми",
+  "Separated by commas": "Через кому",
+  "Keyword Tag Options": "Параметри ключового слова",
+  "Include on Export": "Включати під час експорту",
+  "Export Containing Keywords": "Експортувати батьківські ключові слова",
+  "Export Synonyms": "Експортувати синоніми",
+  "Create Keyword Tag": "Створити ключове слово",
+  "Edit Keyword Tag": "Редагувати ключове слово",
+  "Create": "Створити",
+  "No photo has it; the keywords below it go too.": "Його не має жодне фото; вкладені в нього ключові слова теж зникнуть.",
+  "Edit Keyword Tag…": "Редагувати ключове слово…",
+  "Put New Keywords Inside This Keyword": "Додавати нові ключові слова в це ключове слово",
+  "Purge Unused Keywords": "Очистити невикористані ключові слова",
+  "Delete Keyword…": "Видалити ключове слово…",
+  "Drop here for the top level": "Перетягніть сюди для верхнього рівня",
+  "Their photos and the keywords below them come together under one keyword.": "Їхні фото та вкладені ключові слова об’єднуються під одним ключовим словом.",
+  "Select photos to give them keywords.": "Виберіть фото, щоб додати їм ключові слова.",
+  "Add to All Selected Photos": "Додати до всіх вибраних фото",
+  "Will Export": "Буде експортовано",
+  "No keywords are exported": "Ключові слова не експортуються",
+  "& Containing": "і батьківські",
+  "Edit Set…": "Редагувати набір…",
+  "Edit Keyword Set": "Редагувати набір ключових слів",
+  "Keywords (⌥1–⌥9)": "Ключові слова (⌥1–⌥9)",
+  "A keyword set needs a name": "Набір ключових слів потребує назви",
+  "Save as a new set": "Зберегти як новий набір",
+  "Recent Keywords is built in: choose another name": "«Останні ключові слова» — вбудований набір: виберіть іншу назву",
+  "Import Keywords…": "Імпортувати ключові слова…",
+  "Export Keywords…": "Експортувати ключові слова…",
+  "Import Keywords": "Імпортувати ключові слова",
+  "Export Keywords": "Експортувати ключові слова",
+  "Keyword Lists": "Списки ключових слів",
+  "Synchronize Folder…": "Синхронізувати теку…",
+  "Synchronize Folder": "Синхронізувати теку",
+  "Synchronize": "Синхронізувати",
+  "Scanning…": "Сканування…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "Знайти фото, додані до цієї теки на диску або відсутні в ній, і файли XMP, змінені іншими програмами",
+  "Bring the library up to date with this folder and the folders inside it:": "Оновити бібліотеку відповідно до цієї теки та вкладених тек:",
+  "Import new photos": "Імпортувати нові фото",
+  "Remove missing photos from the library": "Прибрати відсутні фото з бібліотеки",
+  "Read metadata updates from XMP sidecars": "Прочитати оновлені метадані з файлів XMP",
+  "The library is up to date with this folder.": "Бібліотека відповідає цій теці.",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "Відсутні фото переходять до «Нещодавно видалених» і їх можна відновити; файли на диску не змінюються.",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "Читання файлу XMP замінює оцінку, мітки, метадані та обробку фото його вмістом.",
+  "Skipped: files already in the library elsewhere": "Пропущено: файли, які вже є в бібліотеці в іншому місці",
+  "Skipped: files that can't be read": "Пропущено: файли, які не вдається прочитати",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "Цієї теки немає: її переміщено чи перейменовано, або її диск не під’єднано.",
+  "Relink photos whose file was renamed or moved": "Перезв’язати фото, файл яких перейменовано чи переміщено",
+  "A folder is already being synchronized": "Тека вже синхронізується",
+  "Synchronizing…": "Синхронізація…",
+  "Relinked": "Перезв’язано",
+  "Removed": "Прибрано",
+  "Metadata read": "Метадані прочитано",
+  "Failed": "Помилки",
+  "Stopped": "Зупинено",
+  "Stopped by an error (see the log)": "Зупинено через помилку (див. журнал)",
+  "Not saved": "Не збережено",
+  "A folder is being synchronized": "Тека синхронізується",
+  "Wait for the import to finish": "Дочекайтеся завершення імпорту"
+}
diff --git a/crates/ui-egui/locales/zh-hans-formats.json b/crates/ui-egui/locales/zh-hans-formats.json
index e32c7f66..e006cdfd 100644
--- a/crates/ui-egui/locales/zh-hans-formats.json
+++ b/crates/ui-egui/locales/zh-hans-formats.json
@@ -206,5 +206,20 @@
   "In line for AI Denoise ({ahead} ahead)…": "In line for AI Denoise ({ahead} ahead)…",
   "Running on {}.": "Running on {}.",
   "{file} · {size}": "{file} · {size}",
-  "•  {assumption}": "•  {assumption}"
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "放入“{parent}”中",
+  "Delete the keyword “{name}”?": "要删除关键字“{name}”吗？",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "将从 {count} 张照片中移除，其下的关键字也一并移除。撤销可恢复。{:.0}",
+  "Create Keyword Tag Inside “{name}”…": "在“{name}”中创建关键字标记…",
+  "“{parent}” has a “{name}” already. Merge the two?": "“{parent}”中已有“{name}”。要合并两者吗？",
+  "There is a “{name}” at the top level already. Merge the two?": "顶层已有“{name}”。要合并两者吗？",
+  "Added “{keyword}” to {n} photo{}": "已将“{keyword}”添加到 {n} 张照片{:.0}",
+  "On {have} of {of} selected photos": "所选 {of} 张照片中的 {have} 张",
+  "Remove “{name}”": "移除“{name}”",
+  "There is a keyword set “{name}” already": "已有关键字集“{name}”",
+  "Added {n} keyword{}": "已添加 {n} 个关键字{:.0}",
+  "; {n} gained synonyms": "；{n} 个获得了同义词",
+  "Exported {n} keyword{}": "已导出 {n} 个关键字{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — Capture One 不会导入关键字中含有 ; , < 或 > 的列表：{names}",
+  " — left out, as a keyword list can't hold them: {names}": " — 已省略，关键字列表无法容纳: {names}"
 }
diff --git a/crates/ui-egui/locales/zh-hans.json b/crates/ui-egui/locales/zh-hans.json
index 4074dfbd..d654240b 100644
--- a/crates/ui-egui/locales/zh-hans.json
+++ b/crates/ui-egui/locales/zh-hans.json
@@ -1138,6 +1138,8 @@
   "Remove (H)": "移除 (H)",
   "Remove CA": "移除色差",
   "Remove Chromatic Aberration": "移除色差",
+  "Camera local tone mapping": "相机局部色调映射",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "按相机的渲染方式应用 raw 中保存的局部色调映射（Apple ProRAW）",
   "Remove from Album": "从相册中移除",
   "Remove from Favorites": "从收藏夹中移除",
   "Remove from Local": "从本地移除",
@@ -1281,7 +1283,7 @@
   "Set as Target Album (B adds to it)": "设为目标相册 (按 B 添加)",
   "Set as Top of Stack": "设为堆叠顶部",
   "Set date & time": "设置日期和时间",
-  "Set name": "标签集名称",
+  "Set name": "关键字集名称",
   "Set the mix from the photo's colours": "根据照片颜色设置混合",
   "Settings": "设置",
   "Settings file problem": "设置文件有问题",
@@ -1732,5 +1734,132 @@
   "Pending photo action cancelled": "Pending photo action cancelled",
   "Pending photo action cancelled because its library or photo changed": "Pending photo action cancelled because its library or photo changed",
   "ONNX model": "ONNX model",
-  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions"
+  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions",
+  "Decrease Rating": "降低星级",
+  "Increase Rating": "提高星级",
+  "Click to type a value": "单击以输入数值",
+  "Angle": "角度",
+  "Video": "视频",
+  "Copyrighted": "受版权保护",
+  "Public Domain": "公共领域",
+  "Unknown": "未知",
+  "Landscape (wide)": "横向",
+  "Portrait (tall)": "纵向",
+  "Square": "正方形",
+  "In Color": "彩色",
+  "No Label": "无标签",
+  "Choose an album…": "选择相册…",
+  "No albums yet": "还没有相册",
+  "Fix the marked rules to save this album.": "请修正标记的规则以保存此相册。",
+  "Some rules need fixing (Edit Smart Album…):": "有些规则需要修正（编辑智能相册…）：",
+  "isn't a field rules know": "不是已知的字段",
+  "can't be tested that way": "不能这样判断",
+  "is yes or no": "只能是“是”或“否”",
+  "needs a number": "需要一个数字",
+  "needs a time like 1/250 or 2": "需要类似 1/250 或 2 的快门速度",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "需要类似 2026、2026-08 或 2026-08-14 的日期",
+  "has the first date after the second": "第一个日期晚于第二个",
+  "needs two values": "需要两个值",
+  "needs a number more than 0": "需要大于 0 的数字",
+  "needs hours, days, weeks, months or years": "需要小时、天、周、月或年",
+  "isn't one of the choices": "不是可选项之一",
+  "needs something to look for (or use “is empty”)": "需要要查找的内容（或使用“为空”）",
+  "needs something to look for (or use “isn't empty”)": "需要要查找的内容（或使用“不为空”）",
+  "needs text": "需要文本",
+  "can't match any rating from 0 to 5": "不匹配 0 到 5 的任何星级",
+  "needs an album": "需要选择相册",
+  "names an album that no longer exists": "指定的相册已不存在",
+  "can't test a folder; choose an album in it": "无法判断文件夹；请选择其中的相册",
+  "This group is empty: add a rule or remove it.": "此组为空：请添加规则或将其删除。",
+  "needs something to look for (or use “are empty”)": "需要要查找的内容（或使用“为空”）",
+  "needs something to look for (or use “aren't empty”)": "需要要查找的内容（或使用“不为空”）",
+  "Mo": "一",
+  "Tu": "二",
+  "We": "三",
+  "Th": "四",
+  "Fr": "五",
+  "Sa": "六",
+  "Su": "日",
+  "Pick a date": "选择日期",
+  "would make this album include itself through other smart albums": "会通过其他智能相册让此相册包含自身",
+  "Search albums": "搜索相册",
+  "No albums match": "没有匹配的相册",
+  "This is the album you're editing": "这是正在编辑的相册",
+  "It tests this album, so testing it back would loop": "它引用了此相册，反过来引用会形成循环",
+  "Copy Name": "副本名称",
+  "In a Stack": "在堆叠中",
+  "File Extension": "文件扩展名",
+  "Video Duration": "视频时长",
+  "Keyword Count": "关键字数量",
+  "People Count": "人物数量",
+  "Shutter Speed": "快门速度",
+  "Cropped": "已裁剪",
+  "Keywords & People": "关键字与人物",
+  "Description": "描述",
+  "Camera Info": "相机信息",
+  "Develop": "编辑",
+  "Keyword List": "关键字列表",
+  "Filter Keywords": "过滤关键字",
+  "No keywords yet": "还没有关键字",
+  "No keywords match": "没有匹配的关键字",
+  "Keyword Name": "关键字名称",
+  "Synonyms": "同义词",
+  "Separated by commas": "用逗号分隔",
+  "Keyword Tag Options": "关键字标记选项",
+  "Include on Export": "导出时包含",
+  "Export Containing Keywords": "导出上级关键字",
+  "Export Synonyms": "导出同义词",
+  "Create Keyword Tag": "创建关键字标记",
+  "Edit Keyword Tag": "编辑关键字标记",
+  "Create": "创建",
+  "No photo has it; the keywords below it go too.": "没有照片使用它；其下的关键字也会一并删除。",
+  "Edit Keyword Tag…": "编辑关键字标记…",
+  "Put New Keywords Inside This Keyword": "将新关键字放入此关键字中",
+  "Purge Unused Keywords": "清除未使用的关键字",
+  "Delete Keyword…": "删除关键字…",
+  "Drop here for the top level": "拖放到此处以移至顶层",
+  "Their photos and the keywords below them come together under one keyword.": "它们的照片和下级关键字将合并到同一个关键字下。",
+  "Select photos to give them keywords.": "选择照片以为其添加关键字。",
+  "Add to All Selected Photos": "添加到所有所选照片",
+  "Will Export": "将导出",
+  "No keywords are exported": "没有要导出的关键字",
+  "& Containing": "及上级",
+  "Edit Set…": "编辑关键字集…",
+  "Edit Keyword Set": "编辑关键字集",
+  "Keywords (⌥1–⌥9)": "关键字 (⌥1–⌥9)",
+  "A keyword set needs a name": "关键字集需要名称",
+  "Save as a new set": "另存为新关键字集",
+  "Recent Keywords is built in: choose another name": "“最近使用的关键字”为内置集：请另选名称",
+  "Import Keywords…": "导入关键字…",
+  "Export Keywords…": "导出关键字…",
+  "Import Keywords": "导入关键字",
+  "Export Keywords": "导出关键字",
+  "Keyword Lists": "关键字列表",
+  "Synchronize Folder…": "同步文件夹…",
+  "Synchronize Folder": "同步文件夹",
+  "Synchronize": "同步",
+  "Scanning…": "正在扫描…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "查找磁盘上此文件夹中新增或缺失的照片，以及被其他应用更改的 XMP 附属文件",
+  "Bring the library up to date with this folder and the folders inside it:": "让图库与此文件夹及其中的文件夹保持一致：",
+  "Import new photos": "导入新照片",
+  "Remove missing photos from the library": "从图库中移除缺失的照片",
+  "Read metadata updates from XMP sidecars": "从 XMP 附属文件读取元数据更新",
+  "The library is up to date with this folder.": "图库与此文件夹一致。",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "缺失的照片会移到“最近删除”，可以恢复；磁盘上的文件不会被改动。",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "读取附属文件会用其内容替换照片的评级、标签、元数据和编辑。",
+  "Skipped: files already in the library elsewhere": "已跳过：已在图库其他位置的文件",
+  "Skipped: files that can't be read": "已跳过：无法读取的文件",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "此文件夹不存在：它已被移动或重命名，或其磁盘未连接。",
+  "Relink photos whose file was renamed or moved": "重新链接文件被重命名或移动的照片",
+  "A folder is already being synchronized": "已有文件夹正在同步",
+  "Synchronizing…": "正在同步…",
+  "Relinked": "已重新链接",
+  "Removed": "已移除",
+  "Metadata read": "已读取元数据",
+  "Failed": "失败",
+  "Stopped": "已停止",
+  "Stopped by an error (see the log)": "因错误而停止（见日志）",
+  "Not saved": "未保存",
+  "A folder is being synchronized": "正在同步文件夹",
+  "Wait for the import to finish": "请等待导入完成"
 }
diff --git a/crates/ui-egui/locales/zh-hant-formats.json b/crates/ui-egui/locales/zh-hant-formats.json
index 182a7dc6..c47f4569 100644
--- a/crates/ui-egui/locales/zh-hant-formats.json
+++ b/crates/ui-egui/locales/zh-hant-formats.json
@@ -206,5 +206,20 @@
   "In line for AI Denoise ({ahead} ahead)…": "In line for AI Denoise ({ahead} ahead)…",
   "Running on {}.": "Running on {}.",
   "{file} · {size}": "{file} · {size}",
-  "•  {assumption}": "•  {assumption}"
+  "•  {assumption}": "•  {assumption}",
+  "Put inside “{parent}”": "放入「{parent}」中",
+  "Delete the keyword “{name}”?": "要刪除關鍵字「{name}」嗎？",
+  "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.": "將從 {count} 張照片移除，其下的關鍵字也一併移除。還原可復原。{:.0}",
+  "Create Keyword Tag Inside “{name}”…": "在「{name}」中建立關鍵字標記…",
+  "“{parent}” has a “{name}” already. Merge the two?": "「{parent}」中已有「{name}」。要合併兩者嗎？",
+  "There is a “{name}” at the top level already. Merge the two?": "最上層已有「{name}」。要合併兩者嗎？",
+  "Added “{keyword}” to {n} photo{}": "已將「{keyword}」加入 {n} 張照片{:.0}",
+  "On {have} of {of} selected photos": "選取的 {of} 張照片中的 {have} 張",
+  "Remove “{name}”": "移除「{name}」",
+  "There is a keyword set “{name}” already": "已有關鍵字集「{name}」",
+  "Added {n} keyword{}": "已加入 {n} 個關鍵字{:.0}",
+  "; {n} gained synonyms": "；{n} 個獲得了同義詞",
+  "Exported {n} keyword{}": "已匯出 {n} 個關鍵字{:.0}",
+  " — Capture One won't import a list with ; , < or > in a keyword: {names}": " — Capture One 不會匯入關鍵字中含有 ; , < 或 > 的清單：{names}",
+  " — left out, as a keyword list can't hold them: {names}": " — 已省略，關鍵字清單無法容納: {names}"
 }
diff --git a/crates/ui-egui/locales/zh-hant.json b/crates/ui-egui/locales/zh-hant.json
index 96fcbb18..ef8160a5 100644
--- a/crates/ui-egui/locales/zh-hant.json
+++ b/crates/ui-egui/locales/zh-hant.json
@@ -1138,6 +1138,8 @@
   "Remove (H)": "移除（H）",
   "Remove CA": "移除色差",
   "Remove Chromatic Aberration": "移除色差",
+  "Camera local tone mapping": "相機局部色調映射",
+  "Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it": "按相機的渲染方式套用 raw 中儲存的局部色調映射（Apple ProRAW）",
   "Remove from Album": "從相簿移除",
   "Remove from Favorites": "從喜好項目移除",
   "Remove from Local": "從本機移除",
@@ -1281,7 +1283,7 @@
   "Set as Target Album (B adds to it)": "設為目標相簿（按 B 加入）",
   "Set as Top of Stack": "設為堆疊頂端",
   "Set date & time": "設定日期與時間",
-  "Set name": "標籤集名稱",
+  "Set name": "關鍵字集名稱",
   "Set the mix from the photo's colours": "依照片色彩設定混色",
   "Settings": "設定",
   "Settings file problem": "設定檔有問題",
@@ -1732,5 +1734,132 @@
   "Pending photo action cancelled": "Pending photo action cancelled",
   "Pending photo action cancelled because its library or photo changed": "Pending photo action cancelled because its library or photo changed",
   "ONNX model": "ONNX model",
-  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions"
+  "commercial use subject to GPL conditions": "commercial use subject to GPL conditions",
+  "Decrease Rating": "降低評分",
+  "Increase Rating": "提高評分",
+  "Click to type a value": "點擊以輸入數值",
+  "Angle": "角度",
+  "Video": "影片",
+  "Copyrighted": "受著作權保護",
+  "Public Domain": "公有領域",
+  "Unknown": "未知",
+  "Landscape (wide)": "橫向",
+  "Portrait (tall)": "直向",
+  "Square": "正方形",
+  "In Color": "彩色",
+  "No Label": "無標籤",
+  "Choose an album…": "選擇相簿…",
+  "No albums yet": "還沒有相簿",
+  "Fix the marked rules to save this album.": "請修正標記的規則以儲存此相簿。",
+  "Some rules need fixing (Edit Smart Album…):": "有些規則需要修正（編輯智慧型相簿…）：",
+  "isn't a field rules know": "不是已知的欄位",
+  "can't be tested that way": "無法這樣判斷",
+  "is yes or no": "只能是「是」或「否」",
+  "needs a number": "需要一個數字",
+  "needs a time like 1/250 or 2": "需要類似 1/250 或 2 的快門速度",
+  "needs a date like 2026, 2026-08 or 2026-08-14": "需要類似 2026、2026-08 或 2026-08-14 的日期",
+  "has the first date after the second": "第一個日期晚於第二個",
+  "needs two values": "需要兩個值",
+  "needs a number more than 0": "需要大於 0 的數字",
+  "needs hours, days, weeks, months or years": "需要小時、天、週、月或年",
+  "isn't one of the choices": "不是可選項之一",
+  "needs something to look for (or use “is empty”)": "需要要尋找的內容（或使用「為空」）",
+  "needs something to look for (or use “isn't empty”)": "需要要尋找的內容（或使用「不為空」）",
+  "needs text": "需要文字",
+  "can't match any rating from 0 to 5": "不符合 0 到 5 的任何評分",
+  "needs an album": "需要選擇相簿",
+  "names an album that no longer exists": "指定的相簿已不存在",
+  "can't test a folder; choose an album in it": "無法判斷資料夾；請選擇其中的相簿",
+  "This group is empty: add a rule or remove it.": "此群組為空：請新增規則或將其移除。",
+  "needs something to look for (or use “are empty”)": "需要要尋找的內容（或使用「為空」）",
+  "needs something to look for (or use “aren't empty”)": "需要要尋找的內容（或使用「不為空」）",
+  "Mo": "一",
+  "Tu": "二",
+  "We": "三",
+  "Th": "四",
+  "Fr": "五",
+  "Sa": "六",
+  "Su": "日",
+  "Pick a date": "選擇日期",
+  "would make this album include itself through other smart albums": "會透過其他智慧型相簿讓此相簿包含自身",
+  "Search albums": "搜尋相簿",
+  "No albums match": "沒有符合的相簿",
+  "This is the album you're editing": "這是正在編輯的相簿",
+  "It tests this album, so testing it back would loop": "它引用了此相簿，反過來引用會形成循環",
+  "Copy Name": "副本名稱",
+  "In a Stack": "在堆疊中",
+  "File Extension": "副檔名",
+  "Video Duration": "影片長度",
+  "Keyword Count": "關鍵字數量",
+  "People Count": "人物數量",
+  "Shutter Speed": "快門速度",
+  "Cropped": "已裁切",
+  "Keywords & People": "關鍵字與人物",
+  "Description": "描述",
+  "Camera Info": "相機資訊",
+  "Develop": "編輯",
+  "Keyword List": "關鍵字清單",
+  "Filter Keywords": "篩選關鍵字",
+  "No keywords yet": "尚無關鍵字",
+  "No keywords match": "沒有符合的關鍵字",
+  "Keyword Name": "關鍵字名稱",
+  "Synonyms": "同義詞",
+  "Separated by commas": "以逗號分隔",
+  "Keyword Tag Options": "關鍵字標記選項",
+  "Include on Export": "匯出時包含",
+  "Export Containing Keywords": "匯出上層關鍵字",
+  "Export Synonyms": "匯出同義詞",
+  "Create Keyword Tag": "建立關鍵字標記",
+  "Edit Keyword Tag": "編輯關鍵字標記",
+  "Create": "建立",
+  "No photo has it; the keywords below it go too.": "沒有照片使用它；其下的關鍵字也會一併刪除。",
+  "Edit Keyword Tag…": "編輯關鍵字標記…",
+  "Put New Keywords Inside This Keyword": "將新關鍵字放入此關鍵字中",
+  "Purge Unused Keywords": "清除未使用的關鍵字",
+  "Delete Keyword…": "刪除關鍵字…",
+  "Drop here for the top level": "拖放到此處以移至最上層",
+  "Their photos and the keywords below them come together under one keyword.": "它們的照片與下層關鍵字將合併到同一個關鍵字下。",
+  "Select photos to give them keywords.": "選取照片以加入關鍵字。",
+  "Add to All Selected Photos": "加入所有選取的照片",
+  "Will Export": "將匯出",
+  "No keywords are exported": "沒有要匯出的關鍵字",
+  "& Containing": "及上層",
+  "Edit Set…": "編輯關鍵字集…",
+  "Edit Keyword Set": "編輯關鍵字集",
+  "Keywords (⌥1–⌥9)": "關鍵字 (⌥1–⌥9)",
+  "A keyword set needs a name": "關鍵字集需要名稱",
+  "Save as a new set": "另存為新關鍵字集",
+  "Recent Keywords is built in: choose another name": "「最近使用的關鍵字」為內建集：請另選名稱",
+  "Import Keywords…": "匯入關鍵字…",
+  "Export Keywords…": "匯出關鍵字…",
+  "Import Keywords": "匯入關鍵字",
+  "Export Keywords": "匯出關鍵字",
+  "Keyword Lists": "關鍵字清單",
+  "Synchronize Folder…": "同步資料夾…",
+  "Synchronize Folder": "同步資料夾",
+  "Synchronize": "同步",
+  "Scanning…": "正在掃描…",
+  "Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps": "尋找磁碟上此資料夾中新增或遺失的照片，以及被其他 App 更改的 XMP 附屬檔案",
+  "Bring the library up to date with this folder and the folders inside it:": "讓照片庫與此資料夾及其中的資料夾保持一致：",
+  "Import new photos": "匯入新照片",
+  "Remove missing photos from the library": "從照片庫移除遺失的照片",
+  "Read metadata updates from XMP sidecars": "從 XMP 附屬檔案讀取中繼資料更新",
+  "The library is up to date with this folder.": "照片庫與此資料夾一致。",
+  "Missing photos move to Recently Deleted and can be restored; no file on disk is touched.": "遺失的照片會移至「最近刪除」，可以還原；磁碟上的檔案不會被更動。",
+  "Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says.": "讀取附屬檔案會以其內容取代照片的評等、標籤、中繼資料和編輯。",
+  "Skipped: files already in the library elsewhere": "已略過：已在照片庫其他位置的檔案",
+  "Skipped: files that can't be read": "已略過：無法讀取的檔案",
+  "This folder isn't there: it was moved or renamed, or its disk isn't connected.": "此資料夾不存在：它已被移動或重新命名，或其磁碟未連接。",
+  "Relink photos whose file was renamed or moved": "重新連結檔案被重新命名或移動的照片",
+  "A folder is already being synchronized": "已有資料夾正在同步",
+  "Synchronizing…": "正在同步…",
+  "Relinked": "已重新連結",
+  "Removed": "已移除",
+  "Metadata read": "已讀取中繼資料",
+  "Failed": "失敗",
+  "Stopped": "已停止",
+  "Stopped by an error (see the log)": "因錯誤而停止（請見記錄）",
+  "Not saved": "未儲存",
+  "A folder is being synchronized": "正在同步資料夾",
+  "Wait for the import to finish": "請等待匯入完成"
 }
diff --git a/crates/ui-egui/src/album_picker.rs b/crates/ui-egui/src/album_picker.rs
new file mode 100644
index 00000000..72ea3f22
--- /dev/null
+++ b/crates/ui-egui/src/album_picker.rs
@@ -0,0 +1,431 @@
+//! An album picker: a button that opens a popup to pick an album or a smart album, by browsing a
+//! tree like the sidebar's or by typing part of its name.
+//!
+//! Standalone: it edits an `Option<u64>` album id over a list of [`AlbumEntry`]s, in tree order
+//! ([`entries_from`] builds it from a catalog in the sidebar's order). Folders are for browsing,
+//! not picking. An entry can be `blocked` with a reason: shown greyed, the reason on hover.
+//!
+//! With nothing typed it shows the tree, folders closed except those holding the current choice.
+//! Typing lists the albums whose path ("Folder / Name") holds every word typed, names starting
+//! with it first; ↑ / ↓ move through them, Enter picks, Esc closes. Widget ids for tests and agents:
+//! `albumPicker:<id>` (the button), `albumPickerSearch:<id>`, `albumPickerFolder:<folder>:<id>`
+//! and `albumPickerItem:<album>:<id>`.
+
+use egui::{Response, RichText, Ui, vec2};
+
+use crate::icons::Icon;
+use crate::widgets::register;
+
+/// One row of the picker: an album, a smart album or a folder.
+#[derive(Clone, Debug, PartialEq)]
+pub struct AlbumEntry {
+    pub id: u64,
+    pub name: String,
+    pub parent: Option<u64>,
+    /// How deep in folders (0 at the top), from [`set_depths`].
+    pub depth: usize,
+    pub folder: bool,
+    pub smart: bool,
+    /// Why it can't be picked, when it can't (shown on hover).
+    pub blocked: Option<String>,
+}
+
+/// Every album, smart album and folder of `cat` in the sidebar's order (folders first, the user's
+/// order, else by name), each folder followed by what it holds. `blocked` says why an album can't
+/// be picked, if so.
+pub fn entries_from(cat: &lightcraft_catalog::Catalog, blocked: impl Fn(&lightcraft_catalog::Album) -> Option<String>) -> Vec<AlbumEntry> {
+    let kids = cat.album_children_by_parent();
+    let mut out = Vec::new();
+    // depth-first, guarded against a parent loop in a damaged catalog
+    let mut seen = std::collections::HashSet::new();
+    fn walk(
+        parent: Option<lightcraft_catalog::AlbumId>,
+        kids: &std::collections::HashMap<Option<lightcraft_catalog::AlbumId>, Vec<&lightcraft_catalog::Album>>,
+        blocked: &dyn Fn(&lightcraft_catalog::Album) -> Option<String>,
+        seen: &mut std::collections::HashSet<lightcraft_catalog::AlbumId>,
+        out: &mut Vec<AlbumEntry>,
+        depth: usize,
+    ) {
+        if depth > 64 {
+            return;
+        }
+        for a in kids.get(&parent).map(Vec::as_slice).unwrap_or_default() {
+            if !seen.insert(a.id) {
+                continue;
+            }
+            out.push(AlbumEntry {
+                id: a.id.0,
+                name: a.name.clone(),
+                parent: a.parent.map(|p| p.0),
+                depth,
+                folder: a.folder,
+                smart: a.is_smart(),
+                blocked: if a.folder { None } else { blocked(a) },
+            });
+            if a.folder {
+                walk(Some(a.id), kids, blocked, seen, out, depth + 1);
+            }
+        }
+    }
+    walk(None, &kids, &blocked, &mut seen, &mut out, 0);
+    out
+}
+
+/// Where each id sits in `entries`, so walking up the folders costs their depth, not a scan.
+fn index(entries: &[AlbumEntry]) -> std::collections::HashMap<u64, usize> {
+    entries.iter().enumerate().map(|(i, e)| (e.id, i)).collect()
+}
+
+/// [`ancestors`] with a prebuilt [`index`].
+fn ancestors_in(entries: &[AlbumEntry], by_id: &std::collections::HashMap<u64, usize>, id: u64) -> Vec<u64> {
+    let mut out = Vec::new();
+    let mut at = by_id.get(&id).and_then(|&i| entries.get(i)).and_then(|e| e.parent);
+    while let Some(p) = at {
+        // a parent loop in a damaged catalog ends the walk
+        if out.contains(&p) || out.len() > 64 {
+            break;
+        }
+        out.push(p);
+        at = by_id.get(&p).and_then(|&i| entries.get(i)).and_then(|e| e.parent);
+    }
+    out
+}
+
+/// [`path_label`] with a prebuilt [`index`].
+fn path_in(entries: &[AlbumEntry], by_id: &std::collections::HashMap<u64, usize>, id: u64) -> String {
+    let Some(entry) = by_id.get(&id).and_then(|&i| entries.get(i)) else { return String::new() };
+    let mut parts: Vec<&str> =
+        ancestors_in(entries, by_id, id).iter().rev().filter_map(|p| by_id.get(p).and_then(|&i| entries.get(i))).map(|e| e.name.as_str()).collect();
+    parts.push(&entry.name);
+    parts.join(" / ")
+}
+
+/// Fill in each entry's depth from its parents (for lists built by hand).
+pub fn set_depths(entries: &mut [AlbumEntry]) {
+    let by_id = index(entries);
+    let depths: Vec<usize> = entries.iter().map(|e| ancestors_in(entries, &by_id, e.id).len()).collect();
+    for (e, d) in entries.iter_mut().zip(depths) {
+        e.depth = d;
+    }
+}
+
+/// The folders holding album `id`, nearest first; empty at the top level or for an unknown id.
+pub fn ancestors(entries: &[AlbumEntry], id: u64) -> Vec<u64> {
+    ancestors_in(entries, &index(entries), id)
+}
+
+/// "Folder / Sub / Name" for album `id`; empty for an unknown id.
+pub fn path_label(entries: &[AlbumEntry], id: u64) -> String {
+    path_in(entries, &index(entries), id)
+}
+
+/// The rows a tree shows with the folders in `open` open: indexes into `entries`.
+pub fn visible_tree(entries: &[AlbumEntry], open: &[u64]) -> Vec<usize> {
+    let by_id = index(entries);
+    let open: std::collections::HashSet<u64> = open.iter().copied().collect();
+    (0..entries.len()).filter(|&i| ancestors_in(entries, &by_id, entries[i].id).iter().all(|a| open.contains(a))).collect()
+}
+
+/// The albums (not folders) whose path holds every word of `query`, any case: those whose own
+/// name starts with the query first, then the rest, each in tree order. Indexes into `entries`.
+pub fn search(entries: &[AlbumEntry], query: &str) -> Vec<usize> {
+    let query = query.trim().to_lowercase();
+    let words: Vec<&str> = query.split_whitespace().collect();
+    if words.is_empty() {
+        return Vec::new();
+    }
+    let by_id = index(entries);
+    let hits: Vec<usize> = (0..entries.len())
+        .filter(|&i| !entries[i].folder)
+        .filter(|&i| {
+            let path = path_in(entries, &by_id, entries[i].id).to_lowercase();
+            words.iter().all(|w| path.contains(w))
+        })
+        .collect();
+    let (first, rest): (Vec<usize>, Vec<usize>) = hits.into_iter().partition(|&i| entries[i].name.to_lowercase().starts_with(&query));
+    first.into_iter().chain(rest).collect()
+}
+
+/// A small filled triangle centred on `c`: pointing down (`down`), else right.
+fn triangle(p: &egui::Painter, c: egui::Pos2, down: bool, color: egui::Color32) {
+    let pts = if down {
+        vec![c + vec2(-4.0, -2.0), c + vec2(4.0, -2.0), c + vec2(0.0, 3.0)]
+    } else {
+        vec![c + vec2(-2.0, -4.0), c + vec2(3.0, 0.0), c + vec2(-2.0, 4.0)]
+    };
+    p.add(egui::Shape::convex_polygon(pts, color, egui::Stroke::NONE));
+}
+
+/// What the open popup remembers between frames.
+#[derive(Clone, Default)]
+struct State {
+    query: String,
+    open: Vec<u64>,
+    /// The highlighted search result (↑ / ↓, Enter).
+    highlight: usize,
+    focus: bool,
+}
+
+/// A button that edits an album id; see the module docs.
+pub struct AlbumPicker<'a> {
+    id: String,
+    value: &'a mut Option<u64>,
+    entries: &'a [AlbumEntry],
+    width: f32,
+}
+
+impl<'a> AlbumPicker<'a> {
+    /// `id` must be unique among the pickers on screen (it names their widgets and keeps their
+    /// state apart); `value` is the album picked (`None`: none yet); `entries` in tree order.
+    pub fn new(id: impl Into<String>, value: &'a mut Option<u64>, entries: &'a [AlbumEntry]) -> Self {
+        AlbumPicker { id: id.into(), value, entries, width: 180.0 }
+    }
+
+    /// The button's width (180 by default).
+    pub fn width(mut self, width: f32) -> Self {
+        self.width = width;
+        self
+    }
+
+    /// The button and, while open, the popup. The response is `changed()` when an album was picked.
+    pub fn show(self, ui: &mut Ui) -> Response {
+        let AlbumPicker { id, value, entries, width } = self;
+        let chosen = value.filter(|v| entries.iter().any(|e| e.id == *v && !e.folder));
+        let text = chosen.map_or_else(|| crate::i18n::tr("Choose an album…").to_string(), |c| path_label(entries, c));
+        // the name, and a drop-down arrow painted at the right (the UI font has no arrow glyph)
+        let mut button = ui.add_sized(vec2(width, ui.spacing().interact_size.y), egui::Button::new(text).truncate().right_text(" "));
+        let arrow_color = crate::theme::Tokens::get(ui.ctx()).icon;
+        triangle(ui.painter(), egui::pos2(button.rect.right() - 10.0, button.rect.center().y), true, arrow_color);
+        register(ui.ctx(), format!("albumPicker:{id}"), button.rect);
+        let key = egui::Id::new(("albumPicker", id.as_str()));
+        if button.clicked() {
+            // open on the chosen album's folders, with the search empty and ready for typing
+            let open = chosen.map(|c| ancestors(entries, c)).unwrap_or_default();
+            ui.data_mut(|d| d.insert_temp(key, State { open, focus: true, ..Default::default() }));
+        }
+        let mut state: State = ui.data(|d| d.get_temp(key)).unwrap_or_default();
+        let mut picked: Option<u64> = None;
+        egui::Popup::from_toggle_button_response(&button).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
+            ui.set_min_width(width.max(260.0));
+            ui.set_max_width(width.max(260.0) + 120.0);
+            let search_box =
+                ui.add(egui::TextEdit::singleline(&mut state.query).hint_text(crate::i18n::tr("Search albums")).desired_width(f32::INFINITY));
+            register(ui.ctx(), format!("albumPickerSearch:{id}"), search_box.rect);
+            if state.focus {
+                search_box.request_focus();
+                state.focus = false;
+            }
+            if search_box.changed() {
+                state.highlight = 0;
+            }
+            let t = crate::theme::Tokens::get(ui.ctx());
+            // `scroll`: bring the row into view (the arrow keys just moved to it); never every frame,
+            // which would fight the mouse wheel
+            let row = |ui: &mut Ui, e: &AlbumEntry, label: &str, indent: f32, highlighted: bool, scroll: bool, picked: &mut Option<u64>| {
+                ui.horizontal(|ui| {
+                    ui.add_space(indent);
+                    let (r, _) = ui.allocate_exact_size(vec2(14.0, 14.0), egui::Sense::hover());
+                    let icon = if e.smart { Icon::SmartAlbum } else { Icon::Album };
+                    crate::icons::paint(ui.painter(), r, icon, if e.blocked.is_some() { t.text_disabled } else { t.icon });
+                    let resp = ui.add_enabled(e.blocked.is_none(), egui::Button::selectable(Some(e.id) == chosen || highlighted, label));
+                    register(ui.ctx(), format!("albumPickerItem:{}:{id}", e.id), resp.rect);
+                    let resp = match &e.blocked {
+                        Some(why) => resp.on_disabled_hover_text(why.as_str()),
+                        None => resp,
+                    };
+                    if resp.clicked() {
+                        *picked = Some(e.id);
+                    }
+                    if scroll {
+                        resp.scroll_to_me(None);
+                    }
+                });
+            };
+            egui::ScrollArea::vertical().max_height(320.0).auto_shrink([false, true]).show(ui, |ui| {
+                if state.query.trim().is_empty() {
+                    for i in visible_tree(entries, &state.open) {
+                        let e = &entries[i];
+                        let indent = e.depth as f32 * 16.0;
+                        if e.folder {
+                            // a folder row folds and unfolds, like the sidebar's: triangle, icon, name
+                            let open = state.open.contains(&e.id);
+                            let height = ui.spacing().interact_size.y;
+                            let (rect, r) = ui.allocate_exact_size(vec2(ui.available_width(), height), egui::Sense::click());
+                            if r.hovered() {
+                                ui.painter().rect_filled(rect, 3.0, t.hover);
+                            }
+                            let x = rect.left() + indent;
+                            triangle(ui.painter(), egui::pos2(x + 7.0, rect.center().y), open, if r.hovered() { t.text } else { t.text_dim });
+                            let icon = egui::Rect::from_center_size(egui::pos2(x + 23.0, rect.center().y), vec2(14.0, 14.0));
+                            crate::icons::paint(ui.painter(), icon, Icon::Folder, t.icon);
+                            ui.painter().text(
+                                egui::pos2(x + 36.0, rect.center().y),
+                                egui::Align2::LEFT_CENTER,
+                                &e.name,
+                                egui::TextStyle::Button.resolve(ui.style()),
+                                t.text_label,
+                            );
+                            register(ui.ctx(), format!("albumPickerFolder:{}:{id}", e.id), r.rect);
+                            // what assistive tools announce: the folder, and whether it is open
+                            let name = e.name.clone();
+                            r.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::CollapsingHeader, true, open, &name));
+                            if r.clicked() {
+                                // the click took the keyboard from the search box: give it back
+                                state.focus = true;
+                                if open {
+                                    state.open.retain(|o| *o != e.id);
+                                } else {
+                                    state.open.push(e.id);
+                                }
+                            }
+                        } else {
+                            // past the triangle column, so names line up with folder names
+                            row(ui, e, &e.name, indent + 14.0, false, false, &mut picked);
+                        }
+                    }
+                    if entries.iter().all(|e| e.folder) {
+                        ui.label(RichText::new(crate::i18n::tr("No albums yet")).weak());
+                    }
+                } else {
+                    let hits = search(entries, &state.query);
+                    // ↑ / ↓ move through the results that can be picked, Enter picks one
+                    let pickable: Vec<usize> = hits.iter().copied().filter(|&i| entries[i].blocked.is_none()).collect();
+                    let (down, up, enter) = ui.input_mut(|i| {
+                        (
+                            i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowDown),
+                            i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowUp),
+                            i.consume_key(egui::Modifiers::NONE, egui::Key::Enter),
+                        )
+                    });
+                    if down {
+                        state.highlight = (state.highlight + 1).min(pickable.len().saturating_sub(1));
+                    }
+                    if up {
+                        state.highlight = state.highlight.saturating_sub(1);
+                    }
+                    let highlighted = pickable.get(state.highlight).copied();
+                    if enter {
+                        match highlighted {
+                            Some(i) => picked = Some(entries[i].id),
+                            // Enter took the keyboard from the search box and picked nothing: give it back
+                            None => state.focus = true,
+                        }
+                    }
+                    let by_id = index(entries);
+                    for i in &hits {
+                        let e = &entries[*i];
+                        row(
+                            ui,
+                            e,
+                            &path_in(entries, &by_id, e.id),
+                            0.0,
+                            highlighted == Some(*i),
+                            (up || down) && highlighted == Some(*i),
+                            &mut picked,
+                        );
+                    }
+                    if hits.is_empty() {
+                        ui.label(RichText::new(crate::i18n::tr("No albums match")).weak());
+                    }
+                }
+            });
+            // Esc closes the popup and stops there: the dialog around it keeps its edits
+            if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+                crate::widgets::take_escape(ui.ctx());
+                ui.close();
+            }
+            if picked.is_some() {
+                ui.close();
+            }
+        });
+        ui.data_mut(|d| d.insert_temp(key, state));
+        if let Some(p) = picked {
+            *value = Some(p);
+            button.mark_changed();
+        }
+        button
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn e(id: u64, name: &str, parent: Option<u64>, folder: bool, smart: bool) -> AlbumEntry {
+        AlbumEntry { id, name: name.into(), parent, depth: 0, folder, smart, blocked: None }
+    }
+
+    /// [UTILS] (folder) > Excluded | Hidden Photos (smart), Uncurated (smart); Trip; Weddings >
+    /// Tuscany Wedding
+    fn sample() -> Vec<AlbumEntry> {
+        let mut v = vec![
+            e(1, "[UTILS]", None, true, false),
+            e(2, "Excluded | Hidden Photos", Some(1), false, true),
+            e(3, "Uncurated", Some(1), false, true),
+            e(4, "Trip", None, false, false),
+            e(5, "Weddings", None, true, false),
+            e(6, "Tuscany Wedding", Some(5), false, true),
+        ];
+        set_depths(&mut v);
+        v
+    }
+
+    #[test]
+    fn paths_and_depths_follow_the_folders() {
+        let v = sample();
+        assert_eq!(path_label(&v, 2), "[UTILS] / Excluded | Hidden Photos");
+        assert_eq!(path_label(&v, 4), "Trip");
+        assert_eq!(path_label(&v, 99), "");
+        assert_eq!(v.iter().map(|e| e.depth).collect::<Vec<_>>(), vec![0, 1, 1, 0, 0, 1]);
+        assert_eq!(ancestors(&v, 6), vec![5]);
+        assert!(ancestors(&v, 4).is_empty());
+    }
+
+    #[test]
+    fn the_tree_hides_what_closed_folders_hold() {
+        let v = sample();
+        let ids = |open: &[u64]| visible_tree(&v, open).into_iter().map(|i| v[i].id).collect::<Vec<_>>();
+        assert_eq!(ids(&[]), vec![1, 4, 5], "folders closed: only the top level");
+        assert_eq!(ids(&[1]), vec![1, 2, 3, 4, 5]);
+        assert_eq!(ids(&[1, 5]), vec![1, 2, 3, 4, 5, 6]);
+    }
+
+    /// Big libraries stay quick: 20,000 albums in nested folders are laid out and searched in well
+    /// under a second (folder paths are worked out once, not per row by scanning every album).
+    #[test]
+    fn many_albums_stay_quick() {
+        let mut v = Vec::new();
+        let mut paths = Vec::new();
+        for f in 0..200u64 {
+            v.push(e(f * 101 + 1, &format!("Folder {f}"), None, true, false));
+            for a in 0..100u64 {
+                v.push(e(f * 101 + 2 + a, &format!("Wedding {f}-{a}"), Some(f * 101 + 1), false, a % 2 == 0));
+                paths.push(format!("folder {f} / wedding {f}-{a}"));
+            }
+        }
+        let want = paths.iter().filter(|p| ["folder", "7", "wedding"].iter().all(|w| p.contains(w))).count();
+        let start = std::time::Instant::now();
+        set_depths(&mut v);
+        let open: Vec<u64> = (0..200u64).map(|f| f * 101 + 1).collect();
+        assert_eq!(visible_tree(&v, &open).len(), v.len());
+        assert_eq!(search(&v, "folder 7 wedding").len(), want);
+        assert!(start.elapsed() < std::time::Duration::from_secs(1), "took {:?}", start.elapsed());
+    }
+
+    /// Every word typed is in the album's path (folders included), in any case; names that start
+    /// with it come first; folders themselves aren't results.
+    #[test]
+    fn search_finds_albums_by_any_part_of_their_path() {
+        let v = sample();
+        let ids = |q: &str| search(&v, q).into_iter().map(|i| v[i].id).collect::<Vec<_>>();
+        assert_eq!(ids("excl"), vec![2]);
+        assert_eq!(ids("UTILS"), vec![2, 3], "a folder's name finds what it holds");
+        assert_eq!(ids("utils uncur"), vec![3], "every word must match");
+        assert_eq!(ids("t"), vec![4, 6, 2, 3], "names starting with it first (Trip, Tuscany Wedding), then the rest, each in sidebar order");
+        assert_eq!(ids("  "), Vec::<u64>::new(), "an empty search isn't a search");
+        assert_eq!(ids("zzz"), Vec::<u64>::new());
+        let mut accents = vec![e(7, "Été", None, false, false)];
+        set_depths(&mut accents);
+        assert_eq!(search(&accents, "été").len(), 1);
+    }
+}
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index dcd3d1f8..1209a6c7 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -103,6 +103,7 @@ pub fn inspect(app: &LightcraftApp, ctx: &egui::Context) -> Value {
         })),
         "hoverPreview": app.hover_preview.as_ref().map(|h| h.label.clone()),
         "status": app.ui.status,
+        "copied": app.copied,
         "notices": app.notices,
         "quitPrompt": app.quit_prompt,
         // how hard the background face scan may work right now, and why it is judged so (see `panels::faces::scan_pace`)
@@ -200,10 +201,11 @@ pub fn handle(app: &mut LightcraftApp, ctx: &egui::Context, req: &ControlRequest
                 app.synthetic.push(egui::Event::PointerMoved(at));
             } else if req.method == "ui.clickWidget" {
                 let n = p.get("count").and_then(Value::as_u64).unwrap_or(1);
+                let button = if s("button") == Some("right") { egui::PointerButton::Secondary } else { egui::PointerButton::Primary };
                 app.synthetic.push(egui::Event::PointerMoved(at));
                 for _ in 0..n {
-                    app.synthetic.push(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: m });
-                    app.synthetic.push(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: m });
+                    app.synthetic.push(egui::Event::PointerButton { pos: at, button, pressed: true, modifiers: m });
+                    app.synthetic.push(egui::Event::PointerButton { pos: at, button, pressed: false, modifiers: m });
                 }
             } else {
                 let to = egui::pos2(
@@ -273,6 +275,26 @@ pub fn handle(app: &mut LightcraftApp, ctx: &egui::Context, req: &ControlRequest
             ctx.request_repaint();
             ok(Value::Null)
         }
+        // what the system does for ⌘X / ⌘C / ⌘V in a text field: paste `text`, or (without it)
+        // what the system clipboard holds
+        "ui.clipboard" => {
+            // outside a text field ⌘C / ⌘V are the app's shortcuts (and the macOS menu bar's):
+            // agents run those as commands (`develop.copy`, `develop.paste`)
+            if !ctx.text_edit_focused() {
+                return err("ui.clipboard: no text field has the focus (click one first)");
+            }
+            match s("action") {
+                Some("cut") => app.synthetic.push(egui::Event::Cut),
+                Some("copy") => app.synthetic.push(egui::Event::Copy),
+                Some("paste") => match s("text") {
+                    Some(text) => app.synthetic.push(egui::Event::Paste(text.to_string())),
+                    None => ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaste),
+                },
+                _ => return err("ui.clipboard: `action` is cut, copy or paste"),
+            }
+            ctx.request_repaint();
+            ok(Value::Null)
+        }
         "ui.scroll" => {
             app.synthetic.push(egui::Event::MouseWheel {
                 unit: egui::MouseWheelUnit::Point,
@@ -310,8 +332,12 @@ pub fn handle(app: &mut LightcraftApp, ctx: &egui::Context, req: &ControlRequest
         "ui.dialog.confirm" => match app.ui.dialog.take() {
             Some(d) => {
                 let r = crate::panels::dialogs::confirm_dialog(app, &d);
-                // the import review stays open on an error, as with its button
-                if (r.is_err() && matches!(d, crate::state::Dialog::Import { .. } | crate::state::Dialog::SamModel { .. }))
+                // the import review and the rule editor stay open on an error, as with their buttons
+                if (r.is_err()
+                    && matches!(
+                        d,
+                        crate::state::Dialog::Import { .. } | crate::state::Dialog::SamModel { .. } | crate::state::Dialog::SmartRules { .. }
+                    ))
                     || (r.is_ok() && crate::panels::dialogs::keeps_open(app, &d))
                 {
                     app.ui.dialog = Some(d);
@@ -340,6 +366,14 @@ pub fn handle(app: &mut LightcraftApp, ctx: &egui::Context, req: &ControlRequest
             ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(egui::vec2(w, h)));
             ok(Value::Null)
         }
+        "ui.zoomFactor" => match f("factor") {
+            // egui's interface scale (its keyboard shortcuts are off: Cmd+= / Cmd+- zoom the photo)
+            Some(factor) if factor.is_finite() && (0.5..=3.0).contains(&factor) => {
+                ctx.set_zoom_factor(factor as f32);
+                ok(Value::Null)
+            }
+            _ => err("ui.zoomFactor: factor must be a number from 0.5 to 3"),
+        },
         "ui.screenshot" => {
             // never over a photo's original
             if let Some(Err(e)) = s("path").map(|path| app.session.check_write_target(path)) {
diff --git a/crates/ui-egui/src/date_picker.rs b/crates/ui-egui/src/date_picker.rs
new file mode 100644
index 00000000..c04c309a
--- /dev/null
+++ b/crates/ui-egui/src/date_picker.rs
@@ -0,0 +1,449 @@
+//! A date picker: a calendar button that opens a popup to pick a year, a month or a day.
+//!
+//! Standalone: it edits a [`PickedDate`] (a year, optionally a month, optionally a day), so a value
+//! keeps its precision (`2026` means the whole year). Callers can limit the precisions offered and
+//! the dates allowed ([`DatePicker::min`] / [`DatePicker::max`]: a value is allowed when any of its
+//! days falls in range), and say what "today" is. Weekday and month names follow the UI language.
+//! Widget ids for tests and agents: `datePicker:<id>` (the button),
+//! `datePickerPrecision:<year|month|day>:<id>`, `datePickerPrev:<id>`, `datePickerNext:<id>` and
+//! `datePickerCell:<iso>:<id>`.
+
+use egui::{Response, RichText, Ui, vec2};
+
+use crate::icons::Icon;
+use crate::widgets::register;
+
+/// How much of a date a value names.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Precision {
+    Year,
+    Month,
+    Day,
+}
+
+impl Precision {
+    pub const ALL: [Precision; 3] = [Precision::Year, Precision::Month, Precision::Day];
+
+    fn id(self) -> &'static str {
+        match self {
+            Precision::Year => "year",
+            Precision::Month => "month",
+            Precision::Day => "day",
+        }
+    }
+
+    fn label(self) -> &'static str {
+        match self {
+            Precision::Year => "Year",
+            Precision::Month => "Month",
+            Precision::Day => "Day",
+        }
+    }
+}
+
+/// A year, a month of it or a day of that: `2026`, `2026-08`, `2026-08-14`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct PickedDate {
+    pub year: i32,
+    pub month: Option<u8>,
+    pub day: Option<u8>,
+}
+
+impl PickedDate {
+    pub fn year(year: i32) -> Self {
+        PickedDate { year, month: None, day: None }
+    }
+
+    /// Reads `2026`, `2026-08` or `2026-08-14` (anything after a day's `T` or space, such as a
+    /// time, is read past); `None` for anything else or a date that doesn't exist.
+    pub fn parse(s: &str) -> Option<Self> {
+        let s = s.trim();
+        let num = |a: usize, b: usize| s.get(a..b).filter(|t| t.bytes().all(|c| c.is_ascii_digit())).and_then(|t| t.parse::<u32>().ok());
+        let year = i32::try_from(num(0, 4)?).ok()?;
+        if s.len() == 4 {
+            return Some(PickedDate::year(year));
+        }
+        let month = u8::try_from(num(5, 7)?).ok().filter(|m| (1..=12).contains(m))?;
+        if s.get(4..5) != Some("-") {
+            return None;
+        }
+        if s.len() == 7 {
+            return Some(PickedDate { year, month: Some(month), day: None });
+        }
+        let day = u8::try_from(num(8, 10)?).ok().filter(|d| (1..=days_in_month(year, month)).contains(d))?;
+        // a time after the day (read past) must be one: T10, T10:00 or T10:00:00 (or a space for the T)
+        let time_ok = match s.len() {
+            10 => true,
+            13 | 16 | 19 => {
+                matches!(s.get(10..11), Some("T" | " "))
+                    && s.char_indices().skip(11).all(|(i, c)| if i == 13 || i == 16 { c == ':' } else { c.is_ascii_digit() })
+            }
+            _ => false,
+        };
+        (s.get(7..8) == Some("-") && time_ok).then_some(PickedDate { year, month: Some(month), day: Some(day) })
+    }
+
+    /// `2026`, `2026-08` or `2026-08-14`.
+    pub fn iso(&self) -> String {
+        match (self.month, self.day) {
+            (Some(m), Some(d)) => format!("{:04}-{m:02}-{d:02}", self.year),
+            (Some(m), None) => format!("{:04}-{m:02}", self.year),
+            _ => format!("{:04}", self.year),
+        }
+    }
+
+    pub fn precision(&self) -> Precision {
+        match (self.month, self.day) {
+            (Some(_), Some(_)) => Precision::Day,
+            (Some(_), None) => Precision::Month,
+            _ => Precision::Year,
+        }
+    }
+
+    /// The first day the value covers: (year, month, day).
+    pub fn first_day(&self) -> (i32, u8, u8) {
+        (self.year, self.month.unwrap_or(1), self.day.unwrap_or(1))
+    }
+
+    /// The last day the value covers.
+    pub fn last_day(&self) -> (i32, u8, u8) {
+        let month = self.month.unwrap_or(12);
+        (self.year, month, self.day.unwrap_or_else(|| days_in_month(self.year, month)))
+    }
+}
+
+/// Days in `month` (1–12) of `year` in the Gregorian calendar; 0 for a month that doesn't exist.
+pub fn days_in_month(year: i32, month: u8) -> u8 {
+    let leap = (year % 4 == 0 && year % 100 != 0) || year % 400 == 0;
+    match month {
+        1 | 3 | 5 | 7 | 8 | 10 | 12 => 31,
+        4 | 6 | 9 | 11 => 30,
+        2 if leap => 29,
+        2 => 28,
+        _ => 0,
+    }
+}
+
+/// The days of a month laid out in weeks from Monday: `None` before the 1st and after the last
+/// day, so the length is a multiple of 7.
+pub fn month_grid(year: i32, month: u8) -> Vec<Option<u8>> {
+    let first = format!("{year:04}-{month:02}-01");
+    // 1970-01-01 was a Thursday: three days after a Monday
+    let lead = lightcraft_catalog::stacks::iso_seconds(&first).map_or(0, |s| (s.div_euclid(86_400) + 3).rem_euclid(7) as usize);
+    let mut cells: Vec<Option<u8>> = std::iter::repeat_n(None, lead).chain((1..=days_in_month(year, month)).map(Some)).collect();
+    while !cells.len().is_multiple_of(7) {
+        cells.push(None);
+    }
+    cells
+}
+
+/// Whether any day of `date` lies between `min` and `max` (each optional, inclusive).
+pub fn in_bounds(date: &PickedDate, min: Option<&PickedDate>, max: Option<&PickedDate>) -> bool {
+    min.is_none_or(|m| date.last_day() >= m.first_day()) && max.is_none_or(|m| date.first_day() <= m.last_day())
+}
+
+/// Weekday column headers, Monday first (messages for translation catalogs).
+pub const WEEKDAY_SHORT: [&str; 7] = ["Mo", "Tu", "We", "Th", "Fr", "Sa", "Su"];
+
+/// Where the open popup is: what it picks and which page it shows.
+#[derive(Clone, Copy, Debug)]
+struct View {
+    precision: Precision,
+    year: i32,
+    month: u8,
+}
+
+impl View {
+    /// The view opened on `at`: years kept to 0000–9999 and months to 1–12, whatever a caller's
+    /// value holds.
+    fn open(at: PickedDate, precision: Precision) -> View {
+        View { precision, year: at.year.clamp(0, 9999), month: at.month.unwrap_or(1).clamp(1, 12) }
+    }
+}
+
+/// The page before (`forward` false) or after `v`: a month, a year or twelve years. Paging stops at
+/// years 0000 and 9999 rather than wrapping or leaving four-digit years.
+fn step(v: View, forward: bool) -> View {
+    let (year, month) = match v.precision {
+        Precision::Day => {
+            let m = i32::from(v.month) - 1 + if forward { 1 } else { -1 };
+            (v.year.saturating_add(m.div_euclid(12)), u8::try_from(m.rem_euclid(12) + 1).unwrap_or(1))
+        }
+        Precision::Month => (v.year.saturating_add(if forward { 1 } else { -1 }), v.month),
+        Precision::Year => {
+            // pages of twelve years (2016–2027); the first and last pages hold the ends
+            let page = v.year.div_euclid(12).saturating_add(if forward { 1 } else { -1 });
+            (page.saturating_mul(12), v.month)
+        }
+    };
+    let years = 0..=9999;
+    let fits = match v.precision {
+        Precision::Year => years.contains(&year) || years.contains(&year.saturating_add(11)),
+        _ => years.contains(&year),
+    };
+    if fits { View { year, month, ..v } } else { v }
+}
+
+/// Whether picking `cell` would cover today: its day, its month or its year.
+fn holds_today(cell: &PickedDate, today: Option<PickedDate>) -> bool {
+    today.is_some_and(|t| t.first_day() >= cell.first_day() && t.first_day() <= cell.last_day())
+}
+
+/// A calendar button that edits a [`PickedDate`]; see the module docs.
+pub struct DatePicker<'a> {
+    id: String,
+    value: &'a mut Option<PickedDate>,
+    precisions: &'a [Precision],
+    min: Option<PickedDate>,
+    max: Option<PickedDate>,
+    today: Option<PickedDate>,
+}
+
+impl<'a> DatePicker<'a> {
+    /// `id` keeps pickers apart and names their widgets, so it must be unique among the pickers
+    /// on screen (two with the same id share their open page); `value` is what they edit (`None`:
+    /// no date yet, or one that couldn't be read).
+    pub fn new(id: impl Into<String>, value: &'a mut Option<PickedDate>) -> Self {
+        DatePicker { id: id.into(), value, precisions: &Precision::ALL, min: None, max: None, today: None }
+    }
+
+    /// The precisions offered (all three by default), in the order shown. Without a value at one
+    /// of them, the picker opens on days when offered, else on the first.
+    pub fn precisions(mut self, precisions: &'a [Precision]) -> Self {
+        if !precisions.is_empty() {
+            self.precisions = precisions;
+        }
+        self
+    }
+
+    /// The earliest date that can be picked.
+    pub fn min(mut self, min: Option<PickedDate>) -> Self {
+        self.min = min;
+        self
+    }
+
+    /// The latest date that can be picked.
+    pub fn max(mut self, max: Option<PickedDate>) -> Self {
+        self.max = max;
+        self
+    }
+
+    /// Where the calendar opens when there is no value, and the day it marks.
+    pub fn today(mut self, today: Option<PickedDate>) -> Self {
+        self.today = today;
+        self
+    }
+
+    /// The button and, while open, the popup. The response is `changed()` when a date was picked.
+    pub fn show(self, ui: &mut Ui) -> Response {
+        let DatePicker { id, value, precisions, min, max, today } = self;
+        let mut button = crate::widgets::icon_button(ui, &format!("datePicker:{id}"), Icon::Calendar, vec2(24.0, 22.0), false, true, "Pick a date");
+        register(ui.ctx(), format!("datePicker:{id}"), button.rect);
+        let state = egui::Id::new(("datePicker", id.as_str()));
+        if button.clicked() {
+            // open on the value (or today), at its precision when it is one of those offered
+            let at = value.or(today).unwrap_or(PickedDate::year(2026));
+            let fallback = if precisions.contains(&Precision::Day) { Precision::Day } else { precisions.first().copied().unwrap_or(Precision::Day) };
+            let precision = value.map(|v| v.precision()).filter(|p| precisions.contains(p)).unwrap_or(fallback);
+            ui.data_mut(|d| d.insert_temp(state, View::open(at, precision)));
+        }
+        let mut picked: Option<PickedDate> = None;
+        let mut view = ui.data(|d| d.get_temp::<View>(state)).unwrap_or(View { precision: Precision::Day, year: 2026, month: 1 });
+        egui::Popup::from_toggle_button_response(&button).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
+            // as wide as a month of days, however much room the window has
+            ui.set_min_width(220.0);
+            ui.set_max_width(240.0);
+            if precisions.len() > 1 {
+                ui.horizontal(|ui| {
+                    for p in precisions {
+                        let r = ui.selectable_label(view.precision == *p, crate::i18n::tr(p.label()));
+                        register(ui.ctx(), format!("datePickerPrecision:{}:{id}", p.id()), r.rect);
+                        if r.clicked() {
+                            view.precision = *p;
+                        }
+                    }
+                });
+                ui.separator();
+            }
+            ui.horizontal(|ui| {
+                let prev = ui.small_button("‹");
+                register(ui.ctx(), format!("datePickerPrev:{id}"), prev.rect);
+                let title = match view.precision {
+                    Precision::Day => crate::i18n::date_group_label(&format!("{:04}-{:02}", view.year, view.month), false),
+                    Precision::Month => format!("{:04}", view.year),
+                    Precision::Year => {
+                        let first = view.year.div_euclid(12) * 12;
+                        format!("{first:04}–{:04}", first + 11)
+                    }
+                };
+                ui.label(RichText::new(title).strong());
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    let next = ui.small_button("›");
+                    register(ui.ctx(), format!("datePickerNext:{id}"), next.rect);
+                    if next.clicked() {
+                        view = step(view, true);
+                    }
+                    if prev.clicked() {
+                        view = step(view, false);
+                    }
+                });
+            });
+            let cell = |ui: &mut Ui, date: PickedDate, text: String, picked: &mut Option<PickedDate>| {
+                let allowed = in_bounds(&date, min.as_ref(), max.as_ref());
+                let text = if holds_today(&date, today) { RichText::new(text).strong().underline() } else { RichText::new(text) };
+                let r = ui.add_enabled(allowed, egui::Button::selectable(*value == Some(date), text).min_size(vec2(26.0, 0.0)));
+                register(ui.ctx(), format!("datePickerCell:{}:{id}", date.iso()), r.rect);
+                if r.clicked() {
+                    *picked = Some(date);
+                }
+            };
+            egui::Grid::new(("datePickerGrid", id.as_str())).spacing(vec2(2.0, 2.0)).show(ui, |ui| match view.precision {
+                Precision::Day => {
+                    for name in WEEKDAY_SHORT {
+                        ui.label(RichText::new(crate::i18n::tr(name)).weak());
+                    }
+                    ui.end_row();
+                    for week in month_grid(view.year, view.month).chunks(7) {
+                        for d in week {
+                            match d {
+                                Some(d) => {
+                                    cell(ui, PickedDate { year: view.year, month: Some(view.month), day: Some(*d) }, d.to_string(), &mut picked)
+                                }
+                                None => {
+                                    ui.label("");
+                                }
+                            }
+                        }
+                        ui.end_row();
+                    }
+                }
+                Precision::Month => {
+                    for row in 0..3u8 {
+                        for col in 1..=4u8 {
+                            let m = row * 4 + col;
+                            let date = PickedDate { year: view.year, month: Some(m), day: None };
+                            cell(ui, date, crate::i18n::date_group_label(&date.iso(), true), &mut picked);
+                        }
+                        ui.end_row();
+                    }
+                }
+                Precision::Year => {
+                    let first = view.year.div_euclid(12) * 12;
+                    for row in 0..3 {
+                        for col in 0..4 {
+                            let y = first + row * 4 + col;
+                            if (0..=9999).contains(&y) {
+                                cell(ui, PickedDate::year(y), format!("{y:04}"), &mut picked);
+                            }
+                        }
+                        ui.end_row();
+                    }
+                }
+            });
+            // Esc closes the calendar and stops there: the dialog around it keeps its edits
+            if ui.input(|i| i.key_pressed(egui::Key::Escape)) {
+                crate::widgets::take_escape(ui.ctx());
+                ui.close();
+            }
+            if picked.is_some() {
+                ui.close();
+            }
+        });
+        ui.data_mut(|d| d.insert_temp(state, view));
+        if let Some(date) = picked {
+            *value = Some(date);
+            button.mark_changed();
+        }
+        button
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn partial_dates_read_and_write_iso() {
+        let d = |s: &str| PickedDate::parse(s);
+        assert_eq!(d("2026"), Some(PickedDate { year: 2026, month: None, day: None }));
+        assert_eq!(d("2026-08"), Some(PickedDate { year: 2026, month: Some(8), day: None }));
+        assert_eq!(d("2026-08-14"), Some(PickedDate { year: 2026, month: Some(8), day: Some(14) }));
+        assert_eq!(d("2026-08-14T10:00").map(|p| p.iso()), Some("2026-08-14".to_string()), "a time is read past");
+        for bad in ["", "26", "2026-13", "2026-02-30", "banana", "2026/08"] {
+            assert_eq!(d(bad), None, "{bad}");
+        }
+        for s in ["2026", "2026-08", "2026-08-14", "0001-01-01", "9999-12-31"] {
+            assert_eq!(d(s).map(|p| p.iso()).as_deref(), Some(s));
+        }
+        assert_eq!(d("2026-08").map(|p| p.precision()), Some(Precision::Month));
+        // the first and last day a value covers, for bounds
+        assert_eq!(d("2026-02").map(|p| (p.first_day(), p.last_day())), Some(((2026, 2, 1), (2026, 2, 28))));
+        assert_eq!(d("2028").map(|p| (p.first_day(), p.last_day())), Some(((2028, 1, 1), (2028, 12, 31))));
+    }
+
+    #[test]
+    fn month_lengths_and_grids() {
+        assert_eq!((days_in_month(2026, 2), days_in_month(2028, 2), days_in_month(1900, 2), days_in_month(2000, 2)), (28, 29, 28, 29));
+        assert_eq!((days_in_month(2026, 4), days_in_month(2026, 12), days_in_month(2026, 13)), (30, 31, 0));
+        // August 2026 starts on a Saturday: five blanks in a Monday-first week, then 1..=31
+        let g = month_grid(2026, 8);
+        assert_eq!(g.len() % 7, 0);
+        assert_eq!(&g[..6], &[None, None, None, None, None, Some(1)]);
+        assert_eq!(g.iter().flatten().count(), 31);
+        assert_eq!(month_grid(2026, 6).first(), Some(&Some(1)), "June 2026 starts on a Monday");
+    }
+
+    /// Paging stops at years 0000 and 9999 instead of wrapping (‹ on January 0000 stays there),
+    /// and a view opened on a year beyond them starts at the nearest end.
+    #[test]
+    fn paging_stops_at_the_ends() {
+        let v = |precision, year, month| View { precision, year, month };
+        let at = |v: View| (v.year, v.month);
+        assert_eq!(at(step(v(Precision::Day, 2026, 12), true)), (2027, 1));
+        assert_eq!(at(step(v(Precision::Day, 2026, 1), false)), (2025, 12));
+        assert_eq!(at(step(v(Precision::Day, 0, 1), false)), (0, 1));
+        assert_eq!(at(step(v(Precision::Day, 9999, 12), true)), (9999, 12));
+        assert_eq!(at(step(v(Precision::Month, 0, 5), false)), (0, 5));
+        assert_eq!(at(step(v(Precision::Month, 9999, 5), true)), (9999, 5));
+        assert_eq!(at(step(v(Precision::Year, 5, 1), false)), (5, 1), "the first page of years");
+        assert_eq!(at(step(v(Precision::Year, 9990, 1), true)), (9996, 1), "the page holding 9996–9999");
+        assert_eq!(at(step(v(Precision::Year, 9996, 1), true)), (9996, 1), "the last page");
+        assert_eq!(at(step(v(Precision::Year, 2026, 1), false)), (2004, 1), "the page 2004–2015");
+        let huge = PickedDate { year: i32::MAX, month: Some(13), day: None };
+        assert_eq!(at(View::open(huge, Precision::Day)), (9999, 12));
+        assert_eq!(at(View::open(PickedDate { year: i32::MIN, month: Some(0), day: None }, Precision::Day)), (0, 1));
+    }
+
+    /// The picker reads a date the way the rule check does: a time after it must be a time.
+    #[test]
+    fn a_trailing_time_must_be_a_time() {
+        for ok in ["2026-08-14T10", "2026-08-14T10:00", "2026-08-14 10:00:00"] {
+            assert!(PickedDate::parse(ok).is_some(), "{ok}");
+        }
+        for bad in ["2026-08-14Tjunk", "2026-08-14T", "2026-08-14T1", "2026-08-14T10:0", "2026-08-14T10:00Z"] {
+            assert_eq!(PickedDate::parse(bad), None, "{bad}");
+        }
+    }
+
+    /// Today is marked in every view: its day, its month, its year.
+    #[test]
+    fn today_is_marked_at_every_precision() {
+        let d = |s: &str| PickedDate::parse(s).unwrap();
+        let today = Some(d("2026-10-09"));
+        assert!(holds_today(&d("2026-10-09"), today) && holds_today(&d("2026-10"), today) && holds_today(&d("2026"), today));
+        assert!(!holds_today(&d("2026-10-08"), today) && !holds_today(&d("2026-09"), today) && !holds_today(&d("2025"), today));
+        assert!(!holds_today(&d("2026"), None));
+    }
+
+    #[test]
+    fn bounds_keep_whole_values_in_range() {
+        let d = |s: &str| PickedDate::parse(s).unwrap();
+        let (min, max) = (Some(d("2026-03")), Some(d("2026-06-15")));
+        let ok = |s: &str| in_bounds(&d(s), min.as_ref(), max.as_ref());
+        assert!(ok("2026-03-01") && ok("2026-04") && ok("2026-06-15"));
+        assert!(!ok("2026-02-28") && !ok("2026-06-16") && !ok("2026-07"));
+        assert!(ok("2026-06"), "a month that reaches the bound counts");
+        assert!(ok("2026") && !ok("2027") && !ok("2025"));
+        assert!(in_bounds(&d("1999"), None, None));
+    }
+}
diff --git a/crates/ui-egui/src/export_task.rs b/crates/ui-egui/src/export_task.rs
index fee92150..984a9461 100644
--- a/crates/ui-egui/src/export_task.rs
+++ b/crates/ui-egui/src/export_task.rs
@@ -1,7 +1,8 @@
 //! Background export: the Export dialog, File → Export with Preset and Export with Previous hand
 //! their batch to a worker thread so the window stays responsive. Photos are prepared on the UI
 //! thread ([`lightcraft_engine::export::prepare_export`]: cheap, needs the session) and rendered,
-//! encoded and written on the worker; a progress panel shows the count and a Cancel button.
+//! encoded and written on the worker (several side by side: [`run_batch`]); a progress panel shows
+//! the count and a Cancel button.
 //!
 //! Needs [`crate::Services::write_shared`] (a thread-safe writer); without it (web) the batch runs
 //! synchronously as before.
@@ -62,6 +63,50 @@ pub fn start(app: &mut LightcraftApp, items: Vec<PreparedExport>, opts: ExportOp
     Ok(json!({"background": true, "total": total}))
 }
 
+/// Export a single paginated PDF using the same progress and cancellation UI as image exports.
+pub fn start_contact_sheet(app: &mut LightcraftApp, params: &Value) -> Result<Value, String> {
+    if app.export.is_some() {
+        return Err("an export is already running".into());
+    }
+    let path = params.get("path").and_then(Value::as_str).filter(|s| !s.trim().is_empty()).ok_or("missing path")?.to_string();
+    app.session.check_write_target(&path)?;
+    let guard = app.session.original_guard();
+    let prepared = lightcraft_engine::contact_sheet::prepare(&mut app.session, params)?;
+    let total = prepared.len();
+    let write = app.services.write_shared.clone();
+    let progress = Arc::new(Mutex::new((0, String::new())));
+    let cancel = Arc::new(AtomicBool::new(false));
+    let (p, c) = (progress.clone(), cancel.clone());
+    let (tx, rx) = channel();
+    let work = move || {
+        let result = prepared
+            .run(&mut |done, name| {
+                if let Ok(mut g) = p.lock() {
+                    *g = (done, name.to_string());
+                }
+                !c.load(Ordering::Relaxed)
+            })
+            .and_then(|doc| {
+                if c.load(Ordering::Relaxed) {
+                    return Err("Contact sheet cancelled".into());
+                }
+                guard.check(std::path::Path::new(&path))?;
+                match write {
+                    Some(write) => write(&path, &doc.bytes)?,
+                    None => lightcraft_engine::export::write_file(&path, &doc.bytes)?,
+                }
+                Ok(vec![json!({"path": path, "pages": doc.pages, "photos": doc.photos, "bytes": doc.bytes.len(), "contactSheet": true})])
+            });
+        let _ = tx.send(result);
+    };
+    #[cfg(not(target_arch = "wasm32"))]
+    std::thread::Builder::new().name("contact-sheet".into()).spawn(work).map_err(|e| e.to_string())?;
+    #[cfg(target_arch = "wasm32")]
+    work();
+    app.export = Some(ExportTask { total, progress, cancel, rx });
+    Ok(json!({"background": true, "total": total}))
+}
+
 /// Per frame: draw the progress panel; when the batch finishes, report it.
 pub fn poll(app: &mut LightcraftApp, ctx: &egui::Context) {
     let Some(task) = &app.export else { return };
@@ -72,11 +117,15 @@ pub fn poll(app: &mut LightcraftApp, ctx: &egui::Context) {
             app.export = None;
             let msg = match r {
                 Ok(files) => {
+                    let sheet = files.first().filter(|f| f["contactSheet"] == true);
                     let ok = files.iter().filter(|f| f.get("path").is_some()).count();
                     let failed: Vec<&Value> = files.iter().filter(|f| f.get("error").is_some()).collect();
                     let skipped = files.iter().filter(|f| f.get("skipped").is_some()).count();
                     let mut m =
                         crate::i18n::tr_format!("Exported {ok} of {total} photo{}", if total == 1 { "" } else { "s" }, ok = ok, total = total);
+                    if let Some(sheet) = sheet {
+                        m = format!("Exported contact sheet: {} photos, {} pages", sheet["photos"], sheet["pages"]);
+                    }
                     if skipped > 0 {
                         m += &crate::i18n::tr_format!(" · {skipped} skipped (file exists)", skipped = skipped);
                     }
@@ -126,3 +175,73 @@ pub fn poll(app: &mut LightcraftApp, ctx: &egui::Context) {
         }
     }
 }
+
+#[cfg(test)]
+mod contact_sheet_tests {
+    use super::*;
+    use crate::pick::{PickKind, PickRequest};
+    use crate::state::Dialog;
+    use std::time::{Duration, Instant};
+
+    #[test]
+    fn contact_sheet_menu_dialog_picker_and_background_export() {
+        let asked = Arc::new(Mutex::new(Vec::<PickRequest>::new()));
+        let requests = asked.clone();
+        let bytes = Arc::new(Mutex::new(Vec::new()));
+        let written = bytes.clone();
+        let services = crate::Services {
+            picker: Some(Box::new(move |req| {
+                requests.lock().unwrap().push(req);
+                let (tx, rx) = channel();
+                tx.send(vec!["Contact Sheet.pdf".into()]).unwrap();
+                Ok(rx)
+            })),
+            write_shared: Some(Arc::new(move |path, data| {
+                assert_eq!(path, "Contact Sheet.pdf");
+                *written.lock().unwrap() = data.to_vec();
+                Ok(())
+            })),
+            ..Default::default()
+        };
+        let mut app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), services);
+        app.run("dialog.contactSheet", json!({})).unwrap();
+        let Some(Dialog::ContactSheet { options }) = app.ui.dialog.as_mut() else { panic!("no contact sheet settings") };
+        options.paper = "letter".into();
+        options.landscape = true;
+        let mut h = crate::headless::Headless::new(app, [1000.0, 800.0], 1.0);
+        let dialog = h.app.ui.dialog.take().unwrap();
+        crate::panels::dialogs::confirm_dialog(&mut h.app, &dialog).unwrap();
+        assert_eq!(h.app.pending_picks.len(), 1);
+        let deadline = Instant::now() + Duration::from_secs(20);
+        loop {
+            // The progress window lays out text, which egui only allows inside a frame.
+            h.step();
+            if h.app.last_export_result.is_some() {
+                break;
+            }
+            assert!(Instant::now() < deadline, "export did not finish");
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        let req = asked.lock().unwrap();
+        assert_eq!(req[0].kind, PickKind::Save);
+        assert_eq!(req[0].filter.as_ref().unwrap().1, &["pdf"]);
+        assert_eq!(req[0].file_name.as_deref(), Some("Contact Sheet.pdf"));
+        let b = bytes.lock().unwrap();
+        assert!(b.starts_with(b"%PDF-1.4"));
+        assert!(String::from_utf8_lossy(&b).contains("/MediaBox [0 0 792.00 612.00]"));
+        assert_eq!(h.app.last_export_result.as_ref().unwrap()["files"][0]["photos"], 1);
+    }
+
+    #[test]
+    fn cancelled_contact_sheet_never_calls_writer() {
+        let mut app = LightcraftApp::new(
+            lightcraft_engine::Session::with_demo(),
+            crate::Services { write_shared: Some(Arc::new(|_, _| panic!("cancelled export wrote a file"))), ..Default::default() },
+        );
+        let ids: Vec<_> = app.session.catalog.photos().take(24).map(|p| p.id.0).collect();
+        start_contact_sheet(&mut app, &json!({"path": "Cancelled.pdf", "ids": ids})).unwrap();
+        app.export.as_ref().unwrap().cancel.store(true, Ordering::Relaxed);
+        let task = app.export.take().unwrap();
+        assert!(task.rx.recv_timeout(Duration::from_secs(20)).unwrap().is_err());
+    }
+}
diff --git a/crates/ui-egui/src/headless.rs b/crates/ui-egui/src/headless.rs
index d1fae1e1..e2884935 100644
--- a/crates/ui-egui/src/headless.rs
+++ b/crates/ui-egui/src/headless.rs
@@ -79,6 +79,10 @@ pub struct HeadlessView {
     pixels_per_point: f32,
     size: [usize; 2],
     frames: u64,
+    /// The pretend host's clipboard: what the UI last copied, and what a paste request pastes.
+    pub clipboard: String,
+    /// Events the host owes the next frame (a paste request's paste, as a desktop host sends it).
+    owed: Vec<egui::Event>,
 }
 
 impl Default for HeadlessView {
@@ -92,7 +96,16 @@ impl HeadlessView {
         let ctx = egui::Context::default();
         crate::theme::install_fonts(&ctx);
         crate::theme::apply(&ctx);
-        HeadlessView { ctx, textures: TextureStore::default(), shapes: vec![], pixels_per_point: 1.0, size: [1600, 1000], frames: 0 }
+        HeadlessView {
+            ctx,
+            textures: TextureStore::default(),
+            shapes: vec![],
+            pixels_per_point: 1.0,
+            size: [1600, 1000],
+            frames: 0,
+            clipboard: String::new(),
+            owed: vec![],
+        }
     }
 
     /// Input for one frame of a `size` (points) viewport at `pixels_per_point`.
@@ -132,12 +145,28 @@ impl HeadlessView {
                 }
             }
         }
+        raw.events.splice(0..0, std::mem::take(&mut self.owed));
         let mut out = self.ctx.run_ui(raw, run_ui);
         self.frames += 1;
         self.textures.apply(std::mem::take(&mut out.textures_delta));
         self.shapes = std::mem::take(&mut out.shapes);
         self.pixels_per_point = out.pixels_per_point;
-        out.viewport_output.remove(&ViewportId::ROOT).map(|v| v.commands).unwrap_or_default()
+        for c in &out.platform_output.commands {
+            if let egui::OutputCommand::CopyText(text) = c {
+                self.clipboard.clone_from(text);
+            }
+        }
+        let commands = out.viewport_output.remove(&ViewportId::ROOT).map(|v| v.commands).unwrap_or_default();
+        // what a desktop host does with a cut, copy or paste request (egui-winit): the event, next frame
+        for c in &commands {
+            match c {
+                ViewportCommand::RequestCut => self.owed.push(egui::Event::Cut),
+                ViewportCommand::RequestCopy => self.owed.push(egui::Event::Copy),
+                ViewportCommand::RequestPaste if !self.clipboard.is_empty() => self.owed.push(egui::Event::Paste(self.clipboard.clone())),
+                _ => {}
+            }
+        }
+        commands
     }
 
     /// Frames run so far.
@@ -145,6 +174,22 @@ impl HeadlessView {
         self.frames
     }
 
+    /// Every piece of text the last frame painted (labels, tooltips, values), in paint order.
+    pub fn painted_text(&self) -> Vec<String> {
+        fn texts(shape: &egui::epaint::Shape, out: &mut Vec<String>) {
+            match shape {
+                egui::epaint::Shape::Text(shape) => out.push(shape.galley.job.text.clone()),
+                egui::epaint::Shape::Vec(shapes) => shapes.iter().for_each(|shape| texts(shape, out)),
+                _ => {}
+            }
+        }
+        let mut out = Vec::new();
+        for shape in &self.shapes {
+            texts(&shape.shape, &mut out);
+        }
+        out
+    }
+
     /// Size in pixels of the last frame.
     pub fn size_px(&self) -> [usize; 2] {
         self.size
@@ -170,6 +215,9 @@ pub struct Headless {
     pub view: HeadlessView,
     /// The largest texture the pretend GPU takes (what a WebGL device may report: 2048).
     pub max_texture_side: usize,
+    /// The limit egui was last told. Like a native host (egui-winit) it is reported once, not in
+    /// every frame's input: code that reads the raw input sees `None` from then on (issue #652).
+    reported_texture_side: Option<usize>,
     /// Logical size (points) and scale.
     pub size: egui::Vec2,
     pub pixels_per_point: f32,
@@ -182,6 +230,8 @@ pub struct Headless {
     pub window_maximized: bool,
     /// Window-management commands the app sent (`StartDrag`, `Maximized`, …), oldest first.
     pub window_commands: Vec<ViewportCommand>,
+    /// The pointer cursor the last frame asked for (what a real host would show).
+    pub last_cursor: egui::CursorIcon,
 }
 
 impl Headless {
@@ -201,6 +251,7 @@ impl Headless {
             app,
             view: HeadlessView::new(),
             max_texture_side: 16384,
+            reported_texture_side: None,
             size,
             pixels_per_point,
             time: 0.0,
@@ -210,6 +261,7 @@ impl Headless {
             quit: false,
             window_maximized: false,
             window_commands: vec![],
+            last_cursor: egui::CursorIcon::Default,
         }
     }
 
@@ -217,6 +269,11 @@ impl Headless {
         self.frames
     }
 
+    /// Every piece of text the last frame painted ([`HeadlessView::painted_text`]).
+    pub fn painted_text(&self) -> Vec<String> {
+        self.view.painted_text()
+    }
+
     /// `app.quit` was requested.
     pub fn quit_requested(&self) -> bool {
         self.quit
@@ -227,13 +284,17 @@ impl Headless {
         (self.size, self.pixels_per_point) = bounded_viewport(self.size, self.pixels_per_point);
         let mut raw = HeadlessView::raw_input(self.size, self.pixels_per_point, self.time, std::mem::take(&mut self.events));
         raw.viewports.entry(ViewportId::ROOT).or_default().maximized = Some(self.window_maximized);
-        raw.max_texture_side = Some(self.max_texture_side);
+        raw.max_texture_side = (self.reported_texture_side != Some(self.max_texture_side)).then_some(self.max_texture_side);
+        self.reported_texture_side = Some(self.max_texture_side);
         self.app.raw_input_hook(&mut raw);
         let app = &mut self.app;
+        let mut cursor = egui::CursorIcon::Default;
         let commands = self.view.run(raw, |ui| {
             app.logic(ui.ctx());
             app.ui(ui);
+            cursor = ui.ctx().output(|output| output.cursor_icon);
         });
+        self.last_cursor = cursor;
         self.time += FRAME_DT;
         self.frames += 1;
         for c in commands {
@@ -266,6 +327,8 @@ impl Headless {
             || crate::panels::left::fs_cached_running(&self.view.ctx) > 0
             || self.app.merge.busy()
             || self.app.scan.is_some()
+            || self.app.sync.is_some()
+            || self.app.sync_run.is_some()
             || self.app.import.is_some()
             || self.app.export.is_some()
             || self.app.session.denoise_busy()
@@ -424,6 +487,32 @@ mod tests {
 
     use super::*;
 
+    /// The pretend host has a clipboard, as a desktop does: text the UI copies lands in it, and a
+    /// cut, copy or paste request (from a context menu) comes back as that event on the next frame.
+    #[test]
+    fn the_headless_host_has_a_clipboard() {
+        let mut view = HeadlessView::new();
+        let raw = || HeadlessView::raw_input(egui::vec2(200.0, 100.0), 1.0, 0.0, vec![]);
+        view.run(raw(), |ui| ui.ctx().copy_text("Lisbon".into()));
+        assert_eq!(view.clipboard, "Lisbon");
+        for (command, event) in [
+            (ViewportCommand::RequestPaste, egui::Event::Paste("Lisbon".into())),
+            (ViewportCommand::RequestCopy, egui::Event::Copy),
+            (ViewportCommand::RequestCut, egui::Event::Cut),
+        ] {
+            view.run(raw(), |ui| ui.ctx().send_viewport_cmd(command.clone()));
+            let mut seen = vec![];
+            view.run(raw(), |ui| seen = ui.input(|i| i.events.clone()));
+            assert!(seen.contains(&event), "{command:?}: {seen:?}");
+        }
+        // an empty clipboard pastes nothing, as a desktop host does
+        view.clipboard.clear();
+        view.run(raw(), |ui| ui.ctx().send_viewport_cmd(ViewportCommand::RequestPaste));
+        let mut seen = vec![];
+        view.run(raw(), |ui| seen = ui.input(|i| i.events.clone()));
+        assert!(!seen.iter().any(|e| matches!(e, egui::Event::Paste(_))), "{seen:?}");
+    }
+
     #[test]
     fn screenshot_dimensions_are_checked_before_layout() {
         assert_eq!(viewport_pixels([1600.0, 1000.0], 2.0).unwrap(), [3200, 2000]);
@@ -453,20 +542,14 @@ mod tests {
         {
             let mut view = HeadlessView::new();
             for frame in 0..9 {
-                let key = match frame {
-                    1 => Some(egui::Key::Plus),
-                    5 => Some(egui::Key::Minus),
-                    _ => None,
-                };
-                let mut raw = HeadlessView::raw_input(size, scale, frame as f64 / 60.0, vec![]);
-                if let Some(key) = key {
-                    let modifiers = egui::Modifiers { command: true, ..Default::default() };
-                    raw.events.push(egui::Event::ModifiersChanged(modifiers));
-                    raw.events.extend(vec![
-                        egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers },
-                        egui::Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers },
-                    ]);
+                // the interface scale changes between frames (Cmd+Plus / Cmd+Minus are the
+                // photo's zoom, issue #566: egui's own keyboard zoom is off)
+                match frame {
+                    1 => view.ctx.set_zoom_factor(1.1),
+                    5 => view.ctx.set_zoom_factor(1.0),
+                    _ => {}
                 }
+                let raw = HeadlessView::raw_input(size, scale, frame as f64 / 60.0, vec![]);
                 view.run(raw, |ui| {
                     ui.label("UI zoom changes layout, keeping the host viewport size");
                 });
@@ -489,7 +572,8 @@ mod tests {
         app.ui.settings.gpu = false;
         let mut h = Headless::new(app, [480.0, 320.0], 2.0);
         let t = Duration::from_secs(5);
-        assert_eq!(h.request("ui.key", json!({"key": "Plus", "cmd": true}), t)["ok"], true);
+        h.view.ctx.set_zoom_factor(1.1);
+        assert_eq!(h.request("ui.inspect", json!({}), t)["ok"], true);
         assert!(h.view.ctx.zoom_factor() > 1.0);
         let main = h.view.ctx.clone();
         let screenshot = h.app.headless_screenshot(&main, true).unwrap();
@@ -506,7 +590,9 @@ mod tests {
             app.ui.settings.gpu = false;
             let mut h = Headless::new(app, [480.0, 320.0], scale);
             let t = Duration::from_secs(5);
-            assert_eq!(h.request("ui.key", json!({"key": "Plus", "cmd": true}), t)["ok"], true);
+            assert_eq!(h.request("ui.zoomFactor", json!({"factor": 1.1}), t)["ok"], true);
+            h.step();
+            assert!(h.view.ctx.zoom_factor() > 1.0);
             let native_size = resized_viewport([320.0, 240.0], scale, h.view.ctx.zoom_factor()).unwrap();
             let expected = native_viewport_pixels([native_size.x, native_size.y], scale).unwrap();
             assert_eq!(h.request("ui.resize", json!({"width": 320, "height": 240}), t)["ok"], true);
@@ -538,7 +624,8 @@ mod tests {
         app.ui.settings.gpu = false;
         let mut h = Headless::new(app, [480.0, 320.0], 0.9);
         let t = Duration::from_secs(5);
-        assert_eq!(h.request("ui.key", json!({"key": "Minus", "cmd": true}), t)["ok"], true);
+        h.view.ctx.set_zoom_factor(0.9);
+        h.step();
         assert!((h.view.ctx.zoom_factor() - 0.9).abs() < 0.001);
         assert_eq!(h.request("ui.resize", json!({"width": 150, "height": 150}), t)["ok"], true);
         assert_eq!(h.size, egui::vec2(135.0, 135.0));
@@ -580,6 +667,101 @@ mod tests {
         Headless::new(app, size, 1.0)
     }
 
+    /// Agents cut, copy and paste in a text field as the system does for ⌘X / ⌘C / ⌘V
+    /// (`ui.clipboard`), and `ui.inspect` → `copied` says what the UI last copied.
+    #[test]
+    fn agents_cut_copy_and_paste_in_text_fields() {
+        let mut h = demo([1200.0, 760.0]);
+        let t = Duration::from_secs(10);
+        let ask = |h: &mut Headless, method: &str, params: serde_json::Value| {
+            let r = h.request(method, params.clone(), t);
+            assert_eq!(r["ok"], true, "{method} {params}: {r}");
+            h.step();
+            h.step();
+            r
+        };
+        h.settle(SETTLE);
+        ask(&mut h, "ui.clickWidget", json!({"id": "field:search"}));
+        ask(&mut h, "ui.text", json!({"text": "wedding"}));
+        ask(&mut h, "ui.key", json!({"key": "a", "cmd": true}));
+        ask(&mut h, "ui.clipboard", json!({"action": "copy"}));
+        assert_eq!(ask(&mut h, "ui.inspect", json!({}))["result"]["copied"], "wedding");
+        ask(&mut h, "ui.clipboard", json!({"action": "cut"}));
+        assert_eq!(h.app.ui.search, "");
+        ask(&mut h, "ui.clipboard", json!({"action": "paste", "text": "travel"}));
+        assert_eq!(h.app.ui.search, "travel");
+        let r = h.request("ui.clipboard", json!({"action": "shred"}), t);
+        assert_eq!(r["ok"], false, "an unknown action is refused: {r}");
+    }
+
+    /// `ui.clipboard` acts in a text field: with none focused it is refused, rather than doing
+    /// what ⌘V does there on one platform (paste edit settings) and nothing on another.
+    #[test]
+    fn the_clipboard_method_needs_a_text_field() {
+        let mut h = demo([1200.0, 760.0]);
+        let t = Duration::from_secs(10);
+        h.settle(SETTLE);
+        let undo = h.app.session.undo.len();
+        for action in ["copy", "paste"] {
+            let r = h.request("ui.clipboard", json!({"action": action, "text": "travel"}), t);
+            assert_eq!(r["ok"], false, "{action}: {r}");
+            assert!(r["error"].as_str().is_some_and(|e| e.contains("text field")), "{r}");
+        }
+        h.settle(SETTLE);
+        assert_eq!(h.app.session.undo.len(), undo, "nothing was pasted");
+    }
+
+    /// `ui.clickWidget` right-clicks with `button: "right"`, as `ui.click` does (MCP `click`
+    /// passes it on with a widget): a filmstrip photo's context menu opens.
+    #[test]
+    fn click_widget_right_clicks() {
+        let mut h = demo([1200.0, 760.0]);
+        let t = Duration::from_secs(10);
+        h.request("ui.set", json!({"view": "detail"}), t);
+        h.settle(SETTLE);
+        let cell = h.app.widgets.iter().find(|(w, _)| w.starts_with("film:")).map(|(w, _)| w.clone()).expect("a filmstrip photo");
+        assert!(!egui::Popup::is_any_open(&h.view.ctx));
+        let r = h.request("ui.clickWidget", json!({"id": cell, "button": "right"}), t);
+        assert_eq!(r["ok"], true, "{r}");
+        h.settle(SETTLE);
+        assert!(egui::Popup::is_any_open(&h.view.ctx), "its context menu");
+    }
+
+    /// The search field is a shared text field: right-click ▸ Paste puts the clipboard's text in
+    /// and filters by it.
+    #[test]
+    fn the_search_field_pastes_from_its_menu() {
+        let mut h = demo([1200.0, 760.0]);
+        let t = Duration::from_secs(10);
+        h.settle(SETTLE);
+        h.view.clipboard = "wedding".into();
+        for (id, button) in [("field:search", "right"), ("field:search:paste", "left")] {
+            let r = h.request("ui.clickWidget", json!({"id": id, "button": button}), t);
+            assert_eq!(r["ok"], true, "{id}: {r}");
+            h.settle(SETTLE);
+        }
+        assert_eq!(h.app.ui.search, "wedding");
+        assert_eq!(h.app.session.filter.text, "wedding", "and the library is filtered by it");
+    }
+
+    /// Esc in the search field gives back the search from before the edit, and the filter with it.
+    #[test]
+    fn escape_in_the_search_field_gives_back_the_search() {
+        let mut h = demo([1200.0, 760.0]);
+        let t = Duration::from_secs(10);
+        h.settle(SETTLE);
+        for (method, params) in [("ui.clickWidget", json!({"id": "field:search"})), ("ui.text", json!({"text": "travel"}))] {
+            let r = h.request(method, params, t);
+            assert_eq!(r["ok"], true, "{r}");
+            h.settle(SETTLE);
+        }
+        assert_eq!(h.app.session.filter.text, "travel", "filtered while typing");
+        let r = h.request("ui.key", json!({"key": "Escape"}), t);
+        assert_eq!(r["ok"], true, "{r}");
+        h.settle(SETTLE);
+        assert_eq!((h.app.ui.search.as_str(), h.app.session.filter.text.as_str()), ("", ""));
+    }
+
     #[test]
     fn demo_grid_snapshot_has_ui_pixels() {
         let t0 = Instant::now();
@@ -1108,6 +1290,45 @@ mod tests {
         assert_eq!(named(&h, ids[1], 0), None);
     }
 
+    /// The name field under the unnamed faces is a shared text field: right-click ▸ Paste puts the
+    /// clipboard's name in, and Esc leaves the field and clears the selection, as Clear does.
+    #[test]
+    fn the_unnamed_faces_name_field_pastes_and_escape_clears() {
+        use lightcraft_catalog::Op;
+        let mut h = demo([1400.0, 900.0]);
+        let t = Duration::from_secs(10);
+        let id = h.app.session.catalog.photos().map(|p| p.id).next().unwrap();
+        let mut meta = h.app.session.catalog.photo(id).unwrap().meta.clone();
+        meta.regions = vec![lightcraft_meta::Region {
+            rect: lightcraft_geom::Rect { x0: 0.3, y0: 0.2, x1: 0.5, y1: 0.55 },
+            kind: lightcraft_meta::RegionKind::Face,
+            name: None,
+            description: None,
+        }];
+        h.app.session.commit("setup", Op::SetMeta { id, meta: Box::new(meta) }).unwrap();
+        h.request("engine.execute", json!({"command": "view.people"}), t);
+        h.settle(SETTLE);
+        h.view.clipboard = "Wedding Guest".into();
+        for (widget, button) in [
+            (format!("unnamed-face:{}:0", id.0), "left"),
+            ("field:unnamedName".to_string(), "left"),
+            ("field:unnamedName".to_string(), "right"),
+            ("field:unnamedName:paste".to_string(), "left"),
+        ] {
+            let r = h.request("ui.clickWidget", json!({"id": widget, "button": button}), t);
+            assert_eq!(r["ok"], true, "{widget}: {r}");
+            h.step();
+            h.step();
+            h.step();
+        }
+        assert_eq!(h.app.ui.unnamed_name, "Wedding Guest");
+        assert_eq!(h.app.ui.unnamed_selected.len(), 1, "still naming");
+        h.request("ui.key", json!({"key": "Escape"}), t);
+        h.step();
+        h.step();
+        assert!(h.app.ui.unnamed_selected.is_empty() && h.app.ui.unnamed_name.is_empty(), "Esc cleared the selection and the name");
+    }
+
     /// A screenful of faces larger than the picture cache's usual budget (96) is all kept: with a fixed budget the same few
     /// tiles were evicted and re-requested every frame and stayed blank.
     #[test]
@@ -1371,6 +1592,90 @@ mod tests {
         h.settle(SETTLE);
     }
 
+    /// Rename Keyword's name field is a shared text field. It opens with the name selected, so
+    /// typing replaces it, and Return renames; right-click ▸ Paste works too; Esc cancels the
+    /// dialog and renames nothing.
+    #[test]
+    fn the_rename_keyword_field_selects_pastes_and_cancels() {
+        let mut h = demo([1200.0, 800.0]);
+        let t = Duration::from_secs(10);
+        let first = h.app.session.visible_cloned()[0].0;
+        h.request("engine.execute", json!({"command": "photo.setMeta", "params": {"ids": [first], "addKeywords": ["travel"]}}), t);
+        let keywords = |h: &Headless| h.app.session.catalog.photo(lightcraft_catalog::PhotoId(first)).unwrap().meta.keywords.clone();
+        let open = |h: &mut Headless, name: &str| {
+            h.app.ui.dialog = Some(crate::state::Dialog::RenameKeyword { from: name.into(), to: name.into() });
+            h.settle(SETTLE);
+        };
+        let ask = |h: &mut Headless, method: &str, params: serde_json::Value| {
+            let r = h.request(method, params.clone(), t);
+            assert_eq!(r["ok"], true, "{method} {params}: {r}");
+            h.settle(SETTLE);
+        };
+        // typing replaces the selected name
+        open(&mut h, "travel");
+        ask(&mut h, "ui.text", json!({"text": "trips"}));
+        ask(&mut h, "ui.key", json!({"key": "Enter"}));
+        assert!(keywords(&h).contains(&"trips".to_string()) && !keywords(&h).contains(&"travel".to_string()), "{:?}", keywords(&h));
+        assert_eq!(h.app.ui.dialog, None);
+        // the menu's Paste
+        open(&mut h, "trips");
+        h.view.clipboard = "weddings".into();
+        ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordName", "button": "right"}));
+        ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordName:paste"}));
+        ask(&mut h, "ui.key", json!({"key": "Enter"}));
+        assert!(keywords(&h).contains(&"weddings".to_string()), "{:?}", keywords(&h));
+        // Esc cancels
+        open(&mut h, "weddings");
+        ask(&mut h, "ui.text", json!({"text": "parties"}));
+        ask(&mut h, "ui.key", json!({"key": "Escape"}));
+        assert_eq!(h.app.ui.dialog, None, "Esc closed the dialog");
+        assert!(keywords(&h).contains(&"weddings".to_string()), "renamed nothing: {:?}", keywords(&h));
+    }
+
+    /// Return confirms the one-field dialogs: New Album, Rename Album, New Smart Album, Merge
+    /// Keywords and a text prompt (here: renaming an album). Their name opens selected, so typing
+    /// replaces it. Return did nothing: the field took the focus back on every frame, so egui never
+    /// reported the focus Return gives up.
+    #[test]
+    fn return_confirms_the_one_field_dialogs() {
+        use crate::state::Dialog;
+        let mut h = demo([1200.0, 800.0]);
+        let t = Duration::from_secs(10);
+        let first = h.app.session.visible_cloned()[0].0;
+        h.request("engine.execute", json!({"command": "photo.setMeta", "params": {"ids": [first], "addKeywords": ["holiday"]}}), t);
+        let album = |h: &Headless, name: &str| h.app.session.catalog.albums().find(|a| a.name == name).map(|a| a.id.0);
+        let garden = album(&h, "Garden").expect("the demo's Garden album");
+        let confirm = |h: &mut Headless, dialog: Dialog, typed: &str| {
+            h.app.ui.dialog = Some(dialog);
+            h.settle(SETTLE);
+            for (method, params) in [("ui.text", json!({"text": typed})), ("ui.key", json!({"key": "Enter"}))] {
+                let r = h.request(method, params, t);
+                assert_eq!(r["ok"], true, "{r}");
+                h.settle(SETTLE);
+            }
+            assert_eq!(h.app.ui.dialog, None, "Return confirmed the dialog ({typed})");
+        };
+        confirm(&mut h, Dialog::NewAlbum { name: String::new(), folder: false, parent: None }, "Weddings");
+        assert!(album(&h, "Weddings").is_some(), "New Album");
+        confirm(&mut h, Dialog::RenameAlbum { id: garden, name: "Garden".into() }, "Flowers");
+        assert_eq!(album(&h, "Flowers"), Some(garden), "Rename Album");
+        confirm(&mut h, Dialog::NewSmartAlbum { name: "Smart Album".into(), parent: None }, "Everything");
+        assert!(album(&h, "Everything").is_some(), "New Smart Album");
+        confirm(&mut h, Dialog::MergeKeywords { from: vec!["holiday".into()], into: String::new() }, "travel");
+        let keywords = h.app.session.catalog.photo(lightcraft_catalog::PhotoId(first)).unwrap().meta.keywords.clone();
+        assert!(keywords.contains(&"travel".to_string()) && !keywords.contains(&"holiday".to_string()), "Merge Keywords: {keywords:?}");
+        let prompt = Dialog::TextPrompt {
+            title: "Rename Album".into(),
+            hint: "Name".into(),
+            value: "Flowers".into(),
+            command: "album.rename".into(),
+            params: json!({"id": garden}),
+            key: "name".into(),
+        };
+        confirm(&mut h, prompt, "Botanical");
+        assert_eq!(album(&h, "Botanical"), Some(garden), "the text prompt");
+    }
+
     /// The sidebar's file-system checks run on worker threads and add rows when they land, which
     /// moves every row below them: `busy()` counts them, so `settle` waits for them before a test
     /// reads widget positions (a click aimed at a stale rect hits the neighbouring row).
@@ -1622,6 +1927,49 @@ mod tests {
         assert!(w["result"].to_string().contains("field:copyrightStatus"), "{w}");
     }
 
+    /// Info panel fields are shared text fields. The caption takes several lines: Return starts a
+    /// new one and only leaving the field saves it. Esc gives up an edit (the title stays as it
+    /// was, nothing saved), and right-click ▸ Paste works there too.
+    #[test]
+    fn info_fields_take_lines_esc_and_the_menu() {
+        let mut h = demo([1300.0, 1000.0]);
+        let t = Duration::from_secs(10);
+        h.request("ui.set", json!({"view": "detail", "right": "info"}), t);
+        h.settle(SETTLE);
+        let meta = |h: &Headless| h.app.session.catalog.photo(h.app.session.active().unwrap()).unwrap().meta.clone();
+        let ask = |h: &mut Headless, method: &str, params: serde_json::Value| {
+            let r = h.request(method, params.clone(), t);
+            assert_eq!(r["ok"], true, "{method} {params}: {r}");
+            h.step();
+            h.step();
+        };
+        let (title, undo) = (meta(&h).title, h.app.session.undo.len());
+        // the caption: two lines, saved on leaving
+        ask(&mut h, "ui.clickWidget", json!({"id": "field:caption"}));
+        ask(&mut h, "ui.key", json!({"key": "A", "cmd": true}));
+        ask(&mut h, "ui.text", json!({"text": "Harbour at dusk"}));
+        ask(&mut h, "ui.key", json!({"key": "Enter"}));
+        ask(&mut h, "ui.text", json!({"text": "Lisbon, 2026"}));
+        assert_eq!(h.app.session.undo.len(), undo, "Return in the caption saves nothing yet");
+        ask(&mut h, "ui.key", json!({"key": "Tab"}));
+        assert_eq!(meta(&h).caption, "Harbour at dusk\nLisbon, 2026");
+        // the title: Esc gives the edit up
+        let undo = h.app.session.undo.len();
+        ask(&mut h, "ui.clickWidget", json!({"id": "field:title"}));
+        ask(&mut h, "ui.text", json!({"text": " (draft)"}));
+        ask(&mut h, "ui.key", json!({"key": "Escape"}));
+        h.settle(SETTLE);
+        assert_eq!((meta(&h).title, h.app.session.undo.len()), (title, undo), "Esc saved nothing");
+        // the menu
+        h.view.clipboard = "Wedding in Sintra".into();
+        ask(&mut h, "ui.clickWidget", json!({"id": "field:title"}));
+        ask(&mut h, "ui.key", json!({"key": "A", "cmd": true}));
+        ask(&mut h, "ui.clickWidget", json!({"id": "field:title", "button": "right"}));
+        ask(&mut h, "ui.clickWidget", json!({"id": "field:title:paste"}));
+        ask(&mut h, "ui.key", json!({"key": "Enter"}));
+        assert_eq!(meta(&h).title, "Wedding in Sintra");
+    }
+
     /// Local: a folder's photos show without joining the library; the breadcrumb, Include
     /// subfolders and Add to My Photos work from the grid header.
     #[test]
@@ -1663,6 +2011,15 @@ mod tests {
         assert_eq!(h.request("ui.clickWidget", json!({"id": "button:addToLibrary"}), t)["ok"], true);
         h.settle(SETTLE);
         assert_eq!(h.app.session.catalog.photos().filter(|p| !p.local).count(), library_before + 2);
+        // Truncated ancestors remain clickable and still open the original, unabridged path.
+        let inner = dir.join("inner");
+        h.request("engine.execute", json!({"command": "library.browse", "params": {"path": inner.to_string_lossy()}}), t);
+        h.settle(SETTLE);
+        let parent_index = dir.to_string_lossy().split(['/', '\\']).filter(|p| !p.is_empty()).count() - 1;
+        assert_eq!(h.request("ui.clickWidget", json!({"id": format!("crumb:{parent_index}")}), t)["ok"], true);
+        h.settle(SETTLE);
+        // the same folder, whatever the platform's separators (issue #538)
+        assert_eq!(std::path::Path::new(&h.app.session.browse.as_ref().unwrap().path), dir.as_path());
         let _ = std::fs::remove_dir_all(&dir);
     }
 
@@ -1864,6 +2221,28 @@ mod tests {
         assert_eq!(h.app.session.undo.len(), undo0 + 1);
     }
 
+    /// A slider's typed value is a shared text field: right-click ▸ Paste replaces the value
+    /// (selected when the field opens) and Return applies it; the menu doesn't close the field.
+    #[test]
+    fn a_slider_value_pastes_from_its_menu() {
+        let mut h = demo([1300.0, 900.0]);
+        let t = Duration::from_secs(10);
+        h.request("ui.set", json!({"view": "detail", "right": "edit"}), t);
+        h.settle(SETTLE);
+        h.view.clipboard = "0.75".into();
+        for (id, button) in
+            [("sliderValue:light.exposure", "left"), ("sliderField:light.exposure", "right"), ("sliderField:light.exposure:paste", "left")]
+        {
+            let r = h.request("ui.clickWidget", json!({"id": id, "button": button}), t);
+            assert_eq!(r["ok"], true, "{id}: {r}");
+            h.settle(SETTLE);
+        }
+        h.request("ui.key", json!({"key": "Enter"}), t);
+        h.settle(SETTLE);
+        let exposure = h.app.session.develop_of(h.app.session.active().unwrap()).unwrap().light.exposure;
+        assert!((exposure - 0.75).abs() < 1e-9, "{exposure}");
+    }
+
     /// The eye on a section header switches the section off and on again, one undo step each
     /// (issue #316).
     #[test]
@@ -2586,6 +2965,8 @@ mod tests {
         if let Some(crate::state::Dialog::Import { opts }) = &mut h.app.ui.dialog {
             opts.rename = "Trip-_x".into();
         }
+        // Paint the edited template before locating the Tags button in the resized dialog.
+        assert!(h.settle(SETTLE), "Copy dialog layout should settle before locating Tags");
         // the cursor sits after "Trip-"
         let id = egui::Id::new("import-rename");
         let mut st = egui::text_edit::TextEditState::default();
@@ -2633,6 +3014,97 @@ mod tests {
         assert_eq!(h.app.ui.dialog, Some(crate::state::Dialog::About), "switching tabs keeps the dialog open");
     }
 
+    /// Settings ▸ Display / `app.displayProfile`: previews are shown through the monitor profile
+    /// (the loupe rendered for the display, thumbnails converted from sRGB, the histogram still
+    /// sRGB); a file that can't be used is an error, or, as the setting, reported with previews
+    /// left sRGB.
+    #[test]
+    fn display_profile_converts_previews() {
+        use crate::render::Slot;
+        let dir = std::env::temp_dir().join(format!("lightcraft-display-ui-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let p3 = dir.join("p3.icc");
+        std::fs::write(&p3, lightcraft_codecs::icc::write_named(lightcraft_codecs::NamedSpace::DisplayP3)).unwrap();
+        let bad = dir.join("bad.icc");
+        std::fs::write(&bad, b"not a profile").unwrap();
+        let (p3, bad) = (p3.to_string_lossy().to_string(), bad.to_string_lossy().to_string());
+
+        let mut h = demo([1000.0, 700.0]);
+        let t = Duration::from_secs(10);
+        h.request("ui.set", json!({"view": "detail"}), t);
+        let thumb_slot =
+            |h: &Headless| h.app.renderer.textures.keys().copied().filter(|s| matches!(s, Slot::Thumb(_))).min_by_key(|s| format!("{s:?}"));
+        let ready = |h: &Headless| {
+            h.app.renderer.textures.get(&Slot::Main).is_some_and(|t| t.pixels.is_some())
+                && thumb_slot(h).is_some()
+                && !h.app.renderer.is_pending(Slot::Main)
+        };
+        assert!(h.step_until(SETTLE, ready));
+        h.settle(SETTLE);
+        let rgba = |c: &egui::ColorImage| lightcraft_raster::Rgba8 {
+            width: c.size[0],
+            height: c.size[1],
+            data: c.pixels.iter().map(|p| p.to_array()).collect(),
+        };
+        let tex = |h: &Headless, s: Slot| rgba(h.app.renderer.textures.get(&s).and_then(|t| t.pixels.clone()).as_deref().unwrap());
+        let thumb = thumb_slot(&h).unwrap();
+        let (main0, thumb0) = (tex(&h, Slot::Main), tex(&h, thumb));
+        let hist0 = h.app.renderer.textures[&Slot::Main].histogram.clone().unwrap();
+
+        // the command loads it (and keeps it as the setting); textures are made again
+        let r = h.request("engine.execute", json!({"command": "app.displayProfile", "params": {"path": p3}}), t);
+        assert_eq!(r["ok"], true, "{r}");
+        assert_eq!(r["result"]["kind"], "matrix");
+        assert_eq!(h.app.ui.settings.display_profile, p3);
+        let d = h.app.renderer.display().cloned().unwrap();
+        assert!(h.step_until(SETTLE, |h| ready(h) && h.app.renderer.textures.contains_key(&thumb)));
+        h.settle(SETTLE);
+        let (main1, thumb1) = (tex(&h, Slot::Main), tex(&h, thumb));
+        let mut want = thumb0.clone();
+        d.profile.from_srgb(&mut want).unwrap();
+        let max_diff = |a: &lightcraft_raster::Rgba8, b: &lightcraft_raster::Rgba8| {
+            a.data.iter().zip(&b.data).flat_map(|(p, q)| (0..3).map(move |k| (p[k] as i32 - q[k] as i32).abs())).max().unwrap_or(0)
+        };
+        assert_eq!((thumb1.width, thumb1.height), (thumb0.width, thumb0.height));
+        assert!(max_diff(&thumb1, &want) <= 1, "thumbnails are converted from sRGB: {}", max_diff(&thumb1, &want));
+        assert_ne!(thumb1, thumb0);
+        // the loupe: rendered for the display; colours sRGB holds look as they did
+        assert_eq!((main1.width, main1.height), (main0.width, main0.height));
+        assert_ne!(main1, main0);
+        let mut main_want = main0.clone();
+        d.profile.from_srgb(&mut main_want).unwrap();
+        let mean = main1.data.iter().zip(&main_want.data).map(|(p, q)| (0..3).map(|k| (p[k] as f64 - q[k] as f64).abs()).sum::<f64>()).sum::<f64>()
+            / (3 * main1.data.len()) as f64;
+        assert!(mean < 1.5, "{mean}");
+        let hist1 = h.app.renderer.textures[&Slot::Main].histogram.clone().unwrap();
+        assert_eq!(hist1.total, hist0.total, "the histogram stays sRGB");
+
+        // a bad file: an error, nothing changes
+        let r = h.request("engine.execute", json!({"command": "app.displayProfile", "params": {"path": bad}}), t);
+        assert_eq!(r["ok"], false, "{r}");
+        assert_eq!(h.app.renderer.display_id(), Some(d.id()));
+        assert_eq!(h.app.ui.settings.display_profile, p3);
+        // …chosen as the setting (Settings ▸ Display), it is reported and previews go back to sRGB
+        h.app.ui.settings.display_profile = bad.clone();
+        h.step();
+        assert!(h.app.display_error.as_deref().is_some_and(|e| e.contains("not a valid ICC profile")), "{:?}", h.app.display_error);
+        assert_eq!(h.app.renderer.display_id(), None);
+        // the Display tab shows it
+        let r = h.request("engine.execute", json!({"command": "app.settings", "params": {"tab": "display"}}), t);
+        assert_eq!(r["ok"], true, "{r}");
+        h.step();
+        h.step();
+        // none: sRGB again
+        let r = h.request("engine.execute", json!({"command": "app.displayProfile", "params": {"path": null}}), t);
+        assert_eq!(r["ok"], true, "{r}");
+        assert!(r["result"]["path"].is_null());
+        assert!(h.app.ui.settings.display_profile.is_empty() && h.app.display_error.is_none());
+        assert!(h.step_until(SETTLE, |h| ready(h) && h.app.renderer.textures.contains_key(&thumb)));
+        h.settle(SETTLE);
+        assert_eq!(tex(&h, thumb), thumb0, "back to the sRGB thumbnail");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// Settings (⌘,): tabs switch, app settings change the UI state, library settings go through
     /// the engine; the delete confirmation guards ⌫.
     #[test]
@@ -2642,7 +3114,7 @@ mod tests {
         let r = h.request("ui.key", json!({"key": ",", "cmd": true}), t);
         assert_eq!(r["ok"], true, "{r}");
         assert_eq!(h.app.ui.dialog, Some(crate::state::Dialog::Settings { tab: "general".into() }));
-        for tab in ["import", "performance", "interface", "general"] {
+        for tab in ["import", "performance", "display", "interface", "general"] {
             let r = h.request("ui.clickWidget", json!({"id": format!("button:settingsTab-{tab}")}), t);
             assert_eq!(r["ok"], true, "{tab}: {r}");
             assert_eq!(h.app.ui.dialog, Some(crate::state::Dialog::Settings { tab: tab.into() }));
diff --git a/crates/ui-egui/src/i18n.rs b/crates/ui-egui/src/i18n.rs
index 15992604..109accfa 100644
--- a/crates/ui-egui/src/i18n.rs
+++ b/crates/ui-egui/src/i18n.rs
@@ -3,8 +3,8 @@
 //! A language is one entry in [`language_table!`] below: its BCP-47 code, the endonym shown in the
 //! Language menus, the ISO 15924 script its text needs (which picks the CJK font fallback), and its
 //! message catalog (`locales/<code>.json`, embedded at build time). Adding a language is that entry
-//! plus its catalogs — every menu and settings surface is built from the table, so nothing else in
-//! the UI changes.
+//! plus its catalogs and the corresponding language command in `menus.rs`. Settings read the
+//! locale table, while menus and the control channel share the command mapping.
 
 use std::{cell::RefCell, collections::BTreeMap, sync::OnceLock};
 
@@ -124,6 +124,8 @@ language_table! {
     Es, "es", "Español", "Latn", include_str!("../locales/es.json");
     De, "de", "Deutsch", "Latn", include_str!("../locales/de.json");
     Ru, "ru", "Русский", "Cyrl", include_str!("../locales/ru.json");
+    Fr, "fr", "Français", "Latn", include_str!("../locales/fr.json");
+    Uk, "uk", "Українська", "Cyrl", include_str!("../locales/uk.json");
 }
 
 // The settings file stores the BCP-47 code (`"zh-hans"`), never the Rust variant name, so a
@@ -164,6 +166,16 @@ pub fn tr(source: &str) -> &str {
     tr_in(language(), source)
 }
 
+/// [`tr`] for a message whose translation depends on where it appears: a catalog entry keyed
+/// `"<context>|<source>"` wins, else the plain message. A language adds the contextual entry only
+/// where its shared translation reads wrongly there (Japanese はい / いいえ as a rule's value).
+fn tr_ctx_in<'a>(language: Locale, context: &str, source: &'a str) -> &'a str {
+    match language.catalog().get(&format!("{context}|{source}")) {
+        Some(translation) => translation.as_str(),
+        None => tr_in(language, source),
+    }
+}
+
 /// Catalog values are `'static` (they live in the embedded file), so a translation can be handed
 /// out for as long as the `'static` key it was looked up by.
 fn tr_in(language: Locale, source: &str) -> &str {
@@ -308,7 +320,7 @@ pub fn color_label(catalog: &lightcraft_catalog::Catalog, label: lightcraft_cata
 /// A legacy smart-album filter summary, using the same display labels as filter chips.
 pub fn filter_label(filter: &lightcraft_catalog::Filter, catalog: &lightcraft_catalog::Catalog) -> String {
     if language() == Locale::En {
-        filter.describe()
+        filter.describe_with(catalog)
     } else {
         lightcraft_engine::filter_chips(filter, catalog)
             .iter()
@@ -318,9 +330,62 @@ pub fn filter_label(filter: &lightcraft_catalog::Filter, catalog: &lightcraft_ca
     }
 }
 
+/// What people read for a smart-album rule's problem, under its row: the field's name and the
+/// issue, in the current language ("Title: needs something to look for").
+pub fn problem_text(problem: &lightcraft_catalog::rules::Problem) -> String {
+    problem_text_in(language(), problem)
+}
+
+/// [`problem_text`] with the rule's position first ("#2.1 Rating: …"), for lists away from the
+/// editor (the sidebar's tooltip).
+pub fn problem_line(problem: &lightcraft_catalog::rules::Problem) -> String {
+    problem_line_in(language(), problem)
+}
+
+fn problem_text_in(language: Locale, problem: &lightcraft_catalog::rules::Problem) -> String {
+    let issue = tr_in(language, problem.issue.text());
+    // Japanese and Chinese catalogs join a label and its text with a full-width colon
+    let colon = if matches!(language.script(), "Jpan" | "Hans" | "Hant") { "：" } else { ": " };
+    match problem.field.as_deref() {
+        Some(field) => format!("{}{colon}{issue}", tr_in(language, lightcraft_catalog::rules::field_label(field).unwrap_or(field))),
+        None => issue.to_string(),
+    }
+}
+
+fn problem_line_in(language: Locale, problem: &lightcraft_catalog::rules::Problem) -> String {
+    let at: Vec<String> = problem.path.iter().map(|i| i.saturating_add(1).to_string()).collect();
+    // a problem with the album filter around the rules has no rule to point at
+    if at.is_empty() {
+        return problem_text_in(language, problem);
+    }
+    format!("#{} {}", at.join("."), problem_text_in(language, problem))
+}
+
+/// What people read for smart-album choice `id` of `field` ("Gemeinfrei" for `publicDomain` in
+/// German); an id the field doesn't know, as written.
+pub fn choice_text<'a>(field: &str, id: &'a str) -> &'a str {
+    choice_text_in(language(), field, id)
+}
+
+fn choice_text_in<'a>(language: Locale, field: &str, id: &'a str) -> &'a str {
+    lightcraft_catalog::rules::choice_label(field, id).map_or(id, |label| tr_in(language, label))
+}
+
+/// What people read for a smart-album yes/no value ("Ja" / "Nein" in German).
+pub fn bool_text(b: bool) -> &'static str {
+    bool_text_in(language(), b)
+}
+
+/// The context of a smart-album yes/no value ([`tr_ctx_in`]).
+const BOOL_CONTEXT: &str = "smart album value";
+
+fn bool_text_in(language: Locale, b: bool) -> &'static str {
+    tr_ctx_in(language, BOOL_CONTEXT, lightcraft_catalog::rules::bool_label(b))
+}
+
 /// A rule summary for display, keeping free-text rule values verbatim.
-pub fn rules_label(rules: &lightcraft_catalog::RuleSet) -> String {
-    fn describe(rules: &lightcraft_catalog::RuleSet, depth: usize) -> String {
+pub fn rules_label(rules: &lightcraft_catalog::RuleSet, catalog: &lightcraft_catalog::Catalog) -> String {
+    fn describe(rules: &lightcraft_catalog::RuleSet, catalog: &lightcraft_catalog::Catalog, depth: usize) -> String {
         use lightcraft_catalog::{
             Match, Rule,
             rules::{FIELDS, Kind, ops_for},
@@ -332,14 +397,15 @@ pub fn rules_label(rules: &lightcraft_catalog::RuleSet) -> String {
             .rules
             .iter()
             .map(|rule| match rule {
-                Rule::Group { group } => format!("({})", describe(group, depth + 1)),
+                Rule::Group { group } => format!("({})", describe(group, catalog, depth + 1)),
                 Rule::Field { field, op, value } => {
                     let Some((_, label, kind)) = FIELDS.iter().find(|entry| entry.0 == field) else { return field.clone() };
                     let operator = ops_for(*kind).iter().find(|entry| entry.0 == op).map_or(op.as_str(), |entry| entry.1);
                     let text = match kind {
-                        Kind::Choice(_) | Kind::Bool => {
-                            tr(value.as_str().unwrap_or(if value.as_bool() == Some(true) { "true" } else { "false" })).to_string()
-                        }
+                        // the album's name, as people know it (a user's name is never translated)
+                        Kind::Album => lightcraft_catalog::rules::album_name(value, Some(catalog)),
+                        Kind::Choice(_) => value.as_str().map_or_else(|| value.to_string(), |id| choice_text(field, id).to_string()),
+                        Kind::Bool => lightcraft_catalog::rules::bool_value(value).map_or_else(|| value.to_string(), |b| bool_text(b).to_string()),
                         _ if matches!(op.as_str(), "inLast" | "notInLast") => format!(
                             "{} {}",
                             value.get("n").unwrap_or(&serde_json::Value::Null),
@@ -359,7 +425,7 @@ pub fn rules_label(rules: &lightcraft_catalog::RuleSet) -> String {
         if rules.mode == Match::None { format!("{} ({text})", tr("none of")) } else { text }
     }
     // Preserve the established source-language summary.
-    if language() == Locale::En { rules.describe() } else { describe(rules, 0) }
+    if language() == Locale::En { rules.describe_with(catalog) } else { describe(rules, catalog, 0) }
 }
 
 #[cfg(test)]
@@ -444,6 +510,9 @@ mod tests {
         assert_eq!(Locale::parse_tag("pt-BR"), Some(Locale::PtBr));
         assert_eq!(Locale::parse_tag("pt_BR.UTF-8"), Some(Locale::PtBr));
         assert_eq!(Locale::parse_tag("pt"), Some(Locale::PtBr));
+        assert_eq!(Locale::parse_tag("fr"), Some(Locale::Fr));
+        assert_eq!(Locale::parse_tag("fr-FR"), Some(Locale::Fr));
+        assert_eq!(Locale::parse_tag("fr_FR.UTF-8"), Some(Locale::Fr));
         for tag in ["de", "de-DE", "de_AT.UTF-8", "de-CH"] {
             assert_eq!(Locale::parse_tag(tag), Some(Locale::De), "{tag}");
         }
@@ -488,6 +557,9 @@ mod tests {
         set_language(Locale::Ja);
         assert_eq!(tr_format!("Imported {} photo{}", 12, "s"), "12枚を読み込みました");
         assert_eq!(tr_format!("Exported {ok} of {total} photo{}", "s", ok = 4, total = 12), "12枚中4枚を書き出しました");
+        set_language(Locale::Fr);
+        assert_eq!(tr_format!("Imported {} photo{}", 12, "s"), "12 photos importée(s)");
+        assert_eq!(tr_format!("Imported {} photo{}", 1, ""), "1 photo importée(s)");
         // Format specs survive translation: precision, sign, and values a language reorders.
         for language in Locale::ALL {
             set_language(*language);
@@ -590,9 +662,11 @@ mod tests {
             ("app.language.simplifiedChinese", Locale::ZhHans),
             ("app.language.japanese", Locale::Ja),
             ("app.language.portuguese", Locale::PtBr),
+            ("app.language.french", Locale::Fr),
             ("app.language.spanish", Locale::Es),
             ("app.language.german", Locale::De),
             ("app.language.russian", Locale::Ru),
+            ("app.language.ukrainian", Locale::Uk),
         ];
         // One command per language, and every command reachable from the menu table.
         assert_eq!(commands.len(), Locale::ALL.len());
@@ -627,6 +701,226 @@ mod tests {
         }
     }
 
+    /// Smart-album choice values read as words in every language (English "Public Domain", German
+    /// "Gemeinfrei"), never as rule ids like `publicDomain`; an id the field doesn't know shows as
+    /// written. Unlike other labels these must be translated: an untranslated one would be English
+    /// in the middle of a translated rule.
+    #[test]
+    fn choice_values_read_as_words_in_every_language() {
+        use lightcraft_catalog::rules::{FIELDS, Kind};
+        assert_eq!(choice_text_in(Locale::En, "copyrightStatus", "publicDomain"), "Public Domain");
+        assert_eq!(choice_text_in(Locale::De, "copyrightStatus", "publicDomain"), "Gemeinfrei");
+        assert_eq!(choice_text_in(Locale::De, "copyrightStatus", "someday"), "someday");
+        assert_eq!(choice_text_in(Locale::ZhHans, "treatment", "color"), "彩色", "in colour, not the colour noun");
+        assert_eq!(choice_text_in(Locale::Ru, "treatment", "color"), "Цветное");
+        assert_eq!(choice_text_in(Locale::Es, "label", "none"), "Sin etiqueta");
+        // yes/no fields read Yes / No, never true / false
+        assert_eq!((bool_text_in(Locale::En, true), bool_text_in(Locale::En, false)), ("Yes", "No"));
+        assert_eq!(bool_text_in(Locale::De, false), "Nein");
+        // Japanese answers はい / いいえ don't read as a rule's value: its own wording, あり / なし,
+        // through a context, while the shared Yes / No keep their meaning everywhere else
+        assert_eq!((bool_text_in(Locale::Ja, true), bool_text_in(Locale::Ja, false)), ("あり", "なし"));
+        assert_eq!((Locale::Ja.tr("Yes"), Locale::Ja.tr("No")), ("はい", "いいえ"));
+        assert_eq!(tr_ctx_in(Locale::Ja, "nope", "Yes"), "はい", "no contextual entry: the plain message");
+        assert_eq!(tr_ctx_in(Locale::En, BOOL_CONTEXT, "Yes"), "Yes");
+        // and the yes/no fields are named by plain nouns, so "編集 … なし" doesn't read "edits: yes … none"
+        for (field, label, kind) in FIELDS {
+            if *kind != Kind::Bool {
+                continue;
+            }
+            let ja = Locale::Ja.catalog().get(*label).unwrap_or_else(|| panic!("ja lacks the {field} label {label:?}"));
+            assert!(!ja.contains("あり") && !ja.contains("なし"), "{field}: {ja}");
+        }
+        // a contextual entry names a real value (a typo would silently fall back to はい / いいえ)
+        let values = [lightcraft_catalog::rules::bool_label(true), lightcraft_catalog::rules::bool_label(false)];
+        for language in Locale::ALL {
+            for key in language.catalog().keys() {
+                if let Some(value) = key.strip_prefix(BOOL_CONTEXT).and_then(|k| k.strip_prefix('|')) {
+                    assert!(values.contains(&value), "{}: {key:?} isn't a yes/no value", language.code());
+                }
+            }
+        }
+        for language in Locale::ALL.iter().filter(|language| **language != Locale::En) {
+            for label in [lightcraft_catalog::rules::bool_label(true), lightcraft_catalog::rules::bool_label(false)] {
+                assert!(language.catalog().contains_key(label), "{} lacks {label:?}", language.code());
+            }
+        }
+        for language in Locale::ALL {
+            for (field, _, kind) in FIELDS {
+                let Kind::Choice(choices) = kind else { continue };
+                for (id, label) in *choices {
+                    let text = choice_text_in(*language, field, id);
+                    assert_ne!(text, *id, "{}: {field} {id}", language.code());
+                    if *language != Locale::En {
+                        assert!(language.catalog().contains_key(*label), "{} lacks {label:?}", language.code());
+                    }
+                }
+            }
+        }
+    }
+
+    /// A rule's problem reads as the field's name and the issue, in the editor's language ("Titel:
+    /// braucht einen Suchbegriff …"); the sidebar's list puts the rule's position first. Every issue
+    /// is translated in every language: an English one would stand out in a translated editor.
+    #[test]
+    fn problems_read_in_every_language() {
+        use lightcraft_catalog::rules::Issue;
+        let cat = lightcraft_catalog::Catalog::new();
+        let problems = |rules: serde_json::Value| {
+            serde_json::from_value::<lightcraft_catalog::RuleSet>(serde_json::json!({"rules": rules})).unwrap().check(&cat)
+        };
+        let p = problems(serde_json::json!([{"field": "rating", "op": "gte", "value": 3}, {"field": "title", "op": "contains", "value": ""}]));
+        assert_eq!(problem_text_in(Locale::En, &p[0]), "Title: needs something to look for (or use “is empty”)");
+        assert_eq!(problem_text_in(Locale::De, &p[0]), "Titel: braucht einen Suchbegriff (oder „ist leer“)");
+        assert_eq!(problem_line_in(Locale::En, &p[0]), "#2 Title: needs something to look for (or use “is empty”)");
+        // Japanese and Chinese join with a full-width colon, as their catalogs do
+        assert_eq!(problem_text_in(Locale::Ja, &p[0]), "タイトル：検索する語句が必要です（または「が空」を使用）");
+        // a problem with the album filter itself has no rule position to show
+        let filter_loop =
+            lightcraft_catalog::rules::Problem { path: Vec::new(), field: Some("album".into()), issue: Issue::AlbumLoop, message: String::new() };
+        assert!(problem_line_in(Locale::En, &filter_loop).starts_with("Album: "), "{}", problem_line_in(Locale::En, &filter_loop));
+        let g = problems(serde_json::json!([{"group": {"rules": []}}]));
+        assert_eq!(problem_text_in(Locale::En, &g[0]), "This group is empty: add a rule or remove it.");
+        // the issues, the operators their hints name and the album picker's words, in every language
+        for language in Locale::ALL.iter().filter(|l| **l != Locale::En) {
+            // the field menu: every field and every group, so it never mixes languages
+            for label in lightcraft_catalog::rules::FIELDS.iter().map(|f| f.1).chain(lightcraft_catalog::rules::FIELD_GROUPS.iter().map(|g| g.0)) {
+                assert!(language.catalog().contains_key(label), "{} lacks the rule label {label:?}", language.code());
+            }
+            for word in [
+                "Choose an album…",
+                "No albums yet",
+                "Search albums",
+                "No albums match",
+                "This is the album you're editing",
+                "It tests this album, so testing it back would loop",
+                "Fix the marked rules to save this album.",
+            ] {
+                assert!(language.catalog().contains_key(word), "{} lacks {word:?}", language.code());
+            }
+            for issue in Issue::ALL {
+                assert!(language.catalog().contains_key(issue.text()), "{} lacks {:?}", language.code(), issue.text());
+            }
+            for (_, _, kind) in lightcraft_catalog::rules::FIELDS {
+                for (_, op) in lightcraft_catalog::rules::ops_for(*kind) {
+                    assert!(language.catalog().contains_key(*op), "{} lacks the operator {op:?}", language.code());
+                }
+            }
+        }
+    }
+
+    /// The date picker's own words (its tooltip, the weekday headers) are in every language, as the
+    /// month and day labels it borrows from the date headings are.
+    #[test]
+    fn date_picker_words_are_translated() {
+        for language in Locale::ALL.iter().filter(|l| **l != Locale::En) {
+            for word in crate::date_picker::WEEKDAY_SHORT.iter().chain(&["Pick a date", "Year", "Month", "Day"]) {
+                assert!(language.catalog().contains_key(*word), "{} lacks {word:?}", language.code());
+            }
+        }
+    }
+
+    /// Ukrainian's coverage of every catalog message and display label. Gaps are reported, not failed
+    /// (like `catalogs_agree_on_placeholders_and_report_gaps`): a feature PR that adds a label doesn't
+    /// have to ship its Ukrainian text, which shows in English until the translation catches up.
+    #[test]
+    fn ukrainian_coverage_of_catalogs_commands_controls_and_rules_is_reported() {
+        let catalog = Locale::Uk.catalog();
+        let keys: std::collections::BTreeSet<&String> = Locale::ALL.iter().flat_map(|language| language.catalog().keys()).collect();
+        let lacking: Vec<_> = keys.into_iter().filter(|key| !catalog.contains_key(key.as_str())).collect();
+        if !lacking.is_empty() {
+            eprintln!("uk lacks {} catalog message(s) (shown in English): {lacking:?}", lacking.len());
+        }
+        let mut labels: Vec<&str> = lightcraft_engine::command_specs().iter().map(|spec| spec.label).collect();
+        labels.extend(crate::menus::ui_commands().map(|command| command.1).filter(|label| !Locale::ALL.iter().any(|locale| locale.name() == *label)));
+        labels.extend(lightcraft_develop::CONTROLS.iter().map(|control| control.label));
+        labels.extend(crate::panels::settings::TABS.iter().map(|(_, label)| *label));
+        for (_, label, kind) in lightcraft_catalog::rules::FIELDS {
+            labels.push(label);
+            labels.extend(lightcraft_catalog::rules::ops_for(*kind).iter().map(|(_, label)| *label));
+        }
+        labels.extend(lightcraft_engine::rename::TOKENS.iter().map(|token| token.meaning));
+        labels.extend(lightcraft_engine::rename::TEMPLATE_NOTES);
+        let missing: Vec<_> = labels.into_iter().filter(|label| !catalog.contains_key(*label)).collect();
+        if !missing.is_empty() {
+            eprintln!("uk lacks {} display label(s) (shown in English): {missing:?}", missing.len());
+        }
+    }
+
+    #[test]
+    fn ukrainian_switches_persists_formats_dates_and_preserves_values() {
+        use crate::control::{ControlRequest, Outcome};
+        let mut app = crate::LightcraftApp::new(lightcraft_engine::Session::with_demo(), Default::default());
+        app.run("app.language.ukrainian", serde_json::json!({})).unwrap();
+        assert_eq!(app.ui.language, Locale::Uk);
+        assert_eq!(crate::menubar::checked(&app, "app.language.ukrainian"), Some(true));
+        assert_eq!(tr("Light"), "Світло");
+        assert_eq!(tr("Landscape"), "Пейзаж");
+        assert_eq!(tr("Home"), "Домашня тека");
+        assert_eq!(date_group_label("2026-09-20", false), "Неділя, 20.09.2026");
+        assert_eq!(date_group_label("2026-09", false), "09.2026");
+        assert_eq!(display_time("2026-09-20T16:04:05"), "Неділя, 20.09.2026 16:04:05");
+        // Count-neutral labels work for every Ukrainian integer category, with no English suffix.
+        for n in [0, 1, 2, 5, 11, 21, 22, 25, 111] {
+            assert_eq!(tr_format!("Imported {} photo{}", n, if n == 1 { "" } else { "s" }), format!("Імпортовано фото: {n}"));
+            assert_eq!(tr_format!("{} files and {f} folder{}", n, "s", f = n), format!("Файлів: {n}, тек: {n}"));
+            let noun = tr(if n == 1 { "cached picture" } else { "cached pictures" });
+            assert_eq!(tr_format!("{n} {noun}", n = n, noun = noun), format!("Кешовані зображення: {n}"));
+        }
+        // This trailing argument is queue progress, not an English plural suffix.
+        let queued = tr_format!(" · {queued} waiting", queued = 5);
+        assert_eq!(
+            tr_format!("Denoising {name}: {done} of {total} tiles{}", queued, name = "IMG.CR3", done = 1, total = 4),
+            "Усунення шуму IMG.CR3: ділянки — 1 із 4 · очікують: 5"
+        );
+        let name = "Color {title} 日本語";
+        assert_eq!(tr_format!("Added {n} photo{} to “{}”", "s", name, n = 22), format!("До «{name}» додано фото: 22"));
+        assert_eq!(builtin_label("Warm Glow", false), "Warm Glow");
+        assert_eq!(builtin_label("Warm Glow", true), "Тепле сяйво");
+        assert_eq!(tr("photo-{title}.jpg"), "photo-{title}.jpg");
+        assert_eq!(tr("develop.set"), "develop.set");
+        let saved = serde_json::to_string(&app.ui).unwrap();
+        assert!(saved.contains(r#""language":"uk""#));
+        assert_eq!(serde_json::from_str::<crate::state::UiState>(&saved).unwrap().language, Locale::Uk);
+        let ctx = egui::Context::default();
+        for code in ["uk", "uk-UA", "uk_UA.UTF-8", "uk-Cyrl-UA"] {
+            assert_eq!(Locale::parse_tag(code), Some(Locale::Uk));
+            let (request, _) = ControlRequest::new("ui.set", serde_json::json!({"language": code}));
+            let Outcome::Done(reply) = crate::control::handle(&mut app, &ctx, &request) else { panic!("expected reply") };
+            assert_eq!(reply["ok"], true);
+            assert_eq!(language(), Locale::Uk);
+        }
+        set_language(Locale::En);
+    }
+
+    #[test]
+    fn ukrainian_panels_dialogs_and_letters_paint_with_bundled_fonts() {
+        let ctx = fonts_ctx(&[]);
+        let mut app = crate::LightcraftApp::new(lightcraft_engine::Session::with_demo(), Default::default());
+        app.ui.left_panel = true;
+        let text = painted_text(&ctx, &mut app, Locale::Uk);
+        assert!(text.contains("Мої фото") && text.contains("Усі фото"), "{text}");
+        for (command, title) in [("app.about", "Про LightCraft"), ("app.shortcuts", "Клавіатурні скорочення"), ("app.settings", "Налаштування")]
+        {
+            app.ui.dialog = None;
+            app.run(command, serde_json::json!({})).unwrap();
+            let text = painted_text(&ctx, &mut app, Locale::Uk);
+            assert!(text.contains(title), "{command}: {text}");
+        }
+        ctx.fonts_mut(|fonts| {
+            for family in [egui::FontFamily::Proportional, egui::FontFamily::Name(crate::theme::FONT_SEMIBOLD.into())] {
+                let font = egui::FontId::new(13.0, family);
+                for ch in "ҐґЄєІіЇї’«»"
+                    .chars()
+                    .chain(Locale::Uk.catalog().values().flat_map(|text| text.chars()).filter(|ch| ('\u{0400}'..='\u{04ff}').contains(ch)))
+                {
+                    assert!(fonts.has_glyph(&font, ch), "missing Ukrainian glyph {ch}");
+                }
+            }
+        });
+        set_language(Locale::En);
+    }
+
     /// Every command, control, rule and rename label, and every line of What's New, is a message a
     /// catalog can translate. What a language lacks is reported, not failed (like
     /// `catalogs_agree_on_placeholders_and_report_gaps`): a feature PR doesn't have to ship every
@@ -640,6 +934,7 @@ mod tests {
             labels.push(label);
             labels.extend(lightcraft_catalog::rules::ops_for(*kind).iter().map(|(_, label)| *label));
         }
+        labels.extend(lightcraft_catalog::rules::FIELD_GROUPS.iter().map(|group| group.0));
         labels.extend(lightcraft_engine::rename::TOKENS.iter().map(|token| token.meaning));
         labels.extend(lightcraft_engine::rename::TEMPLATE_NOTES);
         let ui_labels = labels.len();
@@ -703,7 +998,32 @@ mod tests {
             mode: lightcraft_catalog::Match::All,
             rules: vec![lightcraft_catalog::Rule::Field { field: "keywords".into(), op: "contains".into(), value: serde_json::json!("Color") }],
         };
-        assert_eq!(rules_label(&rules), "Stichwörter enthält Color");
+        let mut catalog = lightcraft_catalog::Catalog::new();
+        catalog
+            .apply(lightcraft_catalog::Op::AddAlbum { album: lightcraft_catalog::Album::new(lightcraft_catalog::AlbumId(4), "Ausgeschlossen") })
+            .unwrap();
+        assert_eq!(rules_label(&rules, &catalog), "Stichwörter enthält Color");
+        let album = lightcraft_catalog::RuleSet {
+            mode: lightcraft_catalog::Match::All,
+            rules: vec![lightcraft_catalog::Rule::Field { field: "album".into(), op: "isNot".into(), value: serde_json::json!(4) }],
+        };
+        assert!(rules_label(&album, &catalog).ends_with(" “Ausgeschlossen”"), "{}", rules_label(&album, &catalog));
+        let rules = lightcraft_catalog::RuleSet {
+            mode: lightcraft_catalog::Match::All,
+            rules: vec![lightcraft_catalog::Rule::Field {
+                field: "copyrightStatus".into(),
+                op: "is".into(),
+                value: serde_json::json!("publicDomain"),
+            }],
+        };
+        assert!(rules_label(&rules, &catalog).ends_with(" Gemeinfrei"), "{}", rules_label(&rules, &catalog));
+        for value in [serde_json::json!(false), serde_json::json!("false")] {
+            let rules = lightcraft_catalog::RuleSet {
+                mode: lightcraft_catalog::Match::All,
+                rules: vec![lightcraft_catalog::Rule::Field { field: "edited".into(), op: "is".into(), value }],
+            };
+            assert!(rules_label(&rules, &catalog).ends_with(" Nein"), "{}", rules_label(&rules, &catalog));
+        }
         let filter = lightcraft_catalog::Filter {
             labels: vec![lightcraft_catalog::ColorLabel::Red, lightcraft_catalog::ColorLabel::Blue],
             ..Default::default()
@@ -742,7 +1062,7 @@ mod tests {
     }
 
     #[test]
-    fn german_buttons_fit_the_bottom_bar_and_export_dialog() {
+    fn german_and_ukrainian_buttons_fit_the_bottom_bar_and_export_dialog() {
         fn collect(shape: &egui::epaint::Shape, bounds: &mut Vec<(String, egui::Rect)>) {
             match shape {
                 egui::epaint::Shape::Text(shape) => {
@@ -752,38 +1072,40 @@ mod tests {
                 _ => {}
             }
         }
-        let ctx = fonts_ctx(&[]);
-        let services = crate::Services { pick_folder: Some(Box::new(|| None)), ..Default::default() };
-        let mut app = crate::LightcraftApp::new(lightcraft_engine::Session::with_demo(), services);
-        app.ui.language = Locale::De;
-        let mut bounds = Vec::new();
-        for export in [false, true] {
-            if export {
-                app.run("dialog.export", serde_json::json!({})).unwrap();
-            }
-            for frame in 0..4 {
-                let input = crate::headless::HeadlessView::raw_input(egui::vec2(1600.0, 1000.0), 1.0, frame as f64 / 60.0, vec![]);
-                let mut out = ctx.run_ui(input, |ui| {
-                    app.logic(ui.ctx());
-                    app.ui(ui);
-                });
-                out.textures_delta.clear();
-                bounds.clear();
-                for shape in out.shapes {
-                    collect(&shape.shape, &mut bounds);
+        for language in [Locale::De, Locale::Uk] {
+            let ctx = fonts_ctx(&[]);
+            let services = crate::Services { pick_folder: Some(Box::new(|| None)), ..Default::default() };
+            let mut app = crate::LightcraftApp::new(lightcraft_engine::Session::with_demo(), services);
+            app.ui.language = language;
+            let mut bounds = Vec::new();
+            for export in [false, true] {
+                if export {
+                    app.run("dialog.export", serde_json::json!({})).unwrap();
                 }
-            }
-            let rect = |id: &str| app.widgets.iter().find(|entry| entry.0 == id).unwrap().1;
-            if export {
-                let dialog = rect("dialog:window");
-                for id in ["button:exportNamingTags", "button:exportChooseFolder", "button:exportSavePreset"] {
-                    assert!(dialog.contains_rect(rect(id)), "{id} spills outside {dialog:?}: {:?}", rect(id));
+                for frame in 0..4 {
+                    let input = crate::headless::HeadlessView::raw_input(egui::vec2(1600.0, 1000.0), 1.0, frame as f64 / 60.0, vec![]);
+                    let mut out = ctx.run_ui(input, |ui| {
+                        app.logic(ui.ctx());
+                        app.ui(ui);
+                    });
+                    out.textures_delta.clear();
+                    bounds.clear();
+                    for shape in out.shapes {
+                        collect(&shape.shape, &mut bounds);
+                    }
+                }
+                let rect = |id: &str| app.widgets.iter().find(|entry| entry.0 == id).unwrap().1;
+                if export {
+                    let dialog = rect("dialog:window");
+                    for id in ["button:exportNamingTags", "button:exportChooseFolder", "button:exportSavePreset"] {
+                        assert!(dialog.contains_rect(rect(id)), "{id} spills outside {dialog:?}: {:?}", rect(id));
+                    }
+                } else {
+                    let button = rect("button:copySettings");
+                    let (_, text) = bounds.iter().find(|entry| entry.0 == language.tr("Copy Edit Settings")).unwrap();
+                    assert!(button.contains_rect(*text), "{language:?} copy caption overflows its button: {text:?} vs {button:?}");
+                    assert!(!button.intersects(rect("icon:copyGear")));
                 }
-            } else {
-                let button = rect("button:copySettings");
-                let (_, text) = bounds.iter().find(|entry| entry.0 == "Bearbeitungseinstellungen kopieren").unwrap();
-                assert!(button.contains_rect(*text), "German copy caption overflows its button: {text:?} vs {button:?}");
-                assert!(!button.intersects(rect("icon:copyGear")));
             }
         }
         set_language(Locale::En);
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs
index acbbba02..9a471889 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/icons.rs
@@ -55,6 +55,7 @@ pub enum Icon {
     Pencil,
     Photos,
     Clock,
+    Calendar,
     Trash,
     Curve,
     ProfileGrid,
@@ -67,6 +68,8 @@ pub enum Icon {
     Subject,
     Picker,
     Rotate,
+    /// A curved line with an arrow at both ends: drag to rotate, either way (the crop tool's pointer).
+    RotateDrag,
     Flip,
     Invert,
     Dots,
@@ -359,6 +362,14 @@ pub fn paint(p: &Painter, rect: Rect, icon: Icon, color: Color32) {
             pen.circle(10.0, 10.0, 7.0);
             pen.line(&[(10.0, 5.5), (10.0, 10.0), (13.5, 11.5)]);
         }
+        Calendar => {
+            // a page with a binding bar, two rings and a marked day
+            pen.rect(3.0, 4.5, 17.0, 17.0, 1.5);
+            pen.line(&[(3.0, 8.5), (17.0, 8.5)]);
+            pen.line(&[(7.0, 2.5), (7.0, 6.0)]);
+            pen.line(&[(13.0, 2.5), (13.0, 6.0)]);
+            pen.rect(11.0, 11.5, 14.0, 14.5, 0.5);
+        }
         Trash => {
             pen.line(&[(3.0, 5.5), (17.0, 5.5)]);
             pen.line(&[(8.0, 5.5), (8.0, 3.0), (12.0, 3.0), (12.0, 5.5)]);
@@ -428,6 +439,12 @@ pub fn paint(p: &Painter, rect: Rect, icon: Icon, color: Color32) {
             pen.arc(10.0, 10.0, 6.5, 200.0, 470.0);
             pen.line(&[(3.0, 5.5), (4.0, 9.0), (7.5, 8.0)]);
         }
+        RotateDrag => {
+            // the upper arc of a circle, an arrowhead at each end pointing along it
+            pen.arc(10.0, 14.0, 7.5, 200.0, 340.0);
+            pen.line(&[(0.8, 9.6), (3.0, 11.9), (6.1, 11.0)]);
+            pen.line(&[(19.2, 9.6), (17.0, 11.9), (13.9, 11.0)]);
+        }
         Flip => {
             pen.line(&[(10.0, 2.5), (10.0, 17.5)]);
             pen.closed(&[(8.0, 5.0), (8.0, 15.0), (3.0, 15.0)]);
diff --git a/crates/ui-egui/src/import.rs b/crates/ui-egui/src/import.rs
index 49e3a266..4b1e4077 100644
--- a/crates/ui-egui/src/import.rs
+++ b/crates/ui-egui/src/import.rs
@@ -393,6 +393,12 @@ pub struct ScanTask {
     sources: Vec<String>,
 }
 
+/// An import and a Synchronize Folder never run at once: each readies its files against the
+/// library as it was when it started, so both could add the same file.
+pub(crate) fn busy_synchronizing(app: &LightcraftApp) -> Result<(), String> {
+    if app.sync_run.is_some() { Err(crate::i18n::tr("A folder is being synchronized").to_string()) } else { Ok(()) }
+}
+
 /// Scan `paths` in the background, then open the review dialog (see [`poll_scan`]).
 pub fn open(app: &mut LightcraftApp, paths: Vec<String>) -> Result<Value, String> {
     if app.scan.is_some() {
@@ -565,6 +571,7 @@ impl ScanTask {
 
 /// Start importing the dialog's checked files (the dialog's OK / `ui.dialog.confirm`).
 pub fn start(app: &mut LightcraftApp, d: &ImportDialog) -> Result<Value, String> {
+    busy_synchronizing(app)?;
     let queue = d.selected_paths();
     if queue.is_empty() {
         return Err("no photos selected".into());
@@ -616,6 +623,7 @@ pub fn start(app: &mut LightcraftApp, d: &ImportDialog) -> Result<Value, String>
 
 /// Start importing `paths` (files or folders) in the background, e.g. dropped on the window.
 pub fn start_paths(app: &mut LightcraftApp, paths: Vec<String>) -> Result<Value, String> {
+    busy_synchronizing(app)?;
     if app.import.is_some() || app.scan.as_ref().is_some_and(|t| !t.browse) {
         return Err("an import is running".into());
     }
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 7684f00d..50587c86 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -6,8 +6,10 @@
 #![forbid(unsafe_code)]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+pub mod album_picker;
 pub mod control;
 pub mod credits;
+pub mod date_picker;
 pub mod export_task;
 pub mod headless;
 pub mod i18n;
@@ -27,20 +29,36 @@ pub mod render;
 pub mod shortcuts;
 pub mod softpaint;
 pub mod state;
+pub mod sync;
 pub mod tasks;
+pub mod text_field;
 pub mod theme;
 pub mod titlebar;
 pub mod widgets;
 
+#[cfg(test)]
+mod tests_album_picker;
+#[cfg(test)]
+mod tests_crop_rotate;
 #[cfg(test)]
 mod tests_curve;
 #[cfg(test)]
+mod tests_date_picker;
+#[cfg(test)]
 mod tests_filmstrip;
 #[cfg(test)]
 mod tests_grid;
 #[cfg(test)]
 mod tests_keymap;
 #[cfg(test)]
+mod tests_keyword_files;
+#[cfg(test)]
+mod tests_keyword_list;
+#[cfg(test)]
+mod tests_keyword_set;
+#[cfg(test)]
+mod tests_keywording;
+#[cfg(test)]
 mod tests_labels;
 #[cfg(test)]
 mod tests_library_problem;
@@ -63,11 +81,15 @@ mod tests_scroll;
 #[cfg(test)]
 mod tests_switch_library;
 #[cfg(test)]
+mod tests_sync;
+#[cfg(test)]
 mod tests_titlebar;
 #[cfg(test)]
 mod tests_unsaved;
 #[cfg(test)]
 mod tests_zoom;
+#[cfg(test)]
+mod tests_zoom_keys;
 
 use std::sync::mpsc::{Receiver, Sender};
 
@@ -115,8 +137,14 @@ pub struct Services {
     pub pick_preset_files: Option<PickFiles>,
     /// Open dialog for a GPS track log (`.gpx`; Photo ▸ Auto-Tag from Tracklog…).
     pub pick_tracklog: Option<PickFiles>,
+    /// Open dialog for a monitor ICC profile (`.icc` / `.icm`; Settings ▸ Display; desktop only).
+    pub pick_display_profile: Option<PickFiles>,
     /// Save dialog for an exported `.lcpreset` file.
     pub save_preset_file: Option<SaveFile>,
+    /// Open dialog for a keyword list file (`.txt`, Photo Supreme's `.utf8`; File ▸ Import Keywords…).
+    pub pick_keyword_list: Option<PickFiles>,
+    /// Save dialog for an exported keyword list (File ▸ Export Keywords…).
+    pub save_keyword_list: Option<SaveFile>,
     /// Open dialog for point-curve preset files (`.lccurve`).
     pub pick_curve_preset_files: Option<PickFiles>,
     /// Save dialog for an exported `.lccurve` file.
@@ -196,6 +224,8 @@ pub struct LightcraftApp {
     shadow: Option<headless::HeadlessView>,
     /// Synthetic input events (from the control channel) injected one step per frame.
     pub synthetic: Vec<egui::Event>,
+    /// The text the UI last put on the clipboard (`ui.inspect` → `copied`).
+    pub copied: Option<String>,
     /// Native file dialogs up for commands (`pick`): each command runs again when its closes.
     pub(crate) pending_picks: Vec<pick::Pending>,
     /// Modifiers announced for synthetic input (held from a button down to its release).
@@ -206,6 +236,8 @@ pub struct LightcraftApp {
     /// The language the installed fonts were built for: the CJK fallback order follows the UI
     /// language's script, so switching language reinstalls them.
     font_language: i18n::Locale,
+    /// Browser font loaded separately from WASM so the module stays below its host's size limit.
+    chinese_font: Option<std::sync::Arc<egui::FontData>>,
     fonts_ready: bool,
     last_time: f64,
     /// Rect of the photo canvas and the displayed image (screen points) from the last frame.
@@ -238,6 +270,12 @@ pub struct LightcraftApp {
     pub import: Option<import::ImportTask>,
     /// A folder scan in progress (feeds the import review).
     pub scan: Option<import::ScanTask>,
+    /// A Synchronize Folder scan in progress (feeds its dialog).
+    pub sync: Option<sync::SyncTask>,
+    /// `session.folder_changes` came from the Synchronize Folder dialog (and goes with it).
+    pub sync_owns_changes: bool,
+    /// A Synchronize Folder at work in the background.
+    pub sync_run: Option<sync::SyncRun>,
     /// A Lightroom catalog inspect/import in progress.
     pub lightroom: Option<lightroom_import::LightroomTask>,
     /// Last terminal Lightroom result, exposed by the command's status/wait response.
@@ -257,6 +295,10 @@ pub struct LightcraftApp {
     gpu_applied: Option<bool>,
     /// The memory budget setting last applied (MB, 0 = automatic).
     memory_applied: Option<u32>,
+    /// The display profile setting last applied (`app.displayProfile`).
+    pub(crate) display_applied: Option<String>,
+    /// Why the display profile setting could not be applied (shown in Settings ▸ Display).
+    pub display_error: Option<String>,
     /// The library failed to open at launch: the blocking window, then the temporary-session
     /// banner (issue #100). Cleared once a library opens.
     pub library_problem: Option<panels::library_problem::LibraryProblem>,
@@ -286,11 +328,13 @@ impl LightcraftApp {
             screenshot_token: 0,
             shadow: None,
             synthetic: vec![],
+            copied: None,
             pending_picks: vec![],
             synthetic_mods: egui::Modifiers::NONE,
             synthetic_mods_release: false,
             styled: false,
             font_language: i18n::Locale::En,
+            chinese_font: None,
             fonts_ready: false,
             last_time: 0.0,
             canvas_rect: None,
@@ -308,6 +352,9 @@ impl LightcraftApp {
             merge: merge::MergeState::default(),
             import: None,
             scan: None,
+            sync: None,
+            sync_owns_changes: false,
+            sync_run: None,
             lightroom: None,
             lightroom_last: None,
             export: None,
@@ -317,11 +364,21 @@ impl LightcraftApp {
             window_is_fullscreen: false,
             gpu_applied: None,
             memory_applied: None,
+            display_applied: None,
+            display_error: None,
             library_problem: None,
             model_setup: Default::default(),
         }
     }
 
+    /// Supply the browser's separately downloaded Simplified Chinese font before the first frame.
+    pub fn with_chinese_font(mut self, bytes: Vec<u8>) -> Self {
+        if !bytes.is_empty() {
+            self.chinese_font = Some(std::sync::Arc::new(egui::FontData::from_owned(bytes)));
+        }
+        self
+    }
+
     pub fn with_control(mut self, rx: Receiver<ControlRequest>) -> Self {
         self.control_rx = Some(rx);
         // keep CPU copies of photo textures so `ui.screenshot {"headless": true}` can draw them
@@ -338,6 +395,11 @@ impl LightcraftApp {
             return r;
         }
         let r = self.session.execute(id, &params).map_err(|e| e.to_string());
+        if r.is_ok() && id == "mask.adjust" {
+            // Judge local adjustments on the photo, without the selection overlay obscuring them.
+            // Keep it hidden after release; O / the overlay eye can show it again.
+            self.ui.mask_overlay = false;
+        }
         if r.is_ok() && id == "photo.label" {
             let label = params.get("label").and_then(Value::as_str).and_then(lightcraft_catalog::ColorLabel::parse);
             let text = match label {
@@ -674,6 +736,23 @@ impl LightcraftApp {
         }
     }
 
+    /// The process is about to end (settings and library are saved by then): make sure nothing is
+    /// inside the GPU driver when it does (issue #620: a render running on a worker thread while
+    /// the process exits crashes in the driver). No GPU work starts from here on; the render
+    /// workers get up to `timeout` to finish their jobs, and what is left of it goes to GPU work
+    /// on other threads (export, denoise, the device warm-up). `false`: the deadline passed first
+    /// (the host exits anyway). The app renders nothing afterwards.
+    pub fn shutdown(&mut self, timeout: std::time::Duration) -> bool {
+        lightcraft_engine::gpu::begin_shutdown();
+        #[cfg(not(target_arch = "wasm32"))]
+        let t0 = std::time::Instant::now();
+        let stopped = self.renderer.shutdown(timeout);
+        #[cfg(not(target_arch = "wasm32"))]
+        let timeout = timeout.saturating_sub(t0.elapsed());
+        let idle = lightcraft_engine::gpu::wait_idle(timeout);
+        stopped && idle
+    }
+
     /// Per-frame logic before layout (control channel, renders, shortcuts, drops).
     pub fn logic(&mut self, ctx: &egui::Context) {
         i18n::set_language(self.ui.language);
@@ -685,7 +764,7 @@ impl LightcraftApp {
 
     fn logic_inner(&mut self, ctx: &egui::Context) {
         if !self.styled {
-            theme::install_fonts(ctx);
+            theme::install_fonts_with_chinese(ctx, self.chinese_font.as_ref());
             theme::apply(ctx);
             // File → Add from Device lists cards scanned in the background: show hot-plugs
             let repaint = ctx.clone();
@@ -699,7 +778,7 @@ impl LightcraftApp {
         } else if self.font_language != self.ui.language {
             // Shared Han characters take the active language's forms (Japanese faces for 日本語,
             // the Simplified Chinese face for 简体中文): rebuild the fallback order.
-            theme::install_fonts(ctx);
+            theme::install_fonts_with_chinese(ctx, self.chinese_font.as_ref());
             self.font_language = self.ui.language;
         } else {
             self.fonts_ready = true;
@@ -723,6 +802,8 @@ impl LightcraftApp {
         self.renderer.poll(ctx, &mut self.session);
         merge::poll(self, ctx);
         import::poll_scan(self, ctx);
+        sync::poll(self, ctx);
+        sync::poll_run(self, ctx);
         import::tick(self, ctx);
         lightroom_import::tick(self, ctx);
         tasks::poll(self, ctx);
@@ -747,7 +828,12 @@ impl LightcraftApp {
         if let Some(folder) = self.session.import_defaults.auto_folder.clone() {
             const LABEL: &str = "Auto Import";
             let now = ctx.input(|i| i.time);
-            if now - self.ui.auto_import_at >= 3.0 && self.import.is_none() && self.lightroom.is_none() && !self.tasks.is_running(LABEL) {
+            if now - self.ui.auto_import_at >= 3.0
+                && self.import.is_none()
+                && self.sync_run.is_none()
+                && self.lightroom.is_none()
+                && !self.tasks.is_running(LABEL)
+            {
                 self.ui.auto_import_at = now;
                 let work = move || lightcraft_engine::cmd::library::list_auto_import_folder(&folder);
                 let done = |app: &mut LightcraftApp, _ctx: &egui::Context, listing: Result<Vec<(String, u64)>, String>| {
@@ -826,6 +912,24 @@ impl LightcraftApp {
             let _ = self.session.execute("app.memoryBudget", &serde_json::json!({"mb": mb}));
         }
         self.memory_applied = Some(mb);
+        // the monitor profile (Settings ▸ Display): previews follow it from the next frame
+        if self.display_applied.as_ref() != Some(&self.ui.settings.display_profile) {
+            let path = self.ui.settings.display_profile.clone();
+            match lightcraft_engine::display::Display::load_opt(&path) {
+                Ok(d) => {
+                    self.renderer.set_display(d);
+                    self.display_error = None;
+                }
+                Err(msg) => {
+                    // a profile that can't be used: previews are sRGB, the setting is kept
+                    self.renderer.set_display(None);
+                    log::warn!("display profile: {msg}");
+                    self.toast_error(ctx, format!("{}: {msg}", crate::i18n::tr("Display profile not used")));
+                    self.display_error = Some(msg);
+                }
+            }
+            self.display_applied = Some(path);
+        }
         if let Some(fs) = ctx.input(|i| i.viewport().fullscreen) {
             self.window_is_fullscreen = fs;
         }
@@ -871,7 +975,14 @@ impl LightcraftApp {
     }
 
     /// Frame timings once layout is done (`t0`: when layout started).
-    fn end_frame(&mut self, t0: f64) {
+    fn end_frame(&mut self, ctx: &egui::Context, t0: f64) {
+        ctx.output(|o| {
+            for c in &o.commands {
+                if let egui::OutputCommand::CopyText(text) = c {
+                    self.copied = Some(text.clone());
+                }
+            }
+        });
         self.perf.frame_ms = now_ms() - t0;
         self.perf.update_ms = self.perf.logic_ms + self.perf.frame_ms;
         self.perf.max_update_ms = self.perf.max_update_ms.max(self.perf.update_ms);
@@ -901,7 +1012,7 @@ impl LightcraftApp {
             panels::library_problem::show(self, &ctx);
             panels::toast(self, &ctx);
             self.widgets = widgets::take_registry(&ctx);
-            self.end_frame(t0);
+            self.end_frame(&ctx, t0);
             return;
         }
         // Order matters: earlier panels take the full edge (top bar spans the window; the tool strip,
@@ -939,15 +1050,17 @@ impl LightcraftApp {
         panels::dialogs::show(self, &ctx);
         panels::library_problem::show(self, &ctx);
         import::progress(self, &ctx);
+        sync::progress_window(self, &ctx);
         import::scan_progress(self, &ctx);
         lightroom_import::progress(self, &ctx);
         export_task::poll(self, &ctx);
         pick::poll(self, &ctx);
         panels::grid::drag_feedback(self, &ctx);
         panels::left::album_drag_feedback(self, &ctx);
+        panels::keyword_list::drag_feedback(self, &ctx);
         panels::toast(self, &ctx);
         self.widgets = widgets::take_registry(&ctx);
-        self.end_frame(t0);
+        self.end_frame(&ctx, t0);
     }
 }
 
@@ -1053,6 +1166,13 @@ mod drop_tests {
 #[derive(Default)]
 pub struct Caches {
     keyword_tree: Option<(u64, std::sync::Arc<Vec<lightcraft_catalog::KeywordNode>>)>,
+    /// The Keywording box's read-only names (with containing keywords, or Will Export), by library
+    /// revision, selection and view.
+    keyword_names: Option<(u64, u64, std::sync::Arc<Vec<panels::keywording::Chip>>)>,
+    /// The Keywording box's chips, by library revision and selection.
+    keyword_chips: Option<(u64, u64, std::sync::Arc<Vec<panels::keywording::Chip>>)>,
+    /// The Keyword List's tick boxes, by library revision and selection.
+    keyword_ticks: Option<(u64, u64, std::sync::Arc<panels::keyword_list::Ticks>)>,
     folder_tree: Option<(u64, std::sync::Arc<Vec<lightcraft_catalog::FolderNode>>)>,
     people: Option<(u64, lightcraft_catalog::Filter, std::sync::Arc<Vec<lightcraft_catalog::Person>>)>,
     suggestions: Option<(u64, std::sync::Arc<Vec<String>>)>,
@@ -1062,6 +1182,12 @@ pub struct Caches {
     album_counts: Option<(u64, std::sync::Arc<std::collections::HashMap<lightcraft_catalog::AlbumId, usize>>)>,
     /// How often the album counts were recomputed (tests check that unchanged frames don't).
     pub album_count_scans: usize,
+    /// What the open smart-album rule dialog shows besides the rules ([`Caches::rules_view`]).
+    rules_view: Option<(u64, std::sync::Arc<RulesView>)>,
+    pub rules_view_scans: usize,
+    /// The problems of every saved smart album that has some ([`Caches::smart_album_problems`]).
+    smart_problems: Option<(u64, std::sync::Arc<std::collections::HashMap<lightcraft_catalog::AlbumId, Vec<lightcraft_catalog::rules::Problem>>>)>,
+    pub smart_problem_scans: usize,
     /// AI denoise: what the pump last saw, the model list and the downloads being watched.
     pub denoise: panels::denoise::Ui,
     /// Bumped when a face model is installed, removed or chosen, so Settings re-reads the list at once.
@@ -1111,6 +1237,14 @@ pub struct FilterValues {
     pub keywords: Vec<String>,
 }
 
+/// What the smart-album rule dialog shows besides the rules themselves: their problems (each row
+/// marks its own), how many photos they match and the albums an Album rule picks from.
+pub struct RulesView {
+    pub problems: Vec<lightcraft_catalog::rules::Problem>,
+    pub count: usize,
+    pub albums: Vec<album_picker::AlbumEntry>,
+}
+
 pub(crate) fn key_of(parts: impl std::hash::Hash) -> u64 {
     use std::hash::{BuildHasher, BuildHasherDefault, DefaultHasher};
     BuildHasherDefault::<DefaultHasher>::default().hash_one(parts)
@@ -1139,6 +1273,60 @@ impl Caches {
             }
         }
     }
+    /// The Keywording box's read-only names for the selection: what exported files carry
+    /// (`export`), or the keywords with those containing them.
+    pub(crate) fn keyword_names(
+        &mut self,
+        cat: &lightcraft_catalog::Catalog,
+        selection: &[lightcraft_catalog::PhotoId],
+        export: bool,
+    ) -> std::sync::Arc<Vec<panels::keywording::Chip>> {
+        let key = key_of((selection, export));
+        match &self.keyword_names {
+            Some((r, k, c)) if *r == cat.revision && *k == key => c.clone(),
+            _ => {
+                let c = std::sync::Arc::new(if export {
+                    panels::keywording::will_export(cat, selection)
+                } else {
+                    panels::keywording::with_containing(cat, selection)
+                });
+                self.keyword_names = Some((cat.revision, key, c.clone()));
+                c
+            }
+        }
+    }
+    /// The selection's keywords (the Keywording box's chips).
+    pub(crate) fn keyword_chips(
+        &mut self,
+        cat: &lightcraft_catalog::Catalog,
+        selection: &[lightcraft_catalog::PhotoId],
+    ) -> std::sync::Arc<Vec<panels::keywording::Chip>> {
+        let key = key_of(selection);
+        match &self.keyword_chips {
+            Some((r, k, c)) if *r == cat.revision && *k == key => c.clone(),
+            _ => {
+                let c = std::sync::Arc::new(panels::keywording::chips(cat, selection));
+                self.keyword_chips = Some((cat.revision, key, c.clone()));
+                c
+            }
+        }
+    }
+    /// How many selected photos have each keyword (the Keyword List's tick boxes).
+    pub(crate) fn keyword_ticks(
+        &mut self,
+        cat: &lightcraft_catalog::Catalog,
+        selection: &[lightcraft_catalog::PhotoId],
+    ) -> std::sync::Arc<panels::keyword_list::Ticks> {
+        let key = key_of(selection);
+        match &self.keyword_ticks {
+            Some((r, k, t)) if *r == cat.revision && *k == key => t.clone(),
+            _ => {
+                let t = std::sync::Arc::new(panels::keyword_list::Ticks::of(cat, selection));
+                self.keyword_ticks = Some((cat.revision, key, t.clone()));
+                t
+            }
+        }
+    }
     /// The people named on faces among the photos the filter lets through (its own `person` aside),
     /// with photo counts.
     pub fn people(
@@ -1238,6 +1426,56 @@ impl Caches {
     /// all bump its revision) and — only while some smart album has an "in the last…" rule —
     /// when `now` (the session clock, ISO) enters a new minute, so such counts follow the clock
     /// within a minute without rescanning every frame.
+    /// [`RulesView`] for `rules` edited in smart album `editing` (`None`: a new album), within
+    /// `folder` when it was made from a folder view: worked out again only when the catalog, the
+    /// rules, the language or (for "in the last…" rules) the minute changes, not every frame.
+    pub fn rules_view(
+        &mut self,
+        cat: &lightcraft_catalog::Catalog,
+        rules: &lightcraft_catalog::RuleSet,
+        editing: Option<u64>,
+        folder: Option<String>,
+        now: &str,
+    ) -> std::sync::Arc<RulesView> {
+        let relative = rules.depends_on_now();
+        let minute = if relative { now.get(..16).unwrap_or(now) } else { "" };
+        let k = key_of((cat.revision, serde_json::to_string(rules).unwrap_or_default(), editing, &folder, minute, i18n::language().code()));
+        if let Some((key, v)) = &self.rules_view
+            && *key == k
+        {
+            return v.clone();
+        }
+        if relative {
+            lightcraft_catalog::rules::set_now(Some(now.to_string()));
+        }
+        let problems = rules.check_for(cat, editing.map(lightcraft_catalog::AlbumId));
+        let filter = lightcraft_catalog::Filter { rule_set: Some(rules.clone()), library_folder: folder, ..Default::default() };
+        let count = if problems.is_empty() { cat.query(&filter, &Default::default()).len() } else { 0 };
+        let v = std::sync::Arc::new(RulesView { problems, count, albums: panels::dialogs::album_entries(cat, editing) });
+        self.rules_view_scans += 1;
+        self.rules_view = Some((k, v.clone()));
+        v
+    }
+
+    /// The problems of every saved smart album that has some (`Catalog::smart_album_problems`),
+    /// for the sidebar's ⚠ marks: worked out again only when the catalog changes.
+    pub fn smart_album_problems(
+        &mut self,
+        cat: &lightcraft_catalog::Catalog,
+    ) -> std::sync::Arc<std::collections::HashMap<lightcraft_catalog::AlbumId, Vec<lightcraft_catalog::rules::Problem>>> {
+        if let Some((rev, v)) = &self.smart_problems
+            && *rev == cat.revision
+        {
+            return v.clone();
+        }
+        let v: std::sync::Arc<std::collections::HashMap<_, _>> = std::sync::Arc::new(
+            cat.albums().filter(|a| a.is_smart()).map(|a| (a.id, cat.smart_album_problems(a.id))).filter(|(_, p)| !p.is_empty()).collect(),
+        );
+        self.smart_problem_scans += 1;
+        self.smart_problems = Some((cat.revision, v.clone()));
+        v
+    }
+
     pub fn album_counts(
         &mut self,
         cat: &lightcraft_catalog::Catalog,
@@ -1313,6 +1551,42 @@ mod cache_tests {
         lightcraft_catalog::rules::set_now(None);
     }
 
+    /// The rule dialog's problems, live count and album list are worked out once per change to the
+    /// catalog or the rules, not every frame; so are the sidebar's smart-album problems.
+    #[test]
+    fn rule_dialog_and_problems_are_cached_until_something_changes() {
+        let mut cat = Catalog::default();
+        let mut c = super::Caches::default();
+        for i in 0..3u64 {
+            cat.apply(photo(i + 1, "2026-09-30T11:00:00", if i == 0 { 5 } else { 1 })).unwrap();
+        }
+        let rules =
+            |v: u64| -> RuleSet { serde_json::from_value(serde_json::json!({"rules": [{"field": "rating", "op": "gte", "value": v}]})).unwrap() };
+        let now = "2026-09-30T12:00:00";
+        let view = c.rules_view(&cat, &rules(3), None, None, now);
+        assert_eq!((view.count, view.problems.len()), (1, 0));
+        for _ in 0..10 {
+            c.rules_view(&cat, &rules(3), None, None, now);
+        }
+        assert_eq!(c.rules_view_scans, 1, "unchanged frames reuse it");
+        assert_eq!(c.rules_view(&cat, &rules(1), None, None, now).count, 3, "a rule change");
+        assert_eq!(c.rules_view(&cat, &rules(9), None, None, now).problems.len(), 1);
+        cat.apply(Op::SetRating { id: PhotoId(2), rating: 4 }).unwrap();
+        assert_eq!(c.rules_view(&cat, &rules(3), None, None, now).count, 2, "a catalog change");
+        assert_eq!(c.rules_view_scans, 4);
+        // the sidebar's problems
+        cat.apply(Op::AddAlbum { album: lightcraft_catalog::Album::new(AlbumId(20), "Trip") }).unwrap();
+        cat.apply(smart(21, serde_json::json!({"rules": [{"field": "album", "op": "is", "value": 20}]}))).unwrap();
+        assert!(c.smart_album_problems(&cat).get(&AlbumId(21)).is_none_or(Vec::is_empty));
+        for _ in 0..10 {
+            c.smart_album_problems(&cat);
+        }
+        assert_eq!(c.smart_problem_scans, 1);
+        cat.apply(Op::RemoveAlbum { id: AlbumId(20) }).unwrap();
+        assert!(c.smart_album_problems(&cat).get(&AlbumId(21)).is_some_and(|p| !p.is_empty()), "its album is gone");
+        assert_eq!(c.smart_problem_scans, 2);
+    }
+
     /// Without "in the last…" rules the clock never causes a rescan.
     #[test]
     fn absolute_rules_ignore_the_clock() {
diff --git a/crates/ui-egui/src/menubar.rs b/crates/ui-egui/src/menubar.rs
index 7d964856..b919aa2e 100644
--- a/crates/ui-egui/src/menubar.rs
+++ b/crates/ui-egui/src/menubar.rs
@@ -77,6 +77,8 @@ const LAYOUT: &[(&str, &[&str])] = &[
             "---",
             "file.importPresets",
             "file.exportPresets",
+            "file.importKeywords",
+            "file.exportKeywords",
             "---",
             "dialog.export",
             "app.exportPrevious",
@@ -144,6 +146,7 @@ const LAYOUT: &[(&str, &[&str])] = &[
             "view.zoom100",
             "---",
             "view.clipping",
+            "view.visualizeHdr",
             "view.softProof",
             "view.maskOverlay",
             "view.maskOverlayMode",
@@ -184,6 +187,7 @@ const LAYOUT: &[(&str, &[&str])] = &[
             "develop.auto",
             "develop.treatment",
             "develop.reset",
+            "develop.updateProcess",
             "dialog.createPreset",
             "---",
             "photo.saveMetadataToFile",
@@ -305,6 +309,7 @@ pub fn checked(app: &LightcraftApp, id: &str) -> Option<bool> {
         "view.filmstrip" => Some(u.filmstrip),
         "view.histogram" => Some(u.histogram),
         "view.clipping" => Some(u.show_clipping),
+        "view.visualizeHdr" => Some(u.hdr_visualize),
         "view.softProof" => Some(u.soft_proof),
         "view.maskOverlay" => Some(u.mask_overlay),
         "view.maskPins" => Some(u.mask_pins),
diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
index 5b79548b..2c63a3d3 100644
--- a/crates/ui-egui/src/menus.rs
+++ b/crates/ui-egui/src/menus.rs
@@ -12,16 +12,18 @@ use crate::state::{BeforeAfter, Dialog, RightPanel, ViewMode, Zoom};
 pub type UiCommand = (&'static str, &'static str, Option<&'static str>, &'static str);
 
 /// The "Edit → Language" entries, one per language in [`crate::i18n::Locale::ALL`], so a language
-/// added to the table shows up in the menu (and in the control channel's command list) by itself.
+/// has a matching menu command (also listed through the control channel). Tests check coverage.
 pub const LANGUAGE_COMMANDS: &[UiCommand] = &[
     ("app.language.english", crate::i18n::Locale::En.name(), None, "Edit>Language"),
     ("app.language.simplifiedChinese", crate::i18n::Locale::ZhHans.name(), None, "Edit>Language"),
     ("app.language.traditionalChinese", crate::i18n::Locale::ZhHant.name(), None, "Edit>Language"),
     ("app.language.japanese", crate::i18n::Locale::Ja.name(), None, "Edit>Language"),
     ("app.language.portuguese", crate::i18n::Locale::PtBr.name(), None, "Edit>Language"),
+    ("app.language.french", crate::i18n::Locale::Fr.name(), None, "Edit>Language"),
     ("app.language.spanish", crate::i18n::Locale::Es.name(), None, "Edit>Language"),
     ("app.language.german", crate::i18n::Locale::De.name(), None, "Edit>Language"),
     ("app.language.russian", crate::i18n::Locale::Ru.name(), None, "Edit>Language"),
+    ("app.language.ukrainian", crate::i18n::Locale::Uk.name(), None, "Edit>Language"),
 ];
 
 /// Every UI command: the languages, then everything else. `xtask parity` reads both tables from
@@ -39,9 +41,11 @@ pub fn language_from_command(id: &str) -> Option<crate::i18n::Locale> {
         "app.language.traditionalChinese" => Some(crate::i18n::Locale::ZhHant),
         "app.language.japanese" => Some(crate::i18n::Locale::Ja),
         "app.language.portuguese" => Some(crate::i18n::Locale::PtBr),
+        "app.language.french" => Some(crate::i18n::Locale::Fr),
         "app.language.spanish" => Some(crate::i18n::Locale::Es),
         "app.language.german" => Some(crate::i18n::Locale::De),
         "app.language.russian" => Some(crate::i18n::Locale::Ru),
+        "app.language.ukrainian" => Some(crate::i18n::Locale::Uk),
         _ => None,
     }
 }
@@ -80,6 +84,7 @@ pub const UI_COMMANDS: &[UiCommand] = &[
     ("view.zoomIn", "Zoom In", Some("Cmd+="), "View"),
     ("view.zoomOut", "Zoom Out", Some("Cmd+-"), "View"),
     ("view.clipping", "Show Clipping", Some("J"), "View"),
+    ("view.visualizeHdr", "Visualize HDR", None, "View"),
     // in grids S expands/collapses stacks (the engine command it shadows)
     ("view.softProof", "Soft Proofing", Some("S"), "View"),
     ("view.histogram", "Histogram", Some("Cmd+Shift+H"), "View"),
@@ -145,6 +150,8 @@ pub const UI_COMMANDS: &[UiCommand] = &[
     ("dialog.pasteSettings", "Paste Selected Settings…", Some("Cmd+Shift+V"), "Edit"),
     ("view.focusSearch", "Find…", Some("Cmd+F"), "Edit"),
     ("dialog.export", "Export…", None, "File"),
+    ("dialog.contactSheet", "Contact Sheet PDF…", None, "File"),
+    ("app.contactSheet", "Export Contact Sheet PDF", None, ""),
     ("photo.editInExternal", "Edit in External Editor", Some("Cmd+Shift+E"), "Photo"),
     ("dialog.mergeHdr", "HDR…", Some("Ctrl+H"), "Photo>Photo Merge"),
     ("dialog.mergePanorama", "Panorama…", Some("Ctrl+M"), "Photo>Photo Merge"),
@@ -164,11 +171,15 @@ pub const UI_COMMANDS: &[UiCommand] = &[
     ("app.quit", "Quit LightCraft", Some("Cmd+Q"), "File"),
     ("file.importPresets", "Import Profiles & Presets…", None, "File"),
     ("file.exportPresets", "Export Presets…", None, "File"),
+    ("file.importKeywords", "Import Keywords…", None, "File"),
+    ("file.exportKeywords", "Export Keywords…", None, "File"),
     // Edit panel ▸ Curve ▸ Point Curve dropdown
     ("file.importCurvePresets", "Import Point Curve Presets…", None, ""),
     ("file.exportCurvePresets", "Export Point Curve Presets…", None, ""),
     ("app.settings", "Settings…", Some("Cmd+,"), "Edit"),
     ("app.openLibrary", "Open Library…", None, "File"),
+    // Settings ▸ Display
+    ("app.displayProfile", "Display Profile", None, ""),
     ("app.about", "About LightCraft", None, "Help"),
     ("app.systemInfo", "System Info…", None, "Help"),
     ("app.openLogFolder", "Open Log Folder", None, "Help"),
@@ -256,7 +267,8 @@ pub fn parse_rgb(v: &Value) -> Option<[u8; 3]> {
 /// Handle UI commands; `None` means "not a UI command — send it to the engine".
 pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Result<Value, String>> {
     if matches!(id, "library.inspectLightroom" | "library.importLightroom") {
-        let ctx = egui::Context::default();
+        // the app's own context: a fresh one's repaints reach no window and its clock starts at zero
+        let ctx = app.tasks.repaint.clone().unwrap_or_default();
         return Some(crate::lightroom_import::command(app, id, p, &ctx));
     }
     if let Some(language) = language_from_command(id) {
@@ -266,7 +278,9 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
         crate::i18n::set_language(app.ui.language);
         return Some(Ok(json!(app.ui.language)));
     }
-    let ctx = egui::Context::default();
+    // the app's own context: a toast's time comes from its clock (a fresh context's clock is at 0,
+    // and a toast set by it was long over by the app's clock: it never showed)
+    let ctx = app.tasks.repaint.clone().unwrap_or_default();
     let r: Result<Value, String> = match id {
         "view.photoGrid" => {
             app.ui.view = ViewMode::PhotoGrid;
@@ -472,6 +486,7 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
             Ok(Value::Null)
         }
         "app.openLibrary" => crate::panels::settings::open_library(app, p),
+        "app.displayProfile" => crate::panels::settings::display_profile(app, p),
         "file.backupLibrary" | "file.restoreLibrary" => {
             let action = if id == "file.backupLibrary" { app.services.backup_library.as_mut() } else { app.services.restore_library.as_mut() };
             match action {
@@ -575,6 +590,11 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
             app.ui.show_clipping = !app.ui.show_clipping;
             Ok(Value::Null)
         }
+        "view.visualizeHdr" => {
+            // {on?}; no params toggles. Shown on photos edited in HDR (see `develop.hdr`).
+            app.ui.hdr_visualize = p.get("on").and_then(Value::as_bool).unwrap_or(!app.ui.hdr_visualize);
+            Ok(json!({"on": app.ui.hdr_visualize}))
+        }
         "view.softProof" => {
             // {on?, space?, destWarning?, displayWarning?}; no params toggles
             let has = |k: &str| p.get(k).is_some();
@@ -821,6 +841,20 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
                     app.ui.tool = "guidedUpright".into();
                 }
                 "brush" => {
+                    // A new mask and Add/Subtract are selection operations, not the brush's
+                    // Erase mode. Paint positively into a component with the requested op.
+                    let create = if p.get("new").and_then(Value::as_bool) == Some(true) {
+                        Some(app.run("mask.add", json!({"kind": "brush"})))
+                    } else {
+                        p.get("op").map(|op| app.run("mask.addComponent", json!({"kind": "brush", "op": op})))
+                    };
+                    if let Some(result) = create {
+                        if let Err(e) = result {
+                            return Some(Err(e));
+                        }
+                        app.ui.brush_erase = false;
+                        app.ui.mask_overlay = true;
+                    }
                     app.ui.right = RightPanel::Masking;
                     app.ui.view = ViewMode::Detail;
                     app.ui.tool = "brush".into();
@@ -873,7 +907,16 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
                 Some(a) => Dialog::SmartRules {
                     id: Some(a.id.0),
                     name: a.name.clone(),
-                    rules: a.smart.as_ref().and_then(|f| f.rule_set.clone()).unwrap_or_default(),
+                    // older rules read as they always matched (RuleSet::upgrade)
+                    rules: a
+                        .smart
+                        .as_ref()
+                        .and_then(|f| f.rule_set.clone())
+                        .map(|mut r| {
+                            r.upgrade();
+                            r
+                        })
+                        .unwrap_or_default(),
                     parent: None,
                 },
                 None => Dialog::SmartRules {
@@ -928,6 +971,27 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
             app.ui.dialog = Some(Dialog::CopySettings { groups });
             Ok(Value::Null)
         }
+        "dialog.contactSheet" => {
+            app.ui.dialog = Some(Dialog::ContactSheet { options: lightcraft_engine::contact_sheet::Options::default() });
+            Ok(Value::Null)
+        }
+        "app.contactSheet" => {
+            if app.export.is_some() {
+                return Some(Err("an export is already running".into()));
+            }
+            let mut params = p.clone();
+            if p.get("path").is_none() {
+                let req = PickRequest::save("Contact Sheet PDF", "PDF", &["pdf"], "Contact Sheet.pdf");
+                let paths = match crate::pick::ask(app, id, p, "path", req, |_| None) {
+                    Picked::Now(paths) => paths,
+                    Picked::Later => return Some(Ok(Value::Null)),
+                    Picked::Unavailable => return Some(Err("no save dialog on this platform; supply path".into())),
+                };
+                let Some(path) = paths.first() else { return Some(Ok(Value::Null)) };
+                params["path"] = json!(path);
+            }
+            crate::export_task::start_contact_sheet(app, &params)
+        }
         "dialog.export" => {
             let prev = app.session.last_export.clone().unwrap_or_default();
             let u = |k: &str, d: u64| prev.get(k).and_then(Value::as_u64).unwrap_or(d);
@@ -1201,7 +1265,8 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
                 if kept > 0 {
                     msg += &crate::i18n::tr_format!("; {kept} already had a location", kept = kept);
                 }
-                app.toast(&egui::Context::default(), msg);
+                let ctx = app.tasks.repaint.clone().unwrap_or_default();
+                app.toast(&ctx, msg);
             }
             r
         }
@@ -1344,6 +1409,80 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
             }
             return Some(r);
         }
+        "file.importKeywords" => {
+            // a keyword list file: Lightroom Classic's, Capture One's, Photo Supreme's (.utf8)
+            let path = match p.get("path").and_then(Value::as_str) {
+                Some(x) => x.to_string(),
+                None => {
+                    let req = PickRequest::file(crate::i18n::tr("Import Keywords"), crate::i18n::tr("Keyword Lists"), &["txt", "utf8"]);
+                    match crate::pick::ask(app, id, p, "path", req, |s| s.pick_keyword_list.as_mut().map(|f| f())) {
+                        Picked::Now(v) => match v.into_iter().next() {
+                            Some(x) => x,
+                            None => return Some(Ok(Value::Null)),
+                        },
+                        Picked::Later => return Some(Ok(Value::Null)),
+                        Picked::Unavailable => return Some(Err("no file dialog on this platform".into())),
+                    }
+                }
+            };
+            let r = app.session.execute("keyword.import", &json!({"path": path})).map_err(|e| e.to_string());
+            match &r {
+                Ok(v) => {
+                    let (added, updated) = (v["added"].as_u64().unwrap_or(0), v["updated"].as_u64().unwrap_or(0));
+                    let mut msg = crate::i18n::tr_format!("Added {n} keyword{}", if added == 1 { "" } else { "s" }, n = added);
+                    if updated > 0 {
+                        msg.push_str(&crate::i18n::tr_format!("; {n} gained synonyms", n = updated));
+                    }
+                    app.toast(&ctx, msg);
+                }
+                Err(e) => app.toast(&ctx, e.clone()),
+            }
+            return Some(r);
+        }
+        "file.exportKeywords" => {
+            let path = match p.get("path").and_then(Value::as_str) {
+                Some(x) => x.to_string(),
+                None => {
+                    let name = "Keywords.txt";
+                    let req = PickRequest::save(crate::i18n::tr("Export Keywords"), crate::i18n::tr("Keyword Lists"), &["txt"], name);
+                    match crate::pick::ask(app, id, p, "path", req, |s| s.save_keyword_list.as_mut().map(|f| f(name).into_iter().collect())) {
+                        Picked::Now(v) => match v.into_iter().next() {
+                            Some(x) => x,
+                            None => return Some(Ok(Value::Null)),
+                        },
+                        Picked::Later => return Some(Ok(Value::Null)),
+                        Picked::Unavailable => return Some(Err("no file dialog on this platform".into())),
+                    }
+                }
+            };
+            let r = app.session.execute("keyword.export", &json!({"path": path})).map_err(|e| e.to_string());
+            if let Err(e) = &r {
+                app.toast(&ctx, e.clone());
+            }
+            if let Ok(v) = &r {
+                let n = v["keywords"].as_u64().unwrap_or(0);
+                let mut msg = crate::i18n::tr_format!("Exported {n} keyword{}", if n == 1 { "" } else { "s" }, n = n);
+                // Capture One's importer refuses ; , < > in a list: say which to rename first
+                let refuses: Vec<&str> = v["captureOneRefuses"].as_array().into_iter().flatten().filter_map(Value::as_str).collect();
+                if !refuses.is_empty() {
+                    msg.push_str(&crate::i18n::tr_format!(
+                        " — Capture One won't import a list with ; , < or > in a keyword: {names}",
+                        names = refuses.iter().take(5).copied().collect::<Vec<_>>().join(" · ")
+                    ));
+                }
+                // what the format can't hold (a name in brackets, a line break…) isn't in the file
+                let left: Vec<&str> = v["unwritable"].as_array().into_iter().flatten().filter_map(Value::as_str).collect();
+                if !left.is_empty() {
+                    msg.push_str(&crate::i18n::tr_format!(
+                        " — left out, as a keyword list can't hold them: {names}",
+                        // escaped: a line break in a name would break the toast
+                        names = left.iter().take(5).map(|n| n.escape_debug().to_string()).collect::<Vec<_>>().join(" · ")
+                    ));
+                }
+                app.toast(&ctx, msg);
+            }
+            return Some(r);
+        }
         "file.exportPresets" => {
             let group = p.get("group").and_then(Value::as_str).map(str::to_string);
             let path = match p.get("path").and_then(Value::as_str) {
@@ -1451,6 +1590,7 @@ pub fn run_ui_command(app: &mut LightcraftApp, id: &str, p: &Value) -> Option<Re
 
 pub fn ui_enabled(app: &LightcraftApp, id: &str) -> bool {
     match id {
+        "dialog.contactSheet" | "app.contactSheet" => !cfg!(target_arch = "wasm32") && app.session.active().is_some() && app.export.is_none(),
         s if s.starts_with("panel.") || s.starts_with("tool.") || s.starts_with("section.") => app.session.active().is_some() || s == "panel.close",
         "app.export" | "dialog.export" | "dialog.createPreset" | "dialog.rename" | "dialog.captureTime" | "dialog.copySettings" => {
             app.session.active().is_some()
diff --git a/crates/ui-egui/src/merge.rs b/crates/ui-egui/src/merge.rs
index d3b53611..3849a191 100644
--- a/crates/ui-egui/src/merge.rs
+++ b/crates/ui-egui/src/merge.rs
@@ -225,7 +225,13 @@ pub fn poll(app: &mut LightcraftApp, ctx: &egui::Context) {
         match t.rx.try_recv() {
             Ok(Ok(out)) => {
                 let Some(t) = app.merge.preview_task.take() else { return };
-                if let Some(img) = out.preview {
+                if let Some(mut img) = out.preview {
+                    // shown through the monitor profile like every other preview
+                    if let Some(d) = app.renderer.display()
+                        && let Err(e) = d.profile.from_srgb(&mut img)
+                    {
+                        log::warn!("display profile: {e}");
+                    }
                     let color = Arc::new(egui::ColorImage::from_rgba_unmultiplied([img.width, img.height], &img.as_bytes()));
                     let tex = ctx.load_texture("merge-preview", color.clone(), egui::TextureOptions::LINEAR);
                     app.merge.preview_pixels = Some(color);
diff --git a/crates/ui-egui/src/panels/chips.rs b/crates/ui-egui/src/panels/chips.rs
index 38dc01e4..d1acd15a 100644
--- a/crates/ui-egui/src/panels/chips.rs
+++ b/crates/ui-egui/src/panels/chips.rs
@@ -37,7 +37,7 @@ pub(crate) fn display_label(chip: &FilterChip, filter: &lightcraft_catalog::Filt
     if chip.clear.get("ruleSet").is_some()
         && let Some(rules) = &filter.rule_set
     {
-        return format!("{}: {}", tr("Rules"), rules_label(rules));
+        return format!("{}: {}", tr("Rules"), rules_label(rules, catalog));
     }
     if chip.clear.get("label").is_some() {
         let mut labels = filter.labels.clone();
diff --git a/crates/ui-egui/src/panels/detail.rs b/crates/ui-egui/src/panels/detail.rs
index ea3d782b..c3678ae2 100644
--- a/crates/ui-egui/src/panels/detail.rs
+++ b/crates/ui-egui/src/panels/detail.rs
@@ -187,10 +187,14 @@ pub(crate) fn navigate_gesture(app: &mut LightcraftApp, ui: &mut egui::Ui, resp:
     true
 }
 
-/// The largest texture the GPU behind `ctx` takes (egui reports it; 2048 when it doesn't, the
+/// The largest texture the GPU behind `ctx` takes (egui reports it; 2048 until it does, the
 /// smallest limit WebGL devices have).
+///
+/// The value egui keeps, not the frame's raw input: a native host (egui-winit) reports the limit
+/// in the first frame's input only, so the raw value is `None` from the second frame on
+/// (issue #652: every window render was cut to 2048 px, with blurry strips beside it).
 pub(crate) fn texture_side(ctx: &egui::Context) -> usize {
-    ctx.input(|i| i.raw.max_texture_side).unwrap_or(2048)
+    ctx.input(|i| i.max_texture_side)
 }
 
 /// The photo's own pixels as it is shown: its size after the crop and the user's rotation (what
@@ -1080,6 +1084,9 @@ pub(crate) fn view_overlay(app: &LightcraftApp, d: &DevelopSettings) -> lightcra
     if edit && app.ui.point_color_visualize && app.ui.flyout_open("pointColor") && app.ui.point_color < d.point_colors.len() {
         return Overlay::PointColorRange(app.ui.point_color as u8);
     }
+    if edit && app.ui.hdr_visualize && d.hdr.enabled {
+        return Overlay::HdrRange;
+    }
     Overlay::None
 }
 
@@ -1248,17 +1255,45 @@ fn crop_overlay(app: &mut LightcraftApp, ui: &mut egui::Ui, resp: &egui::Respons
         let s = to_straight(n, d.crop.geometry.angle, frame);
         d.crop.geometry.rect.contains(Point::new(s.x.clamp(-1.0, 2.0), s.y))
     };
-    if let Some(hq) = resp.hover_pos() {
-        let near = handles.iter().position(|h| h.distance(hq) < 12.0);
-        ui.ctx().set_cursor_icon(match near {
+    // a crop drag cut short (the tool closed before the release) leaves its gesture behind: with no
+    // button held it is over
+    if matches!(app.gesture, Some(Gesture::CropRotate { .. } | Gesture::CropHandle { .. }))
+        && !resp.drag_stopped()
+        && !ui.input(|i| i.pointer.any_down())
+    {
+        app.gesture = None;
+    }
+    // while rotating, the pointer may leave the canvas: it still shows rotation and the angle
+    let rotating = matches!(app.gesture, Some(Gesture::CropRotate { .. }));
+    let pointer = resp.hover_pos().or_else(|| if rotating { ui.input(|i| i.pointer.latest_pos()) } else { None });
+    // with ⌘ held a drag draws a level line (the straighten crosshair, set above), not a rotation
+    let straightening = !rotating && ui.input(|i| i.modifiers.command);
+    if let Some(hq) = pointer.filter(|_| !straightening) {
+        // a move or resize drag keeps its pointer wherever it goes, even past the box
+        let held = match app.gesture {
+            Some(Gesture::CropHandle { handle, .. }) => Some(usize::from(handle)),
+            _ => None,
+        };
+        let near = held.or_else(|| handles.iter().position(|h| h.distance(hq) < 12.0)).filter(|_| !rotating);
+        let cursor = match near {
             Some(0 | 2) => egui::CursorIcon::ResizeNwSe,
             Some(1 | 3) => egui::CursorIcon::ResizeNeSw,
             Some(4 | 6) => egui::CursorIcon::ResizeVertical,
-            Some(_) => egui::CursorIcon::ResizeHorizontal,
-            None if inside(hq) => egui::CursorIcon::Move,
-            None => egui::CursorIcon::Alias,
-        });
+            Some(5 | 7) => egui::CursorIcon::ResizeHorizontal,
+            // 8: the whole box
+            Some(_) => egui::CursorIcon::Move,
+            None if inside(hq) && !rotating => egui::CursorIcon::Move,
+            // a drag here rotates: no system cursor shows that, so draw a curved double arrow
+            None => {
+                rotate_cursor(ui, hq);
+                egui::CursorIcon::None
+            }
+        };
+        ui.ctx().set_cursor_icon(cursor);
     }
+    // the angle next to the pointer, drawn once this frame's rotation is applied (below)
+    let readout_at = pointer.filter(|_| rotating);
+    let mut shown_angle = d.crop.geometry.angle;
     // double-click inside the crop box applies the crop (same as Return / Done)
     if resp.double_clicked()
         && let Some(q) = resp.interact_pointer_pos()
@@ -1299,7 +1334,8 @@ fn crop_overlay(app: &mut LightcraftApp, ui: &mut egui::Ui, resp: &egui::Respons
                 let c = map.screen(Point::new(0.5, 0.5));
                 let a = (q - c).angle();
                 let ang = (start_angle + (a - a0).to_degrees() as f64).clamp(-45.0, 45.0);
-                let _ = app.run("crop.straighten", json!({"angle": (ang * 100.0).round() / 100.0}));
+                shown_angle = (ang * 100.0).round() / 100.0;
+                let _ = app.run("crop.straighten", json!({"angle": shown_angle}));
             }
             _ => {}
         }
@@ -1308,9 +1344,66 @@ fn crop_overlay(app: &mut LightcraftApp, ui: &mut egui::Ui, resp: &egui::Respons
         app.gesture = None;
         let _ = app.run("develop.endInteraction", json!({}));
     }
+    if let Some(at) = readout_at {
+        // the canvas (the loupe's own rect), not the photo: rotating happens in the margin around it
+        angle_readout(ui, at, shown_angle, resp.rect);
+    }
     let _ = id;
 }
 
+/// The crop angle as the rotation readout shows it: like the Straighten value, in degrees.
+pub(crate) fn crop_angle_label(angle: f64) -> String {
+    let shown =
+        lightcraft_develop::controls::find("crop.angle").map_or_else(|| format!("{angle:.2}"), |spec| crate::widgets::shown_value(spec, angle));
+    // the slider's format turns a rounded −0.00 into "0": every zero reads "0.00", the angle's
+    // usual two decimals
+    let shown = if shown == "0" { "0.00".to_string() } else { shown };
+    format!("{shown}°")
+}
+
+/// Where the angle readout of `size` goes for a pointer `at`: below right of it, flipped to the
+/// left / above where that would leave `bounds`, then kept inside them.
+pub(crate) fn readout_rect(at: Pos2, size: egui::Vec2, bounds: Rect) -> Rect {
+    // without a real pointer or bounds (NaN, an empty rect) there is nothing to keep it in; and
+    // f32::clamp panics on NaN, so only finite numbers get there
+    if !at.is_finite() || !bounds.is_finite() || !bounds.is_positive() {
+        let at = if at.is_finite() { at } else { bounds.min.max(Pos2::ZERO) };
+        let at = if at.is_finite() { at } else { Pos2::ZERO };
+        return Rect::from_min_size(at + vec2(18.0, 14.0), size);
+    }
+    let x = if at.x + 18.0 + size.x > bounds.right() { at.x - 18.0 - size.x } else { at.x + 18.0 };
+    let y = if at.y + 14.0 + size.y > bounds.bottom() { at.y - 14.0 - size.y } else { at.y + 14.0 };
+    let x = x.clamp(bounds.left(), (bounds.right() - size.x).max(bounds.left()));
+    let y = y.clamp(bounds.top(), (bounds.bottom() - size.y).max(bounds.top()));
+    Rect::from_min_size(pos2(x, y), size)
+}
+
+/// On top of everything (the tooltip layer), so neither the photo nor a panel covers it.
+fn top_painter(ui: &egui::Ui, name: &'static str) -> egui::Painter {
+    ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new(name)))
+}
+
+/// The rotation pointer: a curved double arrow on a dark disc, so it reads over any photo.
+fn rotate_cursor(ui: &egui::Ui, at: Pos2) {
+    let p = top_painter(ui, "crop-rotate-cursor");
+    let r = Rect::from_center_size(at, vec2(22.0, 22.0));
+    p.circle_filled(at, 12.0, Color32::from_black_alpha(150));
+    crate::icons::paint(&p, r.shrink(2.0), crate::icons::Icon::RotateDrag, Color32::WHITE);
+    register(ui.ctx(), "cropRotateCursor", r);
+}
+
+/// While rotating: the angle, next to the pointer, kept inside `bounds` (the canvas): on the
+/// pointer's other side when it would run past an edge.
+fn angle_readout(ui: &egui::Ui, at: Pos2, angle: f64, bounds: Rect) {
+    let t = Tokens::get(ui.ctx());
+    let p = top_painter(ui, "crop-angle-readout");
+    let galley = p.layout_no_wrap(crop_angle_label(angle), t.font(12.5), Color32::WHITE);
+    let rect = readout_rect(at, galley.size() + vec2(12.0, 6.0), bounds);
+    p.rect_filled(rect, 4.0, Color32::from_black_alpha(170));
+    p.galley(rect.min + vec2(6.0, 3.0), galley, Color32::WHITE);
+    register(ui.ctx(), "cropAngleReadout", rect);
+}
+
 /// Guided Upright: draw up to four guides along lines that should be vertical or horizontal. Guides are
 /// stored in lens-corrected (pre-perspective) coordinates, so they stay attached to the image as it warps.
 fn guided_overlay(app: &mut LightcraftApp, ui: &mut egui::Ui, resp: &egui::Response, map: &CanvasMap, frame: &Frame, d: &DevelopSettings) {
@@ -1434,6 +1527,22 @@ fn moved_shape(shape: &MaskShape, handle: u8, dn: Point, at: Point, map: &Canvas
     }
 }
 
+/// Hit the geometric ellipse, independently of feather/inversion. Radii use long-edge units,
+/// so undo the same scaling and rotation used to draw its outline before testing containment.
+fn radial_body_contains(shape: &MaskShape, at: Point, map: &CanvasMap) -> bool {
+    let MaskShape::Radial { center, rx, ry, angle, .. } = shape else { return false };
+    if !rx.is_finite() || !ry.is_finite() || *rx <= 0.0 || *ry <= 0.0 {
+        return false;
+    }
+    let l = frame_long_norm(map);
+    let dx = (at.x - center.x) / l.0;
+    let dy = (at.y - center.y) / l.1;
+    let (s, co) = angle.to_radians().sin_cos();
+    let x = (dx * co + dy * s) / rx;
+    let y = (-dx * s + dy * co) / ry;
+    x * x + y * y <= 1.0
+}
+
 /// The Masking tool on the photo: outlines and handles of the selected mask, a pin per mask
 /// component (click selects its mask, drag moves the component), and brush painting. The mask
 /// itself shows as a rendered overlay ([`view_overlay`]).
@@ -1608,8 +1717,14 @@ fn mask_overlay(app: &mut LightcraftApp, ui: &mut egui::Ui, resp: &egui::Respons
         && let Some(q) = ui.input(|i| i.pointer.press_origin()).or(resp.interact_pointer_pos())
     {
         let grip = hit(q).map(|(m, c, h, _)| (m, c, h)).or_else(|| {
-            // anywhere on the photo drags the selected linear gradient
             let m = d.masks.iter().find(|m| Some(m.id) == active)?;
+            // Handles take precedence; otherwise grab the selected radial component under
+            // the press, including components after the first in compound masks.
+            let at = map.norm(q);
+            if let Some(ci) = m.components.iter().position(|c| radial_body_contains(&c.shape, at, map)) {
+                return Some((m.id, ci, 0));
+            }
+            // anywhere on the photo drags the selected linear gradient
             matches!(m.components.first()?.shape, MaskShape::Linear { .. }).then_some((m.id, 0, 0))
         });
         if let Some((mask, comp, handle)) = grip
@@ -2028,7 +2143,23 @@ fn straighten_overlay(app: &mut LightcraftApp, ui: &mut egui::Ui, resp: &egui::R
 
 #[cfg(test)]
 mod tests {
-    use super::film_label;
+    use super::{film_label, texture_side};
+
+    /// Issue #652: a native host reports the GPU's texture limit in the first frame's input only.
+    /// The loupe must still know it in every later frame (it read the raw input, found nothing and
+    /// cut every window render to 2048 px).
+    #[test]
+    fn the_texture_limit_outlives_the_frame_it_was_reported_in() {
+        let ctx = egui::Context::default();
+        assert_eq!(texture_side(&ctx), 2048, "until the host says: the smallest limit there is");
+        let mut seen = Vec::new();
+        for reported in [Some(8192), None, None] {
+            let raw = egui::RawInput { max_texture_side: reported, ..Default::default() };
+            let mut out = ctx.run_ui(raw, |ui| seen.push(texture_side(ui.ctx())));
+            out.textures_delta.clear();
+        }
+        assert_eq!(seen, [8192, 8192, 8192]);
+    }
 
     #[test]
     fn film_labels_cut_on_characters_not_bytes() {
diff --git a/crates/ui-egui/src/panels/dialogs.rs b/crates/ui-egui/src/panels/dialogs.rs
index f2bdd668..aa287c95 100644
--- a/crates/ui-egui/src/panels/dialogs.rs
+++ b/crates/ui-egui/src/panels/dialogs.rs
@@ -63,6 +63,11 @@ pub const WHATS_NEW: &str = include_str!("../../../../docs/whats-new.md");
 pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
     let Some(mut dlg) = app.ui.dialog.clone() else { return };
     let at_start = dlg.clone();
+    // Esc with a popup open in the dialog (a dropdown, a date picker's calendar) closes the popup
+    // only: claimed before the dialog is drawn, since the popup is gone once it has handled the key
+    if ctx.input(|i| i.key_pressed(egui::Key::Escape)) && egui::Popup::is_any_open(ctx) {
+        crate::widgets::take_escape(ctx);
+    }
     let t = Tokens::get(ctx);
     let screen = ctx.content_rect();
     // The backdrop is an area below the dialog window (a bare `Middle` layer painter would be
@@ -82,6 +87,11 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
         Dialog::LabelNames { .. } => "Edit Color Label Names",
         Dialog::CaptureTime { .. } => "Edit Capture Time",
         Dialog::RenameKeyword { .. } => "Rename Keyword",
+        Dialog::KeywordTag { editing: None, .. } => "Create Keyword Tag",
+        Dialog::KeywordTag { .. } => "Edit Keyword Tag",
+        Dialog::DeleteKeyword { .. } => "Delete Keyword",
+        Dialog::MoveKeyword { .. } => "Merge Keywords",
+        Dialog::KeywordSet { .. } => "Edit Keyword Set",
         Dialog::MergeKeywords { .. } => "Merge Keywords",
         Dialog::NewSmartAlbum { .. } => "Create Smart Album",
         Dialog::AllMetadata { .. } => "All Metadata",
@@ -98,11 +108,13 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
         Dialog::CopySettings { .. } => "Choose Edit Settings to Copy",
         Dialog::PasteSettings { .. } => "Paste Selected Settings",
         Dialog::Export { .. } => "Export",
+        Dialog::ContactSheet { .. } => "Contact Sheet PDF",
         Dialog::Merge { opts } => opts.title(),
         Dialog::Settings { .. } => "Settings",
         Dialog::ConfirmDelete { .. } => "Delete Photos",
         Dialog::RemoveFolder { disk: true, .. } => "Remove Disk from Library",
         Dialog::RemoveFolder { .. } => "Remove Folder from Library",
+        Dialog::SynchronizeFolder { .. } => "Synchronize Folder",
         // (nothing to download from in this build: the dialog explains the manual install)
         Dialog::SamModel { .. } if sam_by_hand(&app.session.segmenter) => "Install the SAM 3 Model",
         Dialog::SamModel { .. } => "Download the SAM 3 Model?",
@@ -242,27 +254,28 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                     let r = ui.add(egui::TextEdit::singleline(name).hint_text(crate::i18n::tr("Name")).desired_width(f32::INFINITY));
                     crate::widgets::register(ui.ctx(), "field:smartName", r.rect);
                     ui.add_space(6.0);
-                    egui::ScrollArea::vertical().max_height(360.0).auto_shrink([false, true]).show(ui, |ui| {
-                        crate::panels::rules_editor::edit(ui, rules, "rules", 0);
-                    });
-                    let problems = rules.problems();
                     // the folder an album made from a folder view carries is not in the editor, but it counts
                     let folder = id.and_then(|id| app.session.catalog.album(lightcraft_catalog::AlbumId(id))).and_then(|a| a.smart.as_deref().and_then(|f| f.library_folder.clone()));
-                    let f = lightcraft_catalog::Filter { rule_set: Some(rules.clone()), library_folder: folder, ..Default::default() };
-                    let n = if problems.is_empty() { app.session.catalog.query(&f, &Default::default()).len() } else { 0 };
+                    // problems, count and albums: cached until the catalog or the rules change (not per frame)
+                    let now = (app.session.clock)();
+                    let view = app.caches.rules_view(&app.session.catalog, rules, *id, folder, &now);
+                    let env = crate::panels::rules_editor::Env { problems: view.problems.clone(), today: now, albums: view.albums.clone() };
+                    egui::ScrollArea::vertical().max_height(360.0).auto_shrink([false, true]).show(ui, |ui| {
+                        crate::panels::rules_editor::edit(ui, rules, "rules", 0, &[], &env);
+                    });
+                    let n = view.count;
                     ui.add_space(4.0);
-                    ui.label(
-                        egui::RichText::new(match problems.first() {
-                            Some(p) => p.clone(),
-                            None => crate::i18n::tr_format!("{n} photo{} match · updates automatically as photos change", if n == 1 { "" } else { "s" }, n = n),
-                        })
-                        .color(t.text_dim),
-                    );
+                    if view.problems.is_empty() {
+                        ui.label(
+                            egui::RichText::new(crate::i18n::tr_format!("{n} photo{} match · updates automatically as photos change", if n == 1 { "" } else { "s" }, n = n))
+                                .color(t.text_dim),
+                        );
+                    } else {
+                        ui.label(egui::RichText::new(crate::i18n::tr("Fix the marked rules to save this album.")).color(t.caution));
+                    }
                 }
                 Dialog::NewSmartAlbum { name, .. } => {
-                    let r = ui.add(egui::TextEdit::singleline(name).hint_text(crate::i18n::tr("Name")).desired_width(f32::INFINITY));
-                    r.request_focus();
-                    if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                    if dialog_field(ui, "field:smartAlbumName", name, "Name") {
                         confirm = true;
                     }
                     let rules = app.session.view_rules();
@@ -410,10 +423,7 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                 }
                 Dialog::RenameKeyword { from, to } => {
                     let n = app.session.catalog.photos().filter(|p| p.meta.keywords.iter().any(|k| lightcraft_catalog::keywords::is_under(k, from))).count();
-                    let r = ui.add(egui::TextEdit::singleline(to).hint_text(crate::i18n::tr("New name")).desired_width(f32::INFINITY));
-                    crate::widgets::register(ui.ctx(), "field:keywordName", r.rect);
-                    r.request_focus();
-                    if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                    if dialog_field(ui, "field:keywordName", to, "New name") {
                         confirm = true;
                     }
                     ui.label(
@@ -424,10 +434,7 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                 }
                 Dialog::MergeKeywords { from, into } => {
                     ui.label(egui::RichText::new(crate::i18n::tr_format!("Replace {} with:", from.iter().map(|f| format!("“{f}”")).collect::<Vec<_>>().join(", "))).color(t.text_label));
-                    let r = ui.add(egui::TextEdit::singleline(into).hint_text(crate::i18n::tr("Keyword")).desired_width(f32::INFINITY));
-                    crate::widgets::register(ui.ctx(), "field:keywordInto", r.rect);
-                    r.request_focus();
-                    if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                    if dialog_field(ui, "field:keywordInto", into, "Keyword") {
                         confirm = true;
                     }
                     let options: Vec<String> = app
@@ -446,16 +453,12 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                     });
                 }
                 Dialog::TextPrompt { value, hint, .. } => {
-                    let r = ui.add(egui::TextEdit::singleline(value).hint_text(crate::i18n::tr(hint.as_str())).desired_width(f32::INFINITY));
-                    r.request_focus();
-                    if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                    if dialog_field(ui, "field:prompt", value, hint) {
                         confirm = true;
                     }
                 }
                 Dialog::NewAlbum { name, .. } | Dialog::RenameAlbum { name, .. } => {
-                    let r = ui.add(egui::TextEdit::singleline(name).hint_text(crate::i18n::tr("Name")).desired_width(f32::INFINITY));
-                    r.request_focus();
-                    if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
+                    if dialog_field(ui, "field:albumName", name, "Name") {
                         confirm = true;
                     }
                 }
@@ -474,6 +477,24 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                     );
                     group_checklist(ui, "pasteGroup", groups);
                 }
+                Dialog::ContactSheet { options } => {
+                    options.columns = options.columns.clamp(1, 8);
+                    options.rows = options.rows.clamp(1, 10);
+                    let n = app.session.targets(&json!({})).len();
+                    ui.label(format!("{n} selected photos · {} pages", n.div_ceil(options.columns * options.rows)));
+                    field(ui, "Paper", |ui| {
+                        egui::ComboBox::from_id_salt("contactSheetPaper").selected_text(&options.paper).show_ui(ui, |ui| {
+                            ui.selectable_value(&mut options.paper, "a4".into(), "A4");
+                            ui.selectable_value(&mut options.paper, "letter".into(), "Letter");
+                        });
+                    });
+                    ui.checkbox(&mut options.landscape, "Landscape");
+                    field(ui, "Columns", |ui| { ui.add(egui::DragValue::new(&mut options.columns).range(1..=8)); });
+                    field(ui, "Rows", |ui| { ui.add(egui::DragValue::new(&mut options.rows).range(1..=10)); });
+                    ui.checkbox(&mut options.captions, "Filename captions");
+                    ui.label("150 dpi · sRGB · current edits · fit without cropping");
+                    ui.label("Choose a PDF destination after confirming. Print the PDF from your viewer.");
+                }
                 Dialog::Export { opts, full_size, resize, preset_name, limit_kb, dir } => {
                     use lightcraft_engine::export::{Anchor as P, ExportFormat as F, MetadataPolicy as M, SharpenAmount as A, SharpenFor as S};
                     let n = app.session.selection.ids.len().max(1);
@@ -532,7 +553,16 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                         choices(ui, "Bit depth", "exportBitDepth", depths, &mut bd);
                         opts.bit_depth = Some(bd);
                     }
+                    if matches!(opts.format, F::Jpeg | F::Tiff | F::Avif) {
+                        let tip = "Photos edited in HDR: JPEG with an HDR gain map (looks right everywhere, brighter highlights on HDR displays), AVIF as 10-bit Rec. 2020 PQ; TIFF needs 32-bit float";
+                        ui.checkbox(&mut opts.hdr, "HDR output").on_hover_text(tip);
+                        if opts.hdr && !opts.hdr_output() {
+                            ui.label(egui::RichText::new("HDR TIFF needs 32-bit float.").color(t.text_dim));
+                        }
+                    }
                     if !rendered {
+                    } else if opts.format == F::Avif && opts.hdr {
+                        ui.label(egui::RichText::new("Color space: Rec. 2020 PQ (HDR AVIF)").color(t.text_dim));
                     } else if opts.format == F::Avif {
                         ui.label(egui::RichText::new(crate::i18n::tr("Color space: sRGB (AVIF)")).color(t.text_dim));
                     } else {
@@ -723,11 +753,135 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                 Dialog::Import { opts } => crate::import::body(app, ui, opts),
                 Dialog::Settings { tab } => crate::panels::settings::body(app, ui, tab),
                 Dialog::SamModel { error, .. } => sam_model_body(app, ui, error.as_deref()),
+                Dialog::KeywordTag {
+                    editing,
+                    name,
+                    parent,
+                    inside,
+                    synonyms,
+                    include_on_export,
+                    export_containing,
+                    export_synonyms,
+                    person,
+                    add_to_selected,
+                } => {
+                    ui.label(egui::RichText::new(crate::i18n::tr("Keyword Name")).color(t.text_dim));
+                    // several fields: the name takes the focus when the dialog opens, not after
+                    let r = crate::text_field::TextField::singleline("field:keywordTagName", name)
+                        .hint(crate::i18n::tr("Keyword Name"))
+                        .width(f32::INFINITY)
+                        .select_on_focus(true)
+                        .show(ui);
+                    if just_opened(ui, "keyword-tag") {
+                        r.response.request_focus();
+                    }
+                    if r.ending == Some(crate::text_field::Ending::Return) {
+                        confirm = true;
+                    }
+                    ui.add_space(4.0);
+                    ui.label(egui::RichText::new(crate::i18n::tr("Synonyms")).color(t.text_dim));
+                    // Return in either field creates (or saves) the keyword
+                    let r = crate::text_field::TextField::singleline("field:keywordSynonyms", synonyms)
+                        .hint(crate::i18n::tr("Separated by commas"))
+                        .width(f32::INFINITY)
+                        .show(ui);
+                    if r.ending == Some(crate::text_field::Ending::Return) {
+                        confirm = true;
+                    }
+                    ui.add_space(6.0);
+                    if editing.is_none() {
+                        if let Some(p) = parent {
+                            let r = ui.checkbox(inside, crate::i18n::tr_format!("Put inside “{parent}”", parent = p.replace('|', " › ")));
+                            crate::widgets::register(ui.ctx(), "check:keywordInside", r.rect);
+                        }
+                        let n = app.session.selection.ids.len();
+                        let r = ui.add_enabled(n > 0, egui::Checkbox::new(add_to_selected, crate::i18n::tr("Add to Selected Photos")));
+                        crate::widgets::register(ui.ctx(), "check:keywordAddToSelected", r.rect);
+                        ui.add_space(4.0);
+                    }
+                    ui.label(egui::RichText::new(crate::i18n::tr("Keyword Tag Options")).color(t.text_dim));
+                    for (on, label, id) in [
+                        (include_on_export, "Include on Export", "check:keywordIncludeOnExport"),
+                        (export_containing, "Export Containing Keywords", "check:keywordExportContaining"),
+                        (export_synonyms, "Export Synonyms", "check:keywordExportSynonyms"),
+                        (person, "Person", "check:keywordPerson"),
+                    ] {
+                        let r = ui.checkbox(on, crate::i18n::tr(label));
+                        crate::widgets::register(ui.ctx(), id, r.rect);
+                    }
+                }
+                Dialog::KeywordSet { replaces, name, slots, as_new } => {
+                    ui.label(egui::RichText::new(crate::i18n::tr("Set name")).color(t.text_dim));
+                    let r = crate::text_field::TextField::singleline("field:keywordSetName", name)
+                        .hint(crate::i18n::tr("Set name"))
+                        .width(f32::INFINITY)
+                        .select_on_focus(true)
+                        .show(ui);
+                    if just_opened(ui, "keyword-set") {
+                        r.response.request_focus();
+                    }
+                    let mut returned = r.ending == Some(crate::text_field::Ending::Return);
+                    ui.add_space(6.0);
+                    ui.label(egui::RichText::new(crate::i18n::tr("Keywords (⌥1–⌥9)")).color(t.text_dim));
+                    slots.resize(9, String::new());
+                    // equal columns of a set width (the window is still finding its own)
+                    let w = 130.0;
+                    egui::Grid::new("keyword-set-slots").num_columns(3).min_col_width(w).spacing([6.0, 4.0]).show(ui, |ui| {
+                        for (i, slot) in slots.iter_mut().enumerate() {
+                            let r = crate::text_field::TextField::singleline(&format!("field:keywordSetSlot:{}", i + 1), slot)
+                                .hint(format!("⌥{}", i + 1))
+                                .width(w)
+                                .show(ui);
+                            returned |= r.ending == Some(crate::text_field::Ending::Return);
+                            if i % 3 == 2 {
+                                ui.end_row();
+                            }
+                        }
+                    });
+                    if replaces.is_some() {
+                        ui.add_space(6.0);
+                        let r = ui.checkbox(as_new, crate::i18n::tr("Save as a new set"));
+                        crate::widgets::register(ui.ctx(), "check:keywordSetAsNew", r.rect);
+                    }
+                    // Return in any field saves the set
+                    if returned {
+                        confirm = true;
+                    }
+                }
+                Dialog::MoveKeyword { keyword, parent } => {
+                    let name = keyword.rsplit('|').next().unwrap_or(keyword);
+                    match parent {
+                        Some(p) => ui.label(crate::i18n::tr_format!(
+                            "“{parent}” has a “{name}” already. Merge the two?",
+                            parent = p.replace('|', " › "),
+                            name = name
+                        )),
+                        None => ui.label(crate::i18n::tr_format!("There is a “{name}” at the top level already. Merge the two?", name = name)),
+                    };
+                    ui.label(egui::RichText::new(crate::i18n::tr("Their photos and the keywords below them come together under one keyword.")).color(t.text_dim));
+                }
+                Dialog::DeleteKeyword { keyword, count } => {
+                    let name = keyword.replace('|', " › ");
+                    ui.label(crate::i18n::tr_format!("Delete the keyword “{name}”?", name = name));
+                    ui.label(
+                        egui::RichText::new(if *count == 0 {
+                            crate::i18n::tr("No photo has it; the keywords below it go too.").to_string()
+                        } else {
+                            crate::i18n::tr_format!(
+                                "It is taken off {count} photo{}, with the keywords below it. Undo brings it back.",
+                                if *count == 1 { "" } else { "s" },
+                                count = count
+                            )
+                        })
+                        .color(t.text_dim),
+                    );
+                }
                 Dialog::ConfirmDelete { count } => {
                     let what = if *count == 1 { crate::i18n::tr("this photo").to_string() } else { crate::i18n::tr_format!("these {count} photos", count = count) };
                     ui.label(crate::i18n::tr_format!("Move {what} to Recently Deleted?", what = what));
                     ui.label(egui::RichText::new(crate::i18n::tr("They can be restored from Recently Deleted until it is emptied.")).color(t.text_dim));
                 }
+                d @ Dialog::SynchronizeFolder { .. } => crate::sync::body(app, ui, d),
                 Dialog::RemoveFolder { name, count, path, disk } => {
                     ui.label(crate::i18n::tr_format!(
                         "Remove “{name}” and its {count} photo{} from the library?",
@@ -763,7 +917,10 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                         _ => {
                             ui.label(egui::RichText::new("LightCraft").font(t.semibold(20.0)).color(t.text));
                             ui.label(crate::i18n::tr_format!("Version {} — a clean-room, pure-Rust photo library and raw developer.", env!("CARGO_PKG_VERSION")));
-                            ui.label(crate::i18n::tr_format!("MIT OR Apache-2.0. Fonts: {} (OFL). Icons: original.", crate::theme::font_credits()));
+                            ui.label(crate::i18n::tr_format!(
+                                "MIT OR Apache-2.0. Fonts: {} (OFL). Icons: original.",
+                                crate::theme::font_credits(app.chinese_font.is_some())
+                            ));
                             ui.add_space(10.0);
                             let discord = egui::Button::new(egui::RichText::new(crate::i18n::tr("Join the ArtCraft Discord")).font(t.semibold(15.0)).color(egui::Color32::WHITE))
                                 .fill(t.accent)
@@ -818,13 +975,20 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                         add_label = crate::i18n::tr_format!("{verb} {n} Photo{}", if n == 1 { "" } else { "s" }, verb = crate::i18n::tr(verb), n = n);
                         add_label.as_str()
                     }
+                    Dialog::ContactSheet { .. } => "Choose PDF…",
                     Dialog::Merge { .. } => "Merge",
                     Dialog::DenoiseModel { info, .. } if info["download"].is_string() => "Accept & Download",
                     Dialog::DenoiseModel { .. } => "Install",
                     Dialog::FaceModel { info, .. } if !informational && info["download"].is_string() => "Download",
                     Dialog::FaceModel { .. } if !informational => "Install",
-                    Dialog::ConfirmDelete { .. } => "Delete",
+                    Dialog::ConfirmDelete { .. } | Dialog::DeleteKeyword { .. } => "Delete",
+                    // (not "Merge": that is photo merging, HDR / panorama, in some languages)
+                    Dialog::MoveKeyword { .. } => "Merge Keywords",
+                    Dialog::KeywordSet { .. } => "Save",
+                    Dialog::KeywordTag { editing: None, .. } => "Create",
+                    Dialog::KeywordTag { .. } => "Save",
                     Dialog::RemoveFolder { .. } => "Remove",
+                    Dialog::SynchronizeFolder { .. } => "Synchronize",
                     Dialog::SamModel { then: Some(_), .. } if sam_installed => "Continue",
                     Dialog::SamModel { .. } if sam_installed || sam_running || sam_nowhere => "",
                     Dialog::SamModel { error, .. } if error.is_some() || sam_failed => "Try Again",
@@ -833,7 +997,14 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                     _ => "OK",
                 };
                 // installing waits for the licence to be accepted
-                let can_confirm = informational || !matches!(&dlg, Dialog::DenoiseModel { accepted: false, .. } | Dialog::FaceModel { accepted: false, .. });
+                // (and Synchronize waits for the scan)
+                let can_confirm = informational
+                    || !matches!(
+                        &dlg,
+                        Dialog::DenoiseModel { accepted: false, .. } | Dialog::FaceModel { accepted: false, .. } | Dialog::SynchronizeFolder { counts: None, .. }
+                    )
+                        // smart-album rules that can't mean anything wait to be fixed
+                        && !matches!(&dlg, Dialog::SmartRules { id, rules, .. } if !rules.check_for(&app.session.catalog, id.map(lightcraft_catalog::AlbumId)).is_empty());
                 let r = (!ok.is_empty()).then(|| ui.add_enabled(can_confirm, egui::Button::new(crate::i18n::tr(ok))));
                 if let Some(r) = &r {
                     crate::widgets::register(ui.ctx(), "button:dialogOk", r.rect);
@@ -854,8 +1025,9 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
         ctx.move_to_top(w.response.layer_id);
         crate::widgets::register(ctx, "dialog:window", w.response.rect);
     }
-    // (while the shortcuts editor records a key, it takes Esc itself to cancel)
-    if ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
+    // (while the shortcuts editor records a key, it takes Esc itself to cancel; an open popup in
+    // the dialog, such as a date picker's calendar, takes it to close itself)
+    if ctx.input(|i| i.key_pressed(egui::Key::Escape)) && !crate::widgets::escape_taken(ctx) {
         close = true;
     }
     if confirm {
@@ -867,9 +1039,13 @@ pub fn show(app: &mut LightcraftApp, ctx: &egui::Context) {
                     dlg,
                     Dialog::Import { .. }
                         | Dialog::Export { .. }
+                        | Dialog::ContactSheet { .. }
                         | Dialog::NewAlbum { .. }
                         | Dialog::NewSmartAlbum { .. }
                         | Dialog::SmartRules { .. }
+                        | Dialog::KeywordTag { .. }
+                        | Dialog::KeywordSet { .. }
+                        | Dialog::SynchronizeFolder { .. }
                 ) =>
             {
                 app.toast(ctx, e)
@@ -1016,6 +1192,17 @@ fn created_in(app: &mut LightcraftApp, command: &str, params: serde_json::Value)
     Ok(r)
 }
 
+/// The albums an Album rule in smart album `editing` picks from, in the sidebar's order: the album
+/// itself and any smart album that tests it (testing it back would loop) are blocked, with why.
+pub(crate) fn album_entries(cat: &lightcraft_catalog::Catalog, editing: Option<u64>) -> Vec<crate::album_picker::AlbumEntry> {
+    let editing = editing.map(lightcraft_catalog::AlbumId);
+    crate::album_picker::entries_from(cat, |a| match editing {
+        Some(e) if a.id == e => Some(crate::i18n::tr("This is the album you're editing").to_string()),
+        Some(e) if cat.album_reaches(a.id, e) => Some(crate::i18n::tr("It tests this album, so testing it back would loop").to_string()),
+        _ => None,
+    })
+}
+
 pub fn confirm_dialog(app: &mut LightcraftApp, dlg: &Dialog) -> Result<serde_json::Value, String> {
     match dlg {
         Dialog::SamModel { then, .. } => {
@@ -1062,6 +1249,80 @@ pub fn confirm_dialog(app: &mut LightcraftApp, dlg: &Dialog) -> Result<serde_jso
         }
         Dialog::Rename { template, start } => app.run("photo.rename", json!({"template": template, "start": start})),
         Dialog::RenameKeyword { from, to } => app.run("keyword.rename", json!({"from": from, "to": to})),
+        Dialog::KeywordTag {
+            editing,
+            name,
+            parent,
+            inside,
+            synonyms,
+            include_on_export,
+            export_containing,
+            export_synonyms,
+            person,
+            add_to_selected,
+        } => {
+            let mut params = json!({
+                "synonyms": synonyms.split(',').map(str::trim).filter(|s| !s.is_empty()).collect::<Vec<_>>(),
+                "includeOnExport": include_on_export,
+                "exportContaining": export_containing,
+                "exportSynonyms": export_synonyms,
+                "person": person,
+            });
+            match editing {
+                Some(keyword) => {
+                    params["keyword"] = json!(keyword);
+                    params["name"] = json!(name);
+                    let r = app.run("keyword.edit", params);
+                    if r.is_ok() {
+                        let to = match keyword.rsplit_once('|') {
+                            Some((parent, _)) => format!("{parent}|{}", name.trim()),
+                            None => name.trim().to_string(),
+                        };
+                        crate::panels::keyword_list::follow(app, keyword, &to);
+                    }
+                    r
+                }
+                None => {
+                    params["name"] = json!(name);
+                    params["parent"] = if *inside { json!(parent) } else { serde_json::Value::Null };
+                    params["addToSelected"] = json!(add_to_selected);
+                    app.run("keyword.create", params)
+                }
+            }
+        }
+        Dialog::DeleteKeyword { keyword, .. } => app.run("keyword.delete", json!({"keyword": keyword})),
+        Dialog::KeywordSet { replaces, name, slots, as_new } => {
+            use lightcraft_catalog::keywords::same;
+            let name = name.trim();
+            if name.is_empty() {
+                return Err(crate::i18n::tr("A keyword set needs a name").to_string());
+            }
+            if same(name, lightcraft_engine::cmd::keywords::RECENT) {
+                return Err(crate::i18n::tr("Recent Keywords is built in: choose another name").to_string());
+            }
+            // the set it renames: none when saving as new, or when it was deleted meanwhile (then it is
+            // saved anew rather than refused)
+            let sets = &app.session.keyword_sets;
+            let renames = replaces.as_deref().filter(|_| !as_new).filter(|old| sets.iter().any(|x| same(&x.name, old)));
+            if sets.iter().any(|x| same(&x.name, name) && !renames.is_some_and(|old| same(&x.name, old))) {
+                return Err(crate::i18n::tr_format!("There is a keyword set “{name}” already", name = name));
+            }
+            let mut params = json!({"name": name, "keywords": slots});
+            match renames {
+                Some(old) => params["replace"] = json!(old),
+                None => params["new"] = json!(true),
+            }
+            app.run("keyword.saveSet", params)
+        }
+        Dialog::MoveKeyword { keyword, parent } => {
+            let r = app.run("keyword.move", json!({"keyword": keyword, "parent": parent, "merge": true}));
+            if r.is_ok() {
+                let leaf = keyword.rsplit('|').next().unwrap_or(keyword);
+                let to = parent.as_deref().map_or_else(|| leaf.to_string(), |p| format!("{p}|{leaf}"));
+                crate::panels::keyword_list::follow(app, keyword, &to);
+            }
+            r
+        }
         Dialog::MergeKeywords { from, into } => app.run("keyword.merge", json!({"from": from, "into": into})),
         Dialog::AutoStack { gap } => app.run("stack.auto", json!({"gap": gap})),
         Dialog::DenoiseModel { info, accepted } => crate::panels::denoise::install(app, info, *accepted),
@@ -1075,14 +1336,14 @@ pub fn confirm_dialog(app: &mut LightcraftApp, dlg: &Dialog) -> Result<serde_jso
             app.run("photo.analyze", p)
         }
         Dialog::SmartRules { id, name, rules, parent } => {
+            // refused before anything changes (not even the name)
+            if let Some(problem) = rules.check_for(&app.session.catalog, id.map(lightcraft_catalog::AlbumId)).first() {
+                return Err(problem.to_string());
+            }
             let name = if name.trim().is_empty() { "Smart Album".to_string() } else { name.trim().to_string() };
             match id {
-                Some(id) => {
-                    if app.session.catalog.album(lightcraft_catalog::AlbumId(*id)).is_some_and(|a| a.name != name) {
-                        app.run("album.rename", json!({"id": id, "name": name}))?;
-                    }
-                    app.run("album.setRules", json!({"id": id, "replace": true, "rules": {"ruleSet": rules}}))
-                }
+                // the name and the rules together: one undo step, both or neither
+                Some(id) => app.run("album.setRules", json!({"id": id, "name": name, "replace": true, "rules": {"ruleSet": rules}})),
                 None => created_in(app, "album.createSmart", json!({"name": name, "rules": {"ruleSet": rules}, "parent": parent})),
             }
         }
@@ -1097,6 +1358,7 @@ pub fn confirm_dialog(app: &mut LightcraftApp, dlg: &Dialog) -> Result<serde_jso
                 "groups": groups,
             }),
         ),
+        Dialog::ContactSheet { options } => app.run("app.contactSheet", json!(options)),
         Dialog::CopySettings { groups } => app.run("develop.copy", json!({"groups": groups})),
         Dialog::PasteSettings { groups } => app.run("develop.paste", json!({"groups": groups})),
         Dialog::Export { opts, full_size, resize, limit_kb, dir, .. } => {
@@ -1109,6 +1371,7 @@ pub fn confirm_dialog(app: &mut LightcraftApp, dlg: &Dialog) -> Result<serde_jso
         Dialog::Import { opts } => crate::import::start(app, opts),
         Dialog::ConfirmDelete { .. } => app.run("photo.delete", json!({})),
         Dialog::RemoveFolder { path, disk, .. } => app.run("library.removeFolder", json!({"path": path, "disk": disk})),
+        d @ Dialog::SynchronizeFolder { .. } => crate::sync::confirm(app, d),
         Dialog::About | Dialog::Shortcuts | Dialog::Settings { .. } => Ok(serde_json::Value::Null),
     }
 }
@@ -1292,3 +1555,25 @@ fn choices<V: PartialEq + Copy>(ui: &mut egui::Ui, label: &str, id: &str, option
         }
     });
 }
+
+/// A dialog's one text field: it keeps the focus (except while its own menu has it) and opens
+/// with its text selected, so typing replaces it. True when Return confirms the dialog; Esc
+/// cancels the dialog (`show`). Taking the focus back with a bare `TextEdit` every frame hid the
+/// focus Return gives up, and Return did nothing.
+fn dialog_field(ui: &mut egui::Ui, widget: &str, text: &mut String, hint: &str) -> bool {
+    let r = crate::text_field::TextField::singleline(widget, text).hint(crate::i18n::tr(hint)).width(f32::INFINITY).select_on_focus(true).show(ui);
+    if !r.editing {
+        r.response.request_focus();
+    }
+    r.ending == Some(crate::text_field::Ending::Return)
+}
+
+/// The dialog part `key` is drawn this frame but wasn't the frame before: the dialog has just
+/// opened (to give its first field the focus once).
+fn just_opened(ui: &egui::Ui, key: &str) -> bool {
+    let id = egui::Id::new(("dialog-shown", key));
+    let pass = ui.ctx().cumulative_pass_nr();
+    let last: Option<u64> = ui.data_mut(|d| d.get_temp(id));
+    ui.data_mut(|d| d.insert_temp(id, pass));
+    last.and_then(|l| l.checked_add(1)) != Some(pass)
+}
diff --git a/crates/ui-egui/src/panels/edit.rs b/crates/ui-egui/src/panels/edit.rs
index fb8d121e..56f405ea 100644
--- a/crates/ui-egui/src/panels/edit.rs
+++ b/crates/ui-egui/src/panels/edit.rs
@@ -153,13 +153,38 @@ pub fn show(app: &mut LightcraftApp, ui: &mut egui::Ui, id: PhotoId) {
         control(app, ui, &d, "profile.amount", true);
         ui.add_space(6.0);
     }
+    // a raw carrying its own local tone mapping (Apple ProRAW's gain table map): off renders it as
+    // Lightroom Classic does, on as the camera does
+    if app.session.source_info(id).local_tone.is_some() {
+        egui::Frame::NONE.inner_margin(egui::Margin { left: 24, right: 22, top: 0, bottom: 10 }).show(ui, |ui| {
+            let mut on = d.profile.camera_local_tone;
+            let r = ui.checkbox(&mut on, crate::i18n::tr("Camera local tone mapping"));
+            crate::widgets::register(ui.ctx(), "check:profile.cameraLocalTone", r.rect);
+            if r.on_hover_text(crate::i18n::tr("Apply the local tone mapping stored in the raw (Apple ProRAW), as the camera renders it")).changed() {
+                let _ = app.run("develop.merge", json!({"settings": {"profile": {"camera_local_tone": on}}, "label": "Camera Local Tone Mapping"}));
+            }
+        });
+    }
     divider(ui);
 
     section(app, ui, &d, "light", "Light", |app, ui, d| {
+        hdr_row(app, ui, d);
         for c in ["light.exposure", "light.contrast", "light.highlights", "light.shadows", "light.whites", "light.blacks"] {
             control(app, ui, d, c, true);
         }
         ui.add_space(6.0);
+        if d.hdr.enabled {
+            let open = app.ui.flyout_open("sdrRendition");
+            if flyout_row(ui, "sdrRendition", "SDR Rendition", Icon::Sliders, open).clicked() {
+                app.ui.toggle_flyout("sdrRendition");
+            }
+            if open {
+                for c in ["hdr.sdrBrightness", "hdr.sdrContrast", "hdr.sdrHighlights", "hdr.sdrShadows", "hdr.sdrWhites", "hdr.sdrClarity"] {
+                    control(app, ui, d, c, true);
+                }
+                ui.add_space(6.0);
+            }
+        }
         let open = app.ui.flyout_open("curve");
         if flyout_row(ui, "curve", crate::i18n::tr("Curve"), Icon::Curve, open).clicked() {
             app.ui.toggle_flyout("curve");
@@ -1060,6 +1085,35 @@ fn point_color(app: &mut LightcraftApp, ui: &mut egui::Ui, d: &DevelopSettings)
     });
 }
 
+// ------------------------------------------------------------------------------ HDR
+
+/// The Light panel's HDR row: the HDR switch and Visualize HDR, then (HDR on) the headroom limit.
+fn hdr_row(app: &mut LightcraftApp, ui: &mut egui::Ui, d: &DevelopSettings) {
+    egui::Frame::NONE.inner_margin(egui::Margin { left: 24, right: 22, top: 4, bottom: 4 }).show(ui, |ui| {
+        ui.horizontal(|ui| {
+            let mut on = d.hdr.enabled;
+            if ui.checkbox(&mut on, "HDR").on_hover_text("Edit in HDR: highlights above SDR white, for HDR exports and displays").changed() {
+                let _ = app.run("develop.hdr", json!({"enabled": on}));
+            }
+            if d.hdr.enabled {
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    let mut v = app.ui.hdr_visualize;
+                    if ui
+                        .checkbox(&mut v, "Visualize HDR")
+                        .on_hover_text("Grey below SDR white; yellow, orange, red, magenta up to 1, 2, 3 and over 3 stops above it")
+                        .changed()
+                    {
+                        app.ui.hdr_visualize = v;
+                    }
+                });
+            }
+        });
+    });
+    if d.hdr.enabled {
+        control(app, ui, d, "hdr.maxEv", true);
+    }
+}
+
 // ------------------------------------------------------------------------------ colour grading
 
 fn grading(app: &mut LightcraftApp, ui: &mut egui::Ui, d: &DevelopSettings) {
diff --git a/crates/ui-egui/src/panels/grid.rs b/crates/ui-egui/src/panels/grid.rs
index 579be235..4264e429 100644
--- a/crates/ui-egui/src/panels/grid.rs
+++ b/crates/ui-egui/src/panels/grid.rs
@@ -1,5 +1,9 @@
 //! Photo Grid (justified rows) and Square Grid. Virtualized: only visible cells request thumbnails.
 
+#[cfg(test)]
+#[path = "grid_header_tests.rs"]
+mod header_tests;
+
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 
@@ -137,8 +141,6 @@ fn show_inner(app: &mut LightcraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     let (generation, ids) = app.session.visible_shared();
     // header: source title + count
-    let (hr, _) = ui.allocate_exact_size(vec2(ui.available_width(), 44.0), Sense::hover());
-    ui.painter().rect_filled(hr, 0.0, t.canvas);
     let sel_n = app.session.selection.ids.len();
     let chips = lightcraft_engine::filter_chips(&app.session.filter, &app.session.catalog);
     let total = app.session.source_total();
@@ -147,9 +149,11 @@ fn show_inner(app: &mut LightcraftApp, ui: &mut egui::Ui) {
     match app.session.browse.clone().filter(|_| app.session.source == lightcraft_engine::LibrarySource::Folder) {
         Some(b) => {
             let local = app.caches.grid.local(&app.session.catalog, &ids, generation);
-            folder_header(app, ui, hr, &b, &ids, local, &cnt)
+            folder_header(app, ui, &b, &ids, local, &cnt);
         }
         None => {
+            let (hr, _) = ui.allocate_exact_size(vec2(ui.available_width(), 44.0), Sense::hover());
+            ui.painter().rect_filled(hr, 0.0, t.canvas);
             let full = crate::i18n::source_title(&app.session);
             let count_w = ui.painter().layout_no_wrap(cnt.clone(), t.font(12.5), t.text_dim).size().x;
             // the title gives way to the count: a long album or folder name is trimmed, in full on hover
@@ -665,55 +669,110 @@ fn cell(app: &mut LightcraftApp, ui: &mut egui::Ui, id: PhotoId, r: Rect, square
 
 /// The header of a Local folder view: the path as a breadcrumb (each part opens that folder),
 /// Include subfolders, Add to My Photos.
-fn folder_header(app: &mut LightcraftApp, ui: &mut egui::Ui, hr: Rect, b: &lightcraft_engine::Browse, ids: &[PhotoId], local_n: usize, cnt: &str) {
+fn folder_header(app: &mut LightcraftApp, ui: &mut egui::Ui, b: &lightcraft_engine::Browse, ids: &[PhotoId], local_n: usize, cnt: &str) -> Rect {
     let t = Tokens::get(ui.ctx());
-    let mut child =
-        ui.new_child(egui::UiBuilder::new().max_rect(hr.shrink2(vec2(16.0, 6.0))).layout(egui::Layout::left_to_right(egui::Align::Center)));
-    child.spacing_mut().item_spacing.x = 4.0;
-    let parts: Vec<&str> = b.path.split(['/', '\\']).filter(|p| !p.is_empty()).collect();
-    // the last few parts (the root side is elided)
-    let skip = parts.len().saturating_sub(4);
-    if skip > 0 {
-        child.label(egui::RichText::new("…  ›").color(t.text_dim));
-    }
-    for (i, part) in parts.iter().enumerate().skip(skip) {
-        let last = i + 1 == parts.len();
-        let text = egui::RichText::new(*part).size(13.0).color(if last { t.text } else { t.text_label });
-        let r = child.add(egui::Label::new(if last { text.strong() } else { text }).sense(Sense::click()));
-        register(child.ctx(), format!("crumb:{i}"), r.rect);
-        if !last {
-            if r.hovered() {
-                child.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
+    // The path/count and actions need independent rows. The frame reserves the actual height,
+    // including any wrapped actions, so the grid below never paints under the header.
+    let header = egui::Frame::NONE.fill(t.canvas).inner_margin(egui::Margin::symmetric(16, 6)).show(ui, |ui| {
+        ui.set_width(ui.available_width());
+        ui.horizontal(|ui| {
+            ui.spacing_mut().item_spacing.x = 8.0;
+            let count_w =
+                ui.painter().layout_no_wrap(cnt.to_owned(), t.font(12.5), t.text_dim).size().x.ceil().min((ui.available_width() * 0.45).floor());
+            let path_w = (ui.available_width() - count_w - 8.0).max(0.0).floor();
+            ui.allocate_ui_with_layout(vec2(path_w, 24.0), egui::Layout::left_to_right(egui::Align::Center), |ui| {
+                folder_breadcrumbs(app, ui, &b.path);
+            });
+            let count = ui.add_sized(vec2(count_w, 24.0), egui::Label::new(egui::RichText::new(cnt).size(12.5).color(t.text_dim)).truncate());
+            register(ui.ctx(), "grid:count", count.rect);
+            count.on_hover_text(cnt);
+        });
+        ui.horizontal_wrapped(|ui| {
+            ui.spacing_mut().item_spacing.x = 12.0;
+            ui.style_mut().wrap_mode = Some(egui::TextWrapMode::Wrap);
+            let mut sub = b.subfolders;
+            let c = ui.checkbox(&mut sub, crate::i18n::tr("Include subfolders"));
+            register(ui.ctx(), "check:includeSubfolders", c.rect);
+            if c.changed() {
+                let _ = app.run("library.browse", json!({"path": b.path, "subfolders": sub}));
             }
-            if r.clicked() {
-                let prefix = if b.path.starts_with('/') { format!("/{}", parts[..=i].join("/")) } else { parts[..=i].join("/") };
-                let _ = app.run("library.browse", json!({"path": prefix}));
-            }
-            child.label(egui::RichText::new("›").color(t.text_dim));
-        }
-    }
-    child.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-        ui.label(egui::RichText::new(cnt).size(12.5).color(t.text_dim));
-        ui.add_space(10.0);
-        // counted once per view (cached); the ids are only gathered on a click
-        if local_n > 0 {
-            let label = crate::i18n::tr_format!("Add {local_n} to My Photos", local_n = local_n);
-            if crate::widgets::text_button(ui, "addToLibrary", &label, false).clicked() {
-                let local: Vec<u64> = ids.iter().filter(|id| app.session.catalog.photo(**id).is_some_and(|p| p.local)).map(|id| id.0).collect();
-                let n = local.len();
-                match app.run("photo.addToLibrary", json!({"ids": local})) {
-                    Ok(_) => app.toast(ui.ctx(), crate::i18n::tr_format!("Added {n} photo{} to My Photos", if n == 1 { "" } else { "s" }, n = n)),
-                    Err(e) => app.toast(ui.ctx(), e),
+            // Counted once per view (cached); the ids are only gathered on a click.
+            if local_n > 0 {
+                let label = crate::i18n::tr_format!("Add {local_n} to My Photos", local_n = local_n);
+                let button =
+                    ui.add(egui::Button::new(egui::RichText::new(label).font(t.semibold(11.5)).color(t.text)).wrap().min_size(vec2(37.0, 24.0)));
+                register(ui.ctx(), "button:addToLibrary", button.rect);
+                if button.clicked() {
+                    let local: Vec<u64> = ids.iter().filter(|id| app.session.catalog.photo(**id).is_some_and(|p| p.local)).map(|id| id.0).collect();
+                    let n = local.len();
+                    match app.run("photo.addToLibrary", json!({"ids": local})) {
+                        Ok(_) => app.toast(ui.ctx(), crate::i18n::tr_format!("Added {n} photo{} to My Photos", if n == 1 { "" } else { "s" }, n = n)),
+                        Err(e) => app.toast(ui.ctx(), e),
+                    }
                 }
             }
-        }
-        let mut sub = b.subfolders;
-        let c = ui.checkbox(&mut sub, crate::i18n::tr("Include subfolders"));
-        register(ui.ctx(), "check:includeSubfolders", c.rect);
-        if c.changed() {
-            let _ = app.run("library.browse", json!({"path": b.path, "subfolders": sub}));
-        }
+        });
     });
+    register(ui.ctx(), "grid:folderHeader", header.response.rect);
+    header.response.rect
+}
+
+/// The folders a breadcrumb shows for `path`: each name with the path that opens it, spelled as
+/// in `path` (its separators, a leading `/` or a UNC `\\server\share`; issue #538). A bare drive
+/// (`C:`) gets its separator back: on its own it means the current folder on that drive.
+pub(crate) fn crumbs(path: &str) -> Vec<(&str, String)> {
+    let mut out = Vec::new();
+    let mut start = 0;
+    for (i, c) in path.char_indices().chain(std::iter::once((path.len(), '/'))) {
+        if c != '/' && c != '\\' {
+            continue;
+        }
+        if let Some(part) = path.get(start..i).filter(|p| !p.is_empty()) {
+            let mut to = path.get(..i).unwrap_or(path).to_string();
+            if out.is_empty() && part.ends_with(':') && to == part {
+                to.push(if path.contains('\\') { '\\' } else { '/' });
+            }
+            out.push((part, to));
+        }
+        start = i + c.len_utf8();
+    }
+    out
+}
+
+fn folder_breadcrumbs(app: &mut LightcraftApp, ui: &mut egui::Ui, path: &str) {
+    let t = Tokens::get(ui.ctx());
+    ui.spacing_mut().item_spacing.x = 4.0;
+    let crumbs = crumbs(path);
+    let parts: Vec<&str> = crumbs.iter().map(|(name, _)| *name).collect();
+    // With all sidebars open even four ellipses and their separators can exceed the row.
+    // Prefer the current folder, showing more ancestors as space permits.
+    let visible = ((ui.available_width() / 80.0) as usize).clamp(1, 4);
+    let skip = parts.len().saturating_sub(visible);
+    if skip > 0 {
+        ui.label(egui::RichText::new("…  ›").color(t.text_dim)).on_hover_text(path);
+    }
+    let separator_w = ui.painter().layout_no_wrap("›".into(), t.font(13.0), t.text_dim).size().x + 8.0;
+    for (i, part) in parts.iter().enumerate().skip(skip) {
+        let remaining = parts.len() - i;
+        let last = remaining == 1;
+        // Share the bounded row among the remaining crumbs, leaving room for every separator.
+        let width = ((ui.available_width() - separator_w * (remaining - 1) as f32) / remaining as f32).max(0.0).floor();
+        let text = egui::RichText::new(*part).size(13.0).color(if last { t.text } else { t.text_label });
+        let r = ui.add_sized(vec2(width, 24.0), egui::Label::new(if last { text.strong() } else { text }).truncate().sense(Sense::click()));
+        register(ui.ctx(), format!("crumb:{i}"), r.rect);
+        if !last {
+            if r.hovered() {
+                ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
+            }
+            if r.clicked()
+                && let Some((_, to)) = crumbs.get(i)
+            {
+                let _ = app.run("library.browse", json!({"path": to}));
+            }
+            ui.label(egui::RichText::new("›").size(13.0).color(t.text_dim));
+        }
+        r.on_hover_text(path);
+    }
 }
 
 /// While photos are dragged: a badge at the pointer; the drag ends when the button is up
@@ -742,9 +801,20 @@ pub fn drag_feedback(app: &mut LightcraftApp, ctx: &egui::Context) {
 
 pub use super::filterbar::label_color;
 
-/// "Set Color Label" items (coloured dot + the label's name), shared by context menus.
+/// "Set Color Label" items for the active photo, shared by context menus.
 pub fn label_menu(app: &mut LightcraftApp, ui: &mut egui::Ui) {
     let current = app.session.active().and_then(|id| app.session.catalog.photo(id)).and_then(|p| p.label);
+    if let Some(l) = label_items(app, ui, current, "photoLabel") {
+        let _ = app.run("photo.label", json!({"label": label_param(l)}));
+        ui.close();
+    }
+}
+
+/// The colour label items of a menu (coloured dot + the label's name, then None and Edit Label
+/// Names…), `current` checked; each colour is widget `<widget>:<colour>` (`<widget>:none`) for
+/// the control channel. Returns the choice (`Some(None)`: None).
+pub fn label_items(app: &mut LightcraftApp, ui: &mut egui::Ui, current: Option<ColorLabel>, widget: &str) -> Option<Option<ColorLabel>> {
+    let mut chosen = None;
     for l in ColorLabel::ALL {
         let name = crate::i18n::color_label(&app.session.catalog, l);
         let resp = ui.horizontal(|ui| {
@@ -752,18 +822,26 @@ pub fn label_menu(app: &mut LightcraftApp, ui: &mut egui::Ui) {
             ui.painter().circle_filled(r.center(), 5.0, label_color(l));
             ui.selectable_label(current == Some(l), name)
         });
+        register(ui.ctx(), format!("{widget}:{}", label_param(Some(l))), resp.inner.rect);
         if resp.inner.clicked() {
-            let _ = app.run("photo.label", json!({"label": format!("{l:?}").to_lowercase()}));
-            ui.close();
+            chosen = Some(Some(l));
         }
     }
-    if ui.selectable_label(current.is_none(), crate::i18n::tr("None")).clicked() {
-        let _ = app.run("photo.label", json!({"label": "none"}));
+    let none = ui.selectable_label(current.is_none(), crate::i18n::tr("None"));
+    register(ui.ctx(), format!("{widget}:none"), none.rect);
+    if none.clicked() {
+        chosen = Some(None);
     }
     ui.separator();
     if ui.button(crate::i18n::tr("Edit Label Names…")).clicked() {
         let _ = app.run("dialog.labelNames", json!({}));
     }
+    chosen
+}
+
+/// A label as the `label` parameter of `photo.label` / `folder.label` names it.
+pub fn label_param(l: Option<ColorLabel>) -> String {
+    l.map_or_else(|| "none".to_string(), |l| format!("{l:?}").to_lowercase())
 }
 
 /// Stack badge at the cell's top-left: the photo count on a collapsed stack's top, `i/n` on the
diff --git a/crates/ui-egui/src/panels/grid_header_tests.rs b/crates/ui-egui/src/panels/grid_header_tests.rs
new file mode 100644
index 00000000..46399162
--- /dev/null
+++ b/crates/ui-egui/src/panels/grid_header_tests.rs
@@ -0,0 +1,86 @@
+use egui::{Rect, vec2};
+
+use crate::{LightcraftApp, Services, headless::HeadlessView, i18n::Locale};
+
+/// Issue #538: a breadcrumb opens its folder spelled as the path is, keeping a UNC share's leading
+/// `\\` and giving a bare drive its root back.
+#[test]
+fn breadcrumbs_open_their_folder_as_spelled() {
+    let to = |path: &str| super::crumbs(path).into_iter().map(|(name, to)| (name.to_string(), to)).collect::<Vec<_>>();
+    let pairs = |v: &[(&str, &str)]| v.iter().map(|(a, b)| (a.to_string(), b.to_string())).collect::<Vec<_>>();
+    assert_eq!(to("/Users/me/Pictures"), pairs(&[("Users", "/Users"), ("me", "/Users/me"), ("Pictures", "/Users/me/Pictures")]));
+    assert_eq!(to(r"C:\Users\me"), pairs(&[("C:", r"C:\"), ("Users", r"C:\Users"), ("me", r"C:\Users\me")]));
+    assert_eq!(to("C:/Users"), pairs(&[("C:", "C:/"), ("Users", "C:/Users")]));
+    assert_eq!(to(r"\\server\share\photos"), pairs(&[("server", r"\\server"), ("share", r"\\server\share"), ("photos", r"\\server\share\photos")]));
+    assert_eq!(to("relative/dir/"), pairs(&[("relative", "relative"), ("dir", "relative/dir")]));
+    assert_eq!(to("/Fotos/día 1/写真"), pairs(&[("Fotos", "/Fotos"), ("día 1", "/Fotos/día 1"), ("写真", "/Fotos/día 1/写真")]));
+    assert!(to("").is_empty() && to("/").is_empty() && to(r"\\").is_empty());
+}
+
+fn text_bounds(shape: &egui::Shape, out: &mut Vec<Rect>) {
+    match shape {
+        egui::Shape::Text(text) => out.push(text.visual_bounding_rect()),
+        egui::Shape::Vec(shapes) => shapes.iter().for_each(|s| text_bounds(s, out)),
+        _ => {}
+    }
+}
+
+#[test]
+fn local_folder_header_text_and_controls_do_not_overlap() {
+    for locale in [Locale::En, Locale::De, Locale::PtBr] {
+        for width in [136.0, 200.0, 320.0, 590.0, 1100.0] {
+            for scale in [1.0, 2.0] {
+                for (path, local_n) in [
+                    ("/Volumes/External drive/Photography archive/Trips and holidays/A very long folder name with many photographs to import", 2408),
+                    ("/A very long folder name with many photographs to import", 2408),
+                    (r"C:\Users\Photographer\Pictures\A very long folder name with many photographs to import", 2408),
+                    ("/Pictures", 0),
+                ] {
+                    let mut app = LightcraftApp::new(lightcraft_engine::Session::new(), Services::default());
+                    let browse = lightcraft_engine::Browse { path: path.into(), subfolders: false };
+                    let ctx = egui::Context::default();
+                    crate::i18n::set_language(locale);
+                    crate::theme::install_fonts(&ctx);
+                    crate::theme::apply(&ctx);
+                    let counted = crate::i18n::tr_format!("{sel_n} selected · {counted}", sel_n = 2408, counted = "2408 photos");
+                    let mut texts = Vec::new();
+                    let mut widgets = Vec::new();
+                    let mut header = Rect::NOTHING;
+                    for frame in 0..3 {
+                        let raw = HeadlessView::raw_input(vec2(width, 300.0), scale, frame as f64 / 60.0, vec![]);
+                        let mut out = ctx.run_ui(raw, |ui| {
+                            egui::CentralPanel::default().frame(egui::Frame::NONE).show(ui, |ui| {
+                                header = super::folder_header(&mut app, ui, &browse, &[], local_n, &counted);
+                                let (grid, _) = ui.allocate_exact_size(vec2(ui.available_width(), 100.0), egui::Sense::hover());
+                                assert!(grid.top() >= header.bottom(), "wrapped controls must reserve space above the grid");
+                            });
+                        });
+                        out.textures_delta.clear();
+                        texts.clear();
+                        for shape in &out.shapes {
+                            text_bounds(&shape.shape, &mut texts);
+                        }
+                        widgets = crate::widgets::take_registry(&ctx);
+                    }
+                    crate::i18n::set_language(Locale::En);
+                    assert!(header.left() >= 0.0 && header.right() <= width, "header must not expand past the centre pane: {header:?}");
+                    let check = widgets.iter().find(|(id, _)| id == "check:includeSubfolders").unwrap().1;
+                    assert!(widgets.iter().any(|(id, _)| id.starts_with("crumb:")));
+                    assert_eq!(widgets.iter().any(|(id, _)| id == "button:addToLibrary"), local_n > 0);
+                    for (id, rect) in &widgets {
+                        assert!(header.contains_rect(*rect), "{locale:?} {width} {scale}: {id} outside header: {rect:?}");
+                        if id.starts_with("crumb:") {
+                            assert!(!rect.intersects(check), "breadcrumb overlaps Include subfolders");
+                        }
+                    }
+                    for (i, a) in texts.iter().enumerate() {
+                        assert!(header.expand(1.0).contains_rect(*a), "{locale:?} {width} {scale}: text outside header: {a:?}");
+                        for b in texts.iter().skip(i + 1) {
+                            assert!(!a.intersects(*b), "{locale:?} {width} {scale}: painted text overlaps: {a:?} / {b:?}");
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/src/panels/keyword_list.rs b/crates/ui-egui/src/panels/keyword_list.rs
new file mode 100644
index 00000000..f201359d
--- /dev/null
+++ b/crates/ui-egui/src/panels/keyword_list.rs
@@ -0,0 +1,621 @@
+//! The Keyword List (Lightroom Classic's Keyword List panel), in the right panel's Keywords: every
+//! keyword of the library, those without photos too, as a tree with photo counts. A tick box per
+//! keyword gives it to the selected photos or takes it away; the arrow shows the photos with it.
+
+use egui::{Align2, Color32, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
+use lightcraft_catalog::keywords::{KeywordInfo, KeywordNode, same};
+use lightcraft_catalog::{Catalog, PhotoId};
+use serde_json::json;
+
+use crate::LightcraftApp;
+use crate::state::Dialog;
+use crate::theme::Tokens;
+use crate::widgets::register;
+
+/// Rows are this tall; each level is indented this much.
+const ROW_H: f32 = 24.0;
+const INDENT: f32 = 14.0;
+
+/// The Keyword List section: a filter box, then the rows.
+pub fn show(app: &mut LightcraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    crate::widgets::divider(ui);
+    // the title, where a dragged keyword goes back to the top level
+    let (title, _) = ui.allocate_exact_size(vec2(ui.available_width(), 46.0), Sense::hover());
+    register(ui.ctx(), "keywordList:topLevel", title);
+    let dragging = app.ui.dragging_keyword.clone();
+    let (pointer, released) = ui.input(|i| (i.pointer.latest_pos(), i.pointer.any_released()));
+    let over_title = shown_under(ui, title, pointer);
+    if dragging.is_some() && over_title {
+        ui.painter().rect_stroke(title.shrink2(vec2(16.0, 6.0)), 4.0, Stroke::new(1.5, t.accent), StrokeKind::Inside);
+    }
+    let heading = if dragging.is_some() { crate::i18n::tr("Drop here for the top level") } else { crate::i18n::tr("Keyword List") };
+    ui.painter().text(pos2(title.left() + 24.0, title.center().y + 2.0), Align2::LEFT_CENTER, heading, t.semibold(15.0), t.text);
+    if released
+        && over_title
+        && let Some(k) = dragging.clone()
+    {
+        drop_keyword(app, ui.ctx(), &k, None);
+    }
+    let fid = egui::Id::new("keyword-list-filter");
+    let mut filter: String = ui.data(|d| d.get_temp(fid)).unwrap_or_default();
+    ui.horizontal(|ui| {
+        ui.add_space(24.0);
+        crate::text_field::TextField::singleline("field:keywordFilter", &mut filter)
+            .hint(crate::i18n::tr("Filter Keywords"))
+            .width(ui.available_width() - 82.0)
+            .show(ui);
+        // + creates a keyword (inside the picked one), − deletes the picked one
+        let plus = ui.button("+").on_hover_text(crate::i18n::tr("Create Keyword Tag"));
+        register(ui.ctx(), "keywordList:create", plus.rect);
+        if plus.clicked() {
+            app.ui.dialog = Some(create_dialog(app));
+        }
+        let picked = app.ui.keyword_list_selected.clone().filter(|k| in_tree(&app.caches.keyword_tree(&app.session.catalog), k));
+        let minus = ui.add_enabled(picked.is_some(), egui::Button::new("−")).on_hover_text(crate::i18n::tr("Delete Keyword"));
+        register(ui.ctx(), "keywordList:delete", minus.rect);
+        if minus.clicked()
+            && let Some(k) = picked
+        {
+            app.ui.dialog = Some(delete_dialog(app, &k));
+        }
+    });
+    ui.data_mut(|d| d.insert_temp(fid, filter.clone()));
+    ui.add_space(6.0);
+    let tree = app.caches.keyword_tree(&app.session.catalog);
+    let open = app.ui.keyword_list_open.clone();
+    let rows = rows(&tree, &filter, &|p| open.iter().any(|o| same(o, p)));
+    if rows.is_empty() {
+        let none = if filter.trim().is_empty() { "No keywords yet" } else { "No keywords match" };
+        ui.horizontal(|ui| {
+            ui.add_space(24.0);
+            ui.label(egui::RichText::new(crate::i18n::tr(none)).color(t.text_dim));
+        });
+    }
+    let selection = app.session.targets(&serde_json::Value::Null);
+    let ticks = app.caches.keyword_ticks(&app.session.catalog, &selection);
+    for r in &rows {
+        row(app, ui, r, &selection, &ticks, filter.trim().is_empty());
+    }
+    ui.add_space(12.0);
+}
+
+/// After the keyword `from` became `to` (renamed, moved or merged), the list's pick and open
+/// levels follow it, and the levels containing it open so that it stays in sight.
+pub(crate) fn follow(app: &mut LightcraftApp, from: &str, to: &str) {
+    use lightcraft_catalog::keywords::{is_under, reparent};
+    let to = app.session.catalog.keyword_path(to).unwrap_or_else(|| to.to_string());
+    if let Some(k) = app.ui.keyword_list_selected.clone()
+        && is_under(&k, from)
+    {
+        app.ui.keyword_list_selected = Some(reparent(&k, from, &to));
+    }
+    for o in &mut app.ui.keyword_list_open {
+        if is_under(o, from) {
+            *o = reparent(o, from, &to).to_lowercase();
+        }
+    }
+    let levels: Vec<&str> = to.split('|').collect();
+    for n in 1..levels.len() {
+        let parent = levels.get(..n).map(|l| l.join("|").to_lowercase()).unwrap_or_default();
+        if !app.ui.keyword_list_open.iter().any(|o| same(o, &parent)) {
+            app.ui.keyword_list_open.push(parent);
+        }
+    }
+}
+
+/// The pointer is on the part of `rect` that is shown: inside it and inside the panel's visible
+/// (scrolled) area, so a drop never lands on a row or title hidden under the top bar.
+fn shown_under(ui: &egui::Ui, rect: Rect, pointer: Option<egui::Pos2>) -> bool {
+    pointer.is_some_and(|p| rect.contains(p) && ui.clip_rect().contains(p))
+}
+
+/// A keyword being dragged, each frame (after the panels, which take the drop): its name follows
+/// the pointer, and the drag ends with the button's release wherever it is (the list may be gone
+/// by then) or with Esc.
+pub fn drag_feedback(app: &mut LightcraftApp, ctx: &egui::Context) {
+    let Some(keyword) = app.ui.dragging_keyword.clone() else { return };
+    let (released, down, at, esc) =
+        ctx.input(|i| (i.pointer.any_released(), i.pointer.any_down(), i.pointer.latest_pos(), i.key_pressed(egui::Key::Escape)));
+    if released || !down || esc {
+        app.ui.dragging_keyword = None;
+        return;
+    }
+    let Some(at) = at else { return };
+    let t = Tokens::get(ctx);
+    ctx.set_cursor_icon(egui::CursorIcon::Grabbing);
+    let name = keyword.rsplit('|').next().unwrap_or(&keyword).to_string();
+    egui::Area::new(egui::Id::new("drag-keyword")).order(egui::Order::Tooltip).interactable(false).fixed_pos(at + vec2(14.0, 10.0)).show(ctx, |ui| {
+        egui::Frame::NONE.fill(t.accent).corner_radius(10.0).inner_margin(egui::Margin::symmetric(9, 3)).show(ui, |ui| {
+            ui.label(egui::RichText::new(name).color(Color32::WHITE).font(t.semibold(12.0)));
+        });
+    });
+}
+
+/// Drop the dragged `keyword` inside `parent` (`None`: the top level). Where one of its name is
+/// already, ask before merging the two; where it is already, nothing happens.
+fn drop_keyword(app: &mut LightcraftApp, ctx: &egui::Context, keyword: &str, parent: Option<&str>) {
+    app.ui.dragging_keyword = None;
+    let cat = &app.session.catalog;
+    let leaf = keyword.rsplit('|').next().unwrap_or(keyword);
+    let parent = parent.map(|p| cat.keyword_path(p).unwrap_or_else(|| p.to_string()));
+    if parent.as_deref().is_some_and(|p| lightcraft_catalog::keywords::is_under(p, keyword)) {
+        return;
+    }
+    let to = parent.as_deref().map_or_else(|| leaf.to_string(), |p| format!("{p}|{leaf}"));
+    if same(&to, keyword) {
+        return;
+    }
+    if cat.has_keyword(&to) {
+        app.ui.dialog = Some(Dialog::MoveKeyword { keyword: keyword.to_string(), parent });
+        return;
+    }
+    match app.run("keyword.move", json!({"keyword": keyword, "parent": parent})) {
+        Ok(_) => follow(app, keyword, &to),
+        Err(e) => app.toast(ctx, e),
+    }
+}
+
+/// One keyword's row: the triangle, the tick box, the name, the count, and on hover the arrow.
+/// `can_fold`: the triangle opens and closes the level (not while a filter opens it).
+fn row(app: &mut LightcraftApp, ui: &mut egui::Ui, r: &Row, selection: &[PhotoId], ticks: &Ticks, can_fold: bool) {
+    let t = Tokens::get(ui.ctx());
+    let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), ROW_H), Sense::click_and_drag());
+    register(ui.ctx(), format!("keywordRow:{}", r.path), rect);
+    if resp.drag_started() {
+        app.ui.dragging_keyword = Some(r.path.clone());
+    }
+    drop_target(app, ui, rect, &r.path);
+    let picked = app.ui.keyword_list_selected.as_deref().is_some_and(|k| same(k, &r.path));
+    let inner = Rect::from_min_max(rect.min + vec2(16.0, 0.0), rect.max - vec2(16.0, 0.0));
+    if picked {
+        ui.painter().rect_filled(inner, 4.0, t.canvas);
+    } else if resp.hovered() {
+        ui.painter().rect_filled(inner, 4.0, t.hover.gamma_multiply(0.6));
+    }
+    let x = inner.left() + 4.0 + r.depth as f32 * INDENT;
+    let cy = rect.center().y;
+    // the triangle
+    if r.has_children {
+        let c = pos2(x + 6.0, cy);
+        let tri = Rect::from_center_size(c, vec2(14.0, 14.0));
+        let tr = ui.interact(tri, egui::Id::new(("keyword-list-tri", r.path.to_lowercase())), Sense::click());
+        register(ui.ctx(), format!("keywordRowToggle:{}", r.path), tri);
+        let pts = if r.open {
+            vec![c + vec2(-4.0, -2.0), c + vec2(4.0, -2.0), c + vec2(0.0, 3.0)]
+        } else {
+            vec![c + vec2(-2.0, -4.0), c + vec2(3.0, 0.0), c + vec2(-2.0, 4.0)]
+        };
+        // while a filter opens the levels the triangle does nothing: it doesn't light up either
+        let lit = tr.hovered() && can_fold;
+        ui.painter().add(egui::Shape::convex_polygon(pts, if lit { t.text } else { t.text_dim }, Stroke::NONE));
+        if tr.clicked() && can_fold {
+            let key = r.path.to_lowercase();
+            if r.open {
+                app.ui.keyword_list_open.retain(|o| !same(o, &key));
+            } else {
+                app.ui.keyword_list_open.push(key);
+            }
+        }
+    }
+    // the tick box: does the selection have it?
+    let state = ticks.tick(&r.path);
+    let boxr = Rect::from_center_size(pos2(x + 22.0, cy), vec2(13.0, 13.0));
+    let on = !selection.is_empty();
+    // (it senses drags too, so a press there that moves doesn't pick the keyword up)
+    let sense = if on { Sense::click_and_drag() } else { Sense::hover() };
+    let tb = ui.interact(boxr.expand(3.0), egui::Id::new(("keyword-list-tick", r.path.to_lowercase())), sense);
+    register(ui.ctx(), format!("keywordCheck:{}", r.path), boxr);
+    let edge = if on { t.text_label } else { t.text_dim.gamma_multiply(0.5) };
+    match state {
+        Tick::All => {
+            ui.painter().rect_filled(boxr, 2.0, t.accent);
+            let pts = vec![boxr.left_center() + vec2(2.5, 0.0), boxr.center_bottom() + vec2(-1.0, -3.0), boxr.right_top() + vec2(-2.5, 3.0)];
+            ui.painter().add(egui::Shape::line(pts, Stroke::new(1.6, Color32::WHITE)));
+        }
+        Tick::Some => {
+            ui.painter().rect_stroke(boxr, 2.0, Stroke::new(1.0, edge), StrokeKind::Inside);
+            ui.painter().line_segment([boxr.left_center() + vec2(3.0, 0.0), boxr.right_center() - vec2(3.0, 0.0)], Stroke::new(1.6, t.text));
+        }
+        Tick::No => {
+            ui.painter().rect_stroke(boxr, 2.0, Stroke::new(1.0, edge), StrokeKind::Inside);
+        }
+    }
+    // (with nothing selected it does nothing, and says nothing)
+    let tb = if on {
+        tb.on_hover_text(crate::i18n::tr(match state {
+            Tick::All => "Remove from Selected Photos",
+            _ => "Add to Selected Photos",
+        }))
+    } else {
+        tb
+    };
+    if tb.clicked() {
+        let key = if state == Tick::All { "removeKeywords" } else { "addKeywords" };
+        let _ = app.run("photo.setMeta", json!({key: [r.path]}));
+    }
+    // the count, then the arrow left of it (shown on hover)
+    let count = ui.painter().layout_no_wrap(r.count.to_string(), t.font(12.0), t.text_dim);
+    let count_rect = Rect::from_min_size(pos2(inner.right() - 6.0 - count.size().x, cy - count.size().y / 2.0), count.size());
+    register(ui.ctx(), format!("keywordCount:{}", r.path), count_rect);
+    ui.painter().galley(count_rect.min, count, t.text_dim);
+    let arrow = Rect::from_center_size(pos2(count_rect.left() - 12.0, cy), vec2(16.0, 16.0));
+    let ar = ui.interact(arrow, egui::Id::new(("keyword-list-show", r.path.to_lowercase())), Sense::click());
+    register(ui.ctx(), format!("keywordShow:{}", r.path), arrow);
+    if resp.hovered() || ar.hovered() {
+        ui.painter().text(arrow.center(), Align2::CENTER_CENTER, "→", t.font(13.0), if ar.hovered() { t.text } else { t.text_dim });
+    }
+    if ar.on_hover_text(crate::i18n::tr("Show Photos with Keyword")).clicked() {
+        super::left::browse_all_photos(app, true);
+        let _ = app.run("library.filter", json!({"keyword": r.path}));
+    }
+    // the name, cut short before the arrow
+    let room = (arrow.left() - 4.0 - (x + 34.0)).max(0.0);
+    let font = t.font(13.0);
+    let measure = |s: &str| ui.painter().layout_no_wrap(s.to_string(), font.clone(), t.text_label).size().x;
+    let name = if measure(&r.name) <= room { r.name.clone() } else { crate::widgets::elide_head(&r.name, room, measure) };
+    let label = ui.painter().text(pos2(x + 34.0, cy), Align2::LEFT_CENTER, name, font.clone(), if picked { t.text } else { t.text_label });
+    // where new keywords go (Put New Keywords Inside This Keyword): a dot after the name
+    if app.session.catalog.default_keyword_parent().as_deref().is_some_and(|k| same(k, &r.path)) {
+        let dot = Rect::from_center_size(pos2(label.right() + 7.0, cy), vec2(6.0, 6.0));
+        ui.painter().circle_filled(dot.center(), 3.0, t.accent);
+        register(ui.ctx(), format!("keywordDefault:{}", r.path), dot);
+    }
+    let resp = resp.on_hover_text(r.path.replace('|', " › "));
+    if resp.clicked() {
+        app.ui.keyword_list_selected = Some(r.path.clone());
+    }
+    if resp.double_clicked() {
+        app.ui.dialog = Some(edit_dialog(app, &r.path));
+    }
+    resp.context_menu(|ui| menu(app, ui, &r.path, selection));
+}
+
+/// A row while a keyword or photos are dragged: outlined under the pointer when the drop would
+/// do something (a keyword never goes inside itself), and a release there does it: nests the
+/// keyword inside this one, or gives this keyword to the photos.
+fn drop_target(app: &mut LightcraftApp, ui: &mut egui::Ui, rect: Rect, path: &str) {
+    let (pointer, released) = ui.input(|i| (i.pointer.latest_pos(), i.pointer.any_released()));
+    if !shown_under(ui, rect, pointer) {
+        return;
+    }
+    let t = Tokens::get(ui.ctx());
+    let outline = |ui: &egui::Ui| ui.painter().rect_stroke(rect.shrink2(vec2(16.0, 1.0)), 4.0, Stroke::new(1.5, t.accent), StrokeKind::Inside);
+    if let Some(k) = app.ui.dragging_keyword.clone() {
+        if lightcraft_catalog::keywords::is_under(path, &k) {
+            return;
+        }
+        outline(ui);
+        if released {
+            drop_keyword(app, ui.ctx(), &k, Some(path));
+        }
+    } else if let Some(ids) = app.ui.dragging_photos.clone() {
+        outline(ui);
+        if released {
+            // only the photos that didn't have it get it
+            let lacking = |id: &u64| {
+                app.session
+                    .catalog
+                    .photo(PhotoId(*id))
+                    .is_some_and(|p| !p.meta.keywords.iter().any(|k| same(&lightcraft_catalog::keywords::clean(k), path)))
+            };
+            let n = ids.iter().filter(|id| lacking(id)).count();
+            app.ui.dragging_photos = None;
+            match app.run("photo.setMeta", json!({"ids": ids, "addKeywords": [path]})) {
+                Ok(_) => app.toast(
+                    ui.ctx(),
+                    crate::i18n::tr_format!(
+                        "Added “{keyword}” to {n} photo{}",
+                        if n == 1 { "" } else { "s" },
+                        keyword = path.replace('|', " › "),
+                        n = n
+                    ),
+                ),
+                Err(e) => app.toast(ui.ctx(), e),
+            }
+        }
+    }
+}
+
+/// A keyword's context menu.
+fn menu(app: &mut LightcraftApp, ui: &mut egui::Ui, path: &str, selection: &[PhotoId]) {
+    let name = path.replace('|', " › ");
+    let item = |ui: &mut egui::Ui, id: &str, label: &str, enabled: bool| {
+        let r = ui.add_enabled(enabled, egui::Button::new(label));
+        register(ui.ctx(), format!("keywordMenu:{id}"), r.rect);
+        r.clicked()
+    };
+    if item(ui, "create", &crate::i18n::tr_format!("Create Keyword Tag Inside “{name}”…", name = name), true) {
+        let mut d = create_dialog(app);
+        if let Dialog::KeywordTag { parent, inside, .. } = &mut d {
+            *parent = Some(path.to_string());
+            *inside = true;
+        }
+        app.ui.dialog = Some(d);
+    }
+    if item(ui, "edit", crate::i18n::tr("Edit Keyword Tag…"), true) {
+        app.ui.dialog = Some(edit_dialog(app, path));
+    }
+    let is_default = app.session.catalog.default_keyword_parent().as_deref().is_some_and(|k| same(k, path));
+    let label = format!("{}{}", if is_default { "✓ " } else { "" }, crate::i18n::tr("Put New Keywords Inside This Keyword"));
+    if item(ui, "defaultParent", &label, true) {
+        let _ = app.run("keyword.setDefaultParent", json!({"keyword": if is_default { serde_json::Value::Null } else { json!(path) }}));
+    }
+    ui.separator();
+    let some = !selection.is_empty();
+    if item(ui, "add", crate::i18n::tr("Add to Selected Photos"), some) {
+        let _ = app.run("photo.setMeta", json!({"addKeywords": [path]}));
+    }
+    if item(ui, "remove", crate::i18n::tr("Remove from Selected Photos"), some) {
+        let _ = app.run("photo.setMeta", json!({"removeKeywords": [path]}));
+    }
+    if item(ui, "show", crate::i18n::tr("Show Photos with Keyword"), true) {
+        super::left::browse_all_photos(app, true);
+        let _ = app.run("library.filter", json!({"keyword": path}));
+    }
+    ui.separator();
+    if item(ui, "purge", crate::i18n::tr("Purge Unused Keywords"), true) {
+        let _ = app.run("keyword.purgeUnused", json!({}));
+    }
+    if item(ui, "delete", crate::i18n::tr("Delete Keyword…"), true) {
+        app.ui.dialog = Some(delete_dialog(app, path));
+    }
+}
+
+/// Create Keyword Tag: inside the keyword picked in the list, else the default parent.
+pub(crate) fn create_dialog(app: &LightcraftApp) -> Dialog {
+    let parent =
+        app.ui.keyword_list_selected.clone().filter(|k| app.session.catalog.has_keyword(k)).or_else(|| app.session.catalog.default_keyword_parent());
+    let d = KeywordInfo::default();
+    Dialog::KeywordTag {
+        editing: None,
+        name: String::new(),
+        inside: parent.is_some(),
+        parent,
+        synonyms: String::new(),
+        include_on_export: d.include_on_export,
+        export_containing: d.export_containing,
+        export_synonyms: d.export_synonyms,
+        person: d.person,
+        add_to_selected: false,
+    }
+}
+
+/// Edit Keyword Tag for `path`, showing its name and attributes.
+pub(crate) fn edit_dialog(app: &LightcraftApp, path: &str) -> Dialog {
+    let path = app.session.catalog.keyword_path(path).unwrap_or_else(|| path.to_string());
+    let info = app.session.catalog.keyword_info(&path).cloned().unwrap_or_default();
+    Dialog::KeywordTag {
+        name: path.rsplit('|').next().unwrap_or(&path).to_string(),
+        editing: Some(path),
+        parent: None,
+        inside: false,
+        synonyms: info.synonyms.join(", "),
+        include_on_export: info.include_on_export,
+        export_containing: info.export_containing,
+        export_synonyms: info.export_synonyms,
+        person: info.person,
+        add_to_selected: false,
+    }
+}
+
+/// Delete Keyword, saying how many photos have it.
+pub(crate) fn delete_dialog(app: &LightcraftApp, path: &str) -> Dialog {
+    let keyword = app.session.catalog.keyword_path(path).unwrap_or_else(|| path.to_string());
+    let count = app
+        .session
+        .catalog
+        .photos()
+        .filter(|p| p.in_library() && p.meta.keywords.iter().any(|k| lightcraft_catalog::keywords::is_under(k, &keyword)))
+        .count();
+    Dialog::DeleteKeyword { keyword, count }
+}
+
+/// One row of the Keyword List as drawn.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct Row {
+    pub path: String,
+    pub name: String,
+    /// Levels below the top (0 = a top-level keyword).
+    pub depth: usize,
+    pub count: usize,
+    pub has_children: bool,
+    /// Its children are shown.
+    pub open: bool,
+}
+
+/// The rows to draw: the tree with its levels open as `open` says (by path, any case). With a
+/// `filter`, the keywords whose name contains it (any case) and the keywords containing them,
+/// opened so that they show.
+pub(crate) fn rows(tree: &[KeywordNode], filter: &str, open: &dyn Fn(&str) -> bool) -> Vec<Row> {
+    let filter = filter.trim().to_lowercase();
+    let mut out = Vec::new();
+    add_rows(tree, 0, &filter, open, &mut out);
+    out
+}
+
+/// A node holds a match: its name, or a name below it.
+fn holds(n: &KeywordNode, filter: &str) -> bool {
+    n.name.to_lowercase().contains(filter) || n.children.iter().any(|c| holds(c, filter))
+}
+
+fn add_rows(nodes: &[KeywordNode], depth: usize, filter: &str, open: &dyn Fn(&str) -> bool, out: &mut Vec<Row>) {
+    for n in nodes {
+        // filtering: a match, or a keyword containing one, opened down to it
+        let below = n.children.iter().any(|c| holds(c, filter));
+        if !filter.is_empty() && !below && !n.name.to_lowercase().contains(filter) {
+            continue;
+        }
+        let is_open = if filter.is_empty() { open(&n.path) } else { below };
+        out.push(Row { path: n.path.clone(), name: n.name.clone(), depth, count: n.count, has_children: !n.children.is_empty(), open: is_open });
+        if is_open {
+            add_rows(&n.children, depth + 1, filter, open, out);
+        }
+    }
+}
+
+/// Whether the selected photos have a keyword: the tick box's state.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Tick {
+    /// None of them (or nothing is selected).
+    No,
+    /// Some of them: the box shows a dash.
+    Some,
+    /// All of them.
+    All,
+}
+
+/// How many of a selection's photos have each keyword itself, counted once per selection (and
+/// library change) rather than per row and frame: a long list with thousands of photos selected
+/// stays fast.
+#[derive(Debug, Default)]
+pub(crate) struct Ticks {
+    photos: usize,
+    /// Photos with it, by cleaned lower-case keyword.
+    counts: std::collections::HashMap<String, usize>,
+}
+
+impl Ticks {
+    pub(crate) fn of(catalog: &Catalog, photos: &[PhotoId]) -> Ticks {
+        let photos = super::keywording::distinct(catalog, photos);
+        let mut counts: std::collections::HashMap<String, usize> = Default::default();
+        let mut seen = std::collections::HashSet::new();
+        for p in &photos {
+            seen.clear();
+            for k in &p.meta.keywords {
+                let key = lightcraft_catalog::keywords::clean(k).to_lowercase();
+                if seen.insert(key.clone()) {
+                    *counts.entry(key).or_default() += 1;
+                }
+            }
+        }
+        Ticks { photos: photos.len(), counts }
+    }
+
+    /// The tick box of `path`: a photo counts when it has the keyword itself (any case); one with
+    /// only a keyword below it doesn't.
+    pub(crate) fn tick(&self, path: &str) -> Tick {
+        match self.counts.get(&lightcraft_catalog::keywords::clean(path).to_lowercase()).copied().unwrap_or(0) {
+            0 => Tick::No,
+            n if n >= self.photos => Tick::All,
+            _ => Tick::Some,
+        }
+    }
+}
+
+/// The keyword is in the tree (any case).
+fn in_tree(tree: &[KeywordNode], path: &str) -> bool {
+    tree.iter().any(|n| same(&n.path, path) || (lightcraft_catalog::keywords::is_under(path, &n.path) && in_tree(&n.children, path)))
+}
+
+#[cfg(test)]
+mod tests {
+    use lightcraft_catalog::{Op, Photo, Source};
+
+    use super::*;
+
+    fn library(keywords: &[&[&str]]) -> (Catalog, Vec<PhotoId>) {
+        let mut c = Catalog::new();
+        let mut ids = Vec::new();
+        for k in keywords {
+            let id = c.alloc_photo_id();
+            let mut p = Photo::new(id, Source::Demo { scene: 1 }, "a.jpg", "JPEG", 3, 2, "2026-01-01");
+            p.meta.keywords = k.iter().map(|s| s.to_string()).collect();
+            c.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+            ids.push(id);
+        }
+        (c, ids)
+    }
+
+    fn shown(rows: &[Row]) -> Vec<(String, usize, usize)> {
+        rows.iter().map(|r| (r.path.clone(), r.depth, r.count)).collect()
+    }
+
+    /// The list shows the top level, and the keywords below a level once it is open.
+    #[test]
+    fn the_list_shows_the_levels_that_are_open() {
+        let (c, _) = library(&[&["travel|Italy|Rome", "beach"], &["travel|Spain"]]);
+        let tree = c.keyword_tree();
+        let closed = rows(&tree, "", &|_| false);
+        assert_eq!(shown(&closed), [("beach".to_string(), 0, 1), ("travel".to_string(), 0, 2)]);
+        assert!(closed[1].has_children && !closed[1].open && !closed[0].has_children);
+        let open = rows(&tree, "", &|p| p.eq_ignore_ascii_case("TRAVEL"));
+        assert_eq!(
+            shown(&open),
+            [("beach".to_string(), 0, 1), ("travel".to_string(), 0, 2), ("travel|Italy".to_string(), 1, 1), ("travel|Spain".to_string(), 1, 1)]
+        );
+    }
+
+    /// Filtering shows the keywords whose name holds the text, whatever its case, with the keywords
+    /// containing them opened down to them; keywords below a match aren't shown unless they match.
+    #[test]
+    fn filtering_shows_the_matches_with_their_parents() {
+        let (c, _) = library(&[&["travel|Italy|Rome", "travel|Spain|Ronda", "beach"]]);
+        let tree = c.keyword_tree();
+        let found = rows(&tree, "RO", &|_| false);
+        assert_eq!(
+            found.iter().map(|r| r.path.as_str()).collect::<Vec<_>>(),
+            ["travel", "travel|Italy", "travel|Italy|Rome", "travel|Spain", "travel|Spain|Ronda"]
+        );
+        assert!(found.iter().filter(|r| r.has_children).all(|r| r.open));
+        assert_eq!(rows(&tree, "italy", &|_| false).iter().map(|r| r.path.as_str()).collect::<Vec<_>>(), ["travel", "travel|Italy"]);
+        assert!(rows(&tree, "lisbon", &|_| false).is_empty());
+    }
+
+    /// The tick box: ticked when every selected photo has the keyword itself, a dash when some do,
+    /// empty when none do or nothing is selected. Counted once per selection.
+    #[test]
+    fn the_tick_box_says_how_many_selected_photos_have_the_keyword() {
+        let (c, ids) = library(&[&["Travel|Italy"], &["travel|italy", "beach"], &["travel|spain"]]);
+        assert_eq!(Ticks::of(&c, &ids[..2]).tick("travel|Italy"), Tick::All, "whatever the case");
+        let all = Ticks::of(&c, &ids);
+        assert_eq!(all.tick("travel|Italy"), Tick::Some);
+        assert_eq!(all.tick("travel"), Tick::No, "a keyword below doesn't tick its parent");
+        assert_eq!(Ticks::of(&c, &[]).tick("beach"), Tick::No);
+        assert_eq!(Ticks::of(&c, &ids[2..]).tick("beach"), Tick::No);
+        // any letter's case, not only ASCII; a photo with it twice counts once
+        let (c, ids) = library(&[&["Ärzte", "ÄRZTE"], &[]]);
+        assert_eq!(Ticks::of(&c, &ids).tick("ärzte"), Tick::Some);
+    }
+
+    /// The labels the Keyword List and its dialogs pass to `tr` through variables (out of reach of
+    /// a literal search) are translated in every language.
+    #[test]
+    fn labels_passed_through_variables_are_translated() {
+        use crate::i18n::Locale;
+        let labels = [
+            "Include on Export",
+            "Export Containing Keywords",
+            "Export Synonyms",
+            "Person",
+            "Merge Keywords",
+            "No keywords yet",
+            "No keywords match",
+            "Add to Selected Photos",
+            "Remove from Selected Photos",
+            "Keywords",
+            "& Containing",
+            "Will Export",
+            "No keywords are exported",
+            "Add to All Selected Photos",
+            "Set name",
+            "Edit Set…",
+            "Edit Keyword Set",
+            "A keyword set needs a name",
+            "Recent Keywords",
+            "Keywords (⌥1–⌥9)",
+            "Save as a new set",
+            "Import Keywords…",
+            "Export Keywords…",
+        ];
+        let dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("locales");
+        for code in ["de", "es", "fr", "pt-br", "ru", "uk", "ja", "zh-hans", "zh-hant"] {
+            let text = std::fs::read_to_string(dir.join(format!("{code}.json"))).unwrap();
+            let catalog: std::collections::HashMap<String, String> = serde_json::from_str(&text).unwrap();
+            for label in labels {
+                assert!(catalog.contains_key(label), "{code}: “{label}”");
+            }
+        }
+        assert_eq!(Locale::ALL.len(), 10, "a language added: list its file above");
+    }
+}
diff --git a/crates/ui-egui/src/panels/keywording.rs b/crates/ui-egui/src/panels/keywording.rs
new file mode 100644
index 00000000..85749859
--- /dev/null
+++ b/crates/ui-egui/src/panels/keywording.rs
@@ -0,0 +1,380 @@
+//! The Keywording box (the top of the right panel's Keywords): the keywords of the selected photos,
+//! not only the active one's, as Lightroom Classic shows them. A keyword only some of the selected
+//! photos have is marked as such.
+
+use lightcraft_catalog::{Catalog, PhotoId};
+use serde_json::json;
+
+use crate::LightcraftApp;
+use crate::theme::Tokens;
+use crate::widgets::register;
+
+/// The Keywording box's view: the keywords (chips), them with the keywords containing them, or
+/// what exported files will carry.
+pub fn view_switch(app: &mut LightcraftApp, ui: &mut egui::Ui) {
+    use crate::state::KeywordingView as V;
+    ui.horizontal_wrapped(|ui| {
+        for (view, id, label) in
+            [(V::Keywords, "keywords", "Keywords"), (V::Containing, "containing", "& Containing"), (V::WillExport, "willExport", "Will Export")]
+        {
+            let r = ui.selectable_label(app.ui.keywording_view == view, crate::i18n::tr(label));
+            register(ui.ctx(), format!("keywordView:{id}"), r.rect);
+            if r.clicked() {
+                app.ui.keywording_view = view;
+            }
+        }
+    });
+}
+
+/// A read-only view of the selection's keywords: with the keywords containing them, or what
+/// exported files will carry. One only some of the photos have is marked with an asterisk.
+pub fn names_row(app: &mut LightcraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    let selection = app.session.targets(&serde_json::Value::Null);
+    let export = app.ui.keywording_view == crate::state::KeywordingView::WillExport;
+    let names = app.caches.keyword_names(&app.session.catalog, &selection, export);
+    if names.is_empty() {
+        ui.label(egui::RichText::new(crate::i18n::tr(if export { "No keywords are exported" } else { "No keywords yet" })).color(t.text_dim));
+        return;
+    }
+    let prefix = if export { "keywordExport" } else { "keywordContaining" };
+    ui.horizontal_wrapped(|ui| {
+        for n in names.iter() {
+            let (body, _) = chip(ui, &n.path, !n.on_all(), false);
+            register(ui.ctx(), format!("{prefix}:{}", n.path), body.rect);
+            if n.on_all() {
+                body.on_hover_text(&n.path);
+            } else {
+                let count = crate::i18n::tr_format!("On {have} of {of} selected photos", have = n.have, of = n.of);
+                body.on_hover_text(format!("{}\n{count}", n.path));
+            }
+        }
+    });
+}
+
+/// One chip, measured before it is placed so that a wrapping row moves it whole to the next line:
+/// the name (cut short to fit the row) and, with `cross`, a × at its end. A `partial` one (only
+/// some of the selected photos) is dimmed and marked with an asterisk. Returns the name's response
+/// and the ×'s.
+fn chip(ui: &mut egui::Ui, path: &str, partial: bool, cross: bool) -> (egui::Response, Option<egui::Response>) {
+    use egui::{Align2, Rect, Sense, pos2, vec2};
+    let t = Tokens::get(ui.ctx());
+    let font = t.font(13.0);
+    let color = if partial { t.text_dim } else { t.text_label };
+    let cross_w = if cross { 18.0 } else { 0.0 };
+    // at most the row's width
+    let room = (ui.max_rect().width() - 16.0 - cross_w).max(24.0);
+    let measure = |s: &str| ui.painter().layout_no_wrap(s.to_string(), font.clone(), color).size().x;
+    let shown = chip_label(path, partial, room, measure);
+    let w = measure(&shown) + 16.0 + cross_w;
+    // the row places it; its name and × answer under ids of their own keyword, so an open menu
+    // stays with its keyword when the chips change
+    let (rect, _) = ui.allocate_exact_size(vec2(w, 22.0), Sense::hover());
+    let id = egui::Id::new(("keyword-chip", path.to_lowercase(), cross));
+    let body = Rect::from_min_max(rect.min, pos2(rect.right() - cross_w, rect.bottom()));
+    let full = path.replace('|', " › ");
+    let resp = ui.interact(body, id, Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &full));
+    let x = cross.then(|| {
+        let xr = Rect::from_center_size(pos2(rect.right() - 11.0, rect.center().y), vec2(14.0, 14.0));
+        let xresp = ui.interact(xr, id.with("remove"), Sense::click());
+        let said = crate::i18n::tr_format!("Remove “{name}”", name = full);
+        xresp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &said));
+        xresp
+    });
+    ui.painter().rect_stroke(rect, 10.0, egui::Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
+    if resp.hovered() || x.as_ref().is_some_and(egui::Response::hovered) {
+        ui.painter().rect_filled(rect.shrink(1.0), 10.0, t.hover.gamma_multiply(0.5));
+    }
+    ui.painter().text(pos2(rect.left() + 8.0, rect.center().y), Align2::LEFT_CENTER, &shown, font.clone(), color);
+    if let Some(x) = &x {
+        ui.painter().text(x.rect.center(), Align2::CENTER_CENTER, "×", t.font(13.0), if x.hovered() { t.text } else { t.text_dim });
+    }
+    (resp, x)
+}
+
+/// A chip's menu: it acts on the selected photos (deleting a keyword from the whole library is the
+/// Keyword List's).
+fn menu(app: &mut LightcraftApp, ui: &mut egui::Ui, chip: &Chip) {
+    let item = |ui: &mut egui::Ui, id: &str, label: &str| {
+        let r = ui.button(label);
+        register(ui.ctx(), format!("keywordChipMenu:{id}"), r.rect);
+        r.clicked()
+    };
+    if !chip.on_all() && item(ui, "add", crate::i18n::tr("Add to All Selected Photos")) {
+        let _ = app.run("photo.setMeta", json!({"addKeywords": [chip.path]}));
+    }
+    if item(ui, "remove", crate::i18n::tr("Remove from Selected Photos")) {
+        let _ = app.run("photo.setMeta", json!({"removeKeywords": [chip.path]}));
+    }
+    if item(ui, "show", crate::i18n::tr("Show Photos with Keyword")) {
+        super::left::browse_all_photos(app, true);
+        let _ = app.run("library.filter", json!({"keyword": chip.path}));
+    }
+    ui.separator();
+    if item(ui, "edit", crate::i18n::tr("Edit Keyword Tag…")) {
+        app.ui.dialog = Some(super::keyword_list::edit_dialog(app, &chip.path));
+    }
+}
+
+/// The selection's keywords as chips: the name (right-click for its menu), and × to take it off
+/// every selected photo. One only some of them have is marked with an asterisk.
+pub fn chip_row(app: &mut LightcraftApp, ui: &mut egui::Ui) {
+    let selection = app.session.targets(&serde_json::Value::Null);
+    let chips = app.caches.keyword_chips(&app.session.catalog, &selection);
+    ui.horizontal_wrapped(|ui| {
+        for c in chips.iter() {
+            let (body, x) = chip(ui, &c.path, !c.on_all(), true);
+            register(ui.ctx(), format!("keywordChip:{}", c.path), body.rect);
+            if let Some(x) = x {
+                register(ui.ctx(), format!("keywordChipRemove:{}", c.path), x.rect);
+                if x.on_hover_text(crate::i18n::tr("Remove from Selected Photos")).clicked() {
+                    let _ = app.run("photo.setMeta", json!({"removeKeywords": [c.path]}));
+                }
+            }
+            // one tooltip: the whole name (it may be cut short), and how many have it
+            let full = c.path.replace('|', " › ");
+            let body = if c.on_all() {
+                body.on_hover_text(full)
+            } else {
+                register(ui.ctx(), format!("keywordChipPartial:{}", c.path), body.rect);
+                let n = crate::i18n::tr_format!("On {have} of {of} selected photos", have = c.have, of = c.of);
+                body.on_hover_text(format!("{full}\n{n}"))
+            };
+            let c = c.clone();
+            body.context_menu(|ui| menu(app, ui, &c));
+        }
+    });
+}
+
+/// A chip's label within `room` (as `measure` measures text): the keyword's path with " › "
+/// between its levels, and an asterisk when it is `partial`. Too long, it is cut from the front so
+/// that the keyword's own name and the asterisk stay ("…Lisbon › Belém tower *").
+pub(crate) fn chip_label(path: &str, partial: bool, room: f32, measure: impl Fn(&str) -> f32) -> String {
+    let full = path.replace('|', " › ");
+    let marker = if partial { " *" } else { "" };
+    let whole = format!("{full}{marker}");
+    if measure(&whole) <= room {
+        return whole;
+    }
+    // the longest end of the path that fits after "…"
+    let chars: Vec<char> = full.chars().collect();
+    let mut best = format!("…{marker}");
+    for start in (0..chars.len()).rev() {
+        let tail: String = chars.get(start..).map(|c| c.iter().collect()).unwrap_or_default();
+        let candidate = format!("…{}{marker}", tail.trim_start());
+        if measure(&candidate) > room {
+            break;
+        }
+        best = candidate;
+    }
+    best
+}
+
+/// A keyword of the selection, as a chip shows it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct Chip {
+    /// The keyword, spelled as the library spells it.
+    pub path: String,
+    /// Selected photos that have it.
+    pub have: usize,
+    /// Selected photos.
+    pub of: usize,
+}
+
+impl Chip {
+    /// Every selected photo has it.
+    pub fn on_all(&self) -> bool {
+        self.have >= self.of
+    }
+}
+
+/// "Will Export" (Lightroom Classic's Keyword Tags ▸ Will Export): the names exported files carry
+/// for the selected `photos`, as the keyword tag options say, each with how many of them carry it;
+/// by name.
+pub(crate) fn will_export(catalog: &Catalog, photos: &[PhotoId]) -> Vec<Chip> {
+    let photos = distinct(catalog, photos);
+    let mut have: std::collections::BTreeMap<String, (String, usize)> = Default::default();
+    for p in &photos {
+        for name in catalog.export_keywords(&p.meta.keywords).flat {
+            have.entry(name.to_lowercase()).or_insert_with(|| (name.clone(), 0)).1 += 1;
+        }
+    }
+    have.into_values().map(|(path, have)| Chip { path, have, of: photos.len() }).collect()
+}
+
+/// "Keywords & Containing Keywords": the names of the selection's keywords and of the keywords
+/// containing them, each with how many of the selected photos have it (itself or below it); by
+/// name.
+pub(crate) fn with_containing(catalog: &Catalog, photos: &[PhotoId]) -> Vec<Chip> {
+    use lightcraft_catalog::keywords::{SEP, clean};
+    let photos = distinct(catalog, photos);
+    let mut have: std::collections::BTreeMap<String, (String, usize)> = Default::default();
+    let mut seen = std::collections::HashSet::new();
+    for p in &photos {
+        seen.clear();
+        for k in &p.meta.keywords {
+            for name in clean(k).split(SEP) {
+                if !name.is_empty() && seen.insert(name.to_lowercase()) {
+                    have.entry(name.to_lowercase()).or_insert_with(|| (name.to_string(), 0)).1 += 1;
+                }
+            }
+        }
+    }
+    have.into_values().map(|(path, have)| Chip { path, have, of: photos.len() }).collect()
+}
+
+/// The selected photos, each once, those the library has: what "N of M" counts.
+pub(crate) fn distinct<'a>(catalog: &'a Catalog, photos: &[PhotoId]) -> Vec<&'a lightcraft_catalog::Photo> {
+    let mut seen = std::collections::HashSet::new();
+    photos.iter().filter(|id| seen.insert(**id)).filter_map(|id| catalog.photo(*id).map(|p| &**p)).collect()
+}
+
+/// The keywords of the selected `photos`, each once whatever its case, with how many of them have
+/// it; by name.
+pub(crate) fn chips(catalog: &Catalog, photos: &[PhotoId]) -> Vec<Chip> {
+    use lightcraft_catalog::keywords::clean;
+    let photos = distinct(catalog, photos);
+    // by lower-case keyword: as first seen, and the photos with it (each once)
+    let mut have: std::collections::BTreeMap<String, (String, usize)> = Default::default();
+    let mut seen = std::collections::HashSet::new();
+    for p in &photos {
+        seen.clear();
+        for k in &p.meta.keywords {
+            let k = clean(k);
+            if k.is_empty() || !seen.insert(k.to_lowercase()) {
+                continue;
+            }
+            have.entry(k.to_lowercase()).or_insert_with(|| (k.clone(), 0)).1 += 1;
+        }
+    }
+    // spelled as the keyword list spells it, else as first seen (no scan of the library)
+    have.into_values().map(|(k, n)| Chip { path: catalog.listed_path(&k).map(str::to_string).unwrap_or(k), have: n, of: photos.len() }).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use lightcraft_catalog::{Op, Photo, Source};
+
+    use super::*;
+
+    fn library(keywords: &[&[&str]]) -> (Catalog, Vec<PhotoId>) {
+        let mut c = Catalog::new();
+        let mut ids = Vec::new();
+        for k in keywords {
+            let id = c.alloc_photo_id();
+            let mut p = Photo::new(id, Source::Demo { scene: 1 }, "a.jpg", "JPEG", 3, 2, "2026-01-01");
+            p.meta.keywords = k.iter().map(|s| s.to_string()).collect();
+            c.apply(Op::AddPhoto { photo: Box::new(p) }).unwrap();
+            ids.push(id);
+        }
+        (c, ids)
+    }
+
+    fn shown(chips: &[Chip]) -> Vec<(&str, usize, usize)> {
+        chips.iter().map(|c| (c.path.as_str(), c.have, c.of)).collect()
+    }
+
+    /// The chips are the keywords of every selected photo, by name, each saying how many of the
+    /// selected photos have it.
+    #[test]
+    fn the_chips_are_the_selections_keywords() {
+        let (c, ids) = library(&[&["travel|Italy", "beach"], &["beach", "Weddings"], &["sea"]]);
+        assert_eq!(shown(&chips(&c, &ids[..2])), [("beach", 2, 2), ("travel|Italy", 1, 2), ("Weddings", 1, 2)]);
+        assert!(chips(&c, &ids[..2])[0].on_all() && !chips(&c, &ids[..2])[1].on_all());
+        assert_eq!(shown(&chips(&c, &ids[2..])), [("sea", 1, 1)]);
+        assert!(chips(&c, &[]).is_empty());
+    }
+
+    /// A keyword two photos spell differently is one chip, spelled as the library spells it.
+    #[test]
+    fn a_keyword_spelled_two_ways_is_one_chip() {
+        let (c, ids) = library(&[&["Beach"], &["beach"], &["BEACH", "beach"]]);
+        assert_eq!(shown(&chips(&c, &ids)), [("Beach", 3, 3)]);
+    }
+
+    /// "Will Export": the names exported files carry for the selection, as the keyword tag options
+    /// say (a keyword left out goes, its parents and synonyms come), each with how many of the
+    /// selected photos carry it.
+    #[test]
+    fn will_export_shows_what_exported_files_carry() {
+        use lightcraft_catalog::keywords::KeywordInfo;
+        let (mut c, ids) = library(&[&["Places|Lisbon", "draft"], &["Places|Lisbon"]]);
+        let out = KeywordInfo { include_on_export: false, ..KeywordInfo::default() };
+        c.apply(Op::SetKeyword { path: "Places".into(), info: Some(out.clone()) }).unwrap();
+        c.apply(Op::SetKeyword { path: "draft".into(), info: Some(out) }).unwrap();
+        c.apply(Op::SetKeyword {
+            path: "Places|Lisbon".into(),
+            info: Some(KeywordInfo { synonyms: vec!["Lisboa".into()], ..KeywordInfo::default() }),
+        })
+        .unwrap();
+        assert_eq!(shown(&will_export(&c, &ids)), [("Lisboa", 2, 2), ("Lisbon", 2, 2)]);
+        assert!(will_export(&c, &[]).is_empty());
+    }
+
+    /// A chip too long for its row is cut from the front: the keyword's own name and the asterisk
+    /// of a partial one stay.
+    #[test]
+    fn a_long_chip_keeps_its_name_and_asterisk() {
+        let chars = |s: &str| s.chars().count() as f32;
+        assert_eq!(chip_label("travel|Lisbon", false, 40.0, chars), "travel › Lisbon");
+        assert_eq!(chip_label("travel|Lisbon", true, 40.0, chars), "travel › Lisbon *");
+        let cut = chip_label("Places|Portugal|Lisbon|Belém tower", true, 24.0, chars);
+        assert_eq!(cut, "…Lisbon › Belém tower *");
+        assert!(chars(&cut) <= 24.0);
+        assert!(chip_label("Places|Lisbon", false, 4.0, chars).starts_with('…'), "even with hardly any room");
+    }
+
+    /// A photo listed twice in the selection counts once, and one that isn't in the library not at
+    /// all: "On 1 of 2", not "On 2 of 4".
+    #[test]
+    fn the_counts_are_of_photos_not_ids() {
+        let (c, ids) = library(&[&["beach"], &["sea"]]);
+        let selection = [ids[0], ids[0], ids[1], PhotoId(999)];
+        assert_eq!(shown(&chips(&c, &selection)), [("beach", 1, 2), ("sea", 1, 2)]);
+        assert_eq!(shown(&will_export(&c, &selection)), [("beach", 1, 2), ("sea", 1, 2)]);
+        let ticks = crate::panels::keyword_list::Ticks::of(&c, &selection);
+        assert_eq!(ticks.tick("beach"), crate::panels::keyword_list::Tick::Some);
+        assert_eq!(crate::panels::keyword_list::Ticks::of(&c, &[ids[0], ids[0]]).tick("beach"), crate::panels::keyword_list::Tick::All);
+    }
+
+    /// A keyword the Keyword List has is spelled as it spells it.
+    #[test]
+    fn a_listed_keyword_is_spelled_as_listed() {
+        use lightcraft_catalog::keywords::KeywordInfo;
+        let (mut c, ids) = library(&[&["beach"]]);
+        c.apply(Op::SetKeyword { path: "Beach".into(), info: Some(KeywordInfo::default()) }).unwrap();
+        assert_eq!(shown(&chips(&c, &ids)), [("Beach", 1, 1)]);
+    }
+
+    /// Screen readers hear a chip by its whole keyword (even when cut short on screen) and its ×
+    /// as removing that keyword.
+    #[test]
+    fn chips_describe_themselves() {
+        let ctx = egui::Context::default();
+        crate::theme::install_fonts(&ctx);
+        ctx.enable_accesskit();
+        let mut found = Vec::new();
+        for _ in 0..3 {
+            let mut out = ctx.run_ui(egui::RawInput::default(), |ui| {
+                ui.set_max_width(120.0);
+                let _ = chip(ui, "Places|Portugal|Lisbon|Belém tower", true, true);
+            });
+            out.textures_delta.clear();
+            if let Some(update) = out.platform_output.accesskit_update.take() {
+                found = update.nodes.iter().map(|(_, n)| (format!("{:?}", n.role()), n.label().unwrap_or_default().to_string())).collect();
+            }
+        }
+        let has = |role: &str, label: &str| found.iter().any(|(r, l)| r == role && l == label);
+        assert!(has("Button", "Places › Portugal › Lisbon › Belém tower"), "{found:?}");
+        assert!(has("Button", "Remove “Places › Portugal › Lisbon › Belém tower”"), "{found:?}");
+    }
+
+    /// "Keywords & Containing Keywords": every level of the selection's keywords, flat, each
+    /// counted once per photo.
+    #[test]
+    fn containing_keywords_are_every_level() {
+        let (c, ids) = library(&[&["travel|Italy|Rome", "travel|Spain"], &["travel|Italy"]]);
+        assert_eq!(shown(&with_containing(&c, &ids)), [("Italy", 2, 2), ("Rome", 1, 2), ("Spain", 1, 2), ("travel", 2, 2)]);
+    }
+}
diff --git a/crates/ui-egui/src/panels/left.rs b/crates/ui-egui/src/panels/left.rs
index 8863e5d1..b435f6ed 100644
--- a/crates/ui-egui/src/panels/left.rs
+++ b/crates/ui-egui/src/panels/left.rs
@@ -53,10 +53,11 @@ fn row_named(
     selected: bool,
     indent: f32,
 ) -> egui::Response {
-    row_sensed(app, ui, id, icon, label, spoken, count, selected, indent, Sense::click())
+    row_sensed(app, ui, id, icon, label, spoken, count, selected, indent, Sense::click(), None)
 }
 
-/// [`row_named`] with the given `sense` (rows that can be dragged add `drag`).
+/// [`row_named`] with the given `sense` (rows that can be dragged add `drag`) and a colour
+/// label's dot (`mark`) before the count.
 #[allow(clippy::too_many_arguments)]
 fn row_sensed(
     app: &mut LightcraftApp,
@@ -69,6 +70,7 @@ fn row_sensed(
     selected: bool,
     indent: f32,
     sense: Sense,
+    mark: Option<egui::Color32>,
 ) -> egui::Response {
     let label = if matches!(id, "all" | "recentlyAdded" | "picks" | "missing" | "recentlyDeleted") { crate::i18n::tr(label) } else { label };
     let t = Tokens::get(ui.ctx());
@@ -102,8 +104,15 @@ fn row_sensed(
     let count_galley = count.filter(|_| app.ui.show_counts).map(|n| ui.painter().layout_no_wrap(n.to_string(), t.font(12.5), t.text_dim));
     let label_left = r.left() + 42.0 + indent;
     let count_left = count_galley.as_ref().map_or(edge - 18.0, |g| edge - 18.0 - g.size().x);
+    // a label's dot sits just before the count
+    let mark_w = if mark.is_some() { MARK_W } else { 0.0 };
+    if let Some(c) = mark {
+        let dot = Rect::from_center_size(pos2(count_left - MARK_W / 2.0, r.center().y), vec2(8.0, 8.0));
+        ui.painter().circle_filled(dot.center(), 4.0, c);
+        register(ui.ctx(), format!("labelMark:{id}"), dot);
+    }
     // the name gives way to the count: cut with an ellipsis, in full on hover
-    let room = count_left - 8.0 - label_left;
+    let room = count_left - mark_w - 8.0 - label_left;
     let measure = |s: &str| ui.painter().layout_no_wrap(s.to_string(), font.clone(), color).size().x;
     let full_w = measure(label);
     let shown = if full_w <= room { label.to_string() } else { crate::widgets::elide_head(label, room.max(0.0), measure) };
@@ -112,7 +121,7 @@ fn row_sensed(
     let resp = if shown != label { resp.on_hover_text(label) } else { resp };
     // a row asks for room for its name up to a share of a panel, so one very long name does not
     // make everything scroll: depth does that
-    let mut needed = 42.0 + indent + full_w.min(MAX_NAME_NEED) + 18.0;
+    let mut needed = 42.0 + indent + full_w.min(MAX_NAME_NEED) + 18.0 + mark_w;
     if let Some(galley) = count_galley {
         let rect = Rect::from_min_size(pos2(edge - 18.0 - galley.size().x, r.center().y - galley.size().y / 2.0), galley.size());
         needed += rect.width() + 16.0;
@@ -674,7 +683,7 @@ fn date_row(app: &mut LightcraftApp, ui: &mut egui::Ui, key: &str, label: &str,
 /// By Date and Keywords count every photo in the library, so choosing a row shows those photos
 /// from All Photos, not from whatever album or folder happened to be open, where they could be
 /// missing (issue #341). Only when choosing (`on`), not when clearing the row again.
-fn browse_all_photos(app: &mut LightcraftApp, on: bool) {
+pub(crate) fn browse_all_photos(app: &mut LightcraftApp, on: bool) {
     if on && app.session.source != LibrarySource::All {
         let _ = app.run("library.source", json!({"kind": "all"}));
     }
@@ -694,7 +703,8 @@ fn albums_tree(app: &mut LightcraftApp, ui: &mut egui::Ui, all: &AlbumKids, pare
                 open = true;
                 ui.data_mut(|d| d.insert_temp(open_id, true));
             }
-            let resp = row_sensed(app, ui, &format!("folder:{}", a.id.0), Icon::Folder, &a.name, None, None, false, indent, Sense::click_and_drag());
+            let resp =
+                row_sensed(app, ui, &format!("folder:{}", a.id.0), Icon::Folder, &a.name, None, None, false, indent, Sense::click_and_drag(), None);
             // a folder is no source, so its row folds it too; the triangle is the same click, aimed
             let has_children = all.get(&Some(a.id)).is_some_and(|v| !v.is_empty());
             if resp.drag_started() {
@@ -727,7 +737,13 @@ fn albums_tree(app: &mut LightcraftApp, ui: &mut egui::Ui, all: &AlbumKids, pare
             let target =
                 app.session.target_album.filter(|t| app.session.catalog.album(*t).is_some()).or_else(|| app.session.catalog.quick_collection());
             let label = if target == Some(a.id) { format!("{} +", a.name) } else { a.name.clone() };
-            let mut resp = row_sensed(app, ui, &format!("album:{}", a.id.0), icon, &label, None, Some(n), sel, indent, Sense::click_and_drag());
+            // a smart album whose rules no longer check (an album they test was deleted) says so
+            let problems = app.caches.smart_album_problems(&app.session.catalog).get(&a.id).cloned().unwrap_or_default();
+            let label = if problems.is_empty() { label } else { format!("⚠ {label}") };
+            let mut resp = row_sensed(app, ui, &format!("album:{}", a.id.0), icon, &label, None, Some(n), sel, indent, Sense::click_and_drag(), None);
+            if !problems.is_empty() {
+                crate::widgets::register(ui.ctx(), format!("albumProblem:{}", a.id.0), resp.rect);
+            }
             if resp.drag_started() {
                 app.ui.dragging_album = Some(a.id.0);
             }
@@ -736,7 +752,17 @@ fn albums_tree(app: &mut LightcraftApp, ui: &mut egui::Ui, all: &AlbumKids, pare
                 drop_target(app, ui, &resp, a);
             }
             if let Some(rules) = &a.smart {
-                resp = resp.on_hover_text(crate::i18n::tr_format!("Smart album: {}", crate::i18n::filter_label(rules, &app.session.catalog)));
+                // one tooltip: the rules, then what needs fixing in them
+                let mut tip = crate::i18n::tr_format!("Smart album: {}", crate::i18n::filter_label(rules, &app.session.catalog));
+                if !problems.is_empty() {
+                    tip.push_str("\n\n");
+                    tip.push_str(crate::i18n::tr("Some rules need fixing (Edit Smart Album…):"));
+                    for p in &problems {
+                        tip.push('\n');
+                        tip.push_str(&crate::i18n::problem_line(p));
+                    }
+                }
+                resp = resp.on_hover_text(tip);
             }
             if resp.clicked() {
                 let _ = app.run("library.source", json!({"kind": "album", "id": a.id.0}));
@@ -782,6 +808,9 @@ fn drag_auto_scroll(app: &LightcraftApp, ui: &egui::Ui) {
     }
 }
 
+/// Room a colour label's dot takes before a row's count.
+const MARK_W: f32 = 12.0;
+
 /// How long a dragged album must rest on a closed folder before it opens.
 const HOVER_OPEN_SECS: f64 = 0.6;
 
@@ -1038,12 +1067,15 @@ fn folder_menu(app: &mut LightcraftApp, resp: &egui::Response, a: &Album) {
             let _ = app.run("album.clearQuick", json!({}));
         }
         if a.is_smart() && ui.button(crate::i18n::tr("Edit Smart Album…")).clicked() {
-            // older smart albums keep their filter fields; the editor works on the rule set
-            let rules = a.smart.as_ref().and_then(|f| f.rule_set.clone()).unwrap_or_default();
-            app.ui.dialog = Some(crate::state::Dialog::SmartRules { id: Some(a.id.0), name: a.name.clone(), rules, parent: None });
+            // the same editor as `dialog.smartAlbum` (older smart albums keep their filter fields;
+            // it works on the rule set, upgraded)
+            let _ = app.run("dialog.smartAlbum", json!({"id": a.id.0}));
         }
         if a.is_smart() && ui.button(crate::i18n::tr("Update Rules from Current Filter")).clicked() {
-            let _ = app.run("album.setRules", json!({"id": a.id.0, "fromView": true}));
+            // refused when the view would make the album test itself: say why
+            if let Err(e) = app.run("album.setRules", json!({"id": a.id.0, "fromView": true})) {
+                app.toast(ui.ctx(), e);
+            }
         }
         if !a.folder {
             // export: show the album, select its photos, then the dialog / a preset
@@ -1087,8 +1119,15 @@ fn folder_menu(app: &mut LightcraftApp, resp: &egui::Response, a: &Album) {
         if ui.button(crate::i18n::tr("Rename…")).clicked() {
             app.ui.dialog = Some(crate::state::Dialog::RenameAlbum { id: a.id.0, name: a.name.clone() });
         }
-        if ui.button(crate::i18n::tr("Delete")).clicked() {
-            let _ = app.run("album.delete", json!({"id": a.id.0}));
+        let delete = ui.button(crate::i18n::tr("Delete"));
+        register(ui.ctx(), format!("albumDelete:{}", a.id.0), delete.rect);
+        let delete =
+            delete.on_hover_text(crate::i18n::tr("Photos stay in All Photos. Deleting a folder also deletes its albums. You can undo this."));
+        if delete.clicked() {
+            if let Err(e) = app.run("album.delete", json!({"id": a.id.0})) {
+                app.toast(ui.ctx(), e);
+            }
+            ui.close();
         }
     });
 }
@@ -1165,7 +1204,14 @@ fn folder_rows(app: &mut LightcraftApp, ui: &mut egui::Ui, nodes: &[FolderNode],
             && app.session.source == LibrarySource::LibraryFolder
             && app.session.library_folder.as_deref().is_some_and(|f| same_folder(f, &n.path));
         let name = if selectable { n.name.clone() } else { crate::i18n::tr("This Computer").to_string() };
-        let resp = row_named(app, ui, &format!("libfolder:{}", n.path), Icon::Folder, &name, Some(&name), Some(n.count), sel, indent);
+        // the label is said with the name, as it is shown beside it
+        let spoken = match n.label {
+            Some(l) => format!("{name}, {}", crate::i18n::color_label(&app.session.catalog, l)),
+            None => name.clone(),
+        };
+        let mark = n.label.map(crate::theme::label_color);
+        let id = format!("libfolder:{}", n.path);
+        let resp = row_sensed(app, ui, &id, Icon::Folder, &name, Some(&spoken), Some(n.count), sel, indent, Sense::click(), mark);
         let mut toggled = false;
         if !n.children.is_empty() {
             let tr = disclosure_triangle(ui, &resp, indent, open, egui::Id::new(("libfolder-tri", key)), format!("libraryFolderToggle:{}", n.path));
@@ -1204,6 +1250,9 @@ fn row_menu(app: &mut LightcraftApp, resp: &egui::Response, n: &FolderNode) {
         folder_menu_for_library(app, resp, n);
     } else if n.path != "/" {
         resp.context_menu(|ui| {
+            folder_label_menu(app, ui, n);
+            synchronize_item(app, ui, n, &n.name);
+            ui.separator();
             if ui
                 .button(crate::i18n::tr("Remove Disk from Library…"))
                 .on_hover_text(crate::i18n::tr("Moves every photo imported from this disk to Recently Deleted; no file is touched"))
@@ -1216,6 +1265,36 @@ fn row_menu(app: &mut LightcraftApp, resp: &egui::Response, n: &FolderNode) {
     }
 }
 
+/// Synchronize Folder… of a Folders row (widget `folderSynchronize`): opens its dialog, which
+/// scans the folder in the background.
+fn synchronize_item(app: &mut LightcraftApp, ui: &mut egui::Ui, n: &FolderNode, name: &str) {
+    let r = ui
+        .button(crate::i18n::tr("Synchronize Folder…"))
+        .on_hover_text(crate::i18n::tr("Find photos added to or missing from this folder on disk, and XMP sidecars changed by other apps"));
+    crate::widgets::register(ui.ctx(), "folderSynchronize", r.rect);
+    if r.clicked() {
+        // a disk, or a folder holding disks, was chosen as such
+        if let Err(e) = crate::sync::open(app, &n.path, name, n.volume || !n.selectable) {
+            app.toast(ui.ctx(), e);
+        }
+        ui.close();
+    }
+}
+
+/// Set Color Label ▸ of a Folders row (`folder.label`; the submenu is widget `folderLabelMenu`,
+/// its colours `folderLabel:<colour>`).
+fn folder_label_menu(app: &mut LightcraftApp, ui: &mut egui::Ui, n: &FolderNode) {
+    let menu = ui.menu_button(crate::i18n::tr("Set Color Label"), |ui| {
+        if let Some(l) = crate::panels::grid::label_items(app, ui, n.label, "folderLabel") {
+            if let Err(e) = app.run("folder.label", json!({"path": n.path, "label": crate::panels::grid::label_param(l)})) {
+                app.toast(ui.ctx(), e);
+            }
+            ui.close();
+        }
+    });
+    register(ui.ctx(), "folderLabelMenu", menu.response.rect);
+}
+
 /// The context menu of a folder row: the folder's disk actions (the same as Local's, photos
 /// follow) and taking its photos out of the library.
 fn folder_menu_for_library(app: &mut LightcraftApp, resp: &egui::Response, n: &FolderNode) {
@@ -1246,12 +1325,14 @@ fn folder_menu_for_library(app: &mut LightcraftApp, resp: &egui::Response, n: &F
             ui.close();
         }
         if app.services.reveal.is_some()
-            && ui.button(crate::i18n::tr("Show in Finder")).clicked()
+            && ui.button(crate::i18n::tr(crate::menus::reveal_label())).clicked()
             && let Some(f) = app.services.reveal.as_mut()
         {
             let _ = f(path);
             ui.close();
         }
+        folder_label_menu(app, ui, n);
+        synchronize_item(app, ui, n, &label);
         ui.separator();
         if ui
             .button(crate::i18n::tr("Remove from Library…"))
diff --git a/crates/ui-egui/src/panels/masking.rs b/crates/ui-egui/src/panels/masking.rs
index 90fe284f..640bc4f1 100644
--- a/crates/ui-egui/src/panels/masking.rs
+++ b/crates/ui-egui/src/panels/masking.rs
@@ -138,11 +138,12 @@ pub fn show(app: &mut LightcraftApp, ui: &mut egui::Ui, id: PhotoId) {
                         }
                         "object" => start_object(app, ui.ctx(), "new"),
                         "prompt" => start_describe(app, "new"),
-                        "brush" | "linear" | "radial" => {
+                        "brush" => {
+                            let _ = app.run("tool.brush", json!({"new": true}));
+                        }
+                        "linear" | "radial" => {
                             app.ui.tool = kind.to_string();
-                            if *kind != "brush" {
-                                let _ = app.run("mask.add", json!({"kind": kind}));
-                            }
+                            let _ = app.run("mask.add", json!({"kind": kind}));
                         }
                         k => {
                             let _ = app.run("mask.add", json!({"kind": k}));
@@ -798,10 +799,11 @@ fn component_menu(app: &mut LightcraftApp, ui: &mut egui::Ui, op: &str) {
         if kind == "brush" && op == "intersect" {
             continue;
         }
-        if ui.button(label).clicked() {
+        let b = ui.button(label);
+        register(ui.ctx(), format!("maskComp:{op}:{kind}"), b.rect);
+        if b.clicked() {
             if kind == "brush" {
-                app.ui.tool = "brush".into();
-                app.ui.brush_erase = op == "subtract";
+                let _ = app.run("tool.brush", json!({"op": op}));
             } else {
                 let _ = app.run("mask.addComponent", json!({"op": op, "kind": kind}));
             }
diff --git a/crates/ui-egui/src/panels/mod.rs b/crates/ui-egui/src/panels/mod.rs
index abb01551..d87d6789 100644
--- a/crates/ui-egui/src/panels/mod.rs
+++ b/crates/ui-egui/src/panels/mod.rs
@@ -12,6 +12,8 @@ pub mod faces;
 pub mod filterbar;
 pub mod grid;
 pub mod keymap;
+pub mod keyword_list;
+pub mod keywording;
 pub mod left;
 pub mod library_problem;
 pub mod masking;
diff --git a/crates/ui-egui/src/panels/right.rs b/crates/ui-egui/src/panels/right.rs
index 239212d7..ff6bc401 100644
--- a/crates/ui-egui/src/panels/right.rs
+++ b/crates/ui-egui/src/panels/right.rs
@@ -19,6 +19,18 @@ pub fn show(app: &mut LightcraftApp, ui: &mut egui::Ui) {
     let width = app.ui.right_width;
     let resized = super::resizable_side(ui, false, "right_panel", frame, width, crate::state::RIGHT_WIDTH, reserve, |ui| {
         let Some(id) = app.session.active() else {
+            // the Keyword List is the library's, not a photo's: it is there without a selection
+            if app.ui.right == RightPanel::Keywords {
+                egui::ScrollArea::vertical().id_salt("right-scroll").auto_shrink([false, false]).show(ui, |ui| {
+                    ui.spacing_mut().item_spacing.y = 0.0;
+                    header(ui, "Keywords");
+                    padded(ui, |ui| {
+                        ui.label(egui::RichText::new(crate::i18n::tr("Select photos to give them keywords.")).color(t.text_dim));
+                    });
+                    super::keyword_list::show(app, ui);
+                });
+                return;
+            }
             let r = ui.max_rect();
             super::empty_message(ui, r, "No photo selected", "Select a photo to edit");
             return;
@@ -185,6 +197,49 @@ fn crop(app: &mut LightcraftApp, ui: &mut egui::Ui, id: PhotoId) {
     if let Some(spec) = ang {
         let out = slider(ui, &spec, d.crop.geometry.angle, true, Some("Straighten"));
         super::edit::apply_slider_out(app, &spec, out, |app, v| app.run("crop.straighten", json!({"angle": v})));
+        // an exact angle, typed (issue #534): a field of its own, besides the slider's value
+        padded(ui, |ui| {
+            ui.horizontal(|ui| {
+                ui.label(crate::i18n::tr("Angle"));
+                let mut angle = d.crop.geometry.angle;
+                let escape = ui.input(|i| i.key_pressed(egui::Key::Escape));
+                let r = ui.add(
+                    egui::DragValue::new(&mut angle)
+                        .range(spec.min..=spec.max)
+                        .clamp_existing_to_range(false)
+                        .speed(0.05)
+                        .fixed_decimals(2)
+                        // as the readout writes it: "+2.50", and every zero "0.00"
+                        .custom_formatter(|v, _| super::detail::crop_angle_label(v).trim_end_matches('°').to_string())
+                        .suffix("°")
+                        // read as the Straighten value reads a typed one: "-3,25" too
+                        .custom_parser(|text| crate::widgets::typed_value(&spec, text.trim().trim_end_matches('°')))
+                        // a typed angle applies on Return (or leaving the field), not keystroke by
+                        // keystroke: no half-typed angles, one undo step
+                        .update_while_editing(false),
+                );
+                crate::widgets::register(ui.ctx(), "cropAngleField", r.rect);
+                // a drag on the field is one undo step, like the slider's
+                if r.drag_started() {
+                    let _ = app.run("develop.beginInteraction", json!({"label": "Straighten"}));
+                }
+                // egui reports a change while text is typed even when the value isn't updated yet:
+                // apply only a new angle
+                // Esc keeps the old angle, but egui applies the typed text on the frame after the
+                // one where Esc took the focus away: remember the Esc for that frame
+                let cancel = egui::Id::new("cropAngleFieldEscaped");
+                let escaped = ui.data_mut(|m| m.remove_temp::<bool>(cancel)).unwrap_or(false);
+                if escape && r.lost_focus() {
+                    ui.data_mut(|m| m.insert_temp(cancel, true));
+                }
+                if r.changed() && !escaped && angle.is_finite() && angle != d.crop.geometry.angle {
+                    let _ = app.run("crop.straighten", json!({"angle": (angle.clamp(spec.min, spec.max) * 100.0).round() / 100.0}));
+                }
+                if r.drag_stopped() {
+                    let _ = app.run("develop.endInteraction", json!({}));
+                }
+            });
+        });
     }
     padded(ui, |ui| {
         ui.horizontal(|ui| {
@@ -734,79 +789,79 @@ fn meta_field(app: &mut LightcraftApp, ui: &mut egui::Ui, label: &str, key: &str
     ui.label(egui::RichText::new(crate::i18n::tr(label)).size(11.5).color(t.text_dim));
     let id = egui::Id::new(("info-field", key));
     let mut text: String = ui.data(|d| d.get_temp(id)).unwrap_or_else(|| value.to_string());
-    let edit = if lines > 1 { egui::TextEdit::multiline(&mut text).desired_rows(lines) } else { egui::TextEdit::singleline(&mut text) };
-    let r = ui.add(edit.desired_width(f32::INFINITY));
-    register(ui.ctx(), format!("field:{key}"), r.rect);
-    if r.has_focus() {
+    let widget = format!("field:{key}");
+    let field = if lines > 1 {
+        crate::text_field::TextField::multiline(&widget, &mut text).rows(lines)
+    } else {
+        crate::text_field::TextField::singleline(&widget, &mut text)
+    };
+    let r = field.width(f32::INFINITY).show(ui);
+    // the typed text outlives frames while it is edited (the photo's value is drawn otherwise)
+    if r.editing {
         ui.data_mut(|d| d.insert_temp(id, text.clone()));
     } else {
         ui.data_mut(|d| d.remove::<String>(id));
     }
-    if r.lost_focus() && text != value {
+    // Return (one line) or leaving saves; Esc gives the edit up
+    if r.committed() && text != value {
         let _ = app.run("photo.setMeta", json!({key: text}));
     }
     ui.add_space(6.0);
 }
 
 fn keywords(app: &mut LightcraftApp, ui: &mut egui::Ui, id: PhotoId) {
-    let Some(p) = app.session.catalog.photo(id).cloned() else { return };
+    // (the box is the selection's: the active photo only says that there is one)
+    if app.session.catalog.photo(id).is_none() {
+        return;
+    }
     header(ui, "Keywords");
     let t = Tokens::get(ui.ctx());
     padded(ui, |ui| {
         let kid = egui::Id::new("kw-input");
         let mut text = ui.data_mut(|d| d.get_temp::<String>(kid).unwrap_or_default());
-        let r = ui.add(egui::TextEdit::singleline(&mut text).hint_text(crate::i18n::tr("Add keyword")).desired_width(f32::INFINITY));
-        register(ui.ctx(), "field:keyword", r.rect);
-        if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) && !text.trim().is_empty() {
-            let kws: Vec<String> = text.split(',').map(|s| s.trim().to_string()).filter(|s| !s.is_empty()).collect();
+        let r =
+            crate::text_field::TextField::singleline("field:keyword", &mut text).hint(crate::i18n::tr("Add keyword")).width(f32::INFINITY).show(ui);
+        // Return gives the keywords to the selected photos; Esc gives back what was there before
+        // this edit (the shared field does)
+        if r.ending == Some(crate::text_field::Ending::Return) && !text.trim().is_empty() {
+            // a new name goes inside the default parent (Put New Keywords Inside This Keyword)
+            let kws: Vec<String> = text.split(',').map(|s| app.session.catalog.typed_keyword(s)).filter(|s| !s.is_empty()).collect();
             let _ = app.run("photo.setMeta", json!({"addKeywords": kws}));
             text.clear();
         }
         ui.data_mut(|d| d.insert_temp(kid, text));
         ui.add_space(8.0);
-        ui.horizontal_wrapped(|ui| {
-            for k in &p.meta.keywords {
-                let r =
-                    ui.add(egui::Button::new(egui::RichText::new(format!("{}  ×", k.replace('|', " › "))).color(t.text_label)).corner_radius(10.0));
-                register(ui.ctx(), format!("keywordChip:{k}"), r.rect);
-                if r.clicked() {
-                    let _ = app.run("photo.setMeta", json!({"removeKeywords": [k]}));
-                }
-                r.context_menu(|ui| {
-                    if ui.button(crate::i18n::tr("Remove from Photo")).clicked() {
-                        let _ = app.run("photo.setMeta", json!({"removeKeywords": [k]}));
-                    }
-                    if ui.button(crate::i18n::tr("Show Photos with Keyword")).clicked() {
-                        let _ = app.run("library.filter", json!({"keyword": k}));
-                    }
-                    ui.separator();
-                    if ui.button(crate::i18n::tr("Rename Keyword…")).clicked() {
-                        app.ui.dialog = Some(crate::state::Dialog::RenameKeyword { from: k.clone(), to: k.clone() });
-                    }
-                    if ui.button(crate::i18n::tr("Delete Keyword")).clicked() {
-                        let _ = app.run("keyword.delete", json!({"keyword": k}));
-                    }
-                });
-            }
-        });
+        super::keywording::view_switch(app, ui);
+        ui.add_space(4.0);
+        if app.ui.keywording_view == crate::state::KeywordingView::Keywords {
+            super::keywording::chip_row(app, ui);
+        } else {
+            super::keywording::names_row(app, ui);
+        }
         ui.add_space(10.0);
-        keyword_set(app, ui, &p.meta.keywords);
+        keyword_set(app, ui);
         ui.add_space(8.0);
         // the painter: click photos in the grid to give them (or take away) a keyword
         ui.horizontal(|ui| {
             let pid = egui::Id::new("kw-painter");
             let painting = app.ui.keyword_painter.clone();
             let mut k: String = ui.data(|d| d.get_temp(pid)).unwrap_or_else(|| painting.clone().unwrap_or_default());
-            let r = ui.add_enabled(
-                painting.is_none(),
-                egui::TextEdit::singleline(&mut k).hint_text(crate::i18n::tr("Keyword to paint")).desired_width(130.0),
-            );
-            register(ui.ctx(), "field:keywordPainter", r.rect);
+            // (fixed while painting: Stop first)
+            let field = ui
+                .add_enabled_ui(painting.is_none(), |ui| {
+                    crate::text_field::TextField::singleline("field:keywordPainter", &mut k)
+                        .hint(crate::i18n::tr("Keyword to paint"))
+                        .width(130.0)
+                        .show(ui)
+                })
+                .inner;
             ui.data_mut(|d| d.insert_temp(pid, k.clone()));
             let label = if painting.is_some() { "Stop" } else { "Paint" };
+            let returned = field.ending == Some(crate::text_field::Ending::Return) && painting.is_none() && !k.trim().is_empty();
             if text_button(ui, "keywordPaint", label, painting.is_some())
                 .on_hover_text(crate::i18n::tr("Click photos in the grid to toggle the keyword; Esc stops"))
                 .clicked()
+                || returned
             {
                 let _ = app.run("tool.keywordPainter", json!({"keyword": if painting.is_some() { serde_json::Value::Null } else { json!(k) }}));
             }
@@ -816,7 +871,11 @@ fn keywords(app: &mut LightcraftApp, ui: &mut egui::Ui, id: PhotoId) {
         // photo's keywords, else the most used ones
         let typed = ui.data(|d| d.get_temp::<String>(kid).unwrap_or_default());
         let last = typed.rsplit(',').next().unwrap_or("").trim().to_string();
-        let suggestions = (*app.caches.suggestions(&app.session.catalog, &p.meta.keywords, &last, 12)).clone();
+        // the keywords every selected photo has: those only some have are still suggested
+        let selection = app.session.targets(&serde_json::Value::Null);
+        let have: Vec<String> =
+            app.caches.keyword_chips(&app.session.catalog, &selection).iter().filter(|c| c.on_all()).map(|c| c.path.clone()).collect();
+        let suggestions = (*app.caches.suggestions(&app.session.catalog, &have, &last, 12)).clone();
         if !suggestions.is_empty() {
             ui.label(egui::RichText::new(crate::i18n::tr("Suggestions")).color(t.text_dim));
             ui.horizontal_wrapped(|ui| {
@@ -834,17 +893,21 @@ fn keywords(app: &mut LightcraftApp, ui: &mut egui::Ui, id: PhotoId) {
             });
         }
     });
+    super::keyword_list::show(app, ui);
 }
 
 /// The keyword set: pick a set, then nine buttons (⌥1–⌥9) that toggle its keywords on the
 /// selected photos; "Save as Set…" keeps the current nine under a name.
-fn keyword_set(app: &mut LightcraftApp, ui: &mut egui::Ui, have: &[String]) {
+fn keyword_set(app: &mut LightcraftApp, ui: &mut egui::Ui) {
+    // on: every selected photo has it (⌥1–⌥9 then take it off them); partly on: only some do
+    let selection = app.session.targets(&serde_json::Value::Null);
+    let chips = app.caches.keyword_chips(&app.session.catalog, &selection);
     let t = Tokens::get(ui.ctx());
     let sets = lightcraft_engine::cmd::keywords::keyword_sets_json(&app.session);
     let current = sets["current"].as_str().unwrap_or_default().to_string();
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(crate::i18n::tr("Keyword Set")).color(t.text_dim));
-        egui::ComboBox::from_id_salt("kw-set")
+        let combo = egui::ComboBox::from_id_salt("kw-set")
             .selected_text(crate::i18n::builtin_label(&current, current == lightcraft_engine::cmd::keywords::RECENT))
             .show_ui(ui, |ui| {
                 for set in sets["sets"].as_array().into_iter().flatten() {
@@ -857,6 +920,21 @@ fn keyword_set(app: &mut LightcraftApp, ui: &mut egui::Ui, have: &[String]) {
                     }
                 }
                 ui.separator();
+                // Edit Set…: the current nine, slot by slot (named, Recent Keywords becomes a set)
+                let edit = ui.button(crate::i18n::tr("Edit Set…"));
+                register(ui.ctx(), "keywordSetMenu:edit", edit.rect);
+                if edit.clicked() {
+                    let mut slots: Vec<String> =
+                        sets["keywords"].as_array().into_iter().flatten().filter_map(|k| k.as_str().map(str::to_string)).collect();
+                    slots.resize(9, String::new());
+                    let named = current != lightcraft_engine::cmd::keywords::RECENT;
+                    app.ui.dialog = Some(crate::state::Dialog::KeywordSet {
+                        replaces: named.then(|| current.clone()),
+                        name: if named { current.clone() } else { String::new() },
+                        slots,
+                        as_new: false,
+                    });
+                }
                 if ui.button(crate::i18n::tr("Save Current Keywords as Set…")).clicked() {
                     app.ui.dialog = Some(crate::state::Dialog::TextPrompt {
                         title: "Save Keyword Set".into(),
@@ -873,6 +951,7 @@ fn keyword_set(app: &mut LightcraftApp, ui: &mut egui::Ui, have: &[String]) {
                     let _ = app.run("keyword.deleteSet", json!({"name": current}));
                 }
             });
+        register(ui.ctx(), "keywordSetCombo", combo.response.rect);
     });
     let kws: Vec<String> = sets["keywords"].as_array().into_iter().flatten().filter_map(|k| k.as_str().map(str::to_string)).collect();
     if kws.is_empty() {
@@ -882,8 +961,19 @@ fn keyword_set(app: &mut LightcraftApp, ui: &mut egui::Ui, have: &[String]) {
     let bw = ((ui.available_width() - 8.0) / 3.0).floor().max(40.0);
     egui::Grid::new("kw-set-grid").num_columns(3).spacing([4.0, 4.0]).show(ui, |ui| {
         for (i, k) in kws.iter().enumerate() {
-            let on = have.iter().any(|x| x.eq_ignore_ascii_case(k));
-            let short = k.rsplit('|').next().unwrap_or(k);
+            // an empty slot: an idle button, so the others keep their ⌥ keys
+            if k.is_empty() {
+                let r = ui.add_enabled_ui(false, |ui| ui.add_sized([bw, 22.0], egui::Button::new(""))).inner;
+                register(ui.ctx(), format!("kwSetEmpty:{}", i + 1), r.rect);
+                if i % 3 == 2 {
+                    ui.end_row();
+                }
+                continue;
+            }
+            let chip = chips.iter().find(|c| lightcraft_catalog::keywords::same(&c.path, &lightcraft_catalog::keywords::clean(k)));
+            let on = chip.is_some_and(|c| c.on_all());
+            let some = chip.is_some() && !on;
+            let short = format!("{}{}", k.rsplit('|').next().unwrap_or(k), if some { " *" } else { "" });
             let r = ui
                 .add_sized(
                     [bw, 22.0],
@@ -891,6 +981,11 @@ fn keyword_set(app: &mut LightcraftApp, ui: &mut egui::Ui, have: &[String]) {
                 )
                 .on_hover_text(format!("{} — ⌥{}", k.replace('|', " › "), i + 1));
             register(ui.ctx(), format!("kwSet:{}", i + 1), r.rect);
+            if on {
+                register(ui.ctx(), format!("kwSetOn:{}", i + 1), r.rect);
+            } else if some {
+                register(ui.ctx(), format!("kwSetSome:{}", i + 1), r.rect);
+            }
             if r.clicked() {
                 let _ = app.run("keyword.toggleFromSet", json!({"index": i + 1}));
             }
diff --git a/crates/ui-egui/src/panels/rules_editor.rs b/crates/ui-egui/src/panels/rules_editor.rs
index b498f669..006d4266 100644
--- a/crates/ui-egui/src/panels/rules_editor.rs
+++ b/crates/ui-egui/src/panels/rules_editor.rs
@@ -2,10 +2,12 @@
 //! value), with nested groups. Field and operator lists come from `lightcraft_catalog::rules`.
 
 use egui::RichText;
-use lightcraft_catalog::rules::{FIELDS, Kind, field_kind, ops_for};
+use lightcraft_catalog::rules::{FIELD_GROUPS, Kind, Problem, TOP_LEVEL_FIELDS, bool_value, field_kind, field_label, ops_for};
 use lightcraft_catalog::{Match, Rule, RuleSet};
 use serde_json::{Value, json};
 
+use crate::album_picker::{AlbumEntry, AlbumPicker};
+use crate::date_picker::{DatePicker, PickedDate};
 use crate::theme::Tokens;
 use crate::widgets::register;
 
@@ -14,15 +16,30 @@ pub fn default_value(field: &str, op: &str) -> Value {
     match (field_kind(field), op) {
         (_, "isEmpty" | "isNotEmpty") => Value::Null,
         (Some(Kind::Date), "inLast" | "notInLast") => json!({"n": 30, "unit": "days"}),
-        (Some(Kind::Date), "between") => json!(["", ""]),
+        // this year (the catalog's clock): a date that means something, not an empty one that
+        // matches nothing ("is") or every date ("between")
+        (Some(Kind::Date), "between") => {
+            let year = this_year();
+            json!([format!("{year}-01"), format!("{year}-12")])
+        }
+        (Some(Kind::Date), _) => json!(this_year()),
+        (Some(Kind::Number), "between") if field == "shutterSpeed" => json!(["1/1000", "1/125"]),
+        (Some(Kind::Number), _) if field == "shutterSpeed" => json!("1/250"),
         (Some(Kind::Number), "between") => json!([0, 0]),
         (Some(Kind::Number), _) => json!(if field == "rating" { 3 } else { 0 }),
-        (Some(Kind::Choice(c)), _) => json!(c.first().copied().unwrap_or("")),
+        (Some(Kind::Choice(c)), _) => json!(c.first().map_or("", |c| c.0)),
         (Some(Kind::Bool), _) => json!(true),
+        // picked from the list
+        (Some(Kind::Album), _) => Value::Null,
         _ => json!(""),
     }
 }
 
+/// The current year, `2026`.
+fn this_year() -> String {
+    lightcraft_catalog::rules::now().get(..4).unwrap_or("2026").to_string()
+}
+
 /// A new rule (Rating ≥ 3).
 pub fn new_rule() -> Rule {
     Rule::Field { field: "rating".into(), op: "gte".into(), value: json!(3) }
@@ -60,81 +77,221 @@ fn number_value(ui: &mut egui::Ui, v: &mut Value, field: &str) {
         "rating" => (0.0, 5.0, 0.05),
         "iso" => (0.0, 409_600.0, 10.0),
         "aperture" => (0.0, 64.0, 0.05),
+        "keywordCount" | "personCount" => (0.0, 1000.0, 0.05),
+        "longEdge" | "shortEdge" => (0.0, 100_000.0, 10.0),
         _ => (0.0, 100_000.0, 0.5),
     };
-    let whole = matches!(field, "rating" | "iso" | "album");
-    let dv = egui::DragValue::new(&mut n).range(lo..=hi).speed(speed);
+    let whole = matches!(field, "rating" | "iso" | "keywordCount" | "personCount" | "longEdge" | "shortEdge");
+    // the range limits dragging; a stored value outside it (a rating of 9 from an agent) is shown
+    // as it is, marked by the check, not quietly clamped to something that matches
+    let dv = egui::DragValue::new(&mut n).range(lo..=hi).clamp_existing_to_range(false).speed(speed);
     let dv = if whole { dv.fixed_decimals(0) } else { dv.max_decimals(2) };
     if ui.add(dv).changed() {
         *v = if whole { json!(n.round() as i64) } else { json!(n) };
     }
 }
 
+/// A rule date's calendar ([`DatePicker`]): opens on the date as written (or today), keeps its
+/// precision, and writes what is picked as `2026`, `2026-08` or `2026-08-14`. It picks dates, not
+/// times: picking a day for "2026-08-14T10:00" leaves "2026-08-14" (a time is typed).
+fn date_picker(ui: &mut egui::Ui, v: &mut Value, salt: &str, min: Option<PickedDate>, max: Option<PickedDate>, env: &Env) {
+    let mut date = v.as_str().and_then(PickedDate::parse);
+    let today = PickedDate::parse(&env.today);
+    if DatePicker::new(salt, &mut date).min(min).max(max).today(today).show(ui).changed()
+        && let Some(date) = date
+    {
+        *v = json!(date.iso());
+    }
+}
+
+/// What the editor shows besides the rules: the problems `RuleSet::check` found in them (each
+/// row marks its own) and the albums an Album rule can test.
+#[derive(Default)]
+pub struct Env {
+    pub problems: Vec<Problem>,
+    /// Today (`YYYY-MM-DD…`, the session's clock): where a date picker opens when a rule has no date.
+    pub today: String,
+    /// The albums, smart albums and folders an Album rule picks from, in the sidebar's order
+    /// ([`crate::album_picker::entries_from`]); the album being edited and those that would loop
+    /// back to it are blocked, with the reason.
+    pub albums: Vec<AlbumEntry>,
+}
+
+/// An Album rule's value: an album or a smart album, picked from the tree or by typing
+/// ([`AlbumPicker`]). The id is read as the catalog reads it (`3`, `"3"`) and written as a number.
+fn album_value(ui: &mut egui::Ui, v: &mut Value, salt: &str, env: &Env) {
+    let mut chosen = lightcraft_catalog::rules::album_rule_id(v).map(|a| a.0);
+    if AlbumPicker::new(salt, &mut chosen, &env.albums).width(200.0).show(ui).changed()
+        && let Some(id) = chosen
+    {
+        *v = json!(id);
+    }
+}
+
 /// The value editor for one rule.
-fn value_editor(ui: &mut egui::Ui, field: &str, op: &str, v: &mut Value, salt: &str) {
+fn value_editor(ui: &mut egui::Ui, field: &str, op: &str, v: &mut Value, salt: &str, env: &Env) {
     match (field_kind(field), op) {
         (_, "isEmpty" | "isNotEmpty") => {}
+        (Some(Kind::Album), _) => album_value(ui, v, salt, env),
         (Some(Kind::Date), "inLast" | "notInLast") => {
-            if !v.is_object() {
-                *v = default_value(field, op);
-            }
-            let mut n = v["n"].as_f64().unwrap_or(30.0);
-            if ui.add(egui::DragValue::new(&mut n).range(1.0..=10_000.0).speed(0.2).fixed_decimals(0)).changed() {
-                v["n"] = json!(n.round());
-            }
-            let unit = v["unit"].as_str().unwrap_or("days").to_string();
+            // shown as stored ({n, unit}, or a plain number of days) and only written when changed:
+            // drawing never turns "0 days" into 1 or 20,000 into the spinner's 10,000
+            let (stored_n, stored_unit) = match &*v {
+                // n as the catalog reads it: a number, or one written as text ("7")
+                Value::Object(o) => (
+                    o.get("n").and_then(|n| n.as_f64().or_else(|| n.as_str().and_then(|t| t.trim().parse().ok()))),
+                    o.get("unit").and_then(Value::as_str).unwrap_or("days").to_string(),
+                ),
+                Value::Number(n) => (n.as_f64(), "days".to_string()),
+                _ => (None, "days".to_string()),
+            };
+            let mut n = stored_n.unwrap_or(30.0);
+            let mut unit = stored_unit.to_lowercase();
+            let mut changed =
+                ui.add(egui::DragValue::new(&mut n).range(1.0..=10_000.0).clamp_existing_to_range(false).speed(0.2).fixed_decimals(0)).changed();
             egui::ComboBox::from_id_salt(format!("{salt}-unit")).width(70.0).selected_text(crate::i18n::tr(&unit)).show_ui(ui, |ui| {
                 for u in ["hours", "days", "weeks", "months", "years"] {
-                    if ui.selectable_label(unit == u, crate::i18n::tr(u)).clicked() {
-                        v["unit"] = json!(u);
+                    if ui.selectable_label(unit.trim_end_matches('s') == u.trim_end_matches('s'), crate::i18n::tr(u)).clicked() {
+                        unit = u.to_string();
+                        changed = true;
                     }
                 }
             });
+            if changed {
+                *v = json!({"n": n.round(), "unit": unit});
+            }
         }
         (Some(k), "between") => {
-            if v.as_array().is_none_or(|a| a.len() != 2) {
-                *v = default_value(field, op);
-            }
-            let Value::Array(a) = v else { return };
-            if k == Kind::Number {
-                number_value(ui, &mut a[0], field);
+            // a value that isn't a pair is shown as the default pair but kept until one is edited,
+            // so the check can mark it
+            let mut pair = v.as_array().filter(|a| a.len() == 2).cloned().map_or_else(|| default_value(field, op), Value::Array);
+            let before = pair.clone();
+            let Some([lo, hi]) = pair.as_array_mut().map(Vec::as_mut_slice) else { return };
+            if field == "shutterSpeed" {
+                text_value(ui, lo, 60.0, "1/1000", &format!("{salt}-a"));
                 ui.label(crate::i18n::tr("and"));
-                number_value(ui, &mut a[1], field);
+                text_value(ui, hi, 60.0, "1/125", &format!("{salt}-b"));
+            } else if k == Kind::Number {
+                number_value(ui, lo, field);
+                ui.label(crate::i18n::tr("and"));
+                number_value(ui, hi, field);
+            } else if k == Kind::Date {
+                // each date's picker stops at the other one, so the two stay in order
+                let (lo_date, hi_date) = (lo.as_str().and_then(PickedDate::parse), hi.as_str().and_then(PickedDate::parse));
+                text_value(ui, lo, 86.0, "2026-01-01", &format!("{salt}-a"));
+                date_picker(ui, lo, &format!("{salt}-a"), None, hi_date, env);
+                ui.label(crate::i18n::tr("and"));
+                text_value(ui, hi, 86.0, "2026-12", &format!("{salt}-b"));
+                date_picker(ui, hi, &format!("{salt}-b"), lo_date, None, env);
             } else {
-                text_value(ui, &mut a[0], 86.0, "2026-01-01", &format!("{salt}-a"));
+                // a field without "between" (the check marks it): its two values, as text
+                text_value(ui, lo, 86.0, "", &format!("{salt}-a"));
                 ui.label(crate::i18n::tr("and"));
-                text_value(ui, &mut a[1], 86.0, "2026-12", &format!("{salt}-b"));
+                text_value(ui, hi, 86.0, "", &format!("{salt}-b"));
+            }
+            if pair != before {
+                *v = pair;
             }
         }
+        // camera notation: 1/250, 0.5, 2"
+        (Some(Kind::Number), _) if field == "shutterSpeed" => text_value(ui, v, 70.0, "1/250", salt),
         (Some(Kind::Number), _) => number_value(ui, v, field),
         (Some(Kind::Choice(c)), _) => {
             let cur = v.as_str().unwrap_or("").to_string();
-            egui::ComboBox::from_id_salt(format!("{salt}-choice")).width(90.0).selected_text(crate::i18n::tr(&cur)).show_ui(ui, |ui| {
-                for x in c.iter() {
-                    if ui.selectable_label(cur == *x, crate::i18n::tr(x)).clicked() {
-                        *v = json!(x);
+            egui::ComboBox::from_id_salt(format!("{salt}-choice")).width(120.0).selected_text(crate::i18n::choice_text(field, &cur)).show_ui(
+                ui,
+                |ui| {
+                    for (id, _) in c.iter() {
+                        if ui.selectable_label(cur == *id, crate::i18n::choice_text(field, id)).clicked() {
+                            *v = json!(id);
+                        }
+                    }
+                },
+            );
+        }
+        (Some(Kind::Bool), _) => {
+            // the catalog's reading of the value ("false" is no); one that is neither yes nor no is
+            // shown as written and kept until a choice replaces it, so the dialog reports it
+            let cur = bool_value(v);
+            let text = cur.map_or_else(|| v.to_string(), |b| crate::i18n::bool_text(b).to_string());
+            egui::ComboBox::from_id_salt(format!("{salt}-bool")).width(60.0).selected_text(text).show_ui(ui, |ui| {
+                for b in [true, false] {
+                    if ui.selectable_label(cur == Some(b), crate::i18n::bool_text(b)).clicked() {
+                        *v = json!(b);
                     }
                 }
             });
         }
-        (Some(Kind::Bool), _) => {
-            let mut b = v.as_bool().unwrap_or(true);
-            egui::ComboBox::from_id_salt(format!("{salt}-bool"))
-                .width(60.0)
-                .selected_text(crate::i18n::tr(if b { "true" } else { "false" }))
-                .show_ui(ui, |ui| {
-                    ui.selectable_value(&mut b, true, crate::i18n::tr("true"));
-                    ui.selectable_value(&mut b, false, crate::i18n::tr("false"));
-                });
-            *v = json!(b);
+        (Some(Kind::Date), _) => {
+            text_value(ui, v, 120.0, "2026-04 or 2026-04-12", salt);
+            date_picker(ui, v, salt, None, None, env);
         }
-        (Some(Kind::Date), _) => text_value(ui, v, 120.0, "2026-04 or 2026-04-12", salt),
         _ => text_value(ui, v, 140.0, "", salt),
     }
 }
 
-/// Edit `rs` in place; `salt` keeps widget ids apart between groups.
-pub fn edit(ui: &mut egui::Ui, rs: &mut RuleSet, salt: &str, depth: usize) {
+/// The field menu of one rule: the top-level fields, then one submenu per field group. Picking a
+/// field keeps the operator when the new field has it, else takes the field's first operator.
+fn field_menu(ui: &mut egui::Ui, salt: &str, field: &mut String, op: &mut String, value: &mut Value) {
+    let label = field_label(field).unwrap_or(field.as_str()).to_string();
+    let current = field.clone();
+    let r =
+        egui::ComboBox::from_id_salt(format!("{salt}-field")).width(150.0).height(400.0).selected_text(crate::i18n::tr(&label)).show_ui(ui, |ui| {
+            let mut pick = None;
+            let mut item = |ui: &mut egui::Ui, id: &'static str| {
+                let r = ui.selectable_label(current == id, crate::i18n::tr(field_label(id).unwrap_or(id)));
+                register(ui.ctx(), format!("ruleFieldItem:{id}:{salt}"), r.rect);
+                if r.clicked() {
+                    pick = Some(id);
+                    ui.close();
+                }
+            };
+            for id in TOP_LEVEL_FIELDS {
+                item(ui, id);
+            }
+            ui.separator();
+            // submenu rows look like the items above them; the one holding the current field stands out
+            // (a transparent frame, not none: a frameless button drops its padding and hover fill)
+            let inactive = &mut ui.visuals_mut().widgets.inactive;
+            inactive.weak_bg_fill = egui::Color32::TRANSPARENT;
+            inactive.bg_stroke = egui::Stroke::NONE;
+            for (group, ids) in FIELD_GROUPS {
+                let text = RichText::new(crate::i18n::tr(group));
+                let text = if ids.contains(&current.as_str()) { text.strong() } else { text };
+                let r = ui.menu_button(text, |ui| {
+                    for id in *ids {
+                        item(ui, id);
+                    }
+                });
+                register(ui.ctx(), format!("ruleFieldGroup:{group}:{salt}"), r.response.rect);
+            }
+            pick
+        });
+    register(ui.ctx(), format!("ruleField:{salt}"), r.response.rect);
+    let Some(Some(id)) = r.inner else { return };
+    if field == id {
+        return;
+    }
+    *field = id.to_string();
+    let ops = ops_for(field_kind(id).unwrap_or(Kind::Text));
+    if !ops.iter().any(|o| o.0 == op.as_str()) {
+        *op = ops.first().map_or("is", |o| o.0).to_string();
+    }
+    *value = default_value(field, op);
+}
+
+/// A rule's problem, shown under it in the caution colour (`ruleProblem:<salt>` for tests and
+/// agents).
+fn problem_note(ui: &mut egui::Ui, problem: Option<&Problem>, salt: &str) {
+    let Some(p) = problem else { return };
+    let t = Tokens::get(ui.ctx());
+    let r = ui.label(RichText::new(format!("⚠ {}", crate::i18n::problem_text(p))).color(t.caution).small());
+    register(ui.ctx(), format!("ruleProblem:{salt}"), r.rect);
+}
+
+/// Edit `rs` in place; `salt` keeps widget ids apart between groups, `path` is where `rs` sits
+/// (empty at the top) so each row finds its own problem in `env`.
+pub fn edit(ui: &mut egui::Ui, rs: &mut RuleSet, salt: &str, depth: usize, path: &[usize], env: &Env) {
     let t = Tokens::get(ui.ctx());
     ui.horizontal(|ui| {
         ui.label(RichText::new(crate::i18n::tr("Match")).color(t.text_label));
@@ -145,6 +302,8 @@ pub fn edit(ui: &mut egui::Ui, rs: &mut RuleSet, salt: &str, depth: usize) {
     let mut insert: Option<(usize, Rule)> = None;
     for (i, rule) in rs.rules.iter_mut().enumerate() {
         let rsalt = format!("{salt}-{i}");
+        let here: Vec<usize> = path.iter().copied().chain([i]).collect();
+        let problem = env.problems.iter().find(|p| p.path == here);
         match rule {
             Rule::Group { group } => {
                 egui::Frame::group(ui.style()).show(ui, |ui| {
@@ -152,27 +311,14 @@ pub fn edit(ui: &mut egui::Ui, rs: &mut RuleSet, salt: &str, depth: usize) {
                         if ui.small_button("−").on_hover_text(crate::i18n::tr("Remove this group")).clicked() {
                             remove = Some(i);
                         }
-                        ui.vertical(|ui| edit(ui, group, &rsalt, depth + 1));
+                        ui.vertical(|ui| edit(ui, group, &rsalt, depth + 1, &here, env));
                     });
+                    problem_note(ui, problem, &rsalt);
                 });
             }
             Rule::Field { field, op, value } => {
                 ui.horizontal(|ui| {
-                    let label = FIELDS.iter().find(|f| f.0 == field.as_str()).map_or(field.as_str(), |f| f.1).to_string();
-                    egui::ComboBox::from_id_salt(format!("{rsalt}-field")).width(150.0).height(400.0).selected_text(crate::i18n::tr(&label)).show_ui(
-                        ui,
-                        |ui| {
-                            for (id, l, k) in FIELDS {
-                                if ui.selectable_label(field == id, crate::i18n::tr(l)).clicked() && field != id {
-                                    *field = id.to_string();
-                                    if !ops_for(*k).iter().any(|o| o.0 == op.as_str()) {
-                                        *op = ops_for(*k)[0].0.to_string();
-                                    }
-                                    *value = default_value(field, op);
-                                }
-                            }
-                        },
-                    );
+                    field_menu(ui, &rsalt, field, op, value);
                     let kind = field_kind(field).unwrap_or(Kind::Text);
                     let op_label = ops_for(kind).iter().find(|o| o.0 == op.as_str()).map_or(op.as_str(), |o| o.1).to_string();
                     egui::ComboBox::from_id_salt(format!("{rsalt}-op")).width(110.0).selected_text(crate::i18n::tr(&op_label)).show_ui(ui, |ui| {
@@ -186,7 +332,7 @@ pub fn edit(ui: &mut egui::Ui, rs: &mut RuleSet, salt: &str, depth: usize) {
                             }
                         }
                     });
-                    value_editor(ui, field, op, value, &rsalt);
+                    value_editor(ui, field, op, value, &rsalt, env);
                     ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                         let add = ui.small_button("+").on_hover_text(crate::i18n::tr("Add a rule (⌥-click: a group)"));
                         register(ui.ctx(), format!("button:ruleAdd-{rsalt}"), add.rect);
@@ -204,6 +350,7 @@ pub fn edit(ui: &mut egui::Ui, rs: &mut RuleSet, salt: &str, depth: usize) {
                         }
                     });
                 });
+                problem_note(ui, problem, &rsalt);
             }
         }
     }
@@ -226,3 +373,55 @@ pub fn edit(ui: &mut egui::Ui, rs: &mut RuleSet, salt: &str, depth: usize) {
         });
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use lightcraft_catalog::rules::FIELDS;
+    use lightcraft_catalog::{Catalog, Photo, PhotoId, Source};
+
+    /// Every field × operator starts with a known operator and a value of the right shape: none for
+    /// the empty tests, a pair for "between", one of the choices, a number for number fields (a
+    /// real time in camera notation for shutter speed); and evaluating it never panics.
+    #[test]
+    fn default_values_make_valid_rules() {
+        let cat = Catalog::new();
+        let p = Photo::new(PhotoId(1), Source::Demo { scene: 0 }, "a.jpg", "JPEG", 10, 10, "2026-10-01T00:00:00");
+        for (field, _, kind) in FIELDS {
+            for (op, _) in ops_for(*kind) {
+                let rs = RuleSet {
+                    mode: Match::All,
+                    rules: vec![Rule::Field { field: field.to_string(), op: op.to_string(), value: default_value(field, op) }],
+                };
+                // only a text rule (nothing to look for yet) and Album (no album picked yet) wait for
+                // input; every other default is a rule that means something
+                let problems = rs.check(&cat);
+                let waits = matches!(kind, Kind::Text | Kind::Keywords) || *field == "album";
+                assert!(problems.is_empty() || waits && !matches!(*op, "isEmpty" | "isNotEmpty"), "{field} {op}: {problems:?}");
+                let _ = rs.matches(&p, &cat);
+                let v = default_value(field, op);
+                let one = |v: &Value| match kind {
+                    Kind::Choice(c) => v.as_str().is_some_and(|s| c.iter().any(|c| c.0 == s)),
+                    Kind::Number if *field == "shutterSpeed" => v.as_str().and_then(lightcraft_catalog::parse_shutter_seconds).is_some(),
+                    Kind::Number => v.is_number(),
+                    Kind::Bool => v.is_boolean(),
+                    Kind::Album => v.is_null(),
+                    Kind::Text | Kind::Keywords | Kind::Date => v.is_string(),
+                };
+                match *op {
+                    "isEmpty" | "isNotEmpty" => assert!(v.is_null(), "{field} {op}: {v}"),
+                    "between" => assert!(v.as_array().is_some_and(|a| a.len() == 2 && a.iter().all(one)), "{field} {op}: {v}"),
+                    "inLast" | "notInLast" => assert!(v["n"].is_number(), "{field} {op}: {v}"),
+                    _ => assert!(one(&v), "{field} {op}: {v}"),
+                }
+            }
+        }
+        // a new date rule starts at this year, not at "" (and a between doesn't match every date)
+        lightcraft_catalog::rules::set_now(Some("2026-10-09T12:00:00".into()));
+        assert_eq!(default_value("captureDate", "is"), json!("2026"));
+        assert_eq!(default_value("captureDate", "between"), json!(["2026-01", "2026-12"]));
+        lightcraft_catalog::rules::set_now(None);
+        assert_eq!(default_value("shutterSpeed", "gte"), json!("1/250"));
+        assert_eq!(default_value("shutterSpeed", "between"), json!(["1/1000", "1/125"]));
+    }
+}
diff --git a/crates/ui-egui/src/panels/second.rs b/crates/ui-egui/src/panels/second.rs
index ac239bcd..79aa31d1 100644
--- a/crates/ui-egui/src/panels/second.rs
+++ b/crates/ui-egui/src/panels/second.rs
@@ -39,7 +39,7 @@ fn body(app: &mut LightcraftApp, ui: &mut egui::Ui) {
     let ppp = ui.ctx().pixels_per_point();
     let side = super::detail::texture_side(ui.ctx()).clamp(64, 4096);
     let (w, h) = (((area.width() * ppp) as usize).clamp(64, side), ((area.height() * ppp) as usize).clamp(64, side));
-    if let Some(job) = app.session.loupe_job(id, w, h, true)
+    if let Some(job) = app.session.loupe_job(id, w, h, true).map(|j| app.renderer.job_for(Slot::Second, j))
         && app.renderer.textures.get(&Slot::Second).is_none_or(|t| t.key != job.key)
         && !app.renderer.is_pending(Slot::Second)
     {
diff --git a/crates/ui-egui/src/panels/settings.rs b/crates/ui-egui/src/panels/settings.rs
index 2774a962..7036e10f 100644
--- a/crates/ui-egui/src/panels/settings.rs
+++ b/crates/ui-egui/src/panels/settings.rs
@@ -1,8 +1,9 @@
-//! The Settings dialog (⌘,): General, Import, Performance, Interface, Faces, AI Denoise.
+//! The Settings dialog (⌘,): General, Import, Performance, Display, Interface, Faces, AI Denoise.
 //!
 //! Changes apply immediately (no OK/Cancel). Where they are stored:
 //! - **app settings** ([`crate::state::AppSettings`]: startup view, delete confirmation, GPU,
-//!   preview size, filmstrip/grid badges, last library) and Auto Advance live in the UI state,
+//!   preview size, filmstrip/grid badges, last library, monitor profile) and Auto Advance live in
+//!   the UI state,
 //!   saved by the host in its config folder (`ui.json`);
 //! - **library settings** (import defaults, XMP sidecars, thumbnail cache size) go through the
 //!   `library.preferences` / `library.xmpPreferences` commands into the library's `prefs.json`,
@@ -21,6 +22,7 @@ pub const TABS: &[(&str, &str)] = &[
     ("general", "General"),
     ("import", "Import"),
     ("performance", "Performance"),
+    ("display", "Display"),
     ("interface", "Interface"),
     ("faces", "Faces"),
     ("denoise", "AI Denoise"),
@@ -49,6 +51,7 @@ pub fn body(app: &mut LightcraftApp, ui: &mut egui::Ui, tab: &mut String) {
     match tab.as_str() {
         "import" => import_tab(app, ui, &t),
         "performance" => performance_tab(app, ui, &t),
+        "display" => display_tab(app, ui, &t),
         "interface" => interface_tab(app, ui, &t),
         "faces" => super::faces::settings_tab(app, ui, &t),
         "denoise" => super::denoise::settings_tab(app, ui, &t),
@@ -532,6 +535,69 @@ fn smart_previews(app: &mut LightcraftApp, ui: &mut egui::Ui, t: &Tokens) {
 
 // ---------------------------------------------------------------------------------- Interface
 
+/// The monitor profile (`app.displayProfile`): previews are shown through the display's ICC
+/// profile, so wide-gamut and calibrated displays show colours as they are.
+fn display_tab(app: &mut LightcraftApp, ui: &mut egui::Ui, t: &Tokens) {
+    heading(ui, t, crate::i18n::tr("Monitor profile"));
+    let current = app.renderer.display().cloned();
+    row(ui, t, crate::i18n::tr("Profile"), |ui| {
+        let name = match &current {
+            Some(d) => d.profile.description.clone(),
+            None => crate::i18n::tr("None (the display is treated as sRGB)").to_string(),
+        };
+        ui.label(RichText::new(name).color(t.text));
+    });
+    row(ui, t, "", |ui| {
+        let can = app.services.pick_display_profile.is_some();
+        let r = ui.add_enabled(can, egui::Button::new(crate::i18n::tr("Choose Profile…")));
+        register(ui.ctx(), "button:settingsDisplayProfile", r.rect);
+        if r.clicked()
+            && let Some(path) = app.services.pick_display_profile.as_mut().and_then(|pick| pick().into_iter().next())
+        {
+            app.ui.settings.display_profile = path;
+        }
+        let r = ui.add_enabled(!app.ui.settings.display_profile.is_empty(), egui::Button::new(crate::i18n::tr("Use sRGB")));
+        register(ui.ctx(), "button:settingsDisplayProfileNone", r.rect);
+        if r.clicked() {
+            app.ui.settings.display_profile.clear();
+        }
+        if !can {
+            hint(ui, t, crate::i18n::tr("not available here"));
+        }
+    });
+    if let Some(e) = &app.display_error {
+        ui.label(RichText::new(e).size(11.0).color(t.reject));
+    }
+    if let Some(d) = &current {
+        let info = d.describe();
+        row(ui, t, crate::i18n::tr("File"), |ui| {
+            ui.label(RichText::new(&d.path).size(11.0).color(t.text_dim));
+        });
+        row(ui, t, crate::i18n::tr("Type"), |ui| {
+            let kind = match d.profile.kind {
+                lightcraft_engine::display::DisplayKind::MatrixTrc => crate::i18n::tr("Matrix/TRC"),
+                lightcraft_engine::display::DisplayKind::Lut => crate::i18n::tr("LUT-based"),
+            };
+            ui.label(RichText::new(kind).color(t.text));
+        });
+        row(ui, t, crate::i18n::tr("Primaries (x, y)"), |ui| {
+            let p = &info["primaries"];
+            let xy = |(k, l): (&str, &str)| format!("{l} {:.3}, {:.3}", p[k][0].as_f64().unwrap_or(0.0), p[k][1].as_f64().unwrap_or(0.0));
+            let text = [("red", "R"), ("green", "G"), ("blue", "B")].map(xy).join("   ");
+            ui.label(RichText::new(text).size(11.0).color(t.text_dim));
+        });
+    }
+    hint(
+        ui,
+        t,
+        crate::i18n::tr(
+            "Photos are shown through your monitor's ICC profile, so colours are right on wide-gamut and calibrated displays, and the Detail view uses the display's whole gamut. The histogram, the preview caches and exports are not affected.",
+        ),
+    );
+    #[cfg(target_os = "linux")]
+    hint(ui, t, crate::i18n::tr("Profiles assigned in your desktop's colour settings are usually in ~/.local/share/icc."));
+}
+
 fn interface_tab(app: &mut LightcraftApp, ui: &mut egui::Ui, t: &Tokens) {
     heading(ui, t, crate::i18n::tr("Filmstrip"));
     check(ui, "settings.filmNames", &mut app.ui.settings.film_names, "Show file names");
@@ -584,3 +650,29 @@ pub fn open_library(app: &mut LightcraftApp, p: &Value) -> Result<Value, String>
     app.ui.settings.library_path = path.clone();
     Ok(json!({"path": path, "photos": app.session.catalog.len()}))
 }
+
+// ---------------------------------------------------------------------------- Display profile
+
+/// `app.displayProfile {path?: string | null}`: show previews through this monitor ICC profile
+/// (`""` or `null`: none, the display is treated as sRGB) and keep it as the setting; no `path`:
+/// report only. A file that can't be used is an error and changes nothing. Returns the profile in
+/// use: `{path, description, kind (matrix|lut), primaries {red, green, blue: [x, y]}}`.
+pub fn display_profile(app: &mut LightcraftApp, p: &Value) -> Result<Value, String> {
+    let path = match p.get("path") {
+        None => None,
+        Some(Value::Null) => Some(String::new()),
+        Some(Value::String(s)) => Some(s.trim().to_string()),
+        Some(_) => return Err("app.displayProfile: path must be a string or null".into()),
+    };
+    if let Some(path) = path {
+        let d = lightcraft_engine::display::Display::load_opt(&path).map_err(|e| format!("app.displayProfile: {e}"))?;
+        app.renderer.set_display(d);
+        app.ui.settings.display_profile = path.clone();
+        app.display_applied = Some(path);
+        app.display_error = None;
+    }
+    Ok(match app.renderer.display() {
+        Some(d) => d.describe(),
+        None => json!({"path": null, "description": "sRGB (no display profile)"}),
+    })
+}
diff --git a/crates/ui-egui/src/panels/topbar.rs b/crates/ui-egui/src/panels/topbar.rs
index d06a7559..6462c87d 100644
--- a/crates/ui-egui/src/panels/topbar.rs
+++ b/crates/ui-egui/src/panels/topbar.rs
@@ -79,7 +79,7 @@ pub fn show(app: &mut LightcraftApp, ui: &mut egui::Ui) {
             });
             // search field (centred on the window)
             let sr = Rect::from_center_size(pos2(full.center().x, full.center().y), vec2(sw, 28.0));
-            let id = egui::Id::new("search-field");
+            let id = crate::text_field::id("field:search");
             if std::mem::take(&mut app.ui.focus_search) {
                 ui.memory_mut(|m| m.request_focus(id));
             }
@@ -91,7 +91,6 @@ pub fn show(app: &mut LightcraftApp, ui: &mut egui::Ui) {
                 Stroke::new(1.0, if focused { t.accent } else { t.field_border }),
                 StrokeKind::Inside,
             );
-            register(ui.ctx(), "field:search", sr);
             let mut child =
                 ui.new_child(egui::UiBuilder::new().max_rect(sr.shrink2(vec2(10.0, 4.0))).layout(egui::Layout::left_to_right(egui::Align::Center)));
             let empty = app.ui.search.is_empty();
@@ -102,14 +101,13 @@ pub fn show(app: &mut LightcraftApp, ui: &mut egui::Ui) {
                 paint(child.painter(), Rect::from_min_size(pos2(x0, sr.center().y - 8.0), vec2(16.0, 16.0)), Icon::Search, t.text_dim);
                 child.painter().galley(pos2(x0 + 24.0, sr.center().y - g.size().y / 2.0), g, t.text_dim);
             }
-            let resp = child.add(
-                egui::TextEdit::singleline(&mut app.ui.search)
-                    .id(id)
-                    .frame(egui::Frame::NONE)
-                    .desired_width(sr.width() - 20.0)
-                    .font(t.font(13.5))
-                    .text_color(t.text),
-            );
+            let resp = crate::text_field::TextField::singleline("field:search", &mut app.ui.search)
+                .frame(false)
+                .width(sr.width() - 20.0)
+                .font(t.font(13.5))
+                .text_color(t.text)
+                .show(&mut child)
+                .response;
             if resp.changed() {
                 let q = app.ui.search.clone();
                 let _ = app.run("library.filter", json!({"text": q}));
diff --git a/crates/ui-egui/src/panels/unnamed.rs b/crates/ui-egui/src/panels/unnamed.rs
index ef50ccae..0b730db7 100644
--- a/crates/ui-egui/src/panels/unnamed.rs
+++ b/crates/ui-egui/src/panels/unnamed.rs
@@ -132,14 +132,14 @@ pub fn naming_bar(app: &mut LightcraftApp, ui: &mut egui::Ui) {
         let n = selected.len();
         ui.label(RichText::new(if n == 1 { "1 face selected".to_string() } else { format!("{n} faces selected") }).color(t.text));
         let hint = suggested.clone().unwrap_or_else(|| "Name…".to_string());
-        let edit = ui.add(egui::TextEdit::singleline(&mut app.ui.unnamed_name).hint_text(hint).desired_width(240.0));
-        register(ui.ctx(), "field:unnamedName", edit.rect);
+        let field = crate::text_field::TextField::singleline("field:unnamedName", &mut app.ui.unnamed_name).hint(hint).width(240.0).show(ui);
+        let edit = &field.response;
         if std::mem::take(&mut app.ui.unnamed_focus) {
             edit.request_focus();
         }
         let typed = app.ui.unnamed_name.trim().to_string();
         let chosen = if typed.is_empty() { suggested.clone().unwrap_or_default() } else { typed.clone() };
-        if edit.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) && !chosen.is_empty() {
+        if field.ending == Some(crate::text_field::Ending::Return) && !chosen.is_empty() {
             submit = Some(chosen.clone());
         }
         let label = if n == 1 { "Name face".to_string() } else { format!("Name {n} faces") };
@@ -150,7 +150,7 @@ pub fn naming_bar(app: &mut LightcraftApp, ui: &mut egui::Ui) {
         }
         let c = ui.button("Clear");
         register(ui.ctx(), "unnamed:clear", c.rect);
-        clear = c.clicked() || (edit.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Escape)));
+        clear = c.clicked() || field.cancelled();
     });
     // the people already named, matching what is typed (a click names the faces)
     let typed = app.ui.unnamed_name.trim().to_lowercase();
diff --git a/crates/ui-egui/src/render.rs b/crates/ui-egui/src/render.rs
index f4643694..6b2293f6 100644
--- a/crates/ui-egui/src/render.rs
+++ b/crates/ui-egui/src/render.rs
@@ -211,6 +211,8 @@ pub struct Renderer {
     /// A budget other than the memory budget's share (tests).
     #[cfg(test)]
     pub(crate) stage_budget_override: Option<usize>,
+    /// The monitor profile textures are made for (`app.displayProfile`; `None`: sRGB).
+    display: Option<Arc<lightcraft_engine::display::Display>>,
     /// Since when nothing has been pending, and whether the GPU pool was trimmed since.
     #[cfg(not(target_arch = "wasm32"))]
     idle: Option<(std::time::Instant, bool)>,
@@ -268,6 +270,7 @@ impl Renderer {
             stages_trimmed: 0,
             #[cfg(test)]
             stage_budget_override: None,
+            display: None,
             #[cfg(not(target_arch = "wasm32"))]
             idle: None,
         }
@@ -304,6 +307,46 @@ impl Renderer {
         self.thumb_inputs.insert(photo.id, (Arc::downgrade(photo), bucket, key, quick));
     }
 
+    /// Views that render straight into the display profile's primaries (wide gamut); everything
+    /// else is rendered for sRGB and converted ([`lightcraft_engine::display::present`]).
+    fn renders_for_display(slot: Slot) -> bool {
+        matches!(slot, Slot::Main | Slot::Region | Slot::Before | Slot::RegionBefore | Slot::Hover | Slot::Compare(_) | Slot::Second)
+    }
+
+    /// `job` as [`Self::request`] would run it for `slot` (its key included): views render for
+    /// the display profile in use.
+    pub fn job_for(&self, slot: Slot, job: RenderJob) -> RenderJob {
+        if Self::renders_for_display(slot) { job.with_display(self.display.clone()) } else { job }
+    }
+
+    /// The display profile in use (id).
+    pub fn display_id(&self) -> Option<u64> {
+        self.display.as_ref().map(|d| d.id())
+    }
+
+    /// The display profile textures are made for (`None`: sRGB).
+    pub fn display(&self) -> Option<&Arc<lightcraft_engine::display::Display>> {
+        self.display.as_ref()
+    }
+
+    /// Show previews through `display` from now on (`app.displayProfile`): when it changes, every
+    /// texture is made again for the new one.
+    pub fn set_display(&mut self, display: Option<Arc<lightcraft_engine::display::Display>>) {
+        if display.as_ref().map(|d| d.id()) != self.display_id() {
+            self.forget_all();
+        }
+        self.display = display;
+    }
+
+    /// Run `job` and make its image ready for `display` (on the worker thread).
+    fn run_for(job: impl FnOnce() -> RenderResult, display: &Option<Arc<lightcraft_engine::display::Display>>) -> RenderResult {
+        let mut r = job();
+        if let Some(d) = display {
+            lightcraft_engine::display::present(&mut r, d);
+        }
+        r
+    }
+
     fn request_needed(&self, slot: Slot, key: u64, priority: u32) -> bool {
         // A matching old texture must not mask a different newer request (e.g. undo).
         if let Some(&(k, p)) = self.pending.get(&slot) {
@@ -340,7 +383,8 @@ impl Renderer {
     }
 
     /// Request a render for `slot` (no-op if already current or pending at the same priority).
-    pub fn request(&mut self, slot: Slot, mut job: RenderJob, priority: u32) {
+    pub fn request(&mut self, slot: Slot, job: RenderJob, priority: u32) {
+        let mut job = self.job_for(slot, job);
         if !self.request_needed(slot, job.key, priority) {
             return;
         }
@@ -358,11 +402,15 @@ impl Renderer {
         }
         let key = job.key;
         let background = matches!(slot, Slot::Thumb(_) | Slot::ThumbQuick(_) | Slot::Prefetch(_));
+        let display = self.display.clone();
         self.pool.submit(
             slot,
             key,
             priority,
-            Box::new(move || if background { lightcraft_engine::memory::in_background(|| job.run()) } else { job.run() }),
+            Box::new(move || {
+                let run = || if background { lightcraft_engine::memory::in_background(|| job.run()) } else { job.run() };
+                Self::run_for(run, &display)
+            }),
         );
     }
 
@@ -376,7 +424,8 @@ impl Renderer {
         job.request_id = lightcraft_preview::next_tick();
         self.request_ids.insert(slot, job.request_id);
         let key = job.key;
-        self.pool.submit(slot, key, priority, Box::new(move || job.run()));
+        let display = self.display.clone();
+        self.pool.submit(slot, key, priority, Box::new(move || Self::run_for(|| job.run(), &display)));
     }
 
     /// Prepare a photo in the background (a [`Slot::Prefetch`] job runs once per key; a newer one
@@ -415,6 +464,19 @@ impl Renderer {
         self.pending.contains_key(&slot)
     }
 
+    /// The app is closing: drop the jobs that have not started and wait up to `timeout` for the
+    /// ones running on the worker threads. Returns whether all of them have ended. Nothing is
+    /// rendered afterwards.
+    pub fn shutdown(&mut self, timeout: std::time::Duration) -> bool {
+        self.queue.clear();
+        self.pool.shutdown(timeout)
+    }
+
+    /// Worker threads that are still alive (0 before the first render).
+    pub fn live_workers(&self) -> usize {
+        self.pool.live_workers()
+    }
+
     /// The texture to show for a grid/filmstrip thumbnail: the rendered one, else its stand-in.
     pub fn thumb(&self, id: PhotoId) -> Option<&Tex> {
         self.textures.get(&Slot::Thumb(id)).or_else(|| self.textures.get(&Slot::ThumbQuick(id)))
@@ -563,8 +625,12 @@ impl Renderer {
         }
         self.dispatch();
         let mut changed = false;
-        for (mut slot, r, ms) in finished {
+        for (mut slot, mut r, ms) in finished {
             self.completed += 1;
+            // made for another display profile than the one in use: obsolete
+            if r.display.is_some_and(|id| Some(id) != self.display_id()) {
+                continue;
+            }
             // Ignore obsolete pixels, failures and decoded sources, even for the same render key;
             // an interactive view still takes a superseded draft that is newer than what it
             // shows, and the source it decoded: a drag supersedes every request before it
@@ -586,6 +652,10 @@ impl Renderer {
             if slot.is_view() {
                 self.shown_ids.insert(slot, r.request_id);
             }
+            // (results from an offload, which doesn't know the display profile: converted here)
+            if let Some(d) = &self.display {
+                lightcraft_engine::display::present(&mut r, d);
+            }
             if self.pending.get(&slot).is_some_and(|p| p.0 == r.key) {
                 self.pending.remove(&slot);
             }
diff --git a/crates/ui-egui/src/shortcuts.rs b/crates/ui-egui/src/shortcuts.rs
index cd69b2da..e3af3c66 100644
--- a/crates/ui-egui/src/shortcuts.rs
+++ b/crates/ui-egui/src/shortcuts.rs
@@ -260,27 +260,46 @@ pub fn parse(s: &str) -> Option<(Modifiers, Key)> {
 }
 
 fn matches(i: &egui::InputState, m: Modifiers, k: Key) -> bool {
-    i.events.iter().any(|e| match e {
-        egui::Event::Key { key, physical_key, pressed: true, modifiers, .. } => {
-            // `Ctrl` is the physical Control key (on macOS distinct from Cmd; elsewhere Cmd = Ctrl);
-            // "Delete" (⌫ = Backspace) also matches forward-delete
-            let ctrl_ok = if m.ctrl { modifiers.ctrl } else { !modifiers.ctrl || modifiers.command };
-            let cmd_ok = m.ctrl || modifiers.command == m.command;
-            // winit can report shifted digits as punctuation (Shift+1 = `!`). Recognize the
-            // physical number key for culling, without changing layout-aware letter shortcuts.
-            let shifted_digit = m.shift
-                && *physical_key == Some(k)
-                && matches!(k, Key::Num0 | Key::Num1 | Key::Num2 | Key::Num3 | Key::Num4 | Key::Num5 | Key::Num6 | Key::Num7 | Key::Num8 | Key::Num9);
-            (*key == k || shifted_digit || (k == Key::Backspace && *key == Key::Delete))
-                && ctrl_ok
-                && cmd_ok
-                && modifiers.shift == m.shift
-                && modifiers.alt == m.alt
-        }
-        _ => false,
+    // the windowing layer turns ⌘C / ⌘X / ⌘V (with any other modifiers held) and the keyboard's
+    // Copy / Cut / Paste keys into these on Windows and Linux (macOS's menu bar takes them first);
+    // without ⌘/Ctrl held they came from a key that is the plain command (Windows' ⇧Insert pastes)
+    let clipboard = if i.modifiers.command { i.modifiers } else { Modifiers::COMMAND };
+    i.events.iter().any(|e| {
+        let (key, physical_key, modifiers) = match e {
+            egui::Event::Key { key, physical_key, pressed: true, modifiers, .. } => (key, physical_key, modifiers),
+            egui::Event::Copy => (&Key::C, &None, &clipboard),
+            egui::Event::Cut => (&Key::X, &None, &clipboard),
+            egui::Event::Paste(_) => (&Key::V, &None, &clipboard),
+            _ => return false,
+        };
+        // `Ctrl` is the physical Control key (on macOS distinct from Cmd; elsewhere Cmd = Ctrl);
+        // "Delete" (⌫ = Backspace) also matches forward-delete
+        let ctrl_ok = if m.ctrl { modifiers.ctrl } else { !modifiers.ctrl || modifiers.command };
+        let cmd_ok = m.ctrl || modifiers.command == m.command;
+        // winit can report shifted digits as punctuation (Shift+1 = `!`). Recognize the
+        // physical number key for culling, without changing layout-aware letter shortcuts.
+        let shifted_digit = m.shift
+            && *physical_key == Some(k)
+            && matches!(k, Key::Num0 | Key::Num1 | Key::Num2 | Key::Num3 | Key::Num4 | Key::Num5 | Key::Num6 | Key::Num7 | Key::Num8 | Key::Num9);
+        (*key == k || shifted_digit || (k == Key::Backspace && *key == Key::Delete))
+            && ctrl_ok
+            && cmd_ok
+            && modifiers.shift == m.shift
+            && modifiers.alt == m.alt
     })
 }
 
+/// Default brackets rate in grids. Remapped brush keys retain their brush action, and a
+/// saved assignment of either bracket to another command takes precedence over this default.
+fn grid_bracket_command(keymap: &Keymap, grid: bool, id: &'static str, shortcut: (Modifiers, Key)) -> Option<&'static str> {
+    let command = match (grid, id, shortcut) {
+        (true, "brush.smaller", (m, Key::OpenBracket)) if m == Modifiers::NONE => "photo.decreaseRating",
+        (true, "brush.larger", (m, Key::CloseBracket)) if m == Modifiers::NONE => "photo.increaseRating",
+        _ => return Some(id),
+    };
+    if keymap.iter().any(|(other, sc)| other != id && find_bindable(other).is_some() && parse(sc) == Some(shortcut)) { None } else { Some(command) }
+}
+
 pub fn handle(app: &mut LightcraftApp, ctx: &egui::Context) {
     if !matches!(app.ui.dialog, Some(crate::state::Dialog::Shortcuts)) {
         app.recording_shortcut = None;
@@ -294,20 +313,27 @@ pub fn handle(app: &mut LightcraftApp, ctx: &egui::Context) {
     let native = |sc: &str| app.native_shortcuts.contains(sc);
     let mut aliased: Vec<(&str, serde_json::Value)> = Vec::new();
     let keymap = &app.ui.settings.keymap;
+    let grid = library_grid(app);
     // keys the user gave to a command: the fixed bindings below (aliases, ratings) yield to them
     let taken: Vec<(Modifiers, Key)> = keymap.values().filter_map(|s| parse(s)).collect();
+    // an open popup (a menu, a date picker's calendar) closes on Esc itself: Esc's command (Back,
+    // which also closes dialogs) waits until nothing is open
+    let popup_open = egui::Popup::is_any_open(ctx);
     ctx.input(|i| {
         for b in bindable() {
             if let Some(sc) = binding(keymap, b.id, b.default)
                 && let Some((m, k)) = parse(sc)
                 && !native(sc)
+                && !(k == Key::Escape && popup_open)
                 && matches(i, m, k)
+                && let Some(id) = grid_bracket_command(keymap, grid, b.id, (m, k))
             {
-                fire.push(b.id.to_string());
+                fire.push(id.to_string());
             }
         }
         for (sc, id, params) in ALIASES {
             if let Some((m, k)) = parse(sc).filter(|_| !native(sc))
+                && !(k == Key::Escape && popup_open)
                 && !taken.contains(&(m, k))
                 && matches(i, m, k)
             {
@@ -375,6 +401,8 @@ pub fn handle(app: &mut LightcraftApp, ctx: &egui::Context) {
                 crate::i18n::tr_format!("Rated {}", "★".repeat(n.parse().unwrap_or(0)))
             };
             app.toast(ctx, label);
+        } else if matches!(f.as_str(), "photo.decreaseRating" | "photo.increaseRating") {
+            cull(app, &f, json!({}), false);
         } else if let Some(l) = f.strip_prefix("label:") {
             cull(app, "photo.label", json!({"label": l}), false);
         } else if f == "panel.presets" && library_grid(app) {
@@ -844,3 +872,7 @@ mod tests {
         }
     }
 }
+
+#[cfg(test)]
+#[path = "shortcuts/tests_relative_ratings.rs"]
+mod relative_rating_tests;
diff --git a/crates/ui-egui/src/shortcuts/tests_relative_ratings.rs b/crates/ui-egui/src/shortcuts/tests_relative_ratings.rs
new file mode 100644
index 00000000..8ca2adc1
--- /dev/null
+++ b/crates/ui-egui/src/shortcuts/tests_relative_ratings.rs
@@ -0,0 +1,181 @@
+//! Real app command dispatch using egui input, without rendering an image or linking a facade.
+use egui::{Key, Modifiers};
+use lightcraft_catalog::{Flag, Op, Photo, PhotoId, Source};
+use serde_json::json;
+
+use crate::LightcraftApp;
+use crate::state::{Dialog, RightPanel, ViewMode};
+
+fn app() -> lightcraft_engine::Result<LightcraftApp> {
+    let mut s = lightcraft_engine::Session::new();
+    for (id, rating) in [(1, 0), (2, 2), (3, 5)] {
+        let mut photo = Photo::new(
+            PhotoId(id),
+            Source::File { path: format!("/lightcraft-relative-rating-keys/{id}.jpg") },
+            &format!("{id}.jpg"),
+            "JPEG",
+            40,
+            30,
+            "2026-10-09",
+        );
+        photo.rating = rating;
+        s.catalog.apply(Op::AddPhoto { photo: Box::new(photo) })?;
+    }
+    s.execute("library.sort", &json!({"key": "fileName", "ascending": true}))?;
+    s.execute("library.select", &json!({"ids": [1, 2, 3], "active": 2}))?;
+    Ok(LightcraftApp::new(s, crate::Services { png: None, ..Default::default() }))
+}
+
+fn ratings(app: &LightcraftApp) -> lightcraft_engine::Result<Vec<u8>> {
+    (1..=3)
+        .map(|id| {
+            app.session.catalog.photo(PhotoId(id)).map(|p| p.rating).ok_or_else(|| lightcraft_catalog::CatalogError::NoPhoto(PhotoId(id)).into())
+        })
+        .collect()
+}
+
+fn frame(app: &mut LightcraftApp, ctx: &egui::Context, key: Option<Key>, text: Option<&mut String>) {
+    let events = key
+        .map(|key| egui::Event::Key { key, physical_key: Some(key), pressed: true, repeat: false, modifiers: Modifiers::NONE })
+        .into_iter()
+        .collect();
+    let mut text = text;
+    let mut out = ctx.run_ui(
+        egui::RawInput { events, screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(800.0, 600.0))), ..Default::default() },
+        |ui| {
+            if let Some(text) = text.as_deref_mut() {
+                ui.add(egui::TextEdit::singleline(text).id(egui::Id::new("relative-rating-search"))).request_focus();
+            }
+            super::handle(app, ui.ctx());
+        },
+    );
+    out.textures_delta.clear();
+}
+
+#[test]
+fn grid_brackets_rate_mixed_selection_without_resizing_brushes() {
+    for view in [ViewMode::PhotoGrid, ViewMode::SquareGrid] {
+        let mut app = app().unwrap();
+        app.ui.view = view;
+        let ctx = egui::Context::default();
+        let brush = app.ui.brush_size;
+        let remove = app.ui.remove_size;
+        frame(&mut app, &ctx, Some(Key::CloseBracket), None);
+        assert_eq!(ratings(&app).unwrap(), [1, 3, 5]);
+        assert_eq!(app.session.undo.len(), 1);
+        app.session.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(ratings(&app).unwrap(), [0, 2, 5]);
+        app.session.execute("edit.redo", &json!({})).unwrap();
+        frame(&mut app, &ctx, Some(Key::OpenBracket), None);
+        assert_eq!(ratings(&app).unwrap(), [0, 2, 4]);
+        assert_eq!(app.ui.brush_size, brush);
+        assert_eq!(app.ui.remove_size, remove);
+        assert_eq!(app.session.active(), Some(PhotoId(2)));
+    }
+}
+
+#[test]
+fn detail_masking_and_remove_keep_bracket_brush_sizing() {
+    for panel in [RightPanel::Edit, RightPanel::Masking, RightPanel::Remove] {
+        let mut app = app().unwrap();
+        app.ui.view = ViewMode::Detail;
+        app.ui.right = panel;
+        let ctx = egui::Context::default();
+        app.ui.brush_size = 0.05;
+        app.ui.remove_size = 0.05;
+        frame(&mut app, &ctx, Some(Key::CloseBracket), None);
+        let size = if panel == RightPanel::Remove { app.ui.remove_size } else { app.ui.brush_size };
+        assert!((size - 0.06).abs() < 1e-6);
+        frame(&mut app, &ctx, Some(Key::OpenBracket), None);
+        let size = if panel == RightPanel::Remove { app.ui.remove_size } else { app.ui.brush_size };
+        assert!((size - 0.05).abs() < 1e-6);
+        assert_eq!(ratings(&app).unwrap(), [0, 2, 5]);
+        assert!(app.session.undo.is_empty());
+    }
+}
+
+#[test]
+fn saved_keymap_remapping_unbinding_and_reassignment_win() {
+    let mut app = app().unwrap();
+    app.ui.view = ViewMode::PhotoGrid;
+    let ctx = egui::Context::default();
+    super::assign(&mut app.ui.settings.keymap, "brush.larger", Some("F2")).unwrap();
+    super::assign(&mut app.ui.settings.keymap, "brush.smaller", None).unwrap();
+    let brush = app.ui.brush_size;
+    frame(&mut app, &ctx, Some(Key::CloseBracket), None);
+    frame(&mut app, &ctx, Some(Key::OpenBracket), None);
+    assert_eq!(ratings(&app).unwrap(), [0, 2, 5]);
+    assert_eq!(app.ui.brush_size, brush);
+    frame(&mut app, &ctx, Some(Key::F2), None);
+    assert!(app.ui.brush_size > brush, "remapped brush command keeps its meaning");
+    super::reset(&mut app.ui.settings.keymap, "brush.smaller").unwrap();
+    super::assign(&mut app.ui.settings.keymap, "photo.pick", Some("[")).unwrap();
+    frame(&mut app, &ctx, Some(Key::OpenBracket), None);
+    assert_eq!(app.session.catalog.photo(PhotoId(2)).unwrap().flag, Flag::Pick);
+    assert_eq!(ratings(&app).unwrap(), [0, 2, 5]);
+    // Also honor an existing saved override that did not explicitly disable the default.
+    super::reset(&mut app.ui.settings.keymap, "brush.larger").unwrap();
+    app.ui.settings.keymap.insert("photo.reject".into(), "]".into());
+    frame(&mut app, &ctx, Some(Key::CloseBracket), None);
+    assert_eq!(app.session.catalog.photo(PhotoId(2)).unwrap().flag, Flag::Reject);
+    assert_eq!(ratings(&app).unwrap(), [0, 2, 5]);
+}
+
+#[test]
+fn unknown_saved_bracket_assignment_does_not_shadow_grid_ratings() {
+    let mut app = app().unwrap();
+    app.ui.view = ViewMode::PhotoGrid;
+    let ctx = egui::Context::default();
+    app.ui.settings.keymap.insert("retired.command".into(), "]".into());
+    assert!(super::find_bindable("retired.command").is_none());
+    let brush = app.ui.brush_size;
+    frame(&mut app, &ctx, Some(Key::CloseBracket), None);
+    assert_eq!(ratings(&app).unwrap(), [1, 3, 5]);
+    assert_eq!(app.session.undo.len(), 1);
+    assert_eq!(app.ui.brush_size, brush);
+    app.session.execute("edit.undo", &json!({})).unwrap();
+    app.ui.settings.keymap.remove("retired.command");
+    app.ui.settings.keymap.insert("photo.pick".into(), "]".into());
+    frame(&mut app, &ctx, Some(Key::CloseBracket), None);
+    assert_eq!(app.session.catalog.photo(PhotoId(2)).unwrap().flag, Flag::Pick);
+    assert_eq!(ratings(&app).unwrap(), [0, 2, 5], "a known saved override still wins");
+    assert_eq!(app.ui.brush_size, brush);
+}
+
+#[test]
+fn relative_rating_keys_use_auto_advance_and_compare_active_target() {
+    let mut app = app().unwrap();
+    app.ui.view = ViewMode::PhotoGrid;
+    let ctx = egui::Context::default();
+    app.session.execute("library.select", &json!({"ids": [1]})).unwrap();
+    app.ui.auto_advance = true;
+    frame(&mut app, &ctx, Some(Key::CloseBracket), None);
+    assert_eq!(ratings(&app).unwrap(), [1, 2, 5]);
+    assert_eq!(app.session.active(), Some(PhotoId(2)));
+    app.ui.auto_advance = false;
+    app.ui.view = ViewMode::Compare;
+    app.session.execute("library.select", &json!({"ids": [1, 2], "active": 2})).unwrap();
+    super::assign(&mut app.ui.settings.keymap, "photo.increaseRating", Some("F3")).unwrap();
+    frame(&mut app, &ctx, Some(Key::F3), None);
+    assert_eq!(ratings(&app).unwrap(), [1, 3, 5]);
+    assert_eq!(app.session.active(), Some(PhotoId(2)));
+}
+
+#[test]
+fn brackets_yield_to_text_focus_and_shortcut_recording() {
+    let mut app = app().unwrap();
+    app.ui.view = ViewMode::PhotoGrid;
+    let ctx = egui::Context::default();
+    let mut text = String::new();
+    frame(&mut app, &ctx, None, Some(&mut text));
+    frame(&mut app, &ctx, Some(Key::CloseBracket), Some(&mut text));
+    assert!(ctx.egui_wants_keyboard_input());
+    assert_eq!(ratings(&app).unwrap(), [0, 2, 5]);
+    assert!(app.session.undo.is_empty());
+    let ctx = egui::Context::default();
+    app.ui.dialog = Some(Dialog::Shortcuts);
+    app.recording_shortcut = Some("brush.larger".into());
+    frame(&mut app, &ctx, Some(Key::CloseBracket), None);
+    assert_eq!(ratings(&app).unwrap(), [0, 2, 5]);
+    assert!(app.session.undo.is_empty());
+}
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index 83b3df29..b178a167 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -156,6 +156,9 @@ pub struct AppSettings {
     pub grid_badges: GridBadges,
     /// Shortcuts the user changed (Help ▸ Keyboard Shortcuts): command id → shortcut, `""` = none.
     pub keymap: crate::shortcuts::Keymap,
+    /// The monitor's ICC profile previews are shown through (`app.displayProfile`; "" = none:
+    /// the display is treated as sRGB).
+    pub display_profile: String,
 }
 
 impl Default for AppSettings {
@@ -172,6 +175,7 @@ impl Default for AppSettings {
             film_badges: true,
             grid_badges: GridBadges::Auto,
             keymap: Default::default(),
+            display_profile: String::new(),
         }
     }
 }
@@ -262,6 +266,17 @@ pub const RIGHT_WIDTH: PanelWidth = PanelWidth { min: 250.0, default: 270.0, max
 /// The photo area the side panels always leave free (as far as their minimum widths allow).
 pub const MIN_PHOTO_WIDTH: f32 = 360.0;
 
+/// What the Keywording box shows: the keywords (chips to edit), them with the keywords containing
+/// them, or what exported files will carry (read only).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum KeywordingView {
+    #[default]
+    Keywords,
+    Containing,
+    WillExport,
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
 pub struct UiState {
@@ -425,6 +440,8 @@ pub struct UiState {
     pub point_color: usize,
     /// Point Color "Visualize range": the selected sample's range in colour, the rest grey.
     pub point_color_visualize: bool,
+    /// Light panel "Visualize HDR": grey below SDR white, colour bands above (HDR edits).
+    pub hdr_visualize: bool,
     /// Red Eye panel: selected correction, and whether new ones are pet eyes.
     pub eye: usize,
     pub eye_pet: bool,
@@ -449,6 +466,16 @@ pub struct UiState {
     /// The keyword painter: clicking a photo in the grid toggles this keyword on it.
     #[serde(skip)]
     pub keyword_painter: Option<String>,
+    /// What the Keywording box shows (Lightroom Classic's Keyword Tags views).
+    pub keywording_view: KeywordingView,
+    /// The Keyword List's open levels (lower-case paths).
+    pub keyword_list_open: Vec<String>,
+    /// The keyword picked in the Keyword List (− deletes it, Edit edits it).
+    #[serde(skip)]
+    pub keyword_list_selected: Option<String>,
+    /// A keyword being dragged in the Keyword List (onto another to nest it).
+    #[serde(skip)]
+    pub dragging_keyword: Option<String>,
     /// A running slideshow (full screen): seconds per photo, when the next one is due (egui
     /// time), paused.
     #[serde(skip)]
@@ -506,6 +533,9 @@ pub struct NameEdit {
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "kind", rename_all = "camelCase")]
 pub enum Dialog {
+    ContactSheet {
+        options: lightcraft_engine::contact_sheet::Options,
+    },
     /// `parent`: the folder to create it in (none: the top level).
     NewAlbum {
         name: String,
@@ -557,6 +587,47 @@ pub enum Dialog {
         from: String,
         to: String,
     },
+    /// Create a keyword, or edit one (`editing`): Lightroom Classic's Create / Edit Keyword Tag.
+    KeywordTag {
+        /// The keyword being edited; `None`: a new one.
+        editing: Option<String>,
+        name: String,
+        /// A new keyword goes inside this one when `inside` is on (the keyword picked in the
+        /// list, or the default parent).
+        parent: Option<String>,
+        inside: bool,
+        /// Comma-separated.
+        synonyms: String,
+        include_on_export: bool,
+        export_containing: bool,
+        export_synonyms: bool,
+        person: bool,
+        /// A new keyword is given to the selected photos.
+        add_to_selected: bool,
+    },
+    /// Edit Keyword Set: a set's name and its nine slots (an empty one is an empty slot). `replaces`:
+    /// the set being edited (renamed when the name changes); `None` saves a new set (from Recent
+    /// Keywords).
+    KeywordSet {
+        replaces: Option<String>,
+        name: String,
+        slots: Vec<String>,
+        /// Save as a new set, leaving the edited one (Lightroom Classic's Save as New Preset).
+        #[serde(default)]
+        as_new: bool,
+    },
+    /// Move a keyword inside `parent` (`None`: the top level) where one of its name is already:
+    /// asks before merging the two.
+    MoveKeyword {
+        keyword: String,
+        parent: Option<String>,
+    },
+    /// Delete a keyword from every photo and the keyword list, after asking.
+    DeleteKeyword {
+        keyword: String,
+        /// Photos that have it (or one below it).
+        count: usize,
+    },
     /// Merge keywords into another one on every photo.
     MergeKeywords {
         from: Vec<String>,
@@ -665,10 +736,47 @@ pub enum Dialog {
         /// A whole disk or share (`library.removeFolder` takes it only on request).
         disk: bool,
     },
+    /// Synchronize Folder: what changed in a library folder on disk, and what to do about it
+    /// (`folder.synchronize`; the scan runs in [`crate::sync`]).
+    SynchronizeFolder {
+        path: String,
+        /// What the dialog calls it (a folder's last two names).
+        name: String,
+        /// A whole disk, or a folder holding disks (`folder.synchronize` `disk`).
+        #[serde(default)]
+        disk: bool,
+        /// What the scan found (`None` while it runs).
+        counts: Option<SyncCounts>,
+        import_new: bool,
+        #[serde(default = "yes")]
+        relink_moved: bool,
+        remove_missing: bool,
+        read_metadata: bool,
+    },
     About,
     Shortcuts,
 }
 
+fn yes() -> bool {
+    true
+}
+
+/// How many changes a Synchronize Folder scan found, by kind.
+#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct SyncCounts {
+    /// The folder isn't there (moved, renamed, or on a disk that isn't connected).
+    #[serde(default)]
+    pub offline: bool,
+    pub new: usize,
+    pub duplicates: usize,
+    pub unreadable: usize,
+    pub missing: usize,
+    pub metadata: usize,
+    #[serde(default)]
+    pub moved: usize,
+}
+
 impl Default for UiState {
     fn default() -> Self {
         UiState {
@@ -748,6 +856,7 @@ impl Default for UiState {
             remove_opacity: 100.0,
             point_color: 0,
             point_color_visualize: false,
+            hdr_visualize: false,
             eye: 0,
             eye_pet: false,
             visualize_spots: false,
@@ -757,6 +866,10 @@ impl Default for UiState {
             slideshow: None,
             second_window: false,
             keyword_painter: None,
+            keywording_view: KeywordingView::default(),
+            keyword_list_open: Vec::new(),
+            keyword_list_selected: None,
+            dragging_keyword: None,
             info_overlay: InfoOverlay::Off,
             navigator: true,
             settings: AppSettings::default(),
diff --git a/crates/ui-egui/src/sync.rs b/crates/ui-egui/src/sync.rs
new file mode 100644
index 00000000..244f4308
--- /dev/null
+++ b/crates/ui-egui/src/sync.rs
@@ -0,0 +1,348 @@
+//! Synchronize Folder in the app: the folder is scanned on a worker thread (a network share can
+//! take minutes; no frame waits for it) while its dialog is open, and the dialog then says what
+//! changed and what to do about it. Synchronize runs `folder.synchronize`, which acts on exactly
+//! the scan the dialog showed (see `lightcraft_engine::sync`).
+
+use std::sync::Arc;
+use std::sync::atomic::Ordering;
+
+use lightcraft_engine::sync::{FolderChanges, SyncChoice, SyncCommit, SyncInput, SyncJob, SyncProgress, SyncStep, scan_with};
+use serde_json::{Value, json};
+
+use crate::LightcraftApp;
+use crate::state::{Dialog, SyncCounts};
+use crate::theme::Tokens;
+
+/// A running scan of the dialog's folder.
+pub struct SyncTask {
+    path: String,
+    progress: Arc<SyncProgress>,
+    rx: std::sync::mpsc::Receiver<FolderChanges>,
+}
+
+/// Open the dialog for folder `path` (called `name` in it) and start scanning.
+pub fn open(app: &mut LightcraftApp, path: &str, name: &str, disk: bool) -> Result<(), String> {
+    cancel(app);
+    let input = SyncInput::new(&mut app.session, path, disk).map_err(|e| e.to_string())?;
+    let progress = Arc::new(SyncProgress::default());
+    let (tx, rx) = std::sync::mpsc::channel();
+    let p = progress.clone();
+    let job = move || {
+        let _ = tx.send(scan_with(input, &p));
+    };
+    #[cfg(not(target_arch = "wasm32"))]
+    std::thread::spawn(job);
+    #[cfg(target_arch = "wasm32")]
+    job();
+    app.sync = Some(SyncTask { path: path.to_string(), progress, rx });
+    let d = SyncChoice::default();
+    app.ui.dialog = Some(Dialog::SynchronizeFolder {
+        path: path.to_string(),
+        name: name.to_string(),
+        disk,
+        counts: None,
+        import_new: d.import_new,
+        relink_moved: d.relink_moved,
+        remove_missing: d.remove_missing,
+        read_metadata: d.read_metadata,
+    });
+    Ok(())
+}
+
+/// Stop a running scan and let go of a finished one the dialog made (one an agent made with
+/// `folder.scanChanges` is the agent's).
+fn cancel(app: &mut LightcraftApp) {
+    if let Some(t) = app.sync.take() {
+        t.progress.files.cancel.store(true, Ordering::Relaxed);
+    }
+    if std::mem::take(&mut app.sync_owns_changes) {
+        app.session.folder_changes = None;
+    }
+}
+
+/// Collect a finished scan into the dialog (called every frame). A scan whose dialog was closed
+/// is cancelled.
+pub fn poll(app: &mut LightcraftApp, ctx: &egui::Context) {
+    let open_for = match &app.ui.dialog {
+        Some(Dialog::SynchronizeFolder { path, .. }) => Some(path.clone()),
+        _ => None,
+    };
+    let Some(open_for) = open_for else {
+        if app.sync.is_some() || app.sync_owns_changes {
+            cancel(app);
+        }
+        return;
+    };
+    let Some(task) = app.sync.as_ref() else { return };
+    if task.path != open_for {
+        cancel(app);
+        return;
+    }
+    ctx.request_repaint_after(std::time::Duration::from_millis(100));
+    let changes = match task.rx.try_recv() {
+        Ok(c) => c,
+        Err(std::sync::mpsc::TryRecvError::Empty) => return,
+        Err(_) => {
+            app.sync = None;
+            app.ui.dialog = None;
+            app.toast(ctx, crate::i18n::tr("Scan failed"));
+            return;
+        }
+    };
+    app.sync = None;
+    let c = SyncCounts {
+        offline: changes.offline,
+        new: changes.new.len(),
+        duplicates: changes.duplicates,
+        unreadable: changes.unreadable.len(),
+        missing: changes.missing.len(),
+        metadata: changes.metadata.len(),
+        moved: changes.moved.len(),
+    };
+    app.session.folder_changes = Some(changes);
+    app.sync_owns_changes = true;
+    if let Some(Dialog::SynchronizeFolder { counts, .. }) = &mut app.ui.dialog {
+        *counts = Some(c);
+    }
+}
+
+/// How far the scan is (files probed, of how many).
+fn progress(app: &LightcraftApp) -> Option<(usize, usize)> {
+    app.sync.as_ref().map(|t| t.progress.counts())
+}
+
+/// The dialog's body.
+pub fn body(app: &LightcraftApp, ui: &mut egui::Ui, dlg: &mut Dialog) {
+    let Dialog::SynchronizeFolder { path, name, counts, import_new, relink_moved, remove_missing, read_metadata, .. } = dlg else { return };
+    let t = Tokens::get(ui.ctx());
+    ui.set_min_width(420.0);
+    ui.label(crate::i18n::tr("Bring the library up to date with this folder and the folders inside it:"));
+    ui.label(egui::RichText::new(name.as_str()).strong());
+    ui.label(egui::RichText::new(path.as_str()).color(t.text_dim));
+    ui.add_space(6.0);
+    let Some(c) = counts.as_ref() else {
+        ui.horizontal(|ui| {
+            ui.spinner();
+            match progress(app) {
+                Some((done, total)) if total > 0 => ui.label(format!("{} {done} / {total}", crate::i18n::tr("Scanning…"))),
+                _ => ui.label(crate::i18n::tr("Scanning…")),
+            }
+        });
+        return;
+    };
+    if c.offline {
+        ui.label(crate::i18n::tr("This folder isn't there: it was moved or renamed, or its disk isn't connected."));
+        return;
+    }
+    let choice = |ui: &mut egui::Ui, on: &mut bool, n: usize, text: String, widget: &str| {
+        let r = ui.add_enabled(n > 0, egui::Checkbox::new(on, text));
+        crate::widgets::register(ui.ctx(), widget, r.rect);
+    };
+    let count = |text: &str, n: usize| format!("{} ({n})", crate::i18n::tr(text));
+    choice(ui, import_new, c.new, count("Import new photos", c.new), "syncImportNew");
+    choice(ui, relink_moved, c.moved, count("Relink photos whose file was renamed or moved", c.moved), "syncRelinkMoved");
+    choice(ui, remove_missing, c.missing, count("Remove missing photos from the library", c.missing), "syncRemoveMissing");
+    choice(ui, read_metadata, c.metadata, count("Read metadata updates from XMP sidecars", c.metadata), "syncReadMetadata");
+    ui.add_space(6.0);
+    let dim = |ui: &mut egui::Ui, s: &str| ui.label(egui::RichText::new(s).color(t.text_dim));
+    if c.new + c.moved + c.missing + c.metadata == 0 {
+        dim(ui, crate::i18n::tr("The library is up to date with this folder."));
+    }
+    if c.missing > 0 {
+        dim(ui, crate::i18n::tr("Missing photos move to Recently Deleted and can be restored; no file on disk is touched."));
+    }
+    if c.metadata > 0 {
+        dim(ui, crate::i18n::tr("Reading a sidecar replaces the photo's rating, labels, metadata and edits with what it says."));
+    }
+    if c.duplicates > 0 {
+        dim(ui, &count("Skipped: files already in the library elsewhere", c.duplicates));
+    }
+    if c.unreadable > 0 {
+        dim(ui, &count("Skipped: files that can't be read", c.unreadable));
+    }
+}
+
+/// Synchronize with the dialog's choices: the scan the dialog showed is handed to a worker
+/// thread at once ([`SyncRun`]); nothing is read from disk on the UI thread. A scan that went
+/// stale (the folder's photos changed meanwhile) is refused and made again, keeping the choices.
+pub fn confirm(app: &mut LightcraftApp, dlg: &Dialog) -> Result<Value, String> {
+    let Dialog::SynchronizeFolder { path, name, disk, counts: Some(_), import_new, relink_moved, remove_missing, read_metadata, .. } = dlg else {
+        return Err("the folder is still being scanned".into());
+    };
+    if app.sync_run.is_some() {
+        return Err(crate::i18n::tr("A folder is already being synchronized").to_string());
+    }
+    // (an import readies its files against the library as it was: both could add the same file)
+    if app.import.is_some() {
+        return Err(crate::i18n::tr("Wait for the import to finish").to_string());
+    }
+    let choice = SyncChoice { import_new: *import_new, relink_moved: *relink_moved, remove_missing: *remove_missing, read_metadata: *read_metadata };
+    app.sync_owns_changes = false;
+    let started = match app.session.take_folder_changes(path) {
+        Some(changes) => SyncJob::start(&mut app.session, changes, choice).map_err(|e| e.to_string()),
+        None => Err(format!("{path} changed since it was scanned: scan again")),
+    };
+    let (work, commit) = match started {
+        Ok(halves) => halves,
+        Err(e) => {
+            // look again, in the background, keeping what was ticked
+            if open(app, path, name, *disk).is_ok()
+                && let Some(Dialog::SynchronizeFolder { import_new: i, relink_moved: l, remove_missing: m, read_metadata: x, .. }) =
+                    &mut app.ui.dialog
+            {
+                (*i, *l, *m, *x) = (*import_new, *relink_moved, *remove_missing, *read_metadata);
+            }
+            return Err(e);
+        }
+    };
+    let progress = Arc::new(SyncProgress::default());
+    let crashed = Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let (tx, rx) = std::sync::mpsc::channel();
+    let (p, c) = (progress.clone(), crashed.clone());
+    let job = move || {
+        // (a panic in the work ends it; what was handed over is still committed, and the end
+        // says it failed)
+        if lightcraft_engine::guard::catch("synchronize", || work.run(&p, |step| tx.send(step).is_ok())).is_err() {
+            c.store(true, Ordering::Relaxed);
+        }
+    };
+    #[cfg(not(target_arch = "wasm32"))]
+    std::thread::spawn(job);
+    #[cfg(target_arch = "wasm32")]
+    job();
+    app.sync_run = Some(SyncRun { name: name.clone(), progress, crashed, rx, commit: Some(commit), stopping: false, not_saved: Vec::new() });
+    Ok(json!({"started": true}))
+}
+
+/// A synchronize at work: the file-system half on a worker thread, its steps committed here
+/// between frames ([`poll_run`]).
+pub struct SyncRun {
+    name: String,
+    progress: Arc<SyncProgress>,
+    /// The work ended in a panic (logged).
+    crashed: Arc<std::sync::atomic::AtomicBool>,
+    rx: std::sync::mpsc::Receiver<SyncStep>,
+    /// Steps that went into the catalog but could not be saved (a full disk…), and why.
+    not_saved: Vec<String>,
+    commit: Option<SyncCommit>,
+    /// Cancel was pressed: nothing new is started; what was readied is still committed.
+    stopping: bool,
+}
+
+impl SyncRun {
+    /// (done, of how many) — for a progress row.
+    pub fn counts(&self) -> (usize, usize) {
+        self.progress.counts()
+    }
+    /// Stop after the piece in progress.
+    pub fn cancel(&mut self) {
+        self.stopping = true;
+        self.progress.files.cancel.store(true, Ordering::Relaxed);
+    }
+}
+
+impl Drop for SyncRun {
+    /// A dropped run (the app closing) stops its worker at the next piece.
+    fn drop(&mut self) {
+        self.progress.files.cancel.store(true, Ordering::Relaxed);
+    }
+}
+
+/// Commit what the worker readied (called every frame); when it is done, one undo step and a
+/// word on what happened.
+pub fn poll_run(app: &mut LightcraftApp, ctx: &egui::Context) {
+    let Some(run) = app.sync_run.as_mut() else { return };
+    ctx.request_repaint_after(std::time::Duration::from_millis(100));
+    let mut steps = Vec::new();
+    let finished = loop {
+        match run.rx.try_recv() {
+            Ok(step) => steps.push(step),
+            Err(std::sync::mpsc::TryRecvError::Empty) => break false,
+            Err(std::sync::mpsc::TryRecvError::Disconnected) => break true,
+        }
+    };
+    let Some(mut commit) = run.commit.take() else { return };
+    let mut not_saved = Vec::new();
+    for step in steps {
+        // (a step that went in but couldn't be saved — a full disk — is said at the end)
+        if let Err(e) = app.session.execute_fn("folder.synchronize", |s| {
+            commit.apply(s, step);
+            Ok(Value::Null)
+        }) {
+            not_saved.push(e.to_string());
+        }
+    }
+    let Some(run) = app.sync_run.as_mut() else { return };
+    run.not_saved.extend(not_saved);
+    if !finished {
+        run.commit = Some(commit);
+        return;
+    }
+    let (name, stopped, crashed, mut not_saved) =
+        (run.name.clone(), run.stopping, run.crashed.load(Ordering::Relaxed), std::mem::take(&mut run.not_saved));
+    app.sync_run = None;
+    let mut report = None;
+    if let Err(e) = app.session.execute_fn("folder.synchronize", |s| {
+        report = Some(commit.finish(s));
+        Ok(Value::Null)
+    }) {
+        not_saved.push(e.to_string());
+    }
+    let r = report.unwrap_or_default();
+    for (path, e) in &r.failed {
+        log::warn!("synchronize {name}: {path}: {e}");
+    }
+    for e in &not_saved {
+        log::warn!("synchronize {name}: not saved: {e}");
+    }
+    let mut parts: Vec<String> =
+        [("Imported", r.imported), ("Relinked", r.relinked), ("Removed", r.removed), ("Metadata read", r.read), ("Failed", r.failed.len())]
+            .into_iter()
+            .filter(|(_, n)| *n > 0)
+            .map(|(what, n)| format!("{} {n}", crate::i18n::tr(what)))
+            .collect();
+    // how it ended comes first: never "up to date" for a run that was stopped or failed
+    if crashed {
+        parts.insert(0, crate::i18n::tr("Stopped by an error (see the log)").to_string());
+    } else if stopped {
+        parts.insert(0, crate::i18n::tr("Stopped").to_string());
+    }
+    if let Some(e) = not_saved.first() {
+        parts.push(format!("{}: {e}", crate::i18n::tr("Not saved")));
+    }
+    let text = if parts.is_empty() { crate::i18n::tr("The library is up to date with this folder.").to_string() } else { parts.join(" · ") };
+    if not_saved.is_empty() && !crashed {
+        app.toast(ctx, format!("{name}: {text}"));
+    } else {
+        app.toast_for(ctx, format!("{name}: {text}"), 12.0);
+    }
+}
+
+/// The progress window while a synchronize runs, with Cancel (what was done stays, as one undo
+/// step; nothing new is started).
+pub fn progress_window(app: &mut LightcraftApp, ctx: &egui::Context) {
+    let Some(run) = &app.sync_run else { return };
+    let t = Tokens::get(ctx);
+    let (done, total) = run.counts();
+    let text =
+        if run.stopping { crate::i18n::tr("Stopping…").to_string() } else { format!("{} {done} / {total}", crate::i18n::tr("Synchronizing…")) };
+    let frac = if total == 0 { 0.0 } else { done as f32 / total as f32 };
+    let stopping = run.stopping;
+    let mut cancel = false;
+    egui::Window::new(crate::i18n::tr("Synchronize Folder"))
+        .id(egui::Id::new("sync-progress"))
+        .title_bar(false)
+        .resizable(false)
+        .anchor(egui::Align2::CENTER_BOTTOM, [0.0, -80.0])
+        .fixed_size([340.0, 80.0])
+        .show(ctx, |ui| {
+            ui.label(egui::RichText::new(text).color(t.text));
+            ui.add(egui::ProgressBar::new(frac).desired_width(320.0));
+            let r = ui.add_enabled(!stopping, egui::Button::new(crate::i18n::tr("Cancel")));
+            crate::widgets::register(ui.ctx(), "button:syncCancel", r.rect);
+            cancel = r.clicked();
+        });
+    if cancel && let Some(run) = app.sync_run.as_mut() {
+        run.cancel();
+    }
+}
diff --git a/crates/ui-egui/src/tests_album_picker.rs b/crates/ui-egui/src/tests_album_picker.rs
new file mode 100644
index 00000000..f48e150b
--- /dev/null
+++ b/crates/ui-egui/src/tests_album_picker.rs
@@ -0,0 +1,128 @@
+//! The album picker in the smart-album rule editor: a tree like the sidebar's, a search that
+//! narrows it as you type, keys to pick with, and albums that can't be picked shown greyed.
+
+use std::time::Duration;
+
+use lightcraft_catalog::Rule;
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+fn exec(h: &mut Headless, command: &str, params: serde_json::Value) -> serde_json::Value {
+    let r = h.request("engine.execute", json!({"command": command, "params": params}), T);
+    assert_eq!(r["ok"], true, "{command}: {r}");
+    r["result"].clone()
+}
+
+fn id(v: serde_json::Value) -> u64 {
+    v["id"].as_u64().expect("an id")
+}
+
+fn click(h: &mut Headless, id: &str) {
+    let r = h.request("ui.clickWidget", json!({"id": id}), T);
+    assert_eq!(r["ok"], true, "{id}: {r}");
+    h.settle(SETTLE);
+}
+
+fn has(h: &Headless, id: &str) -> bool {
+    h.app.widgets.iter().any(|(w, _)| w == id)
+}
+
+fn value(h: &Headless) -> serde_json::Value {
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &h.app.ui.dialog else { panic!("no rule editor") };
+    let Some(Rule::Field { value, .. }) = rules.rules.first() else { panic!("no rule") };
+    value.clone()
+}
+
+struct Library {
+    h: Headless,
+    utils: u64,
+    excluded: u64,
+    uncurated: u64,
+    trip: u64,
+}
+
+/// [UTILS] > Excluded (smart), Uncurated (smart); Trip; and the rule editor on a new album with one
+/// Album rule.
+fn library() -> Library {
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = Headless::new(app, [1200.0, 800.0], 1.0);
+    let utils = id(exec(&mut h, "album.create", json!({"name": "[UTILS]", "folder": true})));
+    let excluded = id(exec(&mut h, "album.createSmart", json!({"name": "Excluded", "rules": {"rating": 1}, "parent": utils})));
+    let uncurated = id(exec(&mut h, "album.createSmart", json!({"name": "Uncurated", "rules": {"rating": 0}, "parent": utils})));
+    let trip = id(exec(&mut h, "album.create", json!({"name": "Trip", "addSelected": false})));
+    exec(&mut h, "dialog.smartAlbum", json!({"name": "Travel"}));
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+    rules.rules = vec![serde_json::from_value(json!({"field": "album", "op": "isNot", "value": null})).unwrap()];
+    h.settle(SETTLE);
+    Library { h, utils, excluded, uncurated, trip }
+}
+
+/// With nothing typed, the picker shows the sidebar's tree: folders start closed and open on click.
+#[test]
+fn the_tree_opens_folder_by_folder() {
+    let Library { mut h, utils, excluded, trip, .. } = library();
+    click(&mut h, "albumPicker:rules-0");
+    assert!(has(&h, &format!("albumPickerFolder:{utils}:rules-0")) && has(&h, &format!("albumPickerItem:{trip}:rules-0")));
+    assert!(!has(&h, &format!("albumPickerItem:{excluded}:rules-0")), "inside a closed folder");
+    click(&mut h, &format!("albumPickerFolder:{utils}:rules-0"));
+    click(&mut h, &format!("albumPickerItem:{excluded}:rules-0"));
+    assert_eq!(value(&h), json!(excluded));
+    assert!(!has(&h, &format!("albumPickerItem:{trip}:rules-0")), "picking closes it");
+    // it opens again on the chosen album's folder
+    click(&mut h, "albumPicker:rules-0");
+    assert!(has(&h, &format!("albumPickerItem:{excluded}:rules-0")));
+}
+
+/// Typing narrows the albums to those whose path holds every word; Enter picks the first, the
+/// arrow keys move through them.
+#[test]
+fn typing_finds_and_keys_pick() {
+    let Library { mut h, excluded, uncurated, trip, .. } = library();
+    click(&mut h, "albumPicker:rules-0");
+    let r = h.request("ui.text", json!({"text": "utils"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(has(&h, &format!("albumPickerItem:{excluded}:rules-0")) && has(&h, &format!("albumPickerItem:{uncurated}:rules-0")));
+    assert!(!has(&h, &format!("albumPickerItem:{trip}:rules-0")), "Trip doesn't match");
+    for key in ["ArrowDown", "Enter"] {
+        let r = h.request("ui.key", json!({"key": key}), T);
+        assert_eq!(r["ok"], true, "{r}");
+        h.settle(SETTLE);
+    }
+    assert_eq!(value(&h), json!(uncurated), "the second match");
+}
+
+/// Albums that can't be picked (the one being edited, one that would loop) are shown greyed, not
+/// hidden, and clicking them does nothing.
+#[test]
+fn albums_that_would_loop_are_greyed() {
+    let Library { mut h, excluded, .. } = library();
+    let rules = json!({"ruleSet": {"rules": [{"field": "album", "op": "isNot", "value": excluded}]}});
+    let travel = id(exec(&mut h, "album.createSmart", json!({"name": "Travel", "rules": rules})));
+    exec(&mut h, "dialog.smartAlbum", json!({"id": excluded}));
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+    rules.rules = vec![serde_json::from_value(json!({"field": "album", "op": "is", "value": null})).unwrap()];
+    h.settle(SETTLE);
+    click(&mut h, "albumPicker:rules-0");
+    assert!(has(&h, &format!("albumPickerItem:{travel}:rules-0")), "shown");
+    click(&mut h, &format!("albumPickerItem:{travel}:rules-0"));
+    assert_eq!(value(&h), json!(null), "but not picked");
+}
+
+/// After opening a folder, typing still goes to the search: the box keeps the keyboard.
+#[test]
+fn typing_after_a_folder_click_still_searches() {
+    let Library { mut h, utils, excluded, trip, .. } = library();
+    click(&mut h, "albumPicker:rules-0");
+    click(&mut h, &format!("albumPickerFolder:{utils}:rules-0"));
+    assert!(has(&h, &format!("albumPickerItem:{excluded}:rules-0")));
+    let r = h.request("ui.text", json!({"text": "trip"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(has(&h, &format!("albumPickerItem:{trip}:rules-0")) && !has(&h, &format!("albumPickerItem:{excluded}:rules-0")), "searching for trip");
+}
diff --git a/crates/ui-egui/src/tests_crop_rotate.rs b/crates/ui-egui/src/tests_crop_rotate.rs
new file mode 100644
index 00000000..cfbfbde6
--- /dev/null
+++ b/crates/ui-egui/src/tests_crop_rotate.rs
@@ -0,0 +1,366 @@
+//! Rotating in the crop tool (issue #534): outside the crop box the pointer shows that a drag
+//! rotates, a drag shows the angle as it changes, and the Straighten value takes an exact angle.
+
+use std::time::Duration;
+
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+fn crop_tool() -> Headless {
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = Headless::new(app, [1200.0, 800.0], 1.0);
+    for (method, params) in [("ui.set", json!({"view": "detail"})), ("engine.execute", json!({"command": "panel.crop"}))] {
+        let r = h.request(method, params, T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    h.settle(SETTLE);
+    h
+}
+
+fn has(h: &Headless, id: &str) -> bool {
+    h.app.widgets.iter().any(|(w, _)| w == id)
+}
+
+fn angle(h: &Headless) -> f64 {
+    let id = h.app.session.active().expect("a photo");
+    h.app.session.catalog.photo(id).expect("the photo").develop.crop.geometry.angle
+}
+
+fn hover(h: &mut Headless, p: egui::Pos2) {
+    let r = h.request("ui.move", json!({"x": p.x, "y": p.y}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+}
+
+/// Outside the crop box, where a drag rotates, the pointer becomes a curved double arrow drawn at
+/// the pointer (no system cursor has one); inside it is the move cursor, with no rotation glyph.
+#[test]
+fn outside_the_crop_box_the_pointer_shows_rotation() {
+    let mut h = crop_tool();
+    let img = h.app.image_rect.expect("the photo on screen");
+    hover(&mut h, egui::pos2(img.left() - 24.0, img.center().y));
+    assert_eq!(h.last_cursor, egui::CursorIcon::None, "the system cursor gives way to the glyph");
+    assert!(has(&h, "cropRotateCursor"), "the rotation glyph is drawn at the pointer");
+    hover(&mut h, img.center());
+    assert_eq!(h.last_cursor, egui::CursorIcon::Move);
+    assert!(!has(&h, "cropRotateCursor"));
+}
+
+/// Dragging outside the box rotates, and the angle is shown next to the pointer while it moves.
+#[test]
+fn rotating_shows_the_angle() {
+    let mut h = crop_tool();
+    let r = h.request(
+        "ui.pointer",
+        json!({"events": [{"kind": "down", "x": -0.05, "y": 0.2}, {"kind": "drag", "x": -0.05, "y": 0.25}, {"kind": "drag", "x": -0.05, "y": 0.3}]}),
+        T,
+    );
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(angle(&h) != 0.0, "the drag rotated the crop");
+    assert!(has(&h, "cropAngleReadout"), "the angle is shown while rotating");
+    let r = h.request("ui.pointer", json!({"events": [{"kind": "up", "x": -0.05, "y": 0.3}]}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(!has(&h, "cropAngleReadout"), "and gone once released");
+}
+
+/// The Straighten value takes an exact angle: click it, type, Enter.
+#[test]
+fn the_straighten_value_takes_an_exact_angle() {
+    let mut h = crop_tool();
+    let r = h.request("ui.clickWidget", json!({"id": "sliderValue:crop.angle"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    for key in ["a", "Backspace"] {
+        // select what is there and clear it
+        let r = h.request("ui.key", json!({"key": key, "cmd": key == "a"}), T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    let r = h.request("ui.text", json!({"text": "2.5"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    let r = h.request("ui.key", json!({"key": "Enter"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!((angle(&h) - 2.5).abs() < 1e-9, "typed 2.5°, got {}", angle(&h));
+}
+
+/// The angle next to the pointer reads like the Straighten value, in degrees.
+#[test]
+fn the_angle_reads_like_the_straighten_value() {
+    use crate::panels::detail::crop_angle_label;
+    assert_eq!(crop_angle_label(0.0), "0.00°", "as the Angle field shows it at rest");
+    assert_eq!(crop_angle_label(2.5), "+2.50°");
+    assert_eq!(crop_angle_label(-12.254), "-12.25°");
+    assert_eq!(crop_angle_label(-0.001), "0.00°", "no minus zero, and every zero the same");
+}
+
+/// Hovering the Straighten value says that a value can be typed there.
+#[test]
+fn the_straighten_value_says_it_can_be_typed() {
+    let mut h = crop_tool();
+    let r = h.request("ui.hoverWidget", json!({"id": "sliderValue:crop.angle"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    // tooltips wait for the pointer to rest
+    let _ = h.step_until(Duration::from_secs(5), |h| h.painted_text().iter().any(|t| t.contains("type")));
+    assert!(
+        h.painted_text().iter().any(|t| t == "Click to type a value"),
+        "{:?}",
+        h.painted_text().iter().filter(|t| t.contains("lick")).collect::<Vec<_>>()
+    );
+}
+
+/// With ⌘ held a drag draws a level line instead of rotating, so the pointer is the crosshair, not
+/// the rotation arrow.
+#[test]
+fn command_held_shows_the_straighten_crosshair() {
+    let mut h = crop_tool();
+    let img = h.app.image_rect.expect("the photo on screen");
+    h.events.push(egui::Event::ModifiersChanged(egui::Modifiers::COMMAND));
+    h.events.push(egui::Event::PointerMoved(egui::pos2(img.left() - 24.0, img.center().y)));
+    h.settle(SETTLE);
+    assert_eq!(h.last_cursor, egui::CursorIcon::Crosshair);
+    assert!(!has(&h, "cropRotateCursor"));
+}
+
+/// The Crop panel has an angle field: click it, type an exact angle, Return.
+#[test]
+fn the_crop_panel_has_an_angle_field() {
+    let mut h = crop_tool();
+    let r = h.request("ui.clickWidget", json!({"id": "cropAngleField"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    for key in ["a", "Backspace"] {
+        let r = h.request("ui.key", json!({"key": key, "cmd": key == "a"}), T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    let r = h.request("ui.text", json!({"text": "-3.25"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    let r = h.request("ui.key", json!({"key": "Enter"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!((angle(&h) + 3.25).abs() < 1e-9, "typed -3.25°, got {}", angle(&h));
+}
+
+/// Rotating with the pointer at the canvas's corner keeps the angle readout on the canvas (and so
+/// on screen), rather than spilling past its edge.
+#[test]
+fn the_readout_stays_on_the_canvas() {
+    let mut h = crop_tool();
+    let img = h.app.image_rect.expect("the photo on screen");
+    let canvas = h.app.canvas_rect.expect("the canvas");
+    let corner = canvas.right_bottom() - egui::vec2(4.0, 4.0);
+    let (x, y) = ((corner.x - img.left()) / img.width(), (corner.y - img.top()) / img.height());
+    let r = h.request(
+        "ui.pointer",
+        json!({"events": [{"kind": "down", "x": x, "y": y - 0.1}, {"kind": "drag", "x": x, "y": y - 0.05}, {"kind": "drag", "x": x, "y": y}]}),
+        T,
+    );
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let readout = h.app.widgets.iter().find(|(w, _)| w == "cropAngleReadout").map(|(_, r)| *r).expect("the readout while rotating");
+    assert!(canvas.contains_rect(readout), "{readout:?} in {canvas:?}");
+}
+
+/// Dragging the angle field changes the angle as one undo step, like the slider.
+#[test]
+fn dragging_the_angle_field_is_one_undo_step() {
+    let mut h = crop_tool();
+    let undo = h.app.session.undo.len();
+    let r = h.request("ui.dragWidget", json!({"id": "cropAngleField", "dx": 40.0, "dy": 0.0, "steps": 6}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(angle(&h) > 0.0, "dragged right: {}", angle(&h));
+    assert_eq!(h.app.session.undo.len(), undo + 1, "one step for the whole drag");
+}
+
+/// Typing into the Angle field one key at a time applies the angle once, on Return: no undo step
+/// or render per keystroke, no half-typed angles (-3° on the way to -3.25°).
+#[test]
+fn typing_in_the_angle_field_applies_on_return() {
+    let mut h = crop_tool();
+    let r = h.request("ui.clickWidget", json!({"id": "cropAngleField"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    for key in ["a", "Backspace"] {
+        let r = h.request("ui.key", json!({"key": key, "cmd": key == "a"}), T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    h.settle(SETTLE);
+    let (before, undo) = (angle(&h), h.app.session.undo.len());
+    for ch in ["-", "3", ".", "2", "5"] {
+        let r = h.request("ui.text", json!({"text": ch}), T);
+        assert_eq!(r["ok"], true, "{r}");
+        h.settle(SETTLE);
+    }
+    assert_eq!((angle(&h), h.app.session.undo.len()), (before, undo), "nothing applied while typing");
+    let r = h.request("ui.key", json!({"key": "Enter"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!((angle(&h) + 3.25).abs() < 1e-9, "applied on Return: {}", angle(&h));
+    assert_eq!(h.app.session.undo.len(), undo + 1, "as one undo step");
+}
+
+/// Rotating in the margin beside a narrow photo keeps the readout next to the pointer: it is kept
+/// on the canvas, not pinned to the photo's edge.
+#[test]
+fn the_readout_follows_the_pointer_in_the_margin() {
+    let mut h = crop_tool();
+    let img = h.app.image_rect.expect("the photo on screen");
+    let canvas = h.app.canvas_rect.expect("the canvas");
+    assert!(img.left() - canvas.left() > 150.0, "this test needs a margin beside the photo");
+    let at = egui::pos2(canvas.left() + 40.0, img.center().y);
+    let x = (at.x - img.left()) / img.width();
+    let r = h.request(
+        "ui.pointer",
+        json!({"events": [{"kind": "down", "x": x, "y": 0.4}, {"kind": "drag", "x": x, "y": 0.45}, {"kind": "drag", "x": x, "y": 0.5}]}),
+        T,
+    );
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let readout = h.app.widgets.iter().find(|(w, _)| w == "cropAngleReadout").map(|(_, r)| *r).expect("the readout while rotating");
+    assert!(readout.distance_to_pos(at) < 60.0, "{readout:?} near {at:?}");
+}
+
+/// Placing the readout never panics, whatever the bounds (a NaN or an empty rect).
+#[test]
+fn placing_the_readout_never_panics() {
+    use crate::panels::detail::readout_rect;
+    let size = egui::vec2(50.0, 20.0);
+    for bounds in [egui::Rect::NAN, egui::Rect::NOTHING, egui::Rect::from_min_size(egui::pos2(0.0, 0.0), egui::vec2(10.0, 10.0))] {
+        let r = readout_rect(egui::pos2(5.0, 5.0), size, bounds);
+        assert_eq!(r.size(), size, "{bounds:?}");
+    }
+    let r = readout_rect(egui::pos2(f32::NAN, 5.0), size, egui::Rect::from_min_size(egui::pos2(0.0, 0.0), egui::vec2(100.0, 100.0)));
+    assert_eq!(r.size(), size);
+}
+
+/// Esc in the Angle field gives up the typed angle and keeps the old one, as in the slider's value.
+#[test]
+fn escape_in_the_angle_field_keeps_the_angle() {
+    let mut h = crop_tool();
+    let r = h.request("ui.clickWidget", json!({"id": "cropAngleField"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    for key in ["a", "Backspace"] {
+        let r = h.request("ui.key", json!({"key": key, "cmd": key == "a"}), T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    let r = h.request("ui.text", json!({"text": "7"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let (before, undo) = (angle(&h), h.app.session.undo.len());
+    let r = h.request("ui.key", json!({"key": "Escape"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert_eq!((angle(&h), h.app.session.undo.len()), (before, undo), "Esc applied nothing");
+    assert_eq!(h.app.ui.right, crate::state::RightPanel::Crop, "and only left the field");
+}
+
+/// Leaving the Angle field another way than Esc (Tab here) applies the typed angle, as Return does.
+#[test]
+fn leaving_the_angle_field_applies_the_angle() {
+    let mut h = crop_tool();
+    let r = h.request("ui.clickWidget", json!({"id": "cropAngleField"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    for key in ["a", "Backspace"] {
+        let r = h.request("ui.key", json!({"key": key, "cmd": key == "a"}), T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    let r = h.request("ui.text", json!({"text": "4.5"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let undo = h.app.session.undo.len();
+    let r = h.request("ui.key", json!({"key": "Tab"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!((angle(&h) - 4.5).abs() < 1e-9, "applied on leaving: {}", angle(&h));
+    assert_eq!(h.app.session.undo.len(), undo + 1);
+}
+
+/// A move or resize drag keeps its own pointer when it runs past the box (the box stops at the
+/// photo's edge): the rotation glyph would say the drag rotates.
+#[test]
+fn moving_the_box_never_shows_rotation() {
+    let mut h = crop_tool();
+    let r = h.request(
+        "ui.pointer",
+        json!({"events": [{"kind": "down", "x": 0.5, "y": 0.5}, {"kind": "drag", "x": 0.8, "y": 0.5}, {"kind": "drag", "x": 1.2, "y": 0.5}]}),
+        T,
+    );
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert_eq!(h.last_cursor, egui::CursorIcon::Move, "still moving");
+    assert!(!has(&h, "cropRotateCursor"));
+    assert_eq!(angle(&h), 0.0, "nothing rotated");
+}
+
+/// Closing the crop tool in the middle of a rotation (Return) leaves nothing behind: reopened,
+/// the box shows the move pointer and no angle.
+#[test]
+fn a_rotation_cut_short_leaves_nothing_behind() {
+    let mut h = crop_tool();
+    let r = h.request(
+        "ui.pointer",
+        json!({"events": [{"kind": "down", "x": -0.05, "y": 0.2}, {"kind": "drag", "x": -0.05, "y": 0.25}, {"kind": "drag", "x": -0.05, "y": 0.3}]}),
+        T,
+    );
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(has(&h, "cropAngleReadout"), "rotating");
+    for (method, params) in [
+        ("engine.execute", json!({"command": "tool.done"})),
+        ("ui.pointer", json!({"events": [{"kind": "up", "x": -0.05, "y": 0.3}]})),
+        ("engine.execute", json!({"command": "panel.crop"})),
+    ] {
+        let r = h.request(method, params, T);
+        assert_eq!(r["ok"], true, "{r}");
+        h.settle(SETTLE);
+    }
+    let img = h.app.image_rect.expect("the photo on screen");
+    hover(&mut h, img.center());
+    assert_eq!(h.last_cursor, egui::CursorIcon::Move);
+    assert!(!has(&h, "cropAngleReadout"), "no angle");
+    assert!(!has(&h, "cropRotateCursor"), "no rotation glyph");
+}
+
+/// The Angle field reads a typed angle as the Straighten value does: a decimal comma, a degree
+/// sign, and an angle past ±45° held at the limit.
+#[test]
+fn the_angle_field_reads_angles_as_people_type_them() {
+    let mut h = crop_tool();
+    for (typed, want) in [("-3,25", -3.25), ("1.5°", 1.5), ("60", 45.0)] {
+        let r = h.request("ui.clickWidget", json!({"id": "cropAngleField"}), T);
+        assert_eq!(r["ok"], true, "{r}");
+        h.settle(SETTLE);
+        for key in ["a", "Backspace"] {
+            let r = h.request("ui.key", json!({"key": key, "cmd": key == "a"}), T);
+            assert_eq!(r["ok"], true, "{r}");
+        }
+        let r = h.request("ui.text", json!({"text": typed}), T);
+        assert_eq!(r["ok"], true, "{r}");
+        let r = h.request("ui.key", json!({"key": "Enter"}), T);
+        assert_eq!(r["ok"], true, "{r}");
+        h.settle(SETTLE);
+        assert!((angle(&h) - want).abs() < 1e-9, "{typed:?}: want {want}, got {}", angle(&h));
+    }
+}
+
+/// The Angle field writes an angle as the readout does: a sign on a turned angle.
+#[test]
+fn the_angle_field_writes_the_angle_like_the_readout() {
+    let mut h = crop_tool();
+    let r = h.request("engine.execute", json!({"command": "crop.straighten", "params": {"angle": 2.5}}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let texts = h.painted_text();
+    // the field's number follows its label (its "°" is painted on its own)
+    let field = texts.iter().position(|t| t == "Angle").and_then(|i| texts.get(i + 1));
+    assert_eq!(field.map(String::as_str), Some("+2.50"), "{texts:?}");
+}
diff --git a/crates/ui-egui/src/tests_date_picker.rs b/crates/ui-egui/src/tests_date_picker.rs
new file mode 100644
index 00000000..0f701767
--- /dev/null
+++ b/crates/ui-egui/src/tests_date_picker.rs
@@ -0,0 +1,125 @@
+//! The date picker in the smart-album rule editor: picking days, months and years, moving between
+//! months, and the bounds a "between" puts on each of its two dates.
+
+use std::time::Duration;
+
+use lightcraft_catalog::Rule;
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+fn editor(rules: serde_json::Value) -> Headless {
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = Headless::new(app, [1200.0, 800.0], 1.0);
+    let r = h.request("engine.execute", json!({"command": "dialog.smartAlbum", "params": {"name": "Dates"}}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    let Some(crate::state::Dialog::SmartRules { rules: r, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+    *r = serde_json::from_value(json!({"rules": rules})).unwrap();
+    h.settle(SETTLE);
+    h
+}
+
+fn click(h: &mut Headless, id: &str) {
+    let r = h.request("ui.clickWidget", json!({"id": id}), T);
+    assert_eq!(r["ok"], true, "{id}: {r}");
+    h.settle(SETTLE);
+}
+
+fn has(h: &Headless, id: &str) -> bool {
+    h.app.widgets.iter().any(|(w, _)| w == id)
+}
+
+fn value(h: &Headless, i: usize) -> serde_json::Value {
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &h.app.ui.dialog else { panic!("no rule editor") };
+    let Some(Rule::Field { value, .. }) = rules.rules.get(i) else { panic!("no rule {i}") };
+    value.clone()
+}
+
+/// A day, then a month, then a year: each writes the date at that precision and closes the picker.
+#[test]
+fn pick_a_day_a_month_and_a_year() {
+    let mut h = editor(json!([{"field": "captureDate", "op": "is", "value": "2026-01-20"}]));
+    click(&mut h, "datePicker:rules-0");
+    assert!(has(&h, "datePickerCell:2026-01-20:rules-0"), "opens on the rule's month");
+    click(&mut h, "datePickerNext:rules-0");
+    click(&mut h, "datePickerCell:2026-02-14:rules-0");
+    assert_eq!(value(&h, 0), json!("2026-02-14"));
+    assert!(!has(&h, "datePickerCell:2026-02-14:rules-0"), "picking closes it");
+    click(&mut h, "datePicker:rules-0");
+    click(&mut h, "datePickerPrecision:month:rules-0");
+    click(&mut h, "datePickerCell:2026-08:rules-0");
+    assert_eq!(value(&h, 0), json!("2026-08"));
+    click(&mut h, "datePicker:rules-0");
+    assert!(has(&h, "datePickerCell:2026-08:rules-0"), "a month opens at month precision");
+    click(&mut h, "datePickerPrecision:year:rules-0");
+    click(&mut h, "datePickerPrev:rules-0");
+    click(&mut h, "datePickerCell:2015:rules-0");
+    assert_eq!(value(&h, 0), json!("2015"));
+}
+
+/// Each date of a "between" can't pass the other: the earlier one can't be picked after the later.
+#[test]
+fn between_dates_stay_in_order() {
+    let mut h = editor(json!([{"field": "captureDate", "op": "between", "value": ["2026-03", "2026-06"]}]));
+    click(&mut h, "datePicker:rules-0-a");
+    click(&mut h, "datePickerCell:2026-09:rules-0-a");
+    assert_eq!(value(&h, 0), json!(["2026-03", "2026-06"]), "after the later date: not taken");
+    click(&mut h, "datePickerCell:2026-05:rules-0-a");
+    assert_eq!(value(&h, 0), json!(["2026-05", "2026-06"]));
+    click(&mut h, "datePicker:rules-0-b");
+    click(&mut h, "datePickerCell:2026-04:rules-0-b");
+    assert_eq!(value(&h, 0), json!(["2026-05", "2026-06"]), "before the earlier date: not taken");
+    click(&mut h, "datePickerCell:2026-12:rules-0-b");
+    assert_eq!(value(&h, 0), json!(["2026-05", "2026-12"]));
+}
+
+/// A rule without a readable date opens on today's month (the session's clock), and opening it
+/// leaves the rule as written.
+#[test]
+fn an_unreadable_date_opens_on_this_month() {
+    let mut h = editor(json!([{"field": "captureDate", "op": "after", "value": "banana"}]));
+    h.app.session.clock = Box::new(|| "2026-10-09T12:00:00".to_string());
+    h.settle(SETTLE);
+    click(&mut h, "datePicker:rules-0");
+    assert!(has(&h, "datePickerCell:2026-10-09:rules-0"));
+    assert_eq!(value(&h, 0), json!("banana"), "opening doesn't change the rule");
+}
+
+/// Esc closes the calendar only, not the rule editor around it (and its unsaved edits).
+#[test]
+fn escape_closes_only_the_calendar() {
+    let mut h = editor(json!([{"field": "captureDate", "op": "is", "value": "2026-01-20"}]));
+    click(&mut h, "datePicker:rules-0");
+    assert!(has(&h, "datePickerCell:2026-01-20:rules-0"));
+    let r = h.request("ui.key", json!({"key": "Escape"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(!has(&h, "datePickerCell:2026-01-20:rules-0"), "the calendar closed");
+    assert!(h.app.ui.dialog.is_some(), "the editor stays open");
+}
+
+/// Esc with a dropdown open (here the field menu) closes the dropdown, not the editor.
+#[test]
+fn escape_closes_only_a_dropdown() {
+    let mut h = editor(json!([{"field": "rating", "op": "gte", "value": 3}]));
+    click(&mut h, "ruleField:rules-0");
+    assert!(has(&h, "ruleFieldItem:rating:rules-0"));
+    let r = h.request("ui.key", json!({"key": "Escape"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(!has(&h, "ruleFieldItem:rating:rules-0"), "the menu closed");
+    assert!(h.app.ui.dialog.is_some(), "the editor stays open");
+}
+
+/// Only date rules get calendars: a "between" on a text field (written by an agent; the check marks
+/// it) shows its two values as text, without date pickers that would write dates into it.
+#[test]
+fn only_dates_get_calendars() {
+    let h = editor(json!([{"field": "title", "op": "between", "value": ["a", "b"]}]));
+    assert!(!has(&h, "datePicker:rules-0-a") && !has(&h, "datePicker:rules-0-b"));
+    assert!(has(&h, "ruleProblem:rules-0"), "and the operator is marked");
+}
diff --git a/crates/ui-egui/src/tests_keymap.rs b/crates/ui-egui/src/tests_keymap.rs
index a0a1e1d0..0bd55f41 100644
--- a/crates/ui-egui/src/tests_keymap.rs
+++ b/crates/ui-egui/src/tests_keymap.rs
@@ -146,3 +146,33 @@ fn modifiers_wait_for_their_key_and_clipboard_keys_record() {
     // a saved modifier-only shortcut (from the bug) means no shortcut
     assert_eq!(crate::shortcuts::parse("Cmd+SuperLeft"), None);
 }
+
+/// On Windows and Linux the windowing layer turns Ctrl+C / Ctrl+V into clipboard events, not key
+/// presses: outside a text field they still copy the edit settings, and with ⇧ open Paste Selected
+/// Settings.
+#[test]
+fn clipboard_events_run_the_copy_and_paste_shortcuts() {
+    let mut h = demo();
+    assert!(h.app.session.clipboard.is_none());
+    h.events.push(egui::Event::Copy);
+    h.settle(SETTLE);
+    assert!(h.app.session.clipboard.is_some(), "Ctrl+C copied the edit settings");
+    let shift_cmd = egui::Modifiers::SHIFT | egui::Modifiers::COMMAND;
+    h.events.extend([egui::Event::ModifiersChanged(shift_cmd), egui::Event::Paste("text".into())]);
+    h.settle(SETTLE);
+    assert!(matches!(h.app.ui.dialog, Some(Dialog::PasteSettings { .. })), "⇧Ctrl+V: {:?}", h.app.ui.dialog);
+}
+
+/// Windows also pastes with ⇧Insert and cuts with ⇧Delete: the clipboard events they become are
+/// the plain Paste / Cut, not ⇧Ctrl+V (Paste Selected Settings).
+#[test]
+fn shift_insert_pastes_plainly() {
+    let mut h = demo();
+    h.events.push(egui::Event::Copy);
+    h.settle(SETTLE);
+    let undo = h.app.session.undo.len();
+    h.events.extend([egui::Event::ModifiersChanged(egui::Modifiers::SHIFT), egui::Event::Paste("text".into())]);
+    h.settle(SETTLE);
+    assert_eq!(h.app.ui.dialog, None, "no Paste Selected Settings");
+    assert_eq!(h.app.session.undo.len(), undo + 1, "the settings were pasted");
+}
diff --git a/crates/ui-egui/src/tests_keyword_files.rs b/crates/ui-egui/src/tests_keyword_files.rs
new file mode 100644
index 00000000..f7180c31
--- /dev/null
+++ b/crates/ui-egui/src/tests_keyword_files.rs
@@ -0,0 +1,104 @@
+//! File ▸ Import Keywords… / Export Keywords…: keyword list files (Lightroom Classic's format,
+//! which Capture One and Photo Supreme read and write too).
+
+use std::time::Duration;
+
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+fn app() -> Headless {
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = Headless::new(app, [1200.0, 800.0], 1.0);
+    h.settle(SETTLE);
+    h
+}
+
+fn temp_dir(tag: &str) -> std::path::PathBuf {
+    let d = std::env::temp_dir().join(format!("lc-ui-keyword-files-{tag}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+fn run(h: &mut Headless, command: &str, params: serde_json::Value) -> serde_json::Value {
+    let r = h.request("engine.execute", json!({"command": command, "params": params}), T);
+    h.settle(SETTLE);
+    r
+}
+
+fn toast(h: &Headless) -> String {
+    h.app.ui.toast.clone().map(|t| t.0).unwrap_or_default()
+}
+
+/// The File menu offers Import Keywords… and Export Keywords….
+#[test]
+fn the_file_menu_offers_keyword_files() {
+    let mut h = app();
+    let r = h.request("ui.menu.list", json!({}), T);
+    let items = r["result"].to_string();
+    for id in ["file.importKeywords", "file.exportKeywords"] {
+        assert!(items.contains(id), "{id}");
+    }
+}
+
+/// Import Keywords… reads a list and says how many keywords it added.
+#[test]
+fn importing_keywords_says_what_it_added() {
+    let dir = temp_dir("import");
+    let mut h = app();
+    let path = dir.join("vocabulary.utf8");
+    std::fs::write(&path, "[Places]\r\n\tPortugal\r\n\t\tLisbon\r\n").unwrap();
+    let r = run(&mut h, "file.importKeywords", json!({"path": path.to_string_lossy()}));
+    assert_eq!(r["ok"], true, "{r}");
+    assert!(h.app.session.catalog.has_keyword("Places|Portugal|Lisbon"));
+    assert!(toast(&h).contains("3"), "{}", toast(&h));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Export Keywords… writes the list, and warns about the keywords Capture One won't import.
+#[test]
+fn exporting_keywords_warns_about_capture_one() {
+    let dir = temp_dir("export");
+    let mut h = app();
+    let id = h.app.session.visible_cloned()[0].0;
+    run(&mut h, "photo.setMeta", json!({"ids": [id], "addKeywords": ["fish, chips"]}));
+    let path = dir.join("keywords.txt");
+    let r = run(&mut h, "file.exportKeywords", json!({"path": path.to_string_lossy()}));
+    assert_eq!(r["ok"], true, "{r}");
+    assert!(std::fs::read_to_string(&path).unwrap().contains("fish, chips"));
+    assert!(toast(&h).contains("Capture One"), "{}", toast(&h));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A keyword the list format can't hold is left out of the file, and the toast names it.
+#[test]
+fn exporting_keywords_names_what_it_left_out() {
+    let dir = temp_dir("export-left-out");
+    let mut h = app();
+    let id = h.app.session.visible_cloned()[0].0;
+    run(&mut h, "photo.setMeta", json!({"ids": [id], "addKeywords": ["Travel|[draft]"]}));
+    let path = dir.join("keywords.txt");
+    let r = run(&mut h, "file.exportKeywords", json!({"path": path.to_string_lossy()}));
+    assert_eq!(r["ok"], true, "{r}");
+    assert!(toast(&h).contains("Travel|[draft]"), "{}", toast(&h));
+    // a name with a line break in it shows on one line
+    run(&mut h, "photo.setMeta", json!({"ids": [id], "addKeywords": ["Line\nbreak"]}));
+    run(&mut h, "file.exportKeywords", json!({"path": path.to_string_lossy()}));
+    assert!(toast(&h).contains("Line\\nbreak") && !toast(&h).contains('\n'), "{}", toast(&h));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A list that can't be written (a folder that isn't there) says why, as importing one does.
+#[test]
+fn exporting_keywords_says_why_it_failed() {
+    let mut h = app();
+    let path = std::env::temp_dir().join("lc-no-such-folder-for-keywords").join("keywords.txt");
+    let r = run(&mut h, "file.exportKeywords", json!({"path": path.to_string_lossy()}));
+    assert_eq!(r["ok"], false, "{r}");
+    assert!(toast(&h).contains("keywords.txt"), "{}", toast(&h));
+}
diff --git a/crates/ui-egui/src/tests_keyword_list.rs b/crates/ui-egui/src/tests_keyword_list.rs
new file mode 100644
index 00000000..657e5f33
--- /dev/null
+++ b/crates/ui-egui/src/tests_keyword_list.rs
@@ -0,0 +1,430 @@
+//! The Keyword List in the right panel's Keywords (Lightroom Classic's Keyword List panel),
+//! driven through the control channel.
+
+use std::time::Duration;
+
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+/// The demo library in the Library grid with the Keywords panel open, two photos selected.
+fn keywords_panel() -> (Headless, Vec<u64>) {
+    keywords_panel_at([1400.0, 1000.0])
+}
+
+/// [`keywords_panel`] in a window of `size` (tall enough, every keyword row is on screen).
+fn keywords_panel_at(size: [f32; 2]) -> (Headless, Vec<u64>) {
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = Headless::new(app, size, 1.0);
+    let ids: Vec<u64> = h.app.session.visible_cloned().iter().take(2).map(|p| p.0).collect();
+    for (method, params) in [
+        ("ui.set", json!({"view": "photoGrid", "right": "keywords"})),
+        ("engine.execute", json!({"command": "library.select", "params": {"ids": ids}})),
+    ] {
+        let r = h.request(method, params, T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    h.settle(SETTLE);
+    (h, ids)
+}
+
+fn run(h: &mut Headless, command: &str, params: serde_json::Value) -> serde_json::Value {
+    let r = h.request("engine.execute", json!({"command": command, "params": params}), T);
+    assert_eq!(r["ok"], true, "{command}: {r}");
+    h.settle(SETTLE);
+    r
+}
+
+fn ask(h: &mut Headless, method: &str, params: serde_json::Value) {
+    let r = h.request(method, params.clone(), T);
+    assert_eq!(r["ok"], true, "{method} {params}: {r}");
+    h.settle(SETTLE);
+}
+
+fn has(h: &Headless, id: &str) -> bool {
+    h.app.widgets.iter().any(|(w, _)| w == id)
+}
+
+fn keywords_of(h: &Headless, id: u64) -> Vec<String> {
+    h.app.session.catalog.photo(lightcraft_catalog::PhotoId(id)).unwrap().meta.keywords.clone()
+}
+
+/// The list shows every keyword with its photo count, a keyword without photos too; the triangle
+/// opens a level.
+#[test]
+fn the_keyword_list_shows_every_keyword() {
+    let (mut h, _) = keywords_panel();
+    run(&mut h, "keyword.create", json!({"name": "Weddings", "parent": "Events"}));
+    assert!(has(&h, "keywordRow:Events"), "a keyword with no photos is listed");
+    assert!(!has(&h, "keywordRow:Events|Weddings"), "inside a closed level");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRowToggle:Events"}));
+    assert!(has(&h, "keywordRow:Events|Weddings"));
+    assert!(has(&h, "keywordCount:mountains"), "photo counts are shown");
+}
+
+/// The tick box gives the keyword to every selected photo, then takes it away; with only some of
+/// them having it, a click gives it to all.
+#[test]
+fn the_tick_box_gives_a_keyword_to_the_selection() {
+    let (mut h, ids) = keywords_panel();
+    run(&mut h, "keyword.create", json!({"name": "Weddings"}));
+    // the demo has many keywords: find it with the filter box
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordFilter"}));
+    ask(&mut h, "ui.text", json!({"text": "wedd"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordCheck:Weddings"}));
+    assert!(ids.iter().all(|id| keywords_of(&h, *id).contains(&"Weddings".to_string())), "given to both");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordCheck:Weddings"}));
+    assert!(ids.iter().all(|id| !keywords_of(&h, *id).contains(&"Weddings".to_string())), "taken from both");
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[0]], "addKeywords": ["Weddings"]}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordCheck:Weddings"}));
+    assert!(ids.iter().all(|id| keywords_of(&h, *id).contains(&"Weddings".to_string())), "some had it: now all do");
+}
+
+/// Typing in the filter box keeps the keywords whose name holds the text, with their parents.
+#[test]
+fn the_filter_box_narrows_the_list() {
+    let (mut h, _) = keywords_panel();
+    run(&mut h, "keyword.create", json!({"name": "Weddings", "parent": "Events"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordFilter"}));
+    ask(&mut h, "ui.text", json!({"text": "wed"}));
+    let rows: Vec<String> = h.app.widgets.iter().filter_map(|(w, _)| w.strip_prefix("keywordRow:").map(str::to_string)).collect();
+    assert_eq!(rows, ["Events", "Events|Weddings"]);
+}
+
+/// The arrow on a row shows the photos with that keyword.
+#[test]
+fn the_arrow_shows_the_photos_with_the_keyword() {
+    let (mut h, _) = keywords_panel();
+    ask(&mut h, "ui.hoverWidget", json!({"id": "keywordRow:mountains"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordShow:mountains"}));
+    assert_eq!(h.app.session.filter.keyword.as_deref(), Some("mountains"));
+}
+
+fn find(h: &mut Headless, text: &str) {
+    ask(h, "ui.clickWidget", json!({"id": "field:keywordFilter"}));
+    ask(h, "ui.key", json!({"key": "A", "cmd": true}));
+    ask(h, "ui.text", json!({"text": text}));
+}
+
+fn info(h: &mut Headless, keyword: &str) -> serde_json::Value {
+    h.app.session.execute("keyword.info", &json!({"keyword": keyword})).unwrap_or(serde_json::Value::Null)
+}
+
+/// The + button creates a keyword (Create Keyword Tag): inside the keyword picked in the list, with
+/// synonyms, and given to the selected photos when asked; Return creates it.
+#[test]
+fn plus_creates_a_keyword_inside_the_picked_one() {
+    let (mut h, ids) = keywords_panel();
+    find(&mut h, "mountains");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRow:mountains"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordList:create"}));
+    assert!(matches!(h.app.ui.dialog, Some(crate::state::Dialog::KeywordTag { editing: None, .. })), "{:?}", h.app.ui.dialog);
+    ask(&mut h, "ui.text", json!({"text": "Alps"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordSynonyms"}));
+    ask(&mut h, "ui.text", json!({"text": "peaks, summits"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "check:keywordAddToSelected"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordTagName"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    assert_eq!(h.app.ui.dialog, None);
+    let i = info(&mut h, "mountains|Alps");
+    assert_eq!((i["listed"].as_bool(), i["synonyms"].clone()), (Some(true), json!(["peaks", "summits"])), "{i}");
+    assert!(ids.iter().all(|id| keywords_of(&h, *id).contains(&"mountains|Alps".to_string())), "given to the selection");
+}
+
+/// Double-clicking a keyword edits it (Edit Keyword Tag): the dialog shows what it is, and a new
+/// name and an option change apply together, in one undo step.
+#[test]
+fn double_clicking_a_keyword_edits_it() {
+    let (mut h, _) = keywords_panel();
+    run(&mut h, "keyword.create", json!({"name": "Weddings", "synonyms": ["marriage"]}));
+    find(&mut h, "wedd");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRow:Weddings", "count": 2}));
+    let Some(crate::state::Dialog::KeywordTag { editing, name, synonyms, .. }) = h.app.ui.dialog.clone() else { panic!("{:?}", h.app.ui.dialog) };
+    assert_eq!((editing.as_deref(), name.as_str(), synonyms.as_str()), (Some("Weddings"), "Weddings", "marriage"));
+    let undo = h.app.session.undo.len();
+    ask(&mut h, "ui.text", json!({"text": "Marriages"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "check:keywordIncludeOnExport"}));
+    ask(&mut h, "ui.dialog.confirm", json!({}));
+    let i = info(&mut h, "Marriages");
+    assert_eq!((i["includeOnExport"].as_bool(), i["synonyms"].clone()), (Some(false), json!(["marriage"])), "{i}");
+    assert_eq!(h.app.session.undo.len(), undo + 1, "one undo step");
+}
+
+/// The − button deletes the picked keyword after asking how many photos lose it; Cancel keeps it, and undo
+/// brings a deleted one back.
+#[test]
+fn minus_deletes_a_keyword_after_asking() {
+    let (mut h, _) = keywords_panel();
+    find(&mut h, "mountains");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRow:mountains"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordList:delete"}));
+    assert!(matches!(h.app.ui.dialog, Some(crate::state::Dialog::DeleteKeyword { .. })), "{:?}", h.app.ui.dialog);
+    ask(&mut h, "ui.dialog.cancel", json!({}));
+    assert!(h.app.session.catalog.has_keyword("mountains"), "Cancel kept it");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordList:delete"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "button:dialogOk"}));
+    assert!(!h.app.session.catalog.has_keyword("mountains"));
+    run(&mut h, "edit.undo", json!({}));
+    assert!(h.app.session.catalog.has_keyword("mountains"));
+}
+
+/// Creating a keyword that exists says so, and the dialog stays open with what was typed.
+#[test]
+fn creating_a_keyword_that_exists_keeps_the_dialog() {
+    let (mut h, _) = keywords_panel();
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordList:create"}));
+    ask(&mut h, "ui.text", json!({"text": "mountains"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    assert!(matches!(h.app.ui.dialog, Some(crate::state::Dialog::KeywordTag { .. })), "still open");
+    assert!(h.app.ui.toast.as_ref().is_some_and(|t| t.0.contains("already")), "{:?}", h.app.ui.toast);
+}
+
+/// A keyword's context menu: create a keyword inside it, edit it, make it where new keywords go
+/// (marked in the list), and purge the keywords no photo has.
+#[test]
+fn a_keywords_menu_offers_its_actions() {
+    let (mut h, _) = keywords_panel();
+    run(&mut h, "keyword.create", json!({"name": "Weddings", "parent": "Events"}));
+    find(&mut h, "events");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRow:Events", "button": "right"}));
+    for item in ["create", "edit", "defaultParent", "purge", "delete"] {
+        assert!(has(&h, &format!("keywordMenu:{item}")), "{item}");
+    }
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordMenu:defaultParent"}));
+    assert_eq!(h.app.session.catalog.default_keyword_parent().as_deref(), Some("Events"));
+    assert!(has(&h, "keywordDefault:Events"), "the list marks where new keywords go");
+    // Create inside it
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRow:Events", "button": "right"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordMenu:create"}));
+    let Some(crate::state::Dialog::KeywordTag { parent, inside, .. }) = h.app.ui.dialog.clone() else { panic!("{:?}", h.app.ui.dialog) };
+    assert_eq!((parent.as_deref(), inside), (Some("Events"), true));
+    ask(&mut h, "ui.dialog.cancel", json!({}));
+    // Purge: Events|Weddings and Events have no photos
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRow:Events", "button": "right"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordMenu:purge"}));
+    assert!(!h.app.session.catalog.has_keyword("Events"));
+    assert_eq!(h.app.session.catalog.default_keyword_parent(), None, "gone with it");
+}
+
+fn center(h: &Headless, id: &str) -> egui::Pos2 {
+    h.app.widgets.iter().rev().find(|(w, _)| w == id).map(|(_, r)| r.center()).unwrap_or_else(|| panic!("no {id} on screen"))
+}
+
+/// Drag the widget `from` and drop it on the widget `onto`.
+fn drag(h: &mut Headless, from: &str, onto: &str) {
+    let to = center(h, onto);
+    ask(h, "ui.dragWidget", json!({"id": from, "toX": to.x, "toY": to.y, "steps": 12}));
+}
+
+/// Dragging a keyword onto another nests it there, with its photos; dropping it on the Keyword
+/// List's title takes it back to the top level.
+#[test]
+fn dragging_a_keyword_nests_it_and_back() {
+    let (mut h, ids) = keywords_panel_at([1400.0, 2400.0]);
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[0]], "keywords": ["Lisbon"]}));
+    run(&mut h, "keyword.create", json!({"name": "Portugal"}));
+    drag(&mut h, "keywordRow:Lisbon", "keywordRow:Portugal");
+    assert_eq!(keywords_of(&h, ids[0]), ["Portugal|Lisbon"]);
+    assert!(h.app.ui.dragging_keyword.is_none(), "the drag ended");
+    assert!(has(&h, "keywordRow:Portugal|Lisbon"), "Portugal opened to show it");
+    drag(&mut h, "keywordRow:Portugal|Lisbon", "keywordList:topLevel");
+    assert_eq!(keywords_of(&h, ids[0]), ["Lisbon"]);
+}
+
+/// A keyword can't be dropped inside itself or one of its own children: nothing changes.
+#[test]
+fn a_keyword_cant_be_dropped_inside_itself() {
+    let (mut h, ids) = keywords_panel_at([1400.0, 2400.0]);
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[0]], "keywords": ["Portugal|Lisbon"]}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRowToggle:Portugal"}));
+    let undo = h.app.session.undo.len();
+    drag(&mut h, "keywordRow:Portugal", "keywordRow:Portugal|Lisbon");
+    assert_eq!((keywords_of(&h, ids[0]), h.app.session.undo.len()), (vec!["Portugal|Lisbon".to_string()], undo));
+    assert_eq!(h.app.ui.dialog, None);
+    assert_eq!(h.app.ui.toast, None, "not even tried: no error to show");
+}
+
+/// Dropping a keyword where one of that name is already (Italy has a Rome) asks before merging
+/// the two; Merge does it.
+#[test]
+fn dropping_onto_a_taken_name_asks_before_merging() {
+    let (mut h, ids) = keywords_panel_at([1400.0, 2400.0]);
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[0]], "keywords": ["Rome"]}));
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[1]], "keywords": ["Italy|Rome"]}));
+    drag(&mut h, "keywordRow:Rome", "keywordRow:Italy");
+    assert!(matches!(h.app.ui.dialog, Some(crate::state::Dialog::MoveKeyword { .. })), "{:?}", h.app.ui.dialog);
+    assert_eq!(keywords_of(&h, ids[0]), ["Rome"], "nothing yet");
+    ask(&mut h, "ui.clickWidget", json!({"id": "button:dialogOk"}));
+    assert_eq!((keywords_of(&h, ids[0]), keywords_of(&h, ids[1])), (vec!["Italy|Rome".to_string()], vec!["Italy|Rome".to_string()]));
+}
+
+/// Photos dragged from the grid onto a keyword get it.
+#[test]
+fn dropping_photos_on_a_keyword_tags_them() {
+    let (mut h, ids) = keywords_panel_at([1400.0, 2400.0]);
+    run(&mut h, "keyword.create", json!({"name": "Portugal"}));
+    drag(&mut h, &format!("thumb:{}", ids[0]), "keywordRow:Portugal");
+    assert!(ids.iter().all(|id| keywords_of(&h, *id).contains(&"Portugal".to_string())), "the selection got it");
+    assert!(h.app.ui.dragging_photos.is_none());
+}
+
+fn rect(h: &Headless, id: &str) -> egui::Rect {
+    h.app.widgets.iter().rev().find(|(w, _)| w == id).map(|(_, r)| *r).unwrap_or_else(|| panic!("no {id}"))
+}
+
+/// A drop lands only on what is shown: with the list scrolled so that its title is hidden under
+/// the top bar, a keyword released over the top bar stays where it is.
+#[test]
+fn drops_land_only_on_what_is_shown() {
+    let (mut h, ids) = keywords_panel_at([1400.0, 640.0]);
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[0]], "keywords": ["aaa|zz"]}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRowToggle:aaa"}));
+    let title = rect(&h, "keywordList:topLevel");
+    ask(&mut h, "ui.hoverWidget", json!({"id": "keywordRow:aaa"}));
+    ask(&mut h, "ui.scroll", json!({"dx": 0, "dy": -(title.top() - 20.0)}));
+    let title = rect(&h, "keywordList:topLevel");
+    let hidden = egui::pos2(title.center().x, title.top() + 8.0);
+    assert!(hidden.y < 44.0 && title.contains(hidden), "the title's top is under the top bar: {title:?}");
+    let row = rect(&h, "keywordRow:aaa|zz");
+    assert!(row.top() > 44.0, "the row is shown: {row:?}");
+    ask(&mut h, "ui.dragWidget", json!({"id": "keywordRow:aaa|zz", "toX": hidden.x, "toY": hidden.y, "steps": 12}));
+    assert_eq!(keywords_of(&h, ids[0]), ["aaa|zz"], "not moved to the top level");
+}
+
+/// With no photo selected the Keyword List is still there, to create and organize keywords; its
+/// tick boxes wait for a selection.
+#[test]
+fn the_keyword_list_needs_no_selection() {
+    let (mut h, _) = keywords_panel();
+    run(&mut h, "library.select", json!({"ids": []}));
+    assert!(has(&h, "keywordList:topLevel") && has(&h, "keywordList:create"), "the list is shown");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordList:create"}));
+    ask(&mut h, "ui.text", json!({"text": "Weddings"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    assert!(h.app.session.catalog.has_keyword("Weddings"), "and creates keywords");
+}
+
+/// Return in the Synonyms field creates the keyword too, as from the name.
+#[test]
+fn return_in_synonyms_creates_the_keyword() {
+    let (mut h, _) = keywords_panel();
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordList:create"}));
+    ask(&mut h, "ui.text", json!({"text": "Weddings"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordSynonyms"}));
+    ask(&mut h, "ui.text", json!({"text": "marriage"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    assert_eq!(h.app.ui.dialog, None);
+    assert_eq!(info(&mut h, "Weddings")["synonyms"], json!(["marriage"]));
+}
+
+/// The picked keyword and the open levels follow a rename or a move made in the list: renamed,
+/// Events stays open and picked; dropped into Portugal, Lisbon stays in sight and picked.
+#[test]
+fn the_list_follows_its_keywords() {
+    let (mut h, ids) = keywords_panel_at([1400.0, 2400.0]);
+    run(&mut h, "keyword.create", json!({"name": "Weddings", "parent": "Events"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRowToggle:Events"}));
+    // a moment later: the triangle's click and the row's two aren't a triple click
+    for _ in 0..40 {
+        h.step();
+    }
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRow:Events", "count": 2}));
+    ask(&mut h, "ui.text", json!({"text": "Occasions"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    assert!(has(&h, "keywordRow:Occasions|Weddings"), "still open");
+    assert_eq!(h.app.ui.keyword_list_selected.as_deref(), Some("Occasions"), "still picked");
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[0]], "keywords": ["Lisbon"]}));
+    run(&mut h, "keyword.create", json!({"name": "Portugal", "parent": null}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordRow:Lisbon"}));
+    drag(&mut h, "keywordRow:Lisbon", "keywordRow:Portugal");
+    assert!(has(&h, "keywordRow:Portugal|Lisbon"), "its new parent opened");
+    assert_eq!(h.app.ui.keyword_list_selected.as_deref(), Some("Portugal|Lisbon"));
+}
+
+/// Press at `from`, move in steps to `to` (each a frame), without releasing.
+fn press_and_move(h: &mut Headless, from: egui::Pos2, to: egui::Pos2) {
+    let press = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE };
+    h.events.extend([egui::Event::PointerMoved(from), press(from, true)]);
+    h.step();
+    for i in 1..=8 {
+        h.events.push(egui::Event::PointerMoved(from + (to - from) * (i as f32 / 8.0)));
+        h.step();
+    }
+}
+
+fn release(h: &mut Headless, at: egui::Pos2) {
+    h.events.push(egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+    h.settle(SETTLE);
+}
+
+/// Esc gives up a keyword drag: released on another keyword afterwards, it stays where it is.
+#[test]
+fn escape_gives_up_a_keyword_drag() {
+    let (mut h, ids) = keywords_panel_at([1400.0, 2400.0]);
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[0]], "keywords": ["Lisbon"]}));
+    run(&mut h, "keyword.create", json!({"name": "Portugal", "parent": null}));
+    let (from, to) = (center(&h, "keywordRow:Lisbon"), center(&h, "keywordRow:Portugal"));
+    press_and_move(&mut h, from, to);
+    assert_eq!(h.app.ui.dragging_keyword.as_deref(), Some("Lisbon"), "dragging");
+    h.events.push(egui::Event::Key { key: egui::Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE });
+    h.step();
+    assert_eq!(h.app.ui.dragging_keyword, None, "given up");
+    release(&mut h, to);
+    assert_eq!(keywords_of(&h, ids[0]), ["Lisbon"]);
+}
+
+/// A drag ends with the button's release even when the Keyword List went away meanwhile (another
+/// panel opened): it doesn't linger to the next time the list is shown.
+#[test]
+fn a_keyword_drag_ends_without_the_list() {
+    let (mut h, _) = keywords_panel_at([1400.0, 2400.0]);
+    let from = center(&h, "keywordRow:mountains");
+    press_and_move(&mut h, from, from + egui::vec2(-300.0, 0.0));
+    assert_eq!(h.app.ui.dragging_keyword.as_deref(), Some("mountains"));
+    h.app.ui.right = crate::state::RightPanel::Info;
+    h.step();
+    release(&mut h, from + egui::vec2(-300.0, 0.0));
+    assert_eq!(h.app.ui.dragging_keyword, None);
+}
+
+/// Pressing on a tick box and moving doesn't pick the keyword up.
+#[test]
+fn a_tick_box_doesnt_start_a_drag() {
+    let (mut h, _) = keywords_panel_at([1400.0, 2400.0]);
+    let from = center(&h, "keywordCheck:mountains");
+    press_and_move(&mut h, from, from + egui::vec2(0.0, 60.0));
+    assert_eq!(h.app.ui.dragging_keyword, None);
+    release(&mut h, from + egui::vec2(0.0, 60.0));
+}
+
+/// Keywords typed in the Keywords panel's box go inside the default parent too when they are
+/// new (Lightroom Classic's Put New Keywords Inside This Keyword); keywords the library has, and
+/// paths typed whole, stay as typed.
+#[test]
+fn typed_keywords_go_inside_the_default_parent() {
+    let (mut h, ids) = keywords_panel();
+    run(&mut h, "keyword.create", json!({"name": "Events"}));
+    run(&mut h, "keyword.setDefaultParent", json!({"keyword": "Events"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keyword"}));
+    ask(&mut h, "ui.text", json!({"text": "Birthdays, mountains, Places|Lisbon"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    let k = keywords_of(&h, ids[0]);
+    for want in ["Events|Birthdays", "mountains", "Places|Lisbon"] {
+        assert!(k.contains(&want.to_string()), "{want}: {k:?}");
+    }
+}
+
+/// Dropping photos on a keyword says how many got it: one that had it already isn't counted.
+#[test]
+fn dropping_photos_counts_those_that_get_the_keyword() {
+    let (mut h, ids) = keywords_panel_at([1400.0, 2400.0]);
+    run(&mut h, "keyword.create", json!({"name": "Portugal"}));
+    run(&mut h, "photo.setMeta", json!({"ids": [ids[1]], "addKeywords": ["Portugal"]}));
+    drag(&mut h, &format!("thumb:{}", ids[0]), "keywordRow:Portugal");
+    let toast = h.app.ui.toast.clone().map(|t| t.0).unwrap_or_default();
+    assert!(toast.contains("1 photo") && !toast.contains("2 photos"), "{toast}");
+}
diff --git a/crates/ui-egui/src/tests_keyword_set.rs b/crates/ui-egui/src/tests_keyword_set.rs
new file mode 100644
index 00000000..4667f536
--- /dev/null
+++ b/crates/ui-egui/src/tests_keyword_set.rs
@@ -0,0 +1,162 @@
+//! Edit Keyword Set (Lightroom Classic's): the nine keywords of a keyword set, typed in place.
+
+use std::time::Duration;
+
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+/// The Keywords panel with a photo selected, beach and Weddings recently added.
+fn keywords_panel() -> Headless {
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = Headless::new(app, [1400.0, 1000.0], 1.0);
+    let id = h.app.session.visible_cloned()[0].0;
+    for (method, params) in [
+        ("ui.set", json!({"view": "photoGrid", "right": "keywords"})),
+        ("engine.execute", json!({"command": "library.select", "params": {"ids": [id]}})),
+        ("engine.execute", json!({"command": "photo.setMeta", "params": {"addKeywords": ["beach", "Weddings"]}})),
+    ] {
+        let r = h.request(method, params, T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    h.settle(SETTLE);
+    h
+}
+
+fn ask(h: &mut Headless, method: &str, params: serde_json::Value) {
+    let r = h.request(method, params.clone(), T);
+    assert_eq!(r["ok"], true, "{method} {params}: {r}");
+    h.settle(SETTLE);
+}
+
+fn sets(h: &mut Headless) -> serde_json::Value {
+    h.app.session.execute("keyword.sets", &json!({})).unwrap()
+}
+
+fn open_editor(h: &mut Headless) {
+    ask(h, "ui.clickWidget", json!({"id": "keywordSetCombo"}));
+    ask(h, "ui.clickWidget", json!({"id": "keywordSetMenu:edit"}));
+}
+
+/// Edit Set… on Recent Keywords shows the current nine in their slots; named, they become a set of
+/// their own (and the current one), with what was typed in an empty slot.
+#[test]
+fn editing_recent_keywords_saves_them_as_a_set() {
+    let mut h = keywords_panel();
+    let recent = sets(&mut h)["keywords"].clone();
+    open_editor(&mut h);
+    let Some(crate::state::Dialog::KeywordSet { replaces, name, slots, .. }) = h.app.ui.dialog.clone() else { panic!("{:?}", h.app.ui.dialog) };
+    assert_eq!((replaces, name.as_str()), (None, ""));
+    assert_eq!(json!(slots.iter().filter(|k| !k.is_empty()).collect::<Vec<_>>()), recent, "the current nine");
+    ask(&mut h, "ui.text", json!({"text": "Beach Weddings"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordSetSlot:3"}));
+    ask(&mut h, "ui.text", json!({"text": "harbour"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "button:dialogOk"}));
+    assert_eq!(h.app.ui.dialog, None);
+    let s = sets(&mut h);
+    assert_eq!(s["current"], "Beach Weddings");
+    assert_eq!(s["keywords"][2], "harbour", "slot 3 is ⌥3");
+}
+
+/// Edit Set… on a named set edits it: renamed, it keeps its place and stays current.
+#[test]
+fn editing_a_named_set_renames_it() {
+    let mut h = keywords_panel();
+    h.app.session.execute("keyword.saveSet", &json!({"name": "Weddings", "keywords": ["ceremony", "reception"]})).unwrap();
+    h.settle(SETTLE);
+    open_editor(&mut h);
+    let Some(crate::state::Dialog::KeywordSet { replaces, name, .. }) = h.app.ui.dialog.clone() else { panic!("{:?}", h.app.ui.dialog) };
+    assert_eq!((replaces.as_deref(), name.as_str()), (Some("Weddings"), "Weddings"));
+    ask(&mut h, "ui.text", json!({"text": "Ceremonies"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    let s = sets(&mut h);
+    let names: Vec<&str> = s["sets"].as_array().unwrap().iter().map(|x| x["name"].as_str().unwrap()).collect();
+    assert_eq!(names, ["Recent Keywords", "Ceremonies"]);
+    assert_eq!(s["keywords"], json!(["ceremony", "reception"]));
+}
+
+/// A set needs a name: without one the dialog says so and stays open.
+#[test]
+fn a_set_needs_a_name() {
+    let mut h = keywords_panel();
+    open_editor(&mut h);
+    ask(&mut h, "ui.clickWidget", json!({"id": "button:dialogOk"}));
+    assert!(matches!(h.app.ui.dialog, Some(crate::state::Dialog::KeywordSet { .. })), "still open");
+    assert!(h.app.ui.toast.is_some(), "and says why");
+}
+
+/// An empty slot is an empty button that does nothing.
+#[test]
+fn an_empty_slot_is_an_idle_button() {
+    let mut h = keywords_panel();
+    h.app.session.execute("keyword.saveSet", &json!({"name": "Weddings", "keywords": ["ceremony", "", "reception"]})).unwrap();
+    h.settle(SETTLE);
+    assert!(h.app.widgets.iter().any(|(w, _)| w == "kwSetEmpty:2"), "slot 2 is shown empty");
+}
+
+/// The nine fields are alike and wide enough for a keyword: a grid of equal columns, not one sized
+/// by what the window had room for while it found its size.
+#[test]
+fn the_slots_are_alike() {
+    let mut h = keywords_panel();
+    open_editor(&mut h);
+    let slots: Vec<egui::Rect> =
+        (1..=9).map(|i| h.app.widgets.iter().find(|(w, _)| *w == format!("field:keywordSetSlot:{i}")).map(|(_, r)| *r).expect("slot")).collect();
+    for r in &slots {
+        assert!(r.width() >= 100.0, "{r:?}");
+        assert!((r.width() - slots[0].width()).abs() < 1.0, "{r:?} vs {:?}", slots[0]);
+    }
+}
+
+/// Naming Recent Keywords like a set that exists says so, in the user's words, and keeps the
+/// dialog (and that set) as they were.
+#[test]
+fn a_taken_name_says_so() {
+    let mut h = keywords_panel();
+    h.app.session.execute("keyword.saveSet", &json!({"name": "Travel", "keywords": ["harbour"]})).unwrap();
+    h.app.session.execute("keyword.useSet", &json!({"name": "Recent Keywords"})).unwrap();
+    h.settle(SETTLE);
+    open_editor(&mut h);
+    ask(&mut h, "ui.text", json!({"text": "travel"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "button:dialogOk"}));
+    assert!(matches!(h.app.ui.dialog, Some(crate::state::Dialog::KeywordSet { .. })), "still open");
+    let toast = h.app.ui.toast.clone().map(|t| t.0).unwrap_or_default();
+    assert!(toast.starts_with("There is a keyword set"), "{toast}");
+    let s = sets(&mut h);
+    let travel = s["sets"].as_array().unwrap().iter().find(|x| x["name"] == "Travel").cloned().unwrap();
+    assert_eq!(travel["keywords"], json!(["harbour"]), "left alone");
+}
+
+/// A set deleted while its dialog was open is saved again, as a new set, rather than refused.
+#[test]
+fn a_set_deleted_meanwhile_is_saved_anew() {
+    let mut h = keywords_panel();
+    h.app.session.execute("keyword.saveSet", &json!({"name": "Weddings", "keywords": ["ceremony"]})).unwrap();
+    h.settle(SETTLE);
+    open_editor(&mut h);
+    h.app.session.execute("keyword.deleteSet", &json!({"name": "Weddings"})).unwrap();
+    ask(&mut h, "ui.clickWidget", json!({"id": "button:dialogOk"}));
+    assert_eq!(h.app.ui.dialog, None);
+    assert_eq!(sets(&mut h)["current"], "Weddings");
+}
+
+/// Save as a new set (Lightroom Classic's Save as New Preset): the edited set stays, and the new
+/// one, under its own name, becomes current.
+#[test]
+fn save_as_a_new_set_keeps_the_original() {
+    let mut h = keywords_panel();
+    h.app.session.execute("keyword.saveSet", &json!({"name": "Weddings", "keywords": ["ceremony"]})).unwrap();
+    h.settle(SETTLE);
+    open_editor(&mut h);
+    ask(&mut h, "ui.text", json!({"text": "Ceremonies"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "check:keywordSetAsNew"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "button:dialogOk"}));
+    let s = sets(&mut h);
+    let names: Vec<&str> = s["sets"].as_array().unwrap().iter().map(|x| x["name"].as_str().unwrap()).collect();
+    assert_eq!(names, ["Recent Keywords", "Weddings", "Ceremonies"]);
+    assert_eq!(s["current"], "Ceremonies");
+}
diff --git a/crates/ui-egui/src/tests_keywording.rs b/crates/ui-egui/src/tests_keywording.rs
new file mode 100644
index 00000000..a130b86b
--- /dev/null
+++ b/crates/ui-egui/src/tests_keywording.rs
@@ -0,0 +1,229 @@
+//! The Keywording box at the top of the right panel's Keywords: the selection's keywords, driven
+//! through the control channel.
+
+use std::time::Duration;
+
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+/// The Library grid with the Keywords panel open and two photos selected: the first with beach and
+/// Weddings, the second with beach.
+fn two_selected() -> (Headless, Vec<u64>) {
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = Headless::new(app, [1400.0, 1000.0], 1.0);
+    let ids: Vec<u64> = h.app.session.visible_cloned().iter().take(2).map(|p| p.0).collect();
+    for (method, params) in [
+        ("ui.set", json!({"view": "photoGrid", "right": "keywords"})),
+        ("engine.execute", json!({"command": "photo.setMeta", "params": {"ids": [ids[0]], "keywords": ["beach", "Weddings"]}})),
+        ("engine.execute", json!({"command": "photo.setMeta", "params": {"ids": [ids[1]], "keywords": ["beach"]}})),
+        ("engine.execute", json!({"command": "library.select", "params": {"ids": ids}})),
+    ] {
+        let r = h.request(method, params, T);
+        assert_eq!(r["ok"], true, "{r}");
+    }
+    h.settle(SETTLE);
+    (h, ids)
+}
+
+fn ask(h: &mut Headless, method: &str, params: serde_json::Value) {
+    let r = h.request(method, params.clone(), T);
+    assert_eq!(r["ok"], true, "{method} {params}: {r}");
+    h.settle(SETTLE);
+}
+
+fn has(h: &Headless, id: &str) -> bool {
+    h.app.widgets.iter().any(|(w, _)| w == id)
+}
+
+fn keywords_of(h: &Headless, id: u64) -> Vec<String> {
+    h.app.session.catalog.photo(lightcraft_catalog::PhotoId(id)).unwrap().meta.keywords.clone()
+}
+
+/// The chips are the keywords of every selected photo, not only the active one's; a keyword only
+/// some of them have is marked.
+#[test]
+fn the_chips_are_the_selections_keywords() {
+    let (h, _) = two_selected();
+    assert!(
+        has(&h, "keywordChip:beach") && has(&h, "keywordChip:Weddings"),
+        "{:?}",
+        h.app.widgets.iter().filter(|(w, _)| w.starts_with("keywordChip")).collect::<Vec<_>>()
+    );
+    assert!(has(&h, "keywordChipPartial:Weddings"), "only one of the two has Weddings");
+    assert!(!has(&h, "keywordChipPartial:beach"), "both have beach");
+}
+
+/// Only the × removes a keyword, from every selected photo; a click on the chip itself doesn't.
+#[test]
+fn only_the_cross_removes_a_keyword() {
+    let (mut h, ids) = two_selected();
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordChip:beach"}));
+    assert!(ids.iter().all(|id| keywords_of(&h, *id).contains(&"beach".to_string())), "a click on the chip keeps it");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordChipRemove:beach"}));
+    assert!(ids.iter().all(|id| !keywords_of(&h, *id).contains(&"beach".to_string())), "× took it off both");
+}
+
+/// A chip's menu acts on the selection, never on the whole library: give a keyword only some have
+/// to all of them, take it off them, show its photos, or edit it (Edit Keyword Tag). Deleting a
+/// keyword from every photo of the library is the Keyword List's.
+#[test]
+fn a_chips_menu_acts_on_the_selection() {
+    let (mut h, ids) = two_selected();
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordChip:Weddings", "button": "right"}));
+    for item in ["add", "remove", "show", "edit"] {
+        assert!(has(&h, &format!("keywordChipMenu:{item}")), "{item}");
+    }
+    assert!(!has(&h, "keywordChipMenu:delete"), "no library-wide delete");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordChipMenu:add"}));
+    assert!(ids.iter().all(|id| keywords_of(&h, *id).contains(&"Weddings".to_string())), "given to both");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordChip:Weddings", "button": "right"}));
+    assert!(!has(&h, "keywordChipMenu:add"), "both have it now");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordChipMenu:edit"}));
+    assert!(matches!(&h.app.ui.dialog, Some(crate::state::Dialog::KeywordTag { editing: Some(k), .. }) if k == "Weddings"), "{:?}", h.app.ui.dialog);
+}
+
+/// The "Add keyword" box is a shared text field: right-click ▸ Paste fills it, Return gives the
+/// keywords to every selected photo, and Esc gives up what was typed.
+#[test]
+fn the_add_keyword_box_pastes_adds_and_gives_up() {
+    let (mut h, ids) = two_selected();
+    h.view.clipboard = "travel, sunset".into();
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keyword", "button": "right"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keyword:paste"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    for id in &ids {
+        let k = keywords_of(&h, *id);
+        assert!(k.contains(&"travel".to_string()) && k.contains(&"sunset".to_string()), "{k:?}");
+    }
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keyword"}));
+    ask(&mut h, "ui.text", json!({"text": "harbour"}));
+    ask(&mut h, "ui.key", json!({"key": "Escape"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keyword"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    assert!(ids.iter().all(|id| !keywords_of(&h, *id).contains(&"harbour".to_string())), "Esc gave it up");
+}
+
+/// The keyword set's buttons say whether the selection has each keyword, as their ⌥1–⌥9 toggle it
+/// on the selection: on when every selected photo has it, partly on when only some do.
+#[test]
+fn keyword_set_buttons_reflect_the_selection() {
+    let (mut h, _) = two_selected();
+    let sets = h.app.session.execute("keyword.sets", &json!({})).unwrap();
+    let at = |k: &str| sets["keywords"].as_array().unwrap().iter().position(|x| x == k).map(|i| i + 1).unwrap_or_else(|| panic!("{k} in {sets}"));
+    assert!(has(&h, &format!("kwSetOn:{}", at("beach"))), "both have beach");
+    assert!(has(&h, &format!("kwSetSome:{}", at("Weddings"))), "only the active one has Weddings");
+    assert!(!has(&h, &format!("kwSetOn:{}", at("Weddings"))));
+}
+
+/// "Will Export" shows the names exported files will carry for the selection instead of the chips:
+/// a keyword left out of export isn't there; "Keywords" brings the chips back.
+#[test]
+fn will_export_shows_what_exports_carry() {
+    let (mut h, _) = two_selected();
+    let r = h.request("engine.execute", json!({"command": "keyword.edit", "params": {"keyword": "Weddings", "includeOnExport": false}}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordView:willExport"}));
+    assert!(has(&h, "keywordExport:beach"));
+    assert!(!has(&h, "keywordExport:Weddings"), "left out of export");
+    assert!(!has(&h, "keywordChip:beach"), "the chips give way");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordView:keywords"}));
+    assert!(has(&h, "keywordChip:beach") && !has(&h, "keywordExport:beach"));
+}
+
+/// The painter's keyword field is a shared text field: right-click ▸ Paste fills it, and Return
+/// starts painting as the Paint button does.
+#[test]
+fn the_painters_field_pastes_and_return_paints() {
+    let (mut h, _) = two_selected();
+    h.view.clipboard = "Weddings".into();
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordPainter", "button": "right"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keywordPainter:paste"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    assert_eq!(h.app.ui.keyword_painter.as_deref(), Some("Weddings"));
+}
+
+/// Suggestions follow the selection: a keyword only some selected photos have is suggested, to give
+/// it to all of them; one every selected photo has isn't.
+#[test]
+fn suggestions_follow_the_selection() {
+    let (h, _) = two_selected();
+    assert!(has(&h, "kwSuggest:Weddings"), "only the active one has it");
+    assert!(!has(&h, "kwSuggest:beach"), "both have it");
+}
+
+/// Chips wrap whole and stay inside the panel: none overlaps another or runs past the panel's
+/// edge, and one longer than the panel is shortened to fit (a chip laid out in what was left of a
+/// line used to wrap its own text, a letter a line, over the others).
+#[test]
+fn chips_wrap_whole_inside_the_panel() {
+    let (mut h, ids) = two_selected();
+    let long = "Places|Portugal|Lisbon|Belém tower and the old town square on the river";
+    let r = h.request(
+        "engine.execute",
+        json!({"command": "photo.setMeta", "params": {"ids": ids, "addKeywords": ["Events|Weddings", "sunset", "Places|Portugal|Lisbon", "harbour", long]}}),
+        T,
+    );
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let panel = h.app.widgets.iter().find(|(w, _)| w == "panel:right_panel").map(|(_, r)| *r).expect("the right panel");
+    let chips: Vec<(String, egui::Rect)> = h.app.widgets.iter().filter(|(w, _)| w.starts_with("keywordChip:")).cloned().collect();
+    assert!(chips.len() >= 6, "{chips:?}");
+    for (i, (id, r)) in chips.iter().enumerate() {
+        assert!(r.height() < 30.0, "{id} on one line: {r:?}");
+        assert!(r.left() >= panel.left() && r.right() <= panel.right(), "{id} inside the panel: {r:?} in {panel:?}");
+        for (other, o) in chips.iter().skip(i + 1) {
+            assert!(!r.intersects(o.shrink(0.5)), "{id} overlaps {other}");
+        }
+    }
+}
+
+/// With an active photo and nothing else selected, the box is that photo's, as the commands are:
+/// its chips show (keywords typed go to it), and the Keyword List ticks what it has.
+#[test]
+fn the_active_photo_alone_is_the_selection() {
+    let (mut h, ids) = two_selected();
+    ask(&mut h, "engine.execute", json!({"command": "library.select", "params": {"ids": [], "active": ids[0]}}));
+    assert_eq!(h.app.session.selection.active.map(|p| p.0), Some(ids[0]));
+    assert!(h.app.session.selection.ids.is_empty());
+    assert!(has(&h, "keywordChip:Weddings") && !has(&h, "keywordChipPartial:Weddings"), "the active photo's keywords");
+    let ticks = crate::panels::keyword_list::Ticks::of(&h.app.session.catalog, &h.app.session.targets(&json!({})));
+    assert_eq!(ticks.tick("Weddings"), crate::panels::keyword_list::Tick::All);
+    assert!(has(&h, "keywordCheck:beach"));
+}
+
+/// Esc in the Add keyword box gives back what it held before this edit, as every text field does:
+/// text left there by an earlier edit stays.
+#[test]
+fn escape_gives_back_the_text_from_before_the_edit() {
+    let (mut h, ids) = two_selected();
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keyword"}));
+    ask(&mut h, "ui.text", json!({"text": "harbour"}));
+    ask(&mut h, "ui.key", json!({"key": "Tab"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keyword"}));
+    ask(&mut h, "ui.key", json!({"key": "End"}));
+    ask(&mut h, "ui.text", json!({"text": ", sea"}));
+    ask(&mut h, "ui.key", json!({"key": "Escape"}));
+    ask(&mut h, "ui.clickWidget", json!({"id": "field:keyword"}));
+    ask(&mut h, "ui.key", json!({"key": "Enter"}));
+    let k = keywords_of(&h, ids[0]);
+    assert!(k.contains(&"harbour".to_string()) && !k.contains(&"sea".to_string()), "{k:?}");
+}
+
+/// "Keywords & Containing Keywords" lists the selection's keywords with the keywords containing
+/// them, flat (read only).
+#[test]
+fn containing_keywords_view_lists_parents_too() {
+    let (mut h, ids) = two_selected();
+    let r = h.request("engine.execute", json!({"command": "photo.setMeta", "params": {"ids": [ids[0]], "addKeywords": ["Events|Birthdays"]}}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    ask(&mut h, "ui.clickWidget", json!({"id": "keywordView:containing"}));
+    for name in ["Events", "Birthdays", "beach"] {
+        assert!(has(&h, &format!("keywordContaining:{name}")), "{name}");
+    }
+    assert!(!has(&h, "keywordChip:beach"), "the chips give way");
+}
diff --git a/crates/ui-egui/src/tests_masking.rs b/crates/ui-egui/src/tests_masking.rs
index 0729a854..c748ecf1 100644
--- a/crates/ui-egui/src/tests_masking.rs
+++ b/crates/ui-egui/src/tests_masking.rs
@@ -8,6 +8,7 @@ use serde_json::json;
 use crate::headless::Headless;
 use crate::state::RightPanel;
 use crate::{LightcraftApp, Services};
+use lightcraft_catalog::Rule;
 
 const T: Duration = Duration::from_secs(20);
 const SETTLE: Duration = Duration::from_secs(120);
@@ -39,6 +40,211 @@ fn develop(h: &Headless) -> lightcraft_develop::DevelopSettings {
     (*h.app.session.develop_of(id).unwrap_or_default()).clone()
 }
 
+fn click(h: &mut Headless, id: &str) {
+    let r = h.request("ui.clickWidget", json!({"id": id}), T);
+    assert_eq!(r["ok"], true, "{id}: {r}");
+}
+
+fn brush_at(h: &mut Headless, x: f64, y: f64) {
+    pointer(h, json!([{"kind": "down", "x": x, "y": y}, {"kind": "up", "x": x, "y": y}]));
+}
+
+/// Evaluate the real composite, with a deterministic embedded sky matte (no AI model required).
+fn mask_coverage(h: &Headless, mask: usize, x: usize, y: usize) -> f32 {
+    use lightcraft_pipeline::{
+        geometry::Frame,
+        masks::{MatteKind, Mattes, evaluate_one},
+    };
+    use lightcraft_raster::{Image, Plane, Rgb32f};
+    let d = develop(h);
+    let mut sky = Image::<u8>::new(100, 100);
+    sky.data.fill(255);
+    let mut mattes = Mattes::default();
+    mattes.push(MatteKind::Sky, sky);
+    let a = evaluate_one(
+        &d.masks[mask],
+        &Frame::new(100, 100, &Default::default(), true),
+        100,
+        100,
+        &Rgb32f::new(100, 100),
+        &Plane::new(100, 100),
+        0.0,
+        Some(&mattes),
+    );
+    a.get(x, y)
+}
+
+#[test]
+fn subtract_brush_removes_sky_coverage_and_add_restores_it() {
+    let mut h = detail("panel.masking");
+    exec(&mut h, "mask.add", json!({"kind": "sky"}));
+    let r = h.request("ui.set", json!({"brushSize": 0.15, "brushFeather": 0.0, "brushFlow": 100.0}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    click(&mut h, "button:maskMinus:1");
+    click(&mut h, "maskComp:subtract:brush");
+    brush_at(&mut h, 0.5, 0.5);
+    assert!(mask_coverage(&h, 0, 50, 50) < 0.01, "Subtract > Brush must remove sky coverage");
+    assert!(mask_coverage(&h, 0, 10, 10) > 0.99, "unpainted sky stays selected");
+    let subtracted = develop(&h);
+    exec(&mut h, "edit.undo", json!({}));
+    assert!(mask_coverage(&h, 0, 50, 50) > 0.99);
+    exec(&mut h, "edit.redo", json!({}));
+    assert_eq!(develop(&h).masks, subtracted.masks);
+
+    // Renaming must not detach subsequent strokes from the subtract component.
+    exec(&mut h, "mask.component", json!({"component": 1, "action": "rename", "name": "Sky cleanup"}));
+    brush_at(&mut h, 0.25, 0.5);
+    assert!(mask_coverage(&h, 0, 25, 50) < 0.01);
+    assert_eq!(develop(&h).masks[0].components.len(), 2);
+
+    // Erase removes paint from the subtract component, restoring the underlying sky.
+    h.app.ui.brush_erase = true;
+    brush_at(&mut h, 0.5, 0.5);
+    assert!(mask_coverage(&h, 0, 50, 50) > 0.99);
+    click(&mut h, "button:maskPlus:1");
+    click(&mut h, "maskComp:add:brush");
+    brush_at(&mut h, 0.25, 0.5);
+    assert!(mask_coverage(&h, 0, 25, 50) > 0.99, "Add must be composed after Subtract");
+    assert_eq!(develop(&h).masks[0].components.len(), 3);
+    h.settle(SETTLE);
+}
+
+#[test]
+fn new_brush_starts_a_separate_mask_in_paint_mode() {
+    let mut h = detail("panel.masking");
+    exec(&mut h, "mask.add", json!({"kind": "sky"}));
+    let original = develop(&h).masks[0].clone();
+    h.app.ui.brush_erase = true;
+    h.app.ui.mask_overlay = false;
+    click(&mut h, "maskNew:brush");
+    assert_eq!(h.app.session.active_mask, Some(2));
+    assert!(!h.app.ui.brush_erase);
+    assert!(h.app.ui.mask_overlay);
+    let r = h.request("ui.set", json!({"brushSize": 0.15, "brushFeather": 0.0, "brushFlow": 100.0}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    brush_at(&mut h, 0.5, 0.5);
+    assert!(mask_coverage(&h, 1, 50, 50) > 0.99);
+    h.app.ui.brush_erase = true;
+    brush_at(&mut h, 0.5, 0.5);
+    assert!(mask_coverage(&h, 1, 50, 50) < 0.01);
+    exec(&mut h, "edit.undo", json!({}));
+    assert!(mask_coverage(&h, 1, 50, 50) > 0.99);
+    assert_eq!(develop(&h).masks[0], original);
+    h.settle(SETTLE);
+}
+
+#[test]
+fn mask_adjustments_hide_overlay_without_disabling_the_mask() {
+    use lightcraft_pipeline::Overlay;
+    let mut h = detail("panel.masking");
+    exec(&mut h, "mask.add", json!({"kind": "linear", "start": [0.5, 0.2], "end": [0.5, 0.7]}));
+    assert!(h.app.ui.mask_overlay);
+
+    // Changing the shape needs the overlay; changing the image needs an unobscured preview.
+    exec(&mut h, "mask.refine", json!({"value": 10.0}));
+    assert!(h.app.ui.mask_overlay);
+    let r = h.request("ui.clickWidget", json!({"id": "slider:exposure", "fx": 0.7}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    assert!(!h.app.ui.mask_overlay, "the exposure slider hides the overlay after release");
+    let d = develop(&h);
+    assert!(d.masks[0].adjust.exposure > 0.0);
+    assert!(d.masks[0].visible, "hiding the overlay must not disable the mask");
+    assert_eq!(crate::panels::detail::view_overlay(&h.app, &d), Overlay::None);
+    let mask = d.masks[0].clone();
+
+    let r = h.request("ui.key", json!({"key": "o"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    assert!(h.app.ui.mask_overlay, "O can restore the overlay");
+    assert_eq!(develop(&h).masks[0], mask, "toggling the overlay leaves the mask and its effect unchanged");
+    assert!(matches!(crate::panels::detail::view_overlay(&h.app, &develop(&h)), Overlay::Mask { .. }));
+
+    // Failed edits and global adjustments must not hide the mask overlay.
+    assert!(h.app.run("mask.adjust", json!({"id": 999, "values": {"exposure": 1.0}})).is_err());
+    assert!(h.app.ui.mask_overlay);
+    exec(&mut h, "develop.set", json!({"control": "light.exposure", "value": 0.5}));
+    assert!(h.app.ui.mask_overlay);
+
+    // Numeric edits/resets and Amount use the same command path as the sliders.
+    for values in [json!({"exposure": 0.0}), json!({"saturation": 20.0}), json!({"amount": 50.0})] {
+        exec(&mut h, "view.maskOverlay", json!({"show": true}));
+        exec(&mut h, "mask.adjust", json!({"values": values}));
+        assert!(!h.app.ui.mask_overlay);
+    }
+    h.settle(SETTLE);
+}
+
+#[test]
+fn radial_body_drag_moves_rotated_components_and_undoes_once() {
+    let mut h = detail("panel.masking");
+    exec(&mut h, "mask.add", json!({"kind": "luminanceRange"}));
+    exec(&mut h, "mask.addComponent", json!({"kind": "radial", "op": "add", "center": [0.45, 0.5], "rx": 0.22, "ry": 0.1, "angle": 40}));
+    let before = develop(&h);
+    // Well away from the pin and edge/rotation grips, inside a rotated ellipse.
+    pointer(
+        &mut h,
+        json!([{"kind": "down", "x": 0.51, "y": 0.56}, {"kind": "drag", "x": 0.54, "y": 0.58},
+        {"kind": "drag", "x": 0.61, "y": 0.66}, {"kind": "up", "x": 0.61, "y": 0.66}]),
+    );
+    let after = develop(&h);
+    let MaskShape::Radial { center, rx, ry, angle, feather, invert } = &after.masks[0].components[1].shape else { panic!("radial") };
+    assert!((center.x - 0.55).abs() < 0.005 && (center.y - 0.6).abs() < 0.005, "{center:?}");
+    let MaskShape::Radial { rx: old_rx, ry: old_ry, angle: old_angle, feather: old_feather, invert: old_invert, .. } =
+        &before.masks[0].components[1].shape
+    else {
+        panic!("radial")
+    };
+    assert_eq!((rx, ry, angle, feather, invert), (old_rx, old_ry, old_angle, old_feather, old_invert));
+    assert_eq!(after.masks[0].components[0], before.masks[0].components[0], "only the hit component moves");
+    exec(&mut h, "edit.undo", json!({}));
+    assert_eq!(develop(&h), before, "one undo reverses the entire drag");
+    exec(&mut h, "edit.redo", json!({}));
+    assert_eq!(develop(&h), after);
+    // The bounding-box corner is outside the ellipse, even for an inverted radial mask.
+    exec(&mut h, "mask.component", json!({"component": 1, "action": "invert"}));
+    let outside_before = develop(&h);
+    pointer(
+        &mut h,
+        json!([{"kind": "down", "x": 0.35, "y": 0.75}, {"kind": "drag", "x": 0.4, "y": 0.8},
+        {"kind": "up", "x": 0.4, "y": 0.8}]),
+    );
+    assert_eq!(develop(&h), outside_before, "outside the ellipse must not move it");
+    // Hiding pins does not disable dragging the selected ellipse body.
+    exec(&mut h, "view.maskPins", json!({"show": false}));
+    pointer(
+        &mut h,
+        json!([{"kind": "down", "x": 0.61, "y": 0.66}, {"kind": "drag", "x": 0.66, "y": 0.71},
+        {"kind": "up", "x": 0.66, "y": 0.71}]),
+    );
+    let MaskShape::Radial { center, .. } = develop(&h).masks[0].components[1].shape.clone() else { panic!("radial") };
+    assert!((center.x - 0.6).abs() < 0.005 && (center.y - 0.65).abs() < 0.005, "{center:?}");
+}
+
+#[test]
+fn radial_body_drag_keeps_resize_and_rotation_handles() {
+    let mut h = detail("panel.masking");
+    exec(&mut h, "mask.add", json!({"kind": "radial", "center": [0.5, 0.5], "rx": 0.18, "ry": 0.1}));
+    for handle in [1, 5] {
+        let widget = format!("maskHandle:1:0:{handle}");
+        let rect = h.app.widgets.iter().find(|(id, _)| *id == widget).unwrap().1;
+        let image = h.app.image_rect.unwrap();
+        let q = rect.center();
+        let x = (q.x - image.left()) / image.width();
+        let y = (q.y - image.top()) / image.height();
+        pointer(
+            &mut h,
+            json!([{"kind": "down", "x": x, "y": y}, {"kind": "drag", "x": x + 0.03, "y": y + 0.03},
+            {"kind": "up", "x": x + 0.03, "y": y + 0.03}]),
+        );
+        let MaskShape::Radial { center, rx, angle, .. } = develop(&h).masks[0].components[0].shape.clone() else { panic!("radial") };
+        assert!((center.x - 0.5).abs() < 0.005 && (center.y - 0.5).abs() < 0.005, "a handle must not translate the mask");
+        if handle == 1 {
+            assert!(rx > 0.19, "resize grip changes radius");
+        } else {
+            assert!(angle.abs() > 1.0, "rotation grip changes angle");
+        }
+    }
+}
+
 #[test]
 fn mask_overlay_keys_and_pins() {
     use lightcraft_pipeline::{MaskView, Overlay};
@@ -295,6 +501,225 @@ fn smart_album_rule_editor_creates_and_edits() {
     h.settle(SETTLE);
 }
 
+/// Given the rule editor, the field menu shows the top-level fields and one submenu per group;
+/// picking a field from a submenu changes the rule and gives it an operator of that field.
+#[test]
+fn smart_album_field_menu_groups_fields_in_submenus() {
+    let mut h = detail("panel.edit");
+    exec(&mut h, "dialog.smartAlbum", json!({"name": "Grouped"}));
+    let has = |h: &Headless, id: &str| h.app.widgets.iter().any(|(w, _)| w == id);
+    let r = h.request("ui.clickWidget", json!({"id": "ruleField:rules-0"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(has(&h, "ruleFieldItem:rating:rules-0"), "top-level fields are in the menu itself");
+    for (group, _) in lightcraft_catalog::rules::FIELD_GROUPS {
+        assert!(has(&h, &format!("ruleFieldGroup:{group}:rules-0")), "no {group} submenu");
+    }
+    assert!(!has(&h, "ruleFieldItem:filePath:rules-0"), "grouped fields wait in their submenu");
+    // clicking a group row (a touch, or a click faster than hover) opens it, not closes the menu
+    let r = h.request("ui.clickWidget", json!({"id": "ruleFieldGroup:File:rules-0"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let r = h.request("ui.clickWidget", json!({"id": "ruleFieldItem:filePath:rules-0"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &h.app.ui.dialog else { panic!("no rule editor") };
+    let Rule::Field { field, op, .. } = &rules.rules[0] else { panic!("not a field rule") };
+    assert_eq!((field.as_str(), op.as_str()), ("filePath", "contains"), "Rating's ≥ isn't a text operator");
+    assert!(!has(&h, "ruleFieldItem:rating:rules-0") && !has(&h, "ruleFieldItem:filePath:rules-0"), "picking a field closes the menu");
+}
+
+/// A yes/no rule whose value isn't yes or no (written by an agent or an older version) stays as
+/// it is in the editor: the dialog shows the problem and OK doesn't quietly save it as Yes.
+#[test]
+fn smart_album_editor_keeps_an_unreadable_yes_no_value() {
+    let mut h = detail("panel.edit");
+    exec(&mut h, "dialog.smartAlbum", json!({"name": "Odd"}));
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+    rules.rules[0] = serde_json::from_value(json!({"field": "edited", "op": "is", "value": "maybe"})).unwrap();
+    h.settle(SETTLE);
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &h.app.ui.dialog else { panic!("no rule editor") };
+    let Rule::Field { value, .. } = &rules.rules[0] else { panic!("not a field rule") };
+    assert_eq!(value, &json!("maybe"), "drawing the editor doesn't rewrite the value");
+    let r = h.request("ui.dialog.confirm", json!({}), T);
+    assert!(h.app.session.catalog.albums().all(|a| a.name != "Odd"), "OK refuses it: {r}");
+}
+
+/// The rule editor marks each rule that can't mean anything, inside groups too, and keeps OK
+/// disabled until they are fixed; the control channel's confirm is refused the same way.
+#[test]
+fn smart_album_editor_marks_bad_rules_and_blocks_ok() {
+    let mut h = detail("panel.edit");
+    exec(&mut h, "dialog.smartAlbum", json!({"name": "Checked"}));
+    let set = |h: &mut Headless, rules: serde_json::Value| {
+        let Some(crate::state::Dialog::SmartRules { rules: r, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+        *r = serde_json::from_value(json!({"rules": rules})).unwrap();
+        h.settle(SETTLE);
+    };
+    let has = |h: &Headless, id: &str| h.app.widgets.iter().any(|(w, _)| w == id);
+    set(
+        &mut h,
+        json!([
+            {"field": "rating", "op": "gte", "value": 3},
+            {"field": "captureDate", "op": "is", "value": "banana"},
+            {"group": {"match": "any", "rules": [{"field": "iso", "op": "is", "value": 100}, {"field": "rating", "op": "is", "value": 9}]}}
+        ]),
+    );
+    assert!(!has(&h, "ruleProblem:rules-0"), "a good rule isn't marked");
+    assert!(has(&h, "ruleProblem:rules-1"), "the bad date is marked");
+    assert!(has(&h, "ruleProblem:rules-2-1") && !has(&h, "ruleProblem:rules-2-0"), "inside a group, the bad rule itself");
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &h.app.ui.dialog else { panic!("no rule editor") };
+    assert!(serde_json::to_string(rules).unwrap().contains(r#""value":9"#), "drawing doesn't clamp the rating to 5");
+    let r = h.request("ui.clickWidget", json!({"id": "button:dialogOk"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(h.app.session.catalog.albums().all(|a| a.name != "Checked"), "OK is disabled");
+    let r = h.request("ui.dialog.confirm", json!({}), T);
+    assert!(h.app.session.catalog.albums().all(|a| a.name != "Checked"), "confirm refuses too: {r}");
+    assert!(h.app.ui.dialog.is_some(), "and the dialog stays open with the rules");
+    // fixed, the marks go and OK saves
+    set(&mut h, json!([{"field": "rating", "op": "gte", "value": 3}, {"field": "captureDate", "op": "is", "value": "2026"}]));
+    assert!(!h.app.widgets.iter().any(|(w, _)| w.starts_with("ruleProblem:")));
+    let r = h.request("ui.clickWidget", json!({"id": "button:dialogOk"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(h.app.session.catalog.albums().any(|a| a.name == "Checked"));
+}
+
+/// An Album rule picks its album from a list of the albums and smart albums, not by typing an id.
+#[test]
+fn smart_album_editor_picks_an_album_from_a_list() {
+    let mut h = detail("panel.edit");
+    let trip = exec(&mut h, "album.create", json!({"name": "Trip", "addSelected": false}))["id"].as_u64().unwrap();
+    let smart = exec(&mut h, "album.createSmart", json!({"name": "Fives", "rules": {"rating": 5}}))["id"].as_u64().unwrap();
+    exec(&mut h, "dialog.smartAlbum", json!({"name": "In Trip"}));
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+    rules.rules[0] = serde_json::from_value(json!({"field": "album", "op": "is", "value": 0})).unwrap();
+    h.settle(SETTLE);
+    assert!(h.app.widgets.iter().any(|(w, _)| w == "ruleProblem:rules-0"), "no album chosen yet");
+    let r = h.request("ui.clickWidget", json!({"id": "albumPicker:rules-0"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let has = |h: &Headless, id: String| h.app.widgets.iter().any(|(w, _)| *w == id);
+    assert!(has(&h, format!("albumPickerItem:{trip}:rules-0")), "plain albums are offered");
+    assert!(has(&h, format!("albumPickerItem:{smart}:rules-0")), "smart albums too");
+    let r = h.request("ui.clickWidget", json!({"id": format!("albumPickerItem:{trip}:rules-0")}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &h.app.ui.dialog else { panic!("no rule editor") };
+    let Rule::Field { value, .. } = &rules.rules[0] else { panic!("not a field rule") };
+    assert_eq!(value, &json!(trip));
+    assert!(!h.app.widgets.iter().any(|(w, _)| w == "ruleProblem:rules-0"));
+}
+
+/// Drawing the editor never changes a rule: values it can't show as they are (in the last 0 days,
+/// 20,000 days, a plain number of days, a "between" that isn't a pair) stay as stored, and the
+/// ones the check refuses are marked.
+#[test]
+fn smart_album_editor_never_rewrites_what_it_draws() {
+    let mut h = detail("panel.edit");
+    exec(&mut h, "dialog.smartAlbum", json!({"name": "Odd"}));
+    let rules = json!({"rules": [
+        {"field": "captureDate", "op": "inLast", "value": {"n": 0, "unit": "days"}},
+        {"field": "captureDate", "op": "inLast", "value": {"n": 20000, "unit": "Days"}},
+        {"field": "captureDate", "op": "notInLast", "value": 7},
+        {"field": "captureDate", "op": "between", "value": "2026"},
+        {"field": "iso", "op": "between", "value": [100]}
+    ]});
+    let Some(crate::state::Dialog::SmartRules { rules: r, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+    *r = serde_json::from_value(rules.clone()).unwrap();
+    h.settle(SETTLE);
+    let Some(crate::state::Dialog::SmartRules { rules: r, .. }) = &h.app.ui.dialog else { panic!("no rule editor") };
+    assert_eq!(serde_json::to_value(r).unwrap()["rules"], rules["rules"], "unchanged by drawing");
+    let marked: Vec<&str> = h.app.widgets.iter().filter_map(|(w, _)| w.strip_prefix("ruleProblem:")).collect();
+    assert_eq!(marked, ["rules-0", "rules-3", "rules-4"], "0 days and the half-made betweens");
+}
+
+/// Editing an album with rules that need fixing changes nothing, not even its name.
+#[test]
+fn smart_album_edit_with_bad_rules_keeps_the_name() {
+    let mut h = detail("panel.edit");
+    let id = exec(&mut h, "album.createSmart", json!({"name": "Keep", "rules": {"rating": 3}}))["id"].as_u64().unwrap();
+    exec(&mut h, "dialog.smartAlbum", json!({"id": id}));
+    let Some(crate::state::Dialog::SmartRules { name, rules, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+    *name = "Renamed".into();
+    *rules = serde_json::from_value(json!({"rules": [{"field": "captureDate", "op": "is", "value": "banana"}]})).unwrap();
+    h.settle(SETTLE);
+    let r = h.request("ui.clickWidget", json!({"id": "button:dialogOk"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let _ = h.request("ui.dialog.confirm", json!({}), T);
+    let album = h.app.session.catalog.album(lightcraft_catalog::AlbumId(id)).expect("album");
+    assert_eq!(album.name, "Keep", "neither OK nor confirm renamed it");
+    // fixed: OK renames it and sets the rules in one undo step
+    let Some(crate::state::Dialog::SmartRules { rules, .. }) = &mut h.app.ui.dialog else { panic!("the editor stays open") };
+    *rules = serde_json::from_value(json!({"rules": [{"field": "captureDate", "op": "is", "value": "2026"}]})).unwrap();
+    h.settle(SETTLE);
+    let undo = h.app.session.undo.len();
+    let r = h.request("ui.clickWidget", json!({"id": "button:dialogOk"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let album = h.app.session.catalog.album(lightcraft_catalog::AlbumId(id)).expect("album");
+    assert_eq!((album.name.as_str(), h.app.session.undo.len()), ("Renamed", undo + 1));
+    exec(&mut h, "edit.undo", json!({}));
+    let album = h.app.session.catalog.album(lightcraft_catalog::AlbumId(id)).expect("album");
+    assert_eq!(album.name, "Keep", "one undo takes back the name with the rules");
+    assert!(album.smart.as_ref().is_some_and(|f| f.rule_set.is_none()));
+}
+
+/// The sidebar marks a smart album whose rules no longer check, so it can be fixed.
+#[test]
+fn sidebar_marks_smart_albums_with_problems() {
+    let mut h = detail("panel.edit");
+    let trip = exec(&mut h, "album.create", json!({"name": "Trip", "addSelected": false}))["id"].as_u64().unwrap();
+    let rules = json!({"ruleSet": {"rules": [{"field": "album", "op": "is", "value": trip}]}});
+    let id = exec(&mut h, "album.createSmart", json!({"name": "In Trip", "rules": rules}))["id"].as_u64().unwrap();
+    let r = h.request("ui.set", json!({"view": "photoGrid", "leftPanel": true}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    assert!(h.app.widgets.iter().any(|(w, _)| *w == format!("source:album:{id}")), "the album's row is on screen");
+    let marked = |h: &Headless| h.app.widgets.iter().any(|(w, _)| *w == format!("albumProblem:{id}"));
+    assert!(!marked(&h));
+    exec(&mut h, "album.delete", json!({"id": trip}));
+    h.settle(SETTLE);
+    assert!(marked(&h), "its album is gone");
+}
+
+/// Editing "Excluded Photos" while "Travel" tests it: the list shows the album itself and Travel
+/// greyed (testing Travel would loop back), and a rule set to Travel by other means is marked.
+#[test]
+fn smart_album_editor_keeps_albums_from_including_themselves() {
+    let mut h = detail("panel.edit");
+    let trip = exec(&mut h, "album.create", json!({"name": "Trip", "addSelected": false}))["id"].as_u64().unwrap();
+    let excluded = exec(&mut h, "album.createSmart", json!({"name": "Excluded Photos", "rules": {"rating": 1}}))["id"].as_u64().unwrap();
+    let rules = json!({"ruleSet": {"rules": [{"field": "album", "op": "isNot", "value": excluded}]}});
+    let travel = exec(&mut h, "album.createSmart", json!({"name": "Travel", "rules": rules}))["id"].as_u64().unwrap();
+    exec(&mut h, "dialog.smartAlbum", json!({"id": excluded}));
+    let set = |h: &mut Headless, value: serde_json::Value| {
+        let Some(crate::state::Dialog::SmartRules { rules, .. }) = &mut h.app.ui.dialog else { panic!("no rule editor") };
+        rules.rules = vec![serde_json::from_value(json!({"field": "album", "op": "is", "value": value})).unwrap()];
+        h.settle(SETTLE);
+    };
+    set(&mut h, json!(null));
+    let r = h.request("ui.clickWidget", json!({"id": "albumPicker:rules-0"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    let has = |h: &Headless, id: String| h.app.widgets.iter().any(|(w, _)| *w == id);
+    assert!(has(&h, format!("albumPickerItem:{trip}:rules-0")));
+    // itself and an album that tests it are shown, greyed: clicking them picks nothing
+    for blocked in [excluded, travel] {
+        let r = h.request("ui.clickWidget", json!({"id": format!("albumPickerItem:{blocked}:rules-0")}), T);
+        assert_eq!(r["ok"], true, "{r}");
+        h.settle(SETTLE);
+        let Some(crate::state::Dialog::SmartRules { rules, .. }) = &h.app.ui.dialog else { panic!("no rule editor") };
+        assert!(matches!(&rules.rules[0], Rule::Field { value, .. } if value.is_null()), "{blocked} wasn't picked");
+    }
+    let _ = h.request("ui.key", json!({"key": "Escape"}), T);
+    h.settle(SETTLE);
+    set(&mut h, json!(travel));
+    assert!(has(&h, "ruleProblem:rules-0".to_string()), "a loop is marked");
+}
+
 #[test]
 fn g_toggles_grids_and_shift_g_starts_guided_upright() {
     let mut h = detail("panel.edit");
diff --git a/crates/ui-egui/src/tests_offline.rs b/crates/ui-egui/src/tests_offline.rs
index f682fba5..b9896049 100644
--- a/crates/ui-egui/src/tests_offline.rs
+++ b/crates/ui-egui/src/tests_offline.rs
@@ -145,6 +145,9 @@ fn import_reads_files_off_the_ui_thread_and_can_be_cancelled() {
     let mut h = Headless::new(app, [1200.0, 800.0], 1.0);
     let ui_thread = std::thread::current().id();
     h.step();
+    // The first frame installs fonts; finish the first layout before timing the import.
+    h.step();
+    assert!(h.app.fonts_ready, "the UI is initialized before import timing starts");
     let undo0 = h.app.session.undo.len();
     crate::import::start_paths(&mut h.app, vec![dir.to_string_lossy().to_string()]).unwrap();
     // some batches arrive; meanwhile every frame is quick
diff --git a/crates/ui-egui/src/tests_panels.rs b/crates/ui-egui/src/tests_panels.rs
index 66eb360e..1f5cd4d4 100644
--- a/crates/ui-egui/src/tests_panels.rs
+++ b/crates/ui-egui/src/tests_panels.rs
@@ -924,6 +924,29 @@ fn right_click_opens_a_folders_menu_from_the_triangle_too() {
     assert!(!popup_open(&h), "the startup disk offers nothing");
 }
 
+/// Right-click a folder ▸ Set Color Label ▸ a colour: the folder's row shows the label's dot (a
+/// row without a label shows none), and None takes it off again.
+#[test]
+fn a_folder_takes_a_colour_label_from_its_menu() {
+    let mut h = folders_app(&["/pics/trip/a.jpg", "/pics/home/b.jpg"]);
+    click(&mut h, "libraryFolderToggle:/pics");
+    assert!(!has(&h, "labelMark:libfolder:/pics/trip"), "no label, no dot");
+    right_click(&mut h, "source:libfolder:/pics/trip");
+    click(&mut h, "folderLabelMenu");
+    click(&mut h, "folderLabel:red");
+    assert_eq!(h.app.session.catalog.folder_color_label("/pics/trip"), Some(lightcraft_catalog::ColorLabel::Red));
+    assert!(!popup_open(&h), "choosing closes the menu");
+    h.step();
+    assert!(has(&h, "labelMark:libfolder:/pics/trip"), "the row shows its label");
+    assert!(!has(&h, "labelMark:libfolder:/pics/home"), "its neighbour does not");
+    right_click(&mut h, "source:libfolder:/pics/trip");
+    click(&mut h, "folderLabelMenu");
+    click(&mut h, "folderLabel:none");
+    assert_eq!(h.app.session.catalog.folder_color_label("/pics/trip"), None);
+    h.step();
+    assert!(!has(&h, "labelMark:libfolder:/pics/trip"));
+}
+
 #[test]
 fn removing_a_disk_from_the_library_asks_first() {
     use crate::state::Dialog;
@@ -991,7 +1014,7 @@ fn tooltip_shown(h: &Headless) -> bool {
     h.view.ctx.memory(|m| m.areas().visible_layer_ids().into_iter().any(|l| l.order == egui::Order::Tooltip))
 }
 
-const LONG_NAME: &str = "Aliah Ira Polanco-Grylls and a name much longer than any sidebar row can show";
+const LONG_NAME: &str = "Lake Como Wedding-Day and a name much longer than any sidebar row can show";
 
 /// A name never runs past the photo count: it is cut with an ellipsis, in full on hover.
 #[test]
@@ -1096,3 +1119,66 @@ fn date_and_keyword_rows_show_their_photos_from_any_source() {
     h.step();
     assert_eq!(h.app.session.filter, lightcraft_catalog::Filter::default(), "{key}");
 }
+
+/// Issue #501: use the actual context-menu button on the populated demo folder.
+#[test]
+fn deleting_a_populated_album_folder_from_its_menu_is_undoable() {
+    let mut h = demo([1400.0, 900.0], json!({"view": "photoGrid", "leftPanel": true}));
+    let folder = h.app.session.catalog.albums().find(|a| a.folder && a.name == "Travel 2026").unwrap().id;
+    assert!(!h.app.session.catalog.album_children(Some(folder)).is_empty());
+    let before = h.app.session.catalog.to_snapshot();
+    let photo_count = h.app.session.catalog.photos().count();
+    right_click(&mut h, &format!("source:folder:{}", folder.0));
+    click(&mut h, &format!("albumDelete:{}", folder.0));
+    assert!(h.app.session.catalog.album(folder).is_none());
+    assert_eq!(h.app.session.catalog.photos().count(), photo_count);
+    assert!(!popup_open(&h));
+    h.app.run("edit.undo", json!({})).unwrap();
+    h.step();
+    h.step();
+    assert_eq!(h.app.session.catalog.to_snapshot(), before);
+    assert!(has(&h, &format!("source:folder:{}", folder.0)));
+}
+
+/// A menu command's toast shows, however long the app has been running: commands made their
+/// toasts with a fresh context, whose clock is at 0, so by the app's clock they were already over
+/// (Auto Advance On, Imported presets, …).
+#[test]
+fn a_menu_commands_toast_shows_after_a_while() {
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = crate::headless::Headless::new(app, [1000.0, 700.0], 1.0);
+    for _ in 0..600 {
+        h.step();
+    }
+    let r = h.request("engine.execute", serde_json::json!({"command": "view.autoAdvance"}), std::time::Duration::from_secs(10));
+    assert_eq!(r["ok"], true, "{r}");
+    h.step();
+    h.step();
+    assert!(h.app.ui.toast.as_ref().is_some_and(|t| t.0.starts_with("Auto Advance")), "{:?}", h.app.ui.toast);
+}
+
+/// Auto-Tag from Tracklog's toast shows too: it was stamped by a clock of its own, which starts at
+/// zero, so a while into a session it had always already expired.
+#[test]
+fn the_tracklog_toast_shows_after_a_while() {
+    let dir = std::env::temp_dir().join(format!("lc-tracklog-toast-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let gpx = dir.join("walk.gpx");
+    std::fs::write(
+        &gpx,
+        r#"<?xml version="1.0"?><gpx version="1.1" creator="test" xmlns="http://www.topografix.com/GPX/1/1"><trk><trkseg><trkpt lat="46.0" lon="7.0"><time>2026-05-01T10:00:00Z</time></trkpt></trkseg></trk></gpx>"#,
+    )
+    .unwrap();
+    let app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), Services { png: None, ..Default::default() });
+    let mut h = crate::headless::Headless::new(app, [1000.0, 700.0], 1.0);
+    for _ in 0..600 {
+        h.step();
+    }
+    let p = serde_json::json!({"command": "photo.tagFromTracklog", "params": {"path": gpx.to_string_lossy(), "offset": 0}});
+    let r = h.request("engine.execute", p, std::time::Duration::from_secs(10));
+    assert_eq!(r["ok"], true, "{r}");
+    h.step();
+    h.step();
+    assert!(h.app.ui.toast.as_ref().is_some_and(|t| t.0.starts_with("Tagged")), "{:?}", h.app.ui.toast);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/ui-egui/src/tests_preview_limit.rs b/crates/ui-egui/src/tests_preview_limit.rs
index 4b15cd17..f48a2e1c 100644
--- a/crates/ui-egui/src/tests_preview_limit.rs
+++ b/crates/ui-egui/src/tests_preview_limit.rs
@@ -352,6 +352,28 @@ mod in_the_loupe {
         }
     }
 
+    // Issue #652: given a canvas wider than 2048 px on a desktop GPU (which reports its texture
+    // limit to egui once, in the first frame), when I zoom to 1:1, then the window render covers
+    // the whole canvas: no strip of the magnified whole-frame render beside it
+    #[test]
+    fn a_window_covers_a_canvas_wider_than_2048_px() {
+        let (mut h, native) = detail_in([2600.0, 1200.0]);
+        assert!(native > 2600, "the photo is wider than the canvas at 1:1: {native}");
+        h.request("engine.execute", json!({"command": "view.zoom100"}), T);
+        h.settle(SETTLE);
+        let canvas = h.app.canvas_rect.expect("the loupe was drawn");
+        let image = h.app.image_rect.expect("the photo was drawn");
+        let region = h.app.region_view.expect("a window");
+        // the canvas in pixels of the window's frame (scale 1, at 100 %: a point is a pixel)
+        let to_px = region.full.0 as f32 / image.width();
+        let (left, right) = (to_px * (canvas.left() - image.left()), to_px * (canvas.right() - image.left()));
+        assert!(right - left > 2048.0, "the canvas shows more than 2048 px: {left}..{right}");
+        let (x0, x1) = (region.window.x as f32, (region.window.x + region.window.w) as f32);
+        assert!(x0 <= left + 0.5 && x1 >= right - 0.5, "the window {x0}..{x1} leaves part of the canvas {left}..{right} to the preview");
+        let (w, _) = region_tile(&h).expect("the window rendered");
+        assert_eq!(w, region.window.w, "and that is the texture drawn");
+    }
+
     // Given 400 % on a big photo, when a slider is dragged, then the work per frame follows the
     // canvas, not the zoom: a draft of the whole frame at canvas scale and a draft of the window
     #[test]
diff --git a/crates/ui-egui/src/tests_scroll.rs b/crates/ui-egui/src/tests_scroll.rs
index 455bd0d8..1eff1ec7 100644
--- a/crates/ui-egui/src/tests_scroll.rs
+++ b/crates/ui-egui/src/tests_scroll.rs
@@ -84,6 +84,71 @@ fn grid_keeps_the_users_scroll_position() {
     assert!(grid_y(&h) < y2, "scrolled up to the second photo");
 }
 
+#[test]
+fn deleting_photos_does_not_jump_the_grid_to_the_top() {
+    for view in ["photoGrid", "squareGrid"] {
+        for count in [1, 3] {
+            let mut h = demo(view);
+            let ids = h.app.session.visible_cloned();
+            let at = ids.len() / 2;
+            let r = h.request("engine.execute", json!({"command": "library.select", "params": {"ids": &ids[at..at + count]}}), T);
+            assert_eq!(r["ok"], true, "{r}");
+            idle(&mut h, 30);
+            let y = grid_y(&h);
+            assert!(y > 600.0, "selection is well below the top: {view}, {y}");
+            let r = h.request("engine.execute", json!({"command": "photo.delete"}), T);
+            assert_eq!(r["ok"], true, "{r}");
+            idle(&mut h, 60);
+            let next = ids[at + count];
+            assert!(grid_y(&h) > 600.0, "deleting scrolled to the top: {view}, {} → {}", y, grid_y(&h));
+            assert_eq!(h.app.session.active(), Some(next), "{view}, count {count}");
+            let canvas = h.app.canvas_rect.unwrap();
+            assert!(widget(&h, &format!("thumb:{}", next.0)).intersects(canvas), "the next survivor is in view");
+            let after = grid_y(&h);
+            idle(&mut h, 60);
+            assert_eq!(grid_y(&h), after, "idle frames preserve the new position");
+        }
+    }
+}
+
+#[test]
+fn permanently_deleting_photos_keeps_the_current_view_neighbour_in_sight() {
+    for view in ["photoGrid", "squareGrid", "detail"] {
+        for count in [1, 3] {
+            let mut h = demo(view);
+            for (command, params) in
+                [("library.selectAll", json!({})), ("photo.delete", json!({})), ("library.source", json!({"kind": "recentlyDeleted"}))]
+            {
+                let r = h.request("engine.execute", json!({"command": command, "params": params}), T);
+                assert_eq!(r["ok"], true, "{r}");
+            }
+            let ids = h.app.session.visible_cloned();
+            let at = ids.len() / 2;
+            let r = h.request("engine.execute", json!({"command": "library.select", "params": {"ids": &ids[at..at + count]}}), T);
+            assert_eq!(r["ok"], true, "{r}");
+            idle(&mut h, 30);
+            let scroll = |h: &Headless| if view == "detail" { film_x(h) } else { grid_y(h) };
+            let before = scroll(&h);
+            assert!(before > 600.0, "selection is far from the beginning: {view}, {before}");
+            let r = h.request("ui.menu.invoke", json!({"id": "photo.deletePermanently"}), T);
+            assert_eq!(r["ok"], true, "{r}");
+            idle(&mut h, 60);
+            let next = ids[at + count];
+            assert_eq!(h.app.session.active(), Some(next), "{view}, count {count}");
+            assert!(scroll(&h) > 600.0, "deleting scrolled to the beginning: {view}, {before} → {}", scroll(&h));
+            let cell = widget(&h, &format!("{}:{}", if view == "detail" { "film" } else { "thumb" }, next.0));
+            if view == "detail" {
+                assert!(cell.left() >= 0.0 && cell.right() <= 1200.0, "the next survivor is in view: {cell:?}");
+            } else {
+                assert!(cell.intersects(h.app.canvas_rect.unwrap()), "the next survivor is in view");
+            }
+            let after = scroll(&h);
+            idle(&mut h, 60);
+            assert_eq!(scroll(&h), after, "idle frames preserve the new position");
+        }
+    }
+}
+
 #[test]
 fn filmstrip_wheel_scrolls_and_keeps_its_position() {
     let mut h = demo("detail");
diff --git a/crates/ui-egui/src/tests_sync.rs b/crates/ui-egui/src/tests_sync.rs
new file mode 100644
index 00000000..0fa43089
--- /dev/null
+++ b/crates/ui-egui/src/tests_sync.rs
@@ -0,0 +1,256 @@
+//! Synchronize Folder in the app (see `lightcraft_engine::sync`).
+//!
+//! Scenarios, in the words of someone whose folder changed outside LightCraft:
+//!
+//! * Right-click a folder in the sidebar's Folders section ▸ Synchronize Folder…: a dialog opens
+//!   at once and scans the folder without holding up the app, then says how many photos are new,
+//!   missing, or have metadata updates.
+//! * Synchronize with the defaults imports the new photos and leaves missing ones alone.
+//! * Ticking "Remove missing photos" also moves those to Recently Deleted.
+//! * Cancel leaves the library as it was.
+//! * Synchronize hands the work to the background at once: the dialog closes, the app keeps
+//!   answering, and the photos arrive over the next frames under a progress window, as one undo
+//!   step.
+
+use std::time::Duration;
+
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::state::Dialog;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+/// A scratch folder that goes away with the test, however it ends.
+struct Scratch(std::path::PathBuf);
+
+impl Scratch {
+    fn new(tag: &str) -> Scratch {
+        let dir = std::env::temp_dir().join(format!("lc-ui-sync-{tag}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        Scratch(dir)
+    }
+    /// The path as the folder tree writes it (forward slashes; widget ids carry it).
+    fn path(&self, rel: &str) -> String {
+        self.0.join(rel).to_string_lossy().replace('\\', "/")
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn write_png(path: &str, seed: u8) {
+    let (w, h) = (24usize, 16usize);
+    let data: Vec<[u8; 4]> = (0..w * h).map(|i| [(i % w * 9) as u8, (i / w * 13) as u8, seed, 255]).collect();
+    let img = lightcraft_raster::Rgba8 { width: w, height: h, data };
+    let bytes = lightcraft_codecs::encode_png(&lightcraft_codecs::EncodeImage::rgba8(&img), &lightcraft_codecs::EncodeMeta::default()).unwrap();
+    std::fs::create_dir_all(std::path::Path::new(path).parent().unwrap()).unwrap();
+    std::fs::write(path, bytes).unwrap();
+}
+
+/// The app with `trip/a.png` and `trip/b.png` imported, then `c.png` added and `b.png` deleted
+/// on disk behind its back.
+fn changed_folder(dir: &Scratch) -> Headless {
+    write_png(&dir.path("trip/a.png"), 1);
+    write_png(&dir.path("trip/b.png"), 2);
+    let mut session = lightcraft_engine::Session::new().with_fs();
+    session.execute("library.import", &json!({"paths": [dir.path("trip")]})).unwrap();
+    write_png(&dir.path("trip/c.png"), 3);
+    std::fs::remove_file(dir.path("trip/b.png")).unwrap();
+    let app = LightcraftApp::new(session, Services { png: None, ..Default::default() });
+    let mut h = Headless::new(app, [1400.0, 900.0], 1.0);
+    let r = h.request("ui.set", json!({"view": "photoGrid", "leftPanel": true}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    h
+}
+
+fn in_library(h: &Headless) -> Vec<String> {
+    let mut v: Vec<String> = h.app.session.catalog.photos().filter(|p| p.in_library()).map(|p| p.file_name.clone()).collect();
+    v.sort();
+    v
+}
+
+/// Open the dialog from the folder's menu and wait for the scan.
+fn open_and_scan(h: &mut Headless, folder: &str) {
+    // the rows above it hold one folder each and open by themselves
+    let row = format!("source:libfolder:{folder}");
+    assert!(h.step_until(T, |h| h.app.widgets.iter().any(|(w, _)| *w == row)), "no row {row}");
+    let rect = h.app.widgets.iter().find(|(w, _)| *w == row).map(|(_, r)| *r).unwrap_or_else(|| panic!("no row {row}"));
+    let c = rect.center();
+    let r = h.request("ui.click", json!({"x": c.x, "y": c.y, "button": "right"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.step();
+    h.step();
+    let r = h.request("ui.clickWidget", json!({"id": "folderSynchronize"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.step();
+    assert!(matches!(h.app.ui.dialog, Some(Dialog::SynchronizeFolder { .. })), "the dialog opens at once");
+    let scanned = h.step_until(T, |h| matches!(&h.app.ui.dialog, Some(Dialog::SynchronizeFolder { counts: Some(_), .. })));
+    assert!(scanned, "the scan finished: {:?}", h.app.ui.dialog);
+}
+
+/// Synchronize: the dialog closes and the work goes to the background at once (nothing has
+/// changed yet when the confirm returns); then wait for it.
+fn synchronize(h: &mut Headless) {
+    let before = in_library(h);
+    // the dialog's confirm itself, between frames: it only hands the work over
+    let dlg = h.app.ui.dialog.take().expect("the dialog is open");
+    let r = crate::panels::dialogs::confirm_dialog(&mut h.app, &dlg);
+    assert!(r.is_ok(), "{r:?}");
+    assert!(h.app.sync_run.is_some(), "the work runs in the background");
+    assert_eq!(in_library(h), before, "nothing was done on the UI thread");
+    assert!(h.step_until(T, |h| h.app.sync_run.is_none()), "the work finishes");
+}
+
+/// Tick "Remove missing photos" and wait until the click has landed. A click is queued input:
+/// on a loaded machine the dialog can still be settling into place when it arrives, so it is
+/// clicked again (at the box's current place) until it lands.
+fn tick_remove_missing(h: &mut Headless) {
+    let ticked = |h: &Headless| matches!(h.app.ui.dialog, Some(Dialog::SynchronizeFolder { remove_missing: true, .. }));
+    for _ in 0..5 {
+        h.step();
+        let r = h.request("ui.clickWidget", json!({"id": "syncRemoveMissing"}), T);
+        assert_eq!(r["ok"], true, "{r}");
+        if h.step_until(Duration::from_secs(3), ticked) {
+            return;
+        }
+    }
+    panic!("the box never ticked: {:?}", h.app.ui.dialog);
+}
+
+fn counts(h: &Headless) -> crate::state::SyncCounts {
+    match &h.app.ui.dialog {
+        Some(Dialog::SynchronizeFolder { counts: Some(c), .. }) => c.clone(),
+        d => panic!("no scanned dialog: {d:?}"),
+    }
+}
+
+#[test]
+fn the_dialog_says_what_changed_in_the_folder() {
+    let dir = Scratch::new("counts");
+    let mut h = changed_folder(&dir);
+    open_and_scan(&mut h, &dir.path("trip"));
+    let c = counts(&h);
+    assert_eq!((c.new, c.missing, c.metadata), (1, 1, 0), "{c:?}");
+    assert_eq!(in_library(&h), vec!["a.png", "b.png"], "scanning changed nothing");
+}
+
+#[test]
+fn synchronizing_with_the_defaults_imports_the_new_photos_only() {
+    let dir = Scratch::new("defaults");
+    let mut h = changed_folder(&dir);
+    open_and_scan(&mut h, &dir.path("trip"));
+    synchronize(&mut h);
+    assert_eq!(in_library(&h), vec!["a.png", "b.png", "c.png"], "c came in; the missing b stays");
+}
+
+#[test]
+fn ticking_remove_missing_also_removes_the_missing_photos() {
+    let dir = Scratch::new("remove");
+    let mut h = changed_folder(&dir);
+    open_and_scan(&mut h, &dir.path("trip"));
+    tick_remove_missing(&mut h);
+    synchronize(&mut h);
+    assert_eq!(in_library(&h), vec!["a.png", "c.png"], "b went to Recently Deleted");
+    let r = h.request("engine.execute", json!({"command": "edit.undo", "params": {}}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    assert_eq!(in_library(&h), vec!["a.png", "b.png"], "one undo step");
+}
+
+#[test]
+fn cancel_leaves_the_library_as_it_was() {
+    let dir = Scratch::new("cancel");
+    let mut h = changed_folder(&dir);
+    open_and_scan(&mut h, &dir.path("trip"));
+    h.request("ui.key", json!({"key": "escape"}), T);
+    h.step();
+    h.step();
+    assert!(h.app.ui.dialog.is_none());
+    assert_eq!(in_library(&h), vec!["a.png", "b.png"]);
+    assert!(h.app.session.folder_changes.is_none(), "the scan is let go");
+}
+
+#[test]
+fn an_agents_scan_is_kept_between_frames() {
+    let dir = Scratch::new("agent");
+    let mut h = changed_folder(&dir);
+    let r = h.request("engine.execute", json!({"command": "folder.scanChanges", "params": {"path": dir.path("trip")}}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    for _ in 0..5 {
+        h.step();
+    }
+    assert!(h.app.session.folder_changes.is_some(), "the app doesn't drop a scan it didn't make");
+}
+
+#[test]
+fn a_scan_gone_stale_in_the_dialog_is_made_again_in_the_background() {
+    let dir = Scratch::new("restale");
+    let mut h = changed_folder(&dir);
+    open_and_scan(&mut h, &dir.path("trip"));
+    tick_remove_missing(&mut h);
+    // a photo of the folder changes while the dialog is open
+    let a = h.app.session.catalog.photos().find(|p| p.file_name == "a.png").unwrap().id;
+    let r = h.request("engine.execute", json!({"command": "photo.rate", "params": {"ids": [a.0], "rating": 3}}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    let r = h.request("ui.dialog.confirm", json!({}), T);
+    assert_eq!(r["ok"], false, "not done on a stale scan: {r}");
+    assert_eq!(in_library(&h), vec!["a.png", "b.png"]);
+    assert!(matches!(h.app.ui.dialog, Some(Dialog::SynchronizeFolder { .. })), "the dialog stays open");
+    let rescanned = h.step_until(T, |h| matches!(&h.app.ui.dialog, Some(Dialog::SynchronizeFolder { counts: Some(_), .. })));
+    assert!(rescanned, "and scans again");
+    assert!(matches!(h.app.ui.dialog, Some(Dialog::SynchronizeFolder { remove_missing: true, .. })), "keeping what was ticked");
+    synchronize(&mut h);
+    assert_eq!(in_library(&h), vec!["a.png", "c.png"], "c came in, the missing b went");
+}
+
+#[test]
+fn a_stopped_synchronize_says_it_was_stopped_and_stays_at_most_one_step() {
+    let dir = Scratch::new("stop");
+    let mut h = changed_folder(&dir);
+    open_and_scan(&mut h, &dir.path("trip"));
+    let steps = h.app.session.undo.len();
+    let dlg = h.app.ui.dialog.take().expect("the dialog is open");
+    assert!(crate::panels::dialogs::confirm_dialog(&mut h.app, &dlg).is_ok());
+    // the progress window's Cancel, before any frame committed anything
+    h.app.sync_run.as_mut().expect("running").cancel();
+    assert!(h.step_until(T, |h| h.app.sync_run.is_none()), "it ends");
+    let toast = h.app.ui.toast.as_ref().map(|t| t.0.clone()).unwrap_or_default();
+    assert!(toast.contains("Stopped"), "never 'up to date': {toast:?}");
+    assert!(h.app.session.undo.len() <= steps + 1, "what was done by then is at most one step");
+}
+
+#[test]
+fn a_synchronize_and_an_import_never_run_at_once() {
+    let dir = Scratch::new("exclusive");
+    let mut h = changed_folder(&dir);
+    open_and_scan(&mut h, &dir.path("trip"));
+    let dlg = h.app.ui.dialog.take().expect("the dialog is open");
+    assert!(crate::panels::dialogs::confirm_dialog(&mut h.app, &dlg).is_ok());
+    // dropping the same folder on the window while the run works would add its files twice
+    let r = crate::import::start_paths(&mut h.app, vec![dir.path("trip")]);
+    assert!(r.is_err(), "no import while synchronizing: {r:?}");
+    assert!(h.step_until(T, |h| h.app.sync_run.is_none()));
+    // and the other way round: an import is running (no frame has run since it started)
+    let r = crate::import::start_paths(&mut h.app, vec![dir.path("trip/a.png")]);
+    assert!(r.is_ok(), "{r:?}");
+    assert!(h.app.import.is_some());
+    let d = Dialog::SynchronizeFolder {
+        path: dir.path("trip"),
+        name: "trip".into(),
+        disk: false,
+        counts: Some(Default::default()),
+        import_new: true,
+        relink_moved: true,
+        remove_missing: false,
+        read_metadata: false,
+    };
+    let r = crate::panels::dialogs::confirm_dialog(&mut h.app, &d);
+    assert!(r.is_err() && h.app.sync_run.is_none(), "no synchronize while importing: {r:?}");
+}
diff --git a/crates/ui-egui/src/tests_zoom_keys.rs b/crates/ui-egui/src/tests_zoom_keys.rs
new file mode 100644
index 00000000..3c111121
--- /dev/null
+++ b/crates/ui-egui/src/tests_zoom_keys.rs
@@ -0,0 +1,87 @@
+//! Headless tests of the View ▸ Zoom shortcuts and modifier-wheel zoom: Cmd+= / Cmd+- / Cmd+0
+//! (Ctrl on Windows and Linux) zoom the photo and never egui's interface scale, which would
+//! otherwise take the same keys at the end of the frame; Ctrl+wheel over the photo in the Edit
+//! view zooms it.
+
+use std::time::Duration;
+
+use serde_json::json;
+
+use crate::headless::Headless;
+use crate::state::Zoom;
+use crate::{LightcraftApp, Services};
+
+const T: Duration = Duration::from_secs(20);
+const SETTLE: Duration = Duration::from_secs(120);
+
+fn edit_view() -> Headless {
+    let services = Services { png: None, ..Default::default() };
+    let mut app = LightcraftApp::new(lightcraft_engine::Session::with_demo(), services);
+    app.ui.settings.gpu = false;
+    let mut h = Headless::new(app, [1400.0, 900.0], 1.0);
+    let r = h.request("ui.set", json!({"view": "detail", "right": "edit"}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.settle(SETTLE);
+    h
+}
+
+fn key(h: &mut Headless, k: &str) {
+    let r = h.request("ui.key", json!({"key": k, "cmd": true}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    h.step();
+    h.step();
+}
+
+#[test]
+fn zoom_shortcuts_zoom_the_photo_and_leave_the_interface_scale_alone() {
+    let mut h = edit_view();
+    assert_eq!(h.app.ui.zoom, Zoom::Fit);
+    let scale = h.view.ctx.zoom_factor();
+    // Cmd+= (Ctrl+= on Windows / Linux) is View ▸ Zoom In: the photo, not the UI
+    key(&mut h, "=");
+    assert_eq!(h.app.ui.zoom, Zoom::Percent(50.0), "{:?}", h.app.ui.zoom);
+    assert_eq!(h.view.ctx.zoom_factor(), scale, "Cmd+= scaled the interface");
+    // Cmd+Plus (a keypad or layout that reports `+`) is egui's other interface-zoom key
+    key(&mut h, "Plus");
+    assert_eq!(h.view.ctx.zoom_factor(), scale, "Cmd+Plus scaled the interface");
+    key(&mut h, "-");
+    assert_eq!(h.app.ui.zoom, Zoom::Percent(25.0), "{:?}", h.app.ui.zoom);
+    assert_eq!(h.view.ctx.zoom_factor(), scale, "Cmd+- scaled the interface");
+    key(&mut h, "-");
+    assert_eq!(h.app.ui.zoom, Zoom::Fit, "{:?}", h.app.ui.zoom);
+    assert_eq!(h.view.ctx.zoom_factor(), scale, "Cmd+- scaled the interface");
+    // Cmd+0 is Zoom to Fit; egui would reset its interface scale with the same key
+    h.app.run("view.navigate", json!({"zoom": {"percent": 200.0}})).unwrap();
+    h.view.ctx.set_zoom_factor(1.2);
+    h.step();
+    h.step();
+    assert!((h.view.ctx.zoom_factor() - 1.2).abs() < 0.001);
+    key(&mut h, "0");
+    assert_eq!(h.app.ui.zoom, Zoom::Fit, "{:?}", h.app.ui.zoom);
+    assert!((h.view.ctx.zoom_factor() - 1.2).abs() < 0.001, "Cmd+0 reset the interface scale");
+}
+
+#[test]
+fn ctrl_wheel_over_the_photo_zooms_it_in_the_edit_view() {
+    let mut h = edit_view();
+    let img = h.app.image_rect.unwrap();
+    let canvas = h.app.canvas_rect.unwrap();
+    assert!(canvas.contains(img.center()), "{img:?} outside {canvas:?}");
+    let r = h.request("ui.move", json!({"x": img.center().x, "y": img.center().y}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    let r = h.request("ui.scroll", json!({"dy": 120.0, "ctrl": true, "cmd": true}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    for _ in 0..40 {
+        h.step();
+    }
+    assert!(matches!(h.app.ui.zoom, Zoom::Percent(p) if p > 0.0), "Ctrl+wheel did not zoom: {:?}", h.app.ui.zoom);
+    assert!(h.app.image_rect.unwrap().width() > img.width(), "the photo did not grow");
+    // a plain wheel over the photo pans (or does nothing at Fit): never zooms further
+    let zoomed = h.app.image_rect.unwrap();
+    let r = h.request("ui.scroll", json!({"dy": 120.0}), T);
+    assert_eq!(r["ok"], true, "{r}");
+    for _ in 0..40 {
+        h.step();
+    }
+    assert!((h.app.image_rect.unwrap().width() - zoomed.width()).abs() < 0.01, "a plain wheel changed the zoom");
+}
diff --git a/crates/ui-egui/src/text_field.rs b/crates/ui-egui/src/text_field.rs
new file mode 100644
index 00000000..c620ee0a
--- /dev/null
+++ b/crates/ui-egui/src/text_field.rs
@@ -0,0 +1,719 @@
+//! A text field that behaves the same everywhere in the app: right-click for Cut, Copy, Paste and
+//! Select All; Esc gives back the text from before the edit; Return or leaving the field ends the
+//! edit; optionally everything is selected when it takes focus, for fields that are retyped whole.
+//!
+//! It knows nothing of the app's documents or commands, only the UI's plumbing (the automation
+//! registry, translations, shortcut labels). The caller owns the text and learns how an edit
+//! ended from [`TextFieldResponse::ending`]; what an ending means (save, apply, close) is the
+//! caller's. Each field's widget id is unique on screen: its state is keyed by it.
+//!
+//! New text boxes use it rather than `egui::TextEdit`.
+//!
+//! The keyboard's ⌘X / ⌘C / ⌘V / ⌘A and undo are egui's own, and the app's shortcuts step aside
+//! while a field has focus (`shortcuts::handle`, the native menu's `yields_to_text`).
+
+use egui::{Response, Ui};
+
+/// How an edit ended.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Ending {
+    /// Return in a one-line field: the text is meant.
+    Return,
+    /// The focus went elsewhere (a click outside, Tab): the text is kept.
+    Away,
+    /// Esc: the text is back to what it was before the edit.
+    Escape,
+}
+
+pub struct TextFieldResponse {
+    pub response: Response,
+    /// Set on the frame an edit ends.
+    pub ending: Option<Ending>,
+    /// An edit is under way: the field has the focus, or its menu does.
+    pub editing: bool,
+}
+
+impl TextFieldResponse {
+    /// The edit ended with the text kept (Return or leaving the field).
+    pub fn committed(&self) -> bool {
+        matches!(self.ending, Some(Ending::Return | Ending::Away))
+    }
+
+    /// Esc ended the edit and the text is back as it was.
+    pub fn cancelled(&self) -> bool {
+        self.ending == Some(Ending::Escape)
+    }
+}
+
+/// A one-line or multi-line text field, registered under a widget id for the control channel.
+pub struct TextField<'a> {
+    widget: &'a str,
+    text: &'a mut String,
+    multiline: bool,
+    hint: Option<String>,
+    width: Option<f32>,
+    select_on_focus: bool,
+    frame: bool,
+    font: Option<egui::FontId>,
+    color: Option<egui::Color32>,
+    align: Option<egui::Align>,
+    margin: Option<egui::Margin>,
+    rows: Option<usize>,
+}
+
+/// The egui id of the field registered as `widget`, to give it the focus (⌘F to search).
+pub fn id(widget: &str) -> egui::Id {
+    egui::Id::new("lc-text-field").with(widget)
+}
+
+impl<'a> TextField<'a> {
+    /// A one-line field (Return ends the edit) registered as `widget`.
+    pub fn singleline(widget: &'a str, text: &'a mut String) -> Self {
+        TextField {
+            widget,
+            text,
+            multiline: false,
+            hint: None,
+            width: None,
+            select_on_focus: false,
+            frame: true,
+            font: None,
+            color: None,
+            align: None,
+            margin: None,
+            rows: None,
+        }
+    }
+
+    /// A multi-line field: Return starts a new line; leaving the field ends the edit.
+    pub fn multiline(widget: &'a str, text: &'a mut String) -> Self {
+        TextField { multiline: true, ..Self::singleline(widget, text) }
+    }
+
+    /// Grey text shown while the field is empty.
+    pub fn hint(mut self, hint: impl Into<String>) -> Self {
+        self.hint = Some(hint.into());
+        self
+    }
+
+    pub fn width(mut self, width: f32) -> Self {
+        self.width = Some(width);
+        self
+    }
+
+    /// How many lines a multi-line field shows.
+    pub fn rows(mut self, rows: usize) -> Self {
+        self.rows = Some(rows);
+        self
+    }
+
+    /// Draw the field's own box (on by default); off where the caller draws one around it.
+    pub fn frame(mut self, on: bool) -> Self {
+        self.frame = on;
+        self
+    }
+
+    pub fn font(mut self, font: egui::FontId) -> Self {
+        self.font = Some(font);
+        self
+    }
+
+    pub fn text_color(mut self, color: egui::Color32) -> Self {
+        self.color = Some(color);
+        self
+    }
+
+    pub fn horizontal_align(mut self, align: egui::Align) -> Self {
+        self.align = Some(align);
+        self
+    }
+
+    pub fn margin(mut self, margin: egui::Margin) -> Self {
+        self.margin = Some(margin);
+        self
+    }
+
+    /// Select all the text when the field takes focus, so typing replaces it (names, numbers).
+    pub fn select_on_focus(mut self, on: bool) -> Self {
+        self.select_on_focus = on;
+        self
+    }
+
+    pub fn show(self, ui: &mut Ui) -> TextFieldResponse {
+        let id = id(self.widget);
+        let mut memo: Memo = ui.data_mut(|d| d.get_temp(id.with("memo"))).unwrap_or_default();
+        // a field not drawn last frame (its dialog or panel closed) starts afresh: an edit, a menu
+        // or a choice from it that was under way is gone with it
+        let pass = ui.ctx().cumulative_pass_nr();
+        if memo.pass.checked_add(1) != Some(pass) {
+            memo = Memo::default();
+        }
+        memo.pass = pass;
+        // a choice from the menu last frame: the field takes the focus back and does it, with
+        // egui's own handling of the clipboard events (a password is never copied)
+        if let Some(action) = memo.action.take() {
+            ui.memory_mut(|m| m.request_focus(id));
+            match action {
+                Action::Cut => ui.input_mut(|i| i.events.push(egui::Event::Cut)),
+                Action::Copy => ui.input_mut(|i| i.events.push(egui::Event::Copy)),
+                // only the host can read the clipboard: it answers with a paste event
+                Action::Paste => ui.ctx().send_viewport_cmd(egui::ViewportCommand::RequestPaste),
+                Action::SelectAll => select_all(ui.ctx(), id, self.text),
+                Action::Refocus => {}
+            }
+        }
+        let mut edit = if self.multiline { egui::TextEdit::multiline(self.text) } else { egui::TextEdit::singleline(self.text) };
+        edit = edit.id(id);
+        if let Some(hint) = self.hint {
+            edit = edit.hint_text(hint);
+        }
+        if let Some(w) = self.width {
+            edit = edit.desired_width(w);
+        }
+        if !self.frame {
+            edit = edit.frame(egui::Frame::NONE);
+        }
+        if let Some(font) = self.font {
+            edit = edit.font(font);
+        }
+        if let Some(color) = self.color {
+            edit = edit.text_color(color);
+        }
+        if let Some(align) = self.align {
+            edit = edit.horizontal_align(align);
+        }
+        if let Some(margin) = self.margin {
+            edit = edit.margin(margin);
+        }
+        if let Some(rows) = self.rows {
+            edit = edit.desired_rows(rows);
+        }
+        let (escape, enter) = ui.input(|i| (i.key_pressed(egui::Key::Escape), i.key_pressed(egui::Key::Enter)));
+        // a right-click places the cursor as a left one does: the selection the menu acts on
+        // would be gone
+        let right = ui.input(|i| i.pointer.button_down(egui::PointerButton::Secondary) || i.pointer.button_released(egui::PointerButton::Secondary));
+        let selection = egui::text_edit::TextEditState::load(ui.ctx(), id).and_then(|s| s.cursor.char_range());
+        let mut response = ui.add(edit);
+        if right && response.contains_pointer() {
+            let mut state = egui::text_edit::TextEditState::load(ui.ctx(), id).unwrap_or_default();
+            state.cursor.set_char_range(selection);
+            state.store(ui.ctx(), id);
+        }
+        crate::widgets::register(ui.ctx(), self.widget, response.rect);
+        // egui's own focus: `Response::has_focus` is also false while the window is in the
+        // background (another app in front), which neither ends nor restarts an edit
+        let focused = ui.memory(|m| m.has_focus(id));
+
+        // an edit not under way (none, or one cut short when the field went away) is forgotten
+        let in_menu = memo.away || memo.menu_open || memo.action.is_some();
+        if !focused && !response.lost_focus() && !in_menu {
+            memo.before = None;
+        }
+        // the start of an edit (not the focus coming back from the menu)
+        let pressing = ui.input(|i| i.pointer.any_down());
+        if focused && memo.before.is_none() {
+            memo.before = Some(self.text.clone());
+            if self.select_on_focus {
+                // a press that took the focus may go on to drag a selection: wait for its release
+                if pressing {
+                    memo.select_on_release = true;
+                } else {
+                    select_all(ui.ctx(), id, self.text);
+                }
+            }
+        }
+        if memo.select_on_release && !pressing {
+            memo.select_on_release = false;
+            // a plain click selects everything; a drag keeps what it selected
+            if focused && !has_selection(ui.ctx(), id) {
+                select_all(ui.ctx(), id, self.text);
+            }
+        }
+        let menu_was_open = memo.menu_open;
+        // a click on a greyed-out item does nothing, as in a native menu: only a choice or a click
+        // outside closes it
+        memo.menu_open = egui::Popup::context_menu(&response)
+            .close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside)
+            .show(|ui| menu(ui, self.widget, id, self.text, &mut memo.action))
+            .is_some();
+
+        let mut ending = None;
+        let close_menu = |ui: &Ui| egui::Popup::close_id(ui.ctx(), egui::Popup::default_response_id(&response));
+        // egui reports a lost focus on two frames: only an edit under way ends
+        if response.lost_focus() && memo.before.is_some() {
+            if escape && menu_was_open {
+                // Esc closes only the menu, as in native menus: the field takes the focus back
+                memo.action = Some(Action::Refocus);
+            } else if escape {
+                if let Some(before) = memo.before.take()
+                    && *self.text != before
+                {
+                    *self.text = before;
+                    response.mark_changed();
+                }
+                ending = Some(Ending::Escape);
+            } else if enter && !self.multiline {
+                ending = Some(Ending::Return);
+                close_menu(ui);
+            } else if menu_was_open || memo.menu_open || memo.action.is_some() {
+                // the click went to the menu: the edit goes on once the menu is done with
+                memo.away = true;
+            } else {
+                ending = Some(Ending::Away);
+            }
+        } else if memo.away && escape && memo.action.is_none() {
+            // Esc with the focus in the menu (Tab took it there) closes only the menu
+            memo.action = Some(Action::Refocus);
+            memo.away = false;
+        } else if memo.away && !memo.menu_open && memo.action.is_none() && !focused {
+            // the menu closed without a choice: the click outside it left the field
+            ending = Some(Ending::Away);
+        }
+        if focused {
+            memo.away = false;
+        }
+        if ending.is_some() {
+            memo = Memo { pass, ..Memo::default() };
+        }
+        let editing = ending.is_none() && (focused || memo.away || memo.menu_open || memo.action.is_some());
+        ui.data_mut(|d| d.insert_temp(id.with("memo"), memo));
+        TextFieldResponse { response, ending, editing }
+    }
+}
+
+/// What a field remembers between frames.
+#[derive(Clone, Default)]
+struct Memo {
+    /// The text when the edit started, for Esc.
+    before: Option<String>,
+    /// The context menu was open at the end of the frame.
+    menu_open: bool,
+    /// The menu's choice, done next frame.
+    action: Option<Action>,
+    /// The focus left for the menu: the edit ends if the menu closes without a choice.
+    away: bool,
+    /// The field took the focus with select-on-focus under a press: select all on its release,
+    /// unless it dragged a selection.
+    select_on_release: bool,
+    /// The frame (egui pass) the field was last drawn in.
+    pass: u64,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Action {
+    Cut,
+    Copy,
+    Paste,
+    SelectAll,
+    /// Only take the focus back (Esc closed the menu).
+    Refocus,
+}
+
+fn select_all(ctx: &egui::Context, id: egui::Id, text: &str) {
+    let mut state = egui::text_edit::TextEditState::load(ctx, id).unwrap_or_default();
+    let end = egui::text::CCursor::new(text.chars().count());
+    state.cursor.set_char_range(Some(egui::text::CCursorRange::two(egui::text::CCursor::new(0), end)));
+    state.store(ctx, id);
+}
+
+/// Some text is selected in the field.
+fn has_selection(ctx: &egui::Context, id: egui::Id) -> bool {
+    egui::text_edit::TextEditState::load(ctx, id).and_then(|s| s.cursor.char_range()).is_some_and(|r| !r.is_empty())
+}
+
+/// The field's context menu: Cut, Copy, Paste, Select All, with the keyboard's shortcuts beside them.
+fn menu(ui: &mut Ui, widget: &str, id: egui::Id, text: &str, action: &mut Option<Action>) {
+    let mac = ui.ctx().os() == egui::os::OperatingSystem::Mac;
+    let selected = has_selection(ui.ctx(), id);
+    let items = [
+        (Action::Cut, "cut", "Cut", "Cmd+X", selected),
+        (Action::Copy, "copy", "Copy", "Cmd+C", selected),
+        // a browser only pastes from its own paste event, never on request
+        (Action::Paste, "paste", "Paste", "Cmd+V", !cfg!(target_arch = "wasm32")),
+        (Action::SelectAll, "selectAll", "Select All", "Cmd+A", !text.is_empty()),
+    ];
+    for (a, key, label, shortcut, enabled) in items {
+        if a == Action::Paste && cfg!(target_arch = "wasm32") {
+            continue;
+        }
+        if a == Action::SelectAll {
+            ui.separator();
+        }
+        let button = egui::Button::new(crate::i18n::tr(label)).shortcut_text(crate::menubar::shortcut_text(shortcut, mac));
+        let r = ui.add_enabled(enabled, button);
+        crate::widgets::register(ui.ctx(), format!("{widget}:{key}"), r.rect);
+        if r.clicked() {
+            *action = Some(a);
+            ui.close();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use egui::{Event, Key, Modifiers, PointerButton, Pos2, Rect};
+
+    use super::*;
+    use crate::headless::HeadlessView;
+
+    const FIELD: &str = "cityField";
+
+    /// A field alone in a window, with a blank area beside it to click away to.
+    struct Rig {
+        view: HeadlessView,
+        text: String,
+        select_on_focus: bool,
+        /// The field is on screen (a dialog that holds it may close).
+        shown: bool,
+        /// The app's window has the system's focus (the user may switch to another app).
+        window_focused: bool,
+        /// The field said an edit is under way, last frame.
+        editing: bool,
+        endings: Vec<Ending>,
+        widgets: Vec<(String, Rect)>,
+        time: f64,
+    }
+
+    impl Rig {
+        fn new(text: &str) -> Self {
+            let mut rig = Rig {
+                view: HeadlessView::new(),
+                text: text.to_string(),
+                select_on_focus: false,
+                shown: true,
+                window_focused: true,
+                editing: false,
+                endings: vec![],
+                widgets: vec![],
+                time: 0.0,
+            };
+            rig.frame(vec![]);
+            rig
+        }
+
+        fn frame(&mut self, events: Vec<Event>) {
+            self.time += 1.0 / 60.0;
+            let mut raw = HeadlessView::raw_input(egui::vec2(400.0, 300.0), 1.0, self.time, events);
+            raw.focused = self.window_focused;
+            let (text, select, shown, endings, editing) = (&mut self.text, self.select_on_focus, self.shown, &mut self.endings, &mut self.editing);
+            self.view.run(raw, |ui| {
+                ui.add_space(20.0);
+                if !shown {
+                    return;
+                }
+                let r = TextField::singleline(FIELD, text).width(200.0).select_on_focus(select).show(ui);
+                endings.extend(r.ending);
+                *editing = r.editing;
+            });
+            self.widgets = crate::widgets::take_registry(&self.view.ctx);
+        }
+
+        /// A few frames, for menus to open and requests to come back.
+        fn settle(&mut self) {
+            for _ in 0..4 {
+                self.frame(vec![]);
+            }
+        }
+
+        fn rect(&self, id: &str) -> Option<Rect> {
+            self.widgets.iter().rev().find(|(w, _)| w == id).map(|(_, r)| *r)
+        }
+
+        fn click_at(&mut self, at: Pos2, button: PointerButton) {
+            // far apart in time from the last click: two clicks never make a double-click
+            self.time += 1.0;
+            let press = |pressed| Event::PointerButton { pos: at, button, pressed, modifiers: Modifiers::NONE };
+            self.frame(vec![Event::PointerMoved(at), press(true)]);
+            self.frame(vec![press(false)]);
+            self.settle();
+        }
+
+        fn click(&mut self, id: &str, button: PointerButton) {
+            let r = self.rect(id).unwrap_or_else(|| panic!("no {id} on screen: {:?}", self.widgets));
+            self.click_at(r.center(), button);
+        }
+
+        fn key(&mut self, key: Key, modifiers: Modifiers) {
+            let ev = |pressed| Event::Key { key, physical_key: None, pressed, repeat: false, modifiers };
+            self.frame(vec![ev(true), ev(false)]);
+            self.settle();
+        }
+
+        fn type_text(&mut self, text: &str) {
+            self.frame(vec![Event::Text(text.to_string())]);
+            self.settle();
+        }
+
+        fn focused(&self) -> bool {
+            self.view.ctx.memory(|m| m.focused()).is_some()
+        }
+
+        /// Click into the field and select all its text with ⌘A.
+        fn select_all_by_keys(&mut self) {
+            self.click(FIELD, PointerButton::Primary);
+            self.key(Key::A, Modifiers::COMMAND);
+        }
+
+        /// Right-click the field, then pick `item` from its menu.
+        fn menu(&mut self, item: &str) {
+            self.click(FIELD, PointerButton::Secondary);
+            self.click(&format!("{FIELD}:{item}"), PointerButton::Primary);
+        }
+    }
+
+    /// Right-click offers Cut, Copy, Paste and Select All.
+    #[test]
+    fn right_click_offers_cut_copy_paste_and_select_all() {
+        let mut rig = Rig::new("Lisbon");
+        rig.click(FIELD, PointerButton::Secondary);
+        for item in ["cut", "copy", "paste", "selectAll"] {
+            assert!(rig.rect(&format!("{FIELD}:{item}")).is_some(), "{item}: {:?}", rig.widgets);
+        }
+    }
+
+    /// Copy in the menu puts the selected text on the clipboard and leaves the field as it was,
+    /// still being edited.
+    #[test]
+    fn copy_in_the_menu_copies_the_selection() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.menu("copy");
+        assert_eq!(rig.view.clipboard, "Lisbon");
+        assert_eq!(rig.text, "Lisbon");
+        assert!(rig.focused(), "still editing");
+        assert_eq!(rig.endings, vec![], "using the menu is not leaving the field");
+    }
+
+    /// Cut in the menu puts the selected text on the clipboard and takes it out of the field.
+    #[test]
+    fn cut_in_the_menu_moves_the_selection_to_the_clipboard() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.menu("cut");
+        assert_eq!(rig.view.clipboard, "Lisbon");
+        assert_eq!(rig.text, "");
+    }
+
+    /// Paste in the menu puts the clipboard's text in place of the selection.
+    #[test]
+    fn paste_in_the_menu_replaces_the_selection() {
+        let mut rig = Rig::new("Lisbon");
+        rig.view.clipboard = "Porto".into();
+        rig.select_all_by_keys();
+        rig.menu("paste");
+        assert_eq!(rig.text, "Porto");
+    }
+
+    /// Select All in the menu selects the whole text: what is typed next replaces it.
+    #[test]
+    fn select_all_in_the_menu_selects_the_whole_text() {
+        let mut rig = Rig::new("Lisbon");
+        rig.click(FIELD, PointerButton::Primary);
+        rig.menu("selectAll");
+        rig.type_text("Kyoto");
+        assert_eq!(rig.text, "Kyoto");
+    }
+
+    /// With nothing selected, Cut and Copy are greyed out: clicking one does nothing, as in a native
+    /// menu, and neither closes the menu nor ends the edit.
+    #[test]
+    fn greyed_out_items_do_nothing() {
+        let mut rig = Rig::new("Lisbon");
+        rig.click(FIELD, PointerButton::Primary);
+        rig.click(FIELD, PointerButton::Secondary);
+        for item in ["cut", "copy"] {
+            rig.click(&format!("{FIELD}:{item}"), PointerButton::Primary);
+            assert!(rig.rect(&format!("{FIELD}:{item}")).is_some(), "{item}: the menu is still open");
+        }
+        assert_eq!((rig.text.as_str(), rig.view.clipboard.as_str()), ("Lisbon", ""));
+        assert_eq!(rig.endings, vec![], "still editing");
+        rig.menu("selectAll");
+        rig.type_text("Kyoto");
+        assert_eq!(rig.text, "Kyoto", "and the edit goes on");
+    }
+
+    /// Esc gives back the text from before the edit and says the edit was cancelled.
+    #[test]
+    fn escape_gives_back_the_text_from_before_the_edit() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        assert_eq!(rig.text, "Rome");
+        rig.key(Key::Escape, Modifiers::NONE);
+        assert_eq!(rig.text, "Lisbon");
+        assert_eq!(rig.endings, vec![Ending::Escape]);
+    }
+
+    /// Return ends the edit and keeps the text.
+    #[test]
+    fn return_ends_the_edit() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        rig.key(Key::Enter, Modifiers::NONE);
+        assert_eq!(rig.text, "Rome");
+        assert_eq!(rig.endings, vec![Ending::Return]);
+    }
+
+    /// Return with the menu open ends the edit as Return does, and closes the menu.
+    #[test]
+    fn return_with_the_menu_open_ends_the_edit() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        rig.click(FIELD, PointerButton::Secondary);
+        rig.key(Key::Enter, Modifiers::NONE);
+        assert_eq!(rig.endings, vec![Ending::Return]);
+        assert_eq!(rig.text, "Rome");
+        assert!(rig.rect(&format!("{FIELD}:cut")).is_none(), "the menu closed");
+    }
+
+    /// Esc with the menu open closes only the menu, as in native menus: the edit goes on, and a
+    /// second Esc gives back the text.
+    #[test]
+    fn escape_with_the_menu_open_closes_only_the_menu() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        rig.click(FIELD, PointerButton::Secondary);
+        rig.key(Key::Escape, Modifiers::NONE);
+        assert!(rig.rect(&format!("{FIELD}:cut")).is_none(), "the menu closed");
+        assert_eq!((rig.text.as_str(), rig.endings.clone()), ("Rome", vec![]), "the edit goes on");
+        assert!(rig.focused());
+        rig.key(Key::Escape, Modifiers::NONE);
+        assert_eq!((rig.text.as_str(), rig.endings.clone()), ("Lisbon", vec![Ending::Escape]));
+    }
+
+    /// Esc after Tab took the focus into the open menu also closes only the menu.
+    #[test]
+    fn escape_from_inside_the_menu_closes_only_the_menu() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        rig.click(FIELD, PointerButton::Secondary);
+        rig.key(Key::Tab, Modifiers::NONE);
+        rig.key(Key::Escape, Modifiers::NONE);
+        assert_eq!((rig.text.as_str(), rig.endings.clone()), ("Rome", vec![]), "the edit goes on");
+        assert!(rig.focused());
+    }
+
+    /// Clicking elsewhere ends the edit and keeps the text.
+    #[test]
+    fn clicking_away_ends_the_edit() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        rig.click_at(egui::pos2(300.0, 250.0), PointerButton::Primary);
+        assert_eq!(rig.text, "Rome");
+        assert_eq!(rig.endings, vec![Ending::Away]);
+    }
+
+    /// Opening the menu and closing it without a choice (a click outside) leaves the field.
+    #[test]
+    fn dismissing_the_menu_leaves_the_field() {
+        let mut rig = Rig::new("Lisbon");
+        rig.click(FIELD, PointerButton::Primary);
+        rig.click(FIELD, PointerButton::Secondary);
+        rig.click_at(egui::pos2(300.0, 250.0), PointerButton::Primary);
+        assert!(!rig.focused());
+        assert_eq!(rig.endings, vec![Ending::Away]);
+    }
+
+    /// A field that selects on focus: clicking into it selects everything, so typing replaces it.
+    #[test]
+    fn a_field_that_selects_on_focus_is_retyped_whole() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_on_focus = true;
+        rig.click(FIELD, PointerButton::Primary);
+        rig.type_text("Kyoto");
+        assert_eq!(rig.text, "Kyoto");
+    }
+
+    /// Esc after using the menu still gives back the text from before the whole edit.
+    #[test]
+    fn escape_after_the_menu_gives_back_the_original_text() {
+        let mut rig = Rig::new("Lisbon");
+        rig.view.clipboard = "Porto".into();
+        rig.select_all_by_keys();
+        rig.menu("paste");
+        assert_eq!(rig.text, "Porto");
+        rig.key(Key::Escape, Modifiers::NONE);
+        assert_eq!(rig.text, "Lisbon");
+    }
+
+    /// A field that goes away in the middle of an edit (its dialog closed) starts afresh when it
+    /// comes back: Esc then gives back the text it came back with.
+    #[test]
+    fn an_edit_cut_short_is_forgotten() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        rig.shown = false;
+        rig.settle();
+        rig.text = "Porto".into();
+        rig.shown = true;
+        rig.settle();
+        rig.select_all_by_keys();
+        rig.type_text("Kyoto");
+        rig.key(Key::Escape, Modifiers::NONE);
+        assert_eq!(rig.text, "Porto");
+    }
+
+    /// Switching to another app and back in the middle of an edit carries on with it: the field
+    /// is still being edited meanwhile, and Esc still gives back the text from before.
+    #[test]
+    fn switching_apps_carries_on_with_the_edit() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        rig.window_focused = false;
+        rig.settle();
+        assert!(rig.editing, "still being edited while the app is in the background");
+        assert_eq!(rig.endings, vec![]);
+        rig.window_focused = true;
+        rig.settle();
+        rig.key(Key::Escape, Modifiers::NONE);
+        assert_eq!((rig.text.as_str(), rig.endings.clone()), ("Lisbon", vec![Ending::Escape]));
+    }
+
+    /// A field that goes away while its menu is open starts afresh too when it comes back.
+    #[test]
+    fn a_field_gone_with_its_menu_open_starts_afresh() {
+        let mut rig = Rig::new("Lisbon");
+        rig.select_all_by_keys();
+        rig.type_text("Rome");
+        rig.click(FIELD, PointerButton::Secondary);
+        // a click on the greyed-out Cut takes the focus into the menu
+        rig.click(&format!("{FIELD}:cut"), PointerButton::Primary);
+        rig.shown = false;
+        rig.settle();
+        rig.text = "Porto".into();
+        rig.shown = true;
+        rig.settle();
+        assert!(!rig.editing, "no edit under way");
+        assert_eq!(rig.endings, vec![], "and none ended: it was cut short");
+        rig.select_all_by_keys();
+        rig.type_text("Kyoto");
+        rig.key(Key::Escape, Modifiers::NONE);
+        assert_eq!(rig.text, "Porto");
+    }
+
+    /// A field that selects on focus still lets a drag into it select part of the text, as a
+    /// browser's address bar does: only a plain click selects everything.
+    #[test]
+    fn a_drag_into_a_field_that_selects_on_focus_selects_what_it_covers() {
+        let mut rig = Rig::new("Lisbon Portugal Europe Atlantic Ocean");
+        rig.select_on_focus = true;
+        let r = rig.rect(FIELD).expect("the field");
+        let (from, to) = (r.center(), egui::pos2(r.right() + 40.0, r.center().y));
+        let press = |at, pressed| Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
+        rig.frame(vec![Event::PointerMoved(from), press(from, true)]);
+        for i in 1..=5 {
+            rig.frame(vec![Event::PointerMoved(from + (to - from) * (i as f32 / 5.0))]);
+        }
+        rig.frame(vec![press(to, false)]);
+        rig.settle();
+        rig.type_text("X");
+        assert!(rig.text.starts_with("Lisbon") && rig.text.ends_with('X') && rig.text != "X", "{:?}", rig.text);
+    }
+}
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 9534ebb6..0d7e1570 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -6,6 +6,7 @@ use std::sync::Arc;
 use egui::{Color32, CornerRadius, FontData, FontDefinitions, FontFamily, FontId, Stroke, Visuals};
 
 pub const FONT_SEMIBOLD: &str = "semibold";
+const WEB_CHINESE_FONT: &str = "web Noto Sans CJK SC";
 
 /// Shared colour-label palette for badges, thumbnail surrounds and feedback.
 pub fn label_color(label: lightcraft_catalog::ColorLabel) -> Color32 {
@@ -129,14 +130,24 @@ impl Tokens {
 }
 
 pub fn install_fonts(ctx: &egui::Context) {
-    ctx.set_fonts(font_definitions(lightcraft_engine::CRAFT_FONTS));
+    install_fonts_with_chinese(ctx, None);
 }
 
-/// Inter (bundled) for Latin text, egui's default fonts, then the craft-fonts CJK faces as the last
-/// fallback of every family — the active language's own script first, so shared Han characters keep
-/// that language's forms. Without craft-fonts (`craft` empty) CJK text has no glyphs and shows as
-/// boxes.
+/// Install the browser's separately downloaded Chinese face alongside the embedded faces.
+pub fn install_fonts_with_chinese(ctx: &egui::Context, chinese: Option<&Arc<FontData>>) {
+    ctx.set_fonts(font_definitions_with_chinese(lightcraft_engine::CRAFT_FONTS, chinese));
+}
+
+/// Inter remains the default UI face. Egui's default faces and craft-fonts cover other scripts;
+/// the browser's separate Chinese face precedes Japanese faces within the CJK fallback list.
+/// Without craft-fonts or that separate face, CJK text shows boxes.
 pub fn font_definitions(craft: &'static [lightcraft_engine::CraftFont]) -> FontDefinitions {
+    font_definitions_with_chinese(craft, None)
+}
+
+/// The web build keeps the large Simplified Chinese face outside the size-limited WASM module.
+/// Prefer it for Chinese UI text, including Traditional Chinese until it has its own face.
+pub fn font_definitions_with_chinese(craft: &'static [lightcraft_engine::CraftFont], chinese: Option<&Arc<FontData>>) -> FontDefinitions {
     let mut fonts = FontDefinitions::default();
     fonts.font_data.insert("Inter".into(), Arc::new(FontData::from_static(include_bytes!("../../../assets/fonts/Inter-Regular.ttf"))));
     fonts.font_data.insert("Inter-SemiBold".into(), Arc::new(FontData::from_static(include_bytes!("../../../assets/fonts/Inter-SemiBold.ttf"))));
@@ -147,12 +158,24 @@ pub fn font_definitions(craft: &'static [lightcraft_engine::CraftFont]) -> FontD
             .map(craft_font_name)
             .collect::<Vec<String>>()
     };
-    let (regular, bold) = (fallback("Regular"), fallback("Bold"));
+    let (mut regular, mut bold) = (fallback("Regular"), fallback("Bold"));
     for name in regular.iter().chain(bold.iter()) {
         if let Some(font) = craft.iter().find(|font| &craft_font_name(font) == name) {
             fonts.font_data.insert(name.clone(), Arc::new(FontData::from_static(font.bytes)));
         }
     }
+    let script = crate::i18n::language().script();
+    let prefer_chinese = chinese.is_some() && matches!(script, "Hans" | "Hant");
+    if let Some(font) = chinese {
+        fonts.font_data.insert(WEB_CHINESE_FONT.into(), font.clone());
+        if prefer_chinese {
+            regular.insert(0, WEB_CHINESE_FONT.into());
+            bold.insert(0, WEB_CHINESE_FONT.into());
+        } else {
+            regular.push(WEB_CHINESE_FONT.into());
+            bold.push(WEB_CHINESE_FONT.into());
+        }
+    }
     let defaults: Vec<String> = fonts.families.get(&FontFamily::Proportional).cloned().unwrap_or_default();
     let mut prop = vec!["Inter".to_string()];
     prop.extend(defaults.iter().cloned());
@@ -162,19 +185,29 @@ pub fn font_definitions(craft: &'static [lightcraft_engine::CraftFont]) -> FontD
     semi.extend(defaults);
     semi.extend(bold);
     fonts.families.insert(FontFamily::Name(FONT_SEMIBOLD.into()), semi);
-    fonts.families.entry(FontFamily::Monospace).or_default().extend(fallback("Regular"));
+    let mono = fonts.families.entry(FontFamily::Monospace).or_default();
+    let mut mono_fallback = fallback("Regular");
+    if prefer_chinese {
+        mono_fallback.insert(0, WEB_CHINESE_FONT.into());
+    }
+    if chinese.is_some() && !prefer_chinese {
+        mono_fallback.push(WEB_CHINESE_FONT.into());
+    }
+    mono.extend(mono_fallback);
     fonts
 }
 
-/// The embedded font families for the About box: Inter, plus the craft-fonts families when built
-/// with them.
-pub fn font_credits() -> String {
+/// The font families used by this app instance, including the browser's separately loaded face.
+pub fn font_credits(chinese_loaded: bool) -> String {
     let mut families = vec!["Inter"];
     for f in lightcraft_engine::CRAFT_FONTS {
         if !families.contains(&f.family) {
             families.push(f.family);
         }
     }
+    if chinese_loaded && !families.contains(&"Noto Sans CJK SC") {
+        families.push("Noto Sans CJK SC");
+    }
     families.join(" / ")
 }
 
@@ -183,6 +216,11 @@ fn craft_font_name(f: &lightcraft_engine::CraftFont) -> String {
 }
 
 pub fn apply(ctx: &egui::Context) {
+    // Cmd+= / Cmd+- / Cmd+0 (Ctrl on Windows and Linux) are View ▸ Zoom In / Zoom Out / Zoom to Fit
+    // for the photo. egui would take the same keys at the end of every frame for its browser-style
+    // interface zoom (issue #566); on macOS the native menu bar got them first, elsewhere the whole
+    // UI scaled.
+    ctx.options_mut(|o| o.zoom_with_keyboard = false);
     let t = Tokens::default();
     ctx.data_mut(|d| d.insert_temp(egui::Id::NULL, t));
     let mut v = Visuals::dark();
@@ -225,3 +263,88 @@ pub fn apply(ctx: &egui::Context) {
         s.animation_time = 0.08;
     });
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::i18n::{Locale, set_language};
+
+    #[test]
+    fn native_chinese_face_falls_back_after_default_faces() {
+        static FACES: &[lightcraft_engine::CraftFont] = &[
+            lightcraft_engine::CraftFont {
+                family: "BIZ UDPGothic",
+                style: "Regular",
+                scripts: &["Jpan", "Latn"],
+                bytes: include_bytes!("../../../assets/fonts/Inter-Regular.ttf"),
+            },
+            lightcraft_engine::CraftFont {
+                family: "Noto Sans CJK SC",
+                style: "Regular",
+                scripts: &["Hans", "Latn"],
+                bytes: include_bytes!("../../../assets/fonts/Inter-Regular.ttf"),
+            },
+        ];
+        set_language(Locale::ZhHans);
+        let definitions = font_definitions(FACES);
+        let defaults = FontDefinitions::default();
+        let default_prop = defaults.families.get(&FontFamily::Proportional).expect("default proportional fonts");
+        let chinese = "craft-fonts Noto Sans CJK SC Regular";
+        for (family, primary) in [(FontFamily::Proportional, "Inter"), (FontFamily::Name(FONT_SEMIBOLD.into()), "Inter-SemiBold")] {
+            let names = definitions.families.get(&family).expect("UI font family");
+            assert_eq!(names.first().map(String::as_str), Some(primary));
+            assert_eq!(names.get(1), default_prop.first());
+            assert!(names.iter().position(|name| name == chinese).is_some_and(|position| position > default_prop.len()));
+        }
+        let mono = definitions.families.get(&FontFamily::Monospace).expect("monospace font family");
+        let default_mono = defaults.families.get(&FontFamily::Monospace).expect("default monospace fonts");
+        assert_eq!(mono.first(), default_mono.first());
+        assert!(mono.iter().position(|name| name == chinese).is_some_and(|position| position >= default_mono.len()));
+        set_language(Locale::En);
+    }
+
+    #[test]
+    fn separate_web_chinese_face_is_available_in_every_ui_family() {
+        // Simulate the WASM build, which embeds only the Japanese face. The Chinese face arrives
+        // as a separate file and must precede that face when the UI uses Chinese.
+        static JAPANESE: &[lightcraft_engine::CraftFont] = &[lightcraft_engine::CraftFont {
+            family: "BIZ UDPGothic",
+            style: "Regular",
+            scripts: &["Jpan", "Latn"],
+            bytes: include_bytes!("../../../assets/fonts/Inter-Regular.ttf"),
+        }];
+        let embedded = lightcraft_engine::CRAFT_FONTS.iter().find(|font| font.family == "Noto Sans CJK SC" && font.style == "Regular");
+        let fallback: &'static [u8] = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
+        let source = embedded.map_or(fallback, |font| font.bytes);
+        let chinese = Arc::new(FontData::from_static(source));
+        set_language(Locale::ZhHans);
+        let definitions = font_definitions_with_chinese(JAPANESE, Some(&chinese));
+        let default_count = FontDefinitions::default().families.get(&FontFamily::Proportional).map_or(0, Vec::len);
+        for (family, primary) in [(FontFamily::Proportional, "Inter"), (FontFamily::Name(FONT_SEMIBOLD.into()), "Inter-SemiBold")] {
+            let names = definitions.families.get(&family).expect("UI font family");
+            assert_eq!(names.first().map(String::as_str), Some(primary));
+            assert_eq!(names.get(1 + default_count).map(String::as_str), Some(WEB_CHINESE_FONT));
+        }
+        assert!(definitions.families.get(&FontFamily::Monospace).is_some_and(|names| names.contains(&WEB_CHINESE_FONT.to_string())));
+
+        if embedded.is_some() {
+            let ctx = egui::Context::default();
+            ctx.set_fonts(definitions);
+            let mut frame = ctx.run_ui(egui::RawInput::default(), |_| {});
+            frame.textures_delta.clear();
+            ctx.fonts_mut(|fonts| {
+                for family in [FontFamily::Proportional, FontFamily::Name(FONT_SEMIBOLD.into()), FontFamily::Monospace] {
+                    let id = FontId::new(13.0, family);
+                    assert!("简体中文字".chars().all(|ch| fonts.has_glyph(&id, ch)), "{id:?}");
+                }
+            });
+        }
+
+        set_language(Locale::Ja);
+        let japanese = font_definitions_with_chinese(JAPANESE, Some(&chinese));
+        let names = japanese.families.get(&FontFamily::Proportional).expect("proportional fonts");
+        assert_eq!(names.get(1 + default_count).map(String::as_str), Some("craft-fonts BIZ UDPGothic Regular"));
+        assert_eq!(names.get(2 + default_count).map(String::as_str), Some(WEB_CHINESE_FONT));
+        set_language(Locale::En);
+    }
+}
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index c98baf41..4281c28e 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -19,6 +19,18 @@ pub fn register(ctx: &egui::Context, id: impl Into<String>, rect: Rect) {
     ctx.data_mut(|d| d.get_temp_mut_or_default::<Registry>(egui::Id::new("lc-registry")).0.push((id, rect)));
 }
 
+/// Esc was handled this frame by something nested (an open popup closed on it): containers such
+/// as dialogs shouldn't close too. Keyed to the frame, so it lapses by itself on the next one.
+pub fn take_escape(ctx: &egui::Context) {
+    let frame = ctx.cumulative_frame_nr();
+    ctx.data_mut(|d| d.insert_temp(egui::Id::new("lc-escape-taken"), frame));
+}
+
+/// Whether [`take_escape`] was called this frame.
+pub fn escape_taken(ctx: &egui::Context) -> bool {
+    ctx.data(|d| d.get_temp::<u64>(egui::Id::new("lc-escape-taken"))) == Some(ctx.cumulative_frame_nr())
+}
+
 pub fn take_registry(ctx: &egui::Context) -> Vec<(String, Rect)> {
     ctx.data_mut(|d| std::mem::take(&mut d.get_temp_mut_or_default::<Registry>(egui::Id::new("lc-registry")).0))
 }
@@ -153,7 +165,7 @@ pub fn typed_value(spec: &ControlSpec, text: &str) -> Option<f64> {
 }
 
 /// A slider's value as shown next to its label.
-fn shown_value(spec: &ControlSpec, v: f64) -> String {
+pub(crate) fn shown_value(spec: &ControlSpec, v: f64) -> String {
     let shown = if spec.id == "wb.temp" { format!("{v:.0}") } else { spec.format(v).replace("+0.00", "0").replace("-0.00", "0") };
     if shown == "+0" || shown == "-0" { "0".to_string() } else { shown }
 }
@@ -180,8 +192,9 @@ pub fn slider(ui: &mut Ui, spec: &ControlSpec, value: f64, enabled: bool, label_
     let value_rect = Rect::from_min_max(pos2(label_rect.right() - 64.0, label_rect.top()), label_rect.max);
     let value_resp = ui.interact(value_rect, id.with("value"), if enabled { Sense::click() } else { Sense::hover() });
     register(ui.ctx(), format!("sliderValue:{}", spec.id), value_rect);
+    // say that an exact value can be typed here (issue #534: an exact crop angle was hard to find)
+    let value_resp = if enabled { value_resp.on_hover_text(crate::i18n::tr("Click to type a value")) } else { value_resp };
     let typing_id = id.with("typing");
-    let field_id = id.with("typingField");
     // the text being typed and how many frames the field has been up: it takes the keyboard on its
     // first frames (not on the click's own, whose release would take the focus straight back)
     let mut typing: Option<(String, u8)> = ui.data(|m| m.get_temp(typing_id));
@@ -194,28 +207,23 @@ pub fn slider(ui: &mut Ui, spec: &ControlSpec, value: f64, enabled: bool, label_
     let from_x = |x: f32| spec.min + ((x - track_rect.left()) / track_rect.width()).clamp(0.0, 1.0) as f64 * span;
     let mut v = value;
     if let Some((mut text, frames)) = typing.take() {
-        let field = egui::TextEdit::singleline(&mut text)
-            .id(field_id)
-            .font(t.font(12.5))
-            .horizontal_align(egui::Align::RIGHT)
-            .desired_width(value_rect.width())
-            .margin(egui::Margin::ZERO);
         // a child over the value, so the field never moves the rows around it
         let mut child = ui.new_child(egui::UiBuilder::new().max_rect(value_rect).layout(egui::Layout::right_to_left(egui::Align::Center)));
-        let te = child.add(field);
+        // the old value is selected when the field takes the focus, so typing replaces it
+        let field = crate::text_field::TextField::singleline(&format!("sliderField:{}", spec.id), &mut text)
+            .font(t.font(12.5))
+            .horizontal_align(egui::Align::RIGHT)
+            .width(value_rect.width())
+            .margin(egui::Margin::ZERO)
+            .select_on_focus(true)
+            .show(&mut child);
         if frames < 2 {
-            te.request_focus();
-            // the old value is selected, so typing replaces it (set again once the field has the
-            // focus, which places the cursor)
-            let mut state = egui::text_edit::TextEditState::load(ui.ctx(), field_id).unwrap_or_default();
-            let all = egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(text.chars().count()));
-            state.cursor.set_char_range(Some(all));
-            state.store(ui.ctx(), field_id);
+            field.response.request_focus();
             typing = Some((text.clone(), frames + 1));
             ui.data_mut(|m| m.insert_temp(typing_id, (text, frames + 1)));
-        } else if !te.has_focus() || !enabled {
+        } else if field.ending.is_some() || !field.editing || !enabled {
             // Esc (or the slider turning off) keeps the old value; Return or clicking away applies
-            let cancelled = !enabled || ui.input(|i| i.key_pressed(egui::Key::Escape));
+            let cancelled = !enabled || field.cancelled();
             if let Some(nv) = typed_value(spec, &text).filter(|nv| !cancelled && (nv - value).abs() > 1e-12) {
                 out.value = Some(nv);
                 out.drag_started = true;
diff --git a/crates/ui-egui/tests/shutdown.rs b/crates/ui-egui/tests/shutdown.rs
new file mode 100644
index 00000000..1a601bc7
--- /dev/null
+++ b/crates/ui-egui/tests/shutdown.rs
@@ -0,0 +1,40 @@
+//! Issue #620: quitting while previews render must not leave a render worker running (on Linux
+//! with the NVIDIA driver, one inside the GPU when the process exits is a SIGSEGV).
+//! `LightcraftApp::shutdown` stops the render workers and closes the GPU for the whole process,
+//! hence one test in a binary of its own.
+
+use std::time::{Duration, Instant};
+
+use lightcraft_ui_egui::headless::Headless;
+use lightcraft_ui_egui::{LightcraftApp, Services};
+
+#[test]
+fn shutdown_leaves_no_render_worker_running() {
+    let services = Services { png: None, ..Default::default() };
+    let mut h = Headless::new(LightcraftApp::new(lightcraft_engine::Session::with_demo(), services), [1200.0, 760.0], 1.0);
+    // frames until the grid's thumbnails are being rendered on the workers
+    let t0 = Instant::now();
+    while h.app.renderer.live_workers() == 0 || h.app.renderer.in_flight() == 0 {
+        assert!(t0.elapsed() < Duration::from_secs(120), "no render started");
+        h.step();
+    }
+    assert!(!lightcraft_engine::gpu::shutting_down());
+
+    assert!(h.app.shutdown(Duration::from_secs(120)), "the jobs that were running ended in time");
+    assert_eq!(h.app.renderer.live_workers(), 0);
+    assert_eq!(h.app.renderer.queued(), 0, "jobs that had not started are dropped");
+    assert!(lightcraft_engine::gpu::shutting_down());
+    assert!(lightcraft_engine::gpu::wait_idle(Duration::ZERO), "nothing is inside the GPU");
+
+    // frames after it (the window's last ones) ask for renders that are not started any more
+    for _ in 0..3 {
+        h.step();
+    }
+    assert_eq!(h.app.renderer.live_workers(), 0);
+    assert_eq!(h.app.renderer.queued(), 0);
+
+    // a job that was caught before its render gives up: quitting doesn't wait for a CPU render
+    let id = h.app.session.active().or_else(|| h.app.session.catalog.photos().next().map(|p| p.id)).expect("a demo photo");
+    let job = h.app.session.render_job(id, 300, 200, false, true).expect("a render job");
+    assert_eq!(job.run().rendered.err().as_deref(), Some("LightCraft is closing"));
+}
diff --git a/docs/camera-preview-colour.md b/docs/camera-preview-colour.md
index 31be10f5..813b1e16 100644
--- a/docs/camera-preview-colour.md
+++ b/docs/camera-preview-colour.md
@@ -1,6 +1,6 @@
-# Sony ARW, Nikon NEF, Panasonic RW2, Fujifilm RAF, Canon CR3/CR2 and Pentax PEF starting look
+# Sony ARW, Nikon NEF, Panasonic RW2, Fujifilm RAF, Canon CR3/CR2, Pentax PEF, Samsung SRW and Olympus ORF starting look
 
-ARW, NEF, RW2, RAF, CR3, CR2 and PEF decoding supply sensor data and camera white-balance multipliers, but currently no measured camera colour matrix. Treating camera RGB as linear sRGB produces a dark, muted default rendering. The loader now estimates a file-local starting look from that file's embedded camera JPEG, only when a usable camera matrix is absent. All output pixels still come from the RAW sensor data; there is no JPEG replacement or uniform saturation boost.
+ARW, NEF, RW2, RAF, CR3, CR2, PEF, SRW and ORF decoding supply sensor data and camera white-balance multipliers, but currently no measured camera colour matrix. Treating camera RGB as linear sRGB produces a dark, muted default rendering. The loader now estimates a file-local starting look from that file's embedded camera JPEG, only when a usable camera matrix is absent. All output pixels still come from the RAW sensor data; there is no JPEG replacement or uniform saturation boost.
 
 ## Colour and tone are separate
 
@@ -10,11 +10,15 @@ Two thirds of the usable pixels train a ridge-regularised 3×3 **chromaticity**
 
 The JPEG's colourfulness also depends on brightness, as a camera's per-channel tone curve makes it: relative to a luminance-only curve, shadows were up to 1.4× more colourful and highlights above 0.85 luminance bleached to 0.1–0.3×, so warm sunlit rock rendered cream instead of white (+4 b* in the brightest fifth of the picture). A **chroma curve** (8 nodes over display luminance, `CameraTone::chroma`) is fitted to that ratio, including the bright pixels the colour and tone fits leave out, and applied in the finish stage right after the tone map (CPU and GPU), scaling chroma toward luminance so luminance is kept. It is kept only when it lowers the held-out error; smart previews carry it in their header, and older headers load without one.
 
-Matrix-only and matrix + table looks are each completed (tone curve, then chroma curve) and compared on the held-out pixels in gamma-encoded display values: in linear values a slightly missed bright rock outweighed a clearly wrong dark shirt. The acceptance gates below still use linear values. Luminance is fitted separately: 32 equal-population bins with robust median knots and pooled-adjacent-violators isotonic regression. The curve preserves black, cannot reverse, and extends beyond observed highlights with a bounded shoulder.
+Matrix-only and matrix + table looks are each completed (tone curve, then chroma curve) and compared on the held-out pixels in gamma-encoded display values: in linear values a slightly missed bright rock outweighed a clearly wrong dark shirt. The acceptance gates below still use linear values. Luminance is fitted separately, by quantile matching: knot *i* pairs the median of the *i*-th 1/32 of the sorted scene luminances with the median of the *i*-th 1/32 of the sorted JPEG luminances. A tone curve is monotone, so it maps each scene quantile to the same JPEG quantile; this needs no pixel-exact registration and is increasing by construction. The earlier fit (the JPEG's median per scene-luminance bin, then pooled-adjacent-violators isotonic regression) broke on lens-corrected, sharpened JPEGs of busy scenes: neighbouring bins disagreed by more than the gap between them, pooling turned them into flat steps (13 of 31 segments on a CC0 Z 6II forest shot) that rendered as posterised patches with hard edges, and regression toward the mean flattened both ends of the curve (issue #475, also #211, #454). On the 1,781 files of the CC0 archive that render, 384 of the 1,023 accepted fits had at least one flat segment (1,073 in total, up to 14 of 31); with quantile matching 1,017 of the 1,023 have none. The quantile fit is slightly worse by least squares than the conditional medians (median held-out RMS 0.0331 against 0.0330, worst +0.013), and on 7 files (compacts, bridge cameras, early Micro Four Thirds) the look cleared the acceptance gates only with the old curve. The search therefore runs once with the quantile fit (all pixels, away from edges, with and without the camera profile's colour) and, only when no look passes, once more with the earlier conditional-median fit, kept as `fit_tone_conditional`; the gates are the same, so no file loses its look. Those 7 files render exactly as before, and 6 of them still have flat segments (35 in total). The curve preserves black, cannot reverse, and extends beyond observed highlights with a bounded shoulder.
+
+**Clipped sensor pixels are left out of the fit.** A raw pixel with a channel at the clip level (0.99 of white, as in highlight reconstruction) no longer records the scene's colour: a white overcast sky with the green channel clipped and red and blue still rising comes out magenta or blue through the camera matrix, while the camera JPEG shows it white. As training pairs such pixels pulled the colour matrix toward grey and made the chroma curve remove colour at their display luminance. On the CC0 Z 6II forest sample (raw.pixls.us 4160) 24% of the proxy pixels are clipped; every chroma sample above display luminance 0.36 was one of them, and the curve cut colourfulness there to 13-19% (`[1.10, 0.94, 0.69, 0.19, 0.13, 0.19, 0.89, 1.0]`); the colours of the forest were muted by the matrix as well (spread of a\*/b\* on the proxy 63% of the JPEG's before the curve, 48% after). Over the 940 accepted looks with a chroma curve, 37% of the curve's downward pull came from clipped pixels whose JPEG pixel is near neutral, 53% in the 245 curves with a node below 0.4. The proxies therefore carry a clip mask (any sensor sample a proxy pixel covers, aligned with the CR3 framing), and the look is refitted without those pixels. The search on all pixels still decides whether a photo gets a look and which attempt (tone fit, profile or own colour, all pixels or away from edges) gives it; only that attempt is refitted, and when the refit misses the gates the look on all pixels is kept, so no photo loses its look or switches attempt. A photo without a look gets one when the search without the clipped pixels finds it. Camera-profile pairs (`calibrate`) leave clipped pixels out too. On the 1,781 files of the CC0 archive that render: 1,023 looks before, 1,027 after (none lost, 4 gained); 618 renders change (all with a look), 8 keep their earlier look through the fallback; median CIEDE2000 to the camera JPEG over the changed files 3.24 -> 3.07 (worse by more than 0.5 on 3, better by more than 0.5 on 59); median colourfulness (mean C\* of the render over the camera JPEG's) 0.973 -> 0.982 over the files with a look. The rest of the chroma curve's pull is mostly misregistration (a near-neutral JPEG pixel with a matching colour within one proxy pixel: 21%); a registration-free estimate of the curve (band means of colourfulness by each image's own luminance) brought the median colourfulness ratio to 0.999 but did not lower CIEDE2000, and is not used.
 
 The matrix is applied to scene-linear sensor pixels. The curve is carried in `SourceInfo` and applied in the pipeline finish stage, after exposure/WB/local edits. It is never baked into decoded luminance or clipped to JPEG precision. CPU and GPU use the same tone LUT. Contrast, whites and blacks adjust the starting look through the display-domain controls. JPEG neutral rendering and the existing DNG colour model are unchanged.
 
-One third of the pixels are held out from both fits. The combined model must reduce linear-display squared error by at least 30% and have per-channel RMS error ≤0.10 (0.055 rejected half of the public raw.pixls.us samples tried — ILCE-6400, -6700, -7M4 — whose fits were still 1.5–3× closer to the camera JPEG than the fallback and visibly better). When the fit on all pixels fails these gates, it is tried once more, with the same gates, on the pixels away from edges (where the 3×3 neighbourhood in either proxy spans a luminance ratio above 3). Many camera JPEGs are lens-corrected while the raw is not (Sony "Distortion Comp.: Auto", compacts and kit zooms), and on a detailed scene the misaligned edges alone fail the gate although the colours agree everywhere else (issue #232). The public ILCE-7RM2 samples (raw.pixls.us, one façade shot in seven compression/correction variants, 24–70 mm at 51 mm) are up to 15 px of 1440 off their JPEG; the six with distortion correction on missed the gate at held-out RMS 0.108–0.115 and opened in the grey neutral fallback, 13 L* too dark (ΔE76 16.6–16.9 against the JPEG after registering its geometry). Away from edges they pass at 0.049–0.052 and land at ΔE 3.7–3.8 with lightness within 0.6 L*, like the variant shot with distortion correction off (0.059 on all pixels, ΔE 3.9). The corpus GX80 kit-zoom sample (up to 63 px of 1440 off) passes too: 0.107 → 0.081, ΔE 19.1 → 7.9. Fits accepted on all pixels are unchanged. These are provisional acceptance gates, not a colour-accuracy certification. Monochrome, singular, unrelated, aspect-mismatched and poor-fitting references retain the documented fallback. Both fits use the same fixed proxy at every decode resolution.
+One third of the pixels are held out from both fits. The combined model must reduce linear-display squared error by at least 30% and have per-channel RMS error ≤0.10 (0.055 rejected half of the public raw.pixls.us samples tried — ILCE-6400, -6700, -7M4 — whose fits were still 1.5–3× closer to the camera JPEG than the fallback and visibly better). When the fit on all pixels fails these gates, it is tried once more, with the same gates, on the pixels away from edges (where the 3×3 neighbourhood in either proxy spans a luminance ratio above 3). Many camera JPEGs are lens-corrected while the raw is not (Sony "Distortion Comp.: Auto", compacts and kit zooms), and on a detailed scene the misaligned edges alone fail the gate although the colours agree everywhere else (issue #232). The public ILCE-7RM2 samples (raw.pixls.us, one façade shot in seven compression/correction variants, 24–70 mm at 51 mm) are up to 15 px of 1440 off their JPEG; the six with distortion correction on missed the gate at held-out RMS 0.108–0.115 and opened in the grey neutral fallback, 13 L* too dark (ΔE76 16.6–16.9 against the JPEG after registering its geometry). Away from edges they pass at 0.049–0.052 and land at ΔE 3.7–3.8 with lightness within 0.6 L*, like the variant shot with distortion correction off (0.059 on all pixels, ΔE 3.9). The corpus GX80 kit-zoom sample (up to 63 px of 1440 off) passes too: 0.107 → 0.081, ΔE 19.1 → 7.9. Fits accepted on all pixels are unchanged. These are provisional acceptance gates, not a colour-accuracy certification. Monochrome, singular, unrelated and aspect-mismatched references retain the documented fallback; poor-fitting ones get the partial look below when it is clearly closer to the camera JPEG. Both fits use the same fixed proxy at every decode resolution.
+
+**A partial look when the full look misses the gates.** The neutral fallback (camera RGB taken as sRGB, the default tone map) is far from the camera JPEG. Rendered for every photo on this path in the CC0 archive (1,150 files with a camera JPEG), it is 10.7 L\* too dark (median; about one stop), keeps 0.36 of the camera's colourfulness and has hues 7° off on the coloured pixels (median CIEDE2000 13.6). Its white balance is right: on the pixels the camera renders near-neutral the cast is under 1 a\*/b\* (median, every maker). The "blue" fallback on newer Sony bodies (Δb\* −22 over the whole frame on the ILCE-7RM5 sample) is a warm scene losing its colour, not a cast: its near-neutral pixels are within −1.6 b\*. So before falling back, a partial look is fitted (`fit_partial`): the quantile tone curve (registration-free, the largest part of the error), the chroma curve, and, when the scene has enough colour to learn a matrix (the full look's condition), the photo's own colour matrix at half weight, the other half the identity (`PARTIAL_MATRIX_WEIGHT`). No hue/saturation table. Half weight because, on the held-out proxy pixels of the 23 colourful photos without a look, the full matrix left 2 of them more than 2° further from the camera's hues than the neutral fallback and half weight none (median hue error 9.6° with the generic colour, 5.1° at half weight, 4.2° at full weight; on the 1,080 photos with a look 3.9° and 2.7°). Without a matrix (tone and chroma curve alone, or with one global saturation scale) about a third of all photos ended up more than 2° further from the camera's hues than the fallback, as the added colour makes the generic matrix's hue errors visible. The partial look is tried on all pixels, then away from edges, and used only when it cuts the held-out squared error below 0.7 of the neutral fallback's in linear and in gamma-encoded display values, and when the JPEG's luminance ranks the pixels like the scene's (Spearman ≥ 0.5, `PARTIAL_MIN_RANK_CORRELATION`): a curve matched to the brightness of an unrelated picture also beats the dark fallback pixel for pixel. The accepted full looks have 0.55 or more; three old Coolpix files whose raws decode wrongly have 0.07–0.27 and keep the fallback. There is no limit on the partial look's own error. On the archive (1,783 renders): all 1,087 full looks are byte-identical; of the 55 photos that reach the partial fit, 49 get it (40 on all pixels, 9 away from edges; 13 with the damped matrix, 41 with a chroma curve) and 6 keep the fallback (lens-corrected compacts: RX10, TZ80 1:1, D-LUX 4, G10 16:9, GF2 ×2). On the 49, median CIEDE2000 to the camera JPEG 14.0 → 2.1, ΔL\* −11.5 → +0.6, colourfulness 0.36 → 0.87, hue error 10.1° → 7.1°; every one is closer, by at least 1.3. Most of the others without a look never reach a fit: on 48 files (Nikon D4, Df, D300/D300S, D7000, D5100 and others) the camera JPEG proxy comes out a pixel narrower than the sensor proxy and no pairs are collected (the resize in PR #531 fixes this; with it 46 of them pass the full look's gates, CIEDE2000 17.9 → 2.9).
 
 ## Source metadata and white balance
 
@@ -74,9 +78,27 @@ This is a per-file camera-look estimate, **not measured spectral calibration or
 
 One photo can show too little of a colour for its own fit to learn it: in a second shot of the lime shirt only a few dozen proxy pixels show it, next to a hillside of foliage at the same hue that the camera renders differently, and the shirt stayed yellow (hue 68° against the JPEG's 82°; a 192-pixel proxy only reached 74°). `lightcraft-cli calibrate [--max N] [--out DIR] FOLDERS…` therefore pools the colour pairs of many ARWs, NEFs or RAFs per camera model — each against its own embedded JPEG, at a 192-pixel proxy, at most 4000 pairs per photo, files spread evenly over the folders — and fits one matrix (from white-balanced camera RGB, so no single photo's white point is baked in) and one hue/saturation/value table. Models need at least 5 usable photos.
 
-Profiles are JSON files `<model>.json` in `$LIGHTCRAFT_CAMERA_PROFILES`, else `<config>/camera-profiles` (macOS `~/Library/Application Support/LightCraft/camera-profiles`); a local profile replaces a built-in one. Built-in profiles live in `assets/camera-profiles/` (listed in `assets/ATTRIBUTION.md`) and are compiled in, so the app, CLI and web build share them: ILCE-7M4, fitted to 597 photos (2.2 million colour pairs) shot in 2026, mostly with the Standard creative style and DRO Auto; X-H2S, 201 photos; X-T4, 545 photos. They hold aggregate colour statistics only. A photo of a profiled model takes its colour from the profile and fits only its own tone and chroma curves (DRO and picture styles vary per shot); the acceptance gates still apply. A rejected profile fit retries the photo's own colour and tone fit before falling back to neutral rendering. Files are read once per process and validated (version, bounded invertible matrix, table shape and finite data); a damaged file is ignored with a warning. The profiles folder's contents are part of the render cache keys, so thumbnails rendered before a profile existed are redone; smart previews built before keep their colour until rebuilt.
+Profiles are JSON files `<model>.json` in `$LIGHTCRAFT_CAMERA_PROFILES`, else `<config>/camera-profiles` (macOS `~/Library/Application Support/LightCraft/camera-profiles`); a local profile replaces a built-in one. Built-in profiles live in `assets/camera-profiles/` (listed in `assets/ATTRIBUTION.md`) and are compiled in, so the app, CLI and web build share them: ILCE-7M4, fitted to 597 photos (2.2 million colour pairs) shot in 2026, mostly with the Standard creative style and DRO Auto; ILCE-7CR, 125 photos (below); X-H2S, 201 photos; X-T4, 545 photos. They hold aggregate colour statistics only. A photo of a profiled model takes its colour from the profile and fits only its own tone and chroma curves (picture styles vary per shot; with Sony's DRO on, that tone curve is then lowered as described below); the acceptance gates still apply. A rejected profile fit retries the photo's own colour and tone fit before falling back to neutral rendering. Files are read once per process and validated (version, bounded invertible matrix, table shape and finite data); a damaged file is ignored with a warning. The profiles folder's contents are part of the render cache keys, so thumbnails rendered before a profile existed are redone; smart previews built before keep their colour until rebuilt.
 
 
+### Sony ILCE-7CR
+
+Fitted from 125 usable photos of 131 ILCE-7CR ARWs (one photographer, September 2025 to September 2026, Standard creative style with DRO off, Lv3 or Auto; 127 uncompressed, 2 compressed, 2 lossless compressed), 448,230 colour pairs. Measured as above: rendered at 1200 px with `lightcraft-cli render`, mean CIE76 ΔE against each file's embedded JPEG at 200 px.
+
+Without a profile, 123 of the 131 photos accept their own fit; the other 8 open with the neutral fallback at ΔE 6–26. For validation every fifth photo in sorted name order (26) was withheld and a profile fitted to the other 105 (100 usable). On the withheld photos mean ΔE went from 4.07 with per-file fitting to 3.29 with the profile. Both withheld photos whose own fit is rejected are accepted (ΔE 26.0 → 6.1 on a night scene, 6.2 → 5.5). Withheld photos whose own fit was accepted are about unchanged and move both ways: 12 of 24 improve, mean ΔE 3.06 → 3.08, largest regression 1.8. On that photo (gold tinsel bokeh) the profile turns a blue light blue again where the per-file fit had made it teal, but renders the gold slightly more saturated than the camera. With the final profile all 131 photos are accepted, and the 8 previously rejected ones land at ΔE 1.3–5.7; that comparison is in-sample.
+
+The nine public raw.pixls.us ILCE-7CR files are one scene in every coding the camera writes (uncompressed, lossless compressed L, M and S, compressed, full frame and APS-C crop). They were not used for fitting. All nine accept their own fit at ΔE 1.3–2.1 and stay accepted with the profile, at ΔE 1.5–2.9 (mean 1.59 → 1.99). On this colourful daylight scene the per-file fit is already close. The subsampled M and S codings, which decode with unity white-balance gains, move most (2.0 → 2.8). This is a camera-JPEG look estimate like the others, not measured calibration or Lightroom parity.
+
+## Sony Dynamic Range Optimizer (DRO)
+
+Sony bodies apply DRO, a local tone operator that brightens darker regions, to their JPEG (and the preview embedded in the ARW) only; the raw data are unchanged, and the factory default is DRO Auto. The tone curve fitted to that JPEG carried the brightening into the raw's starting look, so DRO photos opened lighter than in Lightroom, darktable, Photomator or Affinity, which develop the raw without it (issue #244). On 24 ILCE-7CR photos (Standard creative style) with Lightroom 9.5.1 default exports, mean L* at 200 px: with DRO off, Lightroom matches the camera JPEG (+0.15 L*, all within ±1.4) and LightCraft matches Lightroom (−0.19 L*, median ΔE76 3.6); with DRO Lv3 or Auto (8 photos), Lightroom is 2.4–10.7 L* darker than the camera JPEG and LightCraft followed the JPEG, +6.4 L* from Lightroom (median ΔE76 7.5). The tone curves fitted to 131 ILCE-7CR photos show where: at scene luminance 0.01, 0.02, 0.05 and 0.1 the median DRO Lv3/Auto curve is 8, 10, 9 and 6 L* above the DRO-off one, and from 0.3 up they agree.
+
+The ARW decoder reads the setting from maker-note tag `0xb025` (ExifTool's Sony tag documentation: 0 Off; 1 Standard, 2 Advanced Auto, 3 Auto, 8–12 Advanced Lv1–5, 16–23 Lv1–8; other values are treated as unknown). It was present on all 264 Sony raws checked (98 bodies, DSLR-A100 to ILCE-7CR); the second tag of that name, `0xb04f`, only says off or on and is missing on the older bodies. With DRO on, the look keeps the colour fitted to the JPEG (matrix, hue/saturation table, chroma curve) and its tone curve is lowered, knot by knot, to Sony's curve without DRO wherever that is darker (`assets/camera-tone/sony-dro-off.json`, listed in `assets/ATTRIBUTION.md`). Past its last knot a curve continues as a shoulder whose rate comes from its last two knots, so the second-last knot is lowered only as far as keeps that shoulder at or below the fitted one; the result is never brighter than the fitted curve at any scene luminance. Sony's curve is quantile-matched, as one photo's tone is, over the pooled pairs of 12 CC0 raw.pixls.us ARWs shot with DRO off and the Standard creative style on 10 interchangeable-lens bodies (ILCE-3500, -5000, -6600, -7M3, -7S, -7CR, -9M2, ILCA-77M2, SLT-A57, NEX-F3; the file lists their URLs and SHA-256); pooled the same way from 55 private ILCE-7CR photos with DRO off, the curve differs by at most 1.2 L* between scene luminance 0.01 and 0.5. DRO only brightens, so the photo's own curve bounds the curve without it from above: the 1″ compacts map raw values darker (with DRO off, the DSC-RX100M2, -RX100M5 and -RX10M4 curves lie 8–16 L* below Sony's at scene luminance 0.18) and keep their own curve where it is the darker one. Photos with DRO off or unknown, and other makers, are unchanged.
+
+Measured before → after (mean L* and CIE76 ΔE at 200 px): on the 24 ILCE-7CR photos with Lightroom references, the 8 with DRO on go from +6.4 L* (+4.4 to +10.5) to +0.8 L* (−0.4 to +1.9) against Lightroom's default, median ΔE 7.5 → 3.3; by Lightroom lightness band (L* 0–25, 25–50, 50–75, 75–100) they now differ from it by +2.3, +1.4, −0.8 and −3.0 L* (before +7.8, +9.4, +3.8, −0.8), like the 16 with DRO off (+2.5, −0.1, −2.0, −3.2), which render byte-identically. Of all 131 ILCE-7CR photos, the 56 fitted with DRO on now render 6.1 L* darker than their camera JPEGs on average (0.3 lighter before), as Lightroom renders the measured ones 5.7 L* darker; the 71 with DRO off are byte-identical. Of 116 CC0 Sony files from 100 bodies, 79 were shot with DRO on (71 of them Auto); the 57 changed of the 69 fitted ones render 2.1 L* darker on average (at most 10.8), the 12 others (six compacts, four ILCE-7M4 shots in Vivid, an ILCE-1 and an ILCE-7RM4, whose own curves are already darker) and all 35 DRO-off files are unchanged. The issue's ILCE-7M3 file goes from +0.8 to −6.5 L* against its camera JPEG. Applied to photos shot with DRO off, whose JPEG shows the camera's own curve, the rule would move the 68 fitted ILCE-7CR photos by −0.4 L* (median; at most −4.1) and 25 of 28 fitted CC0 ones by at most −1.8 L*; the exceptions are an ILCE-3500 (−4.7) and the cine bodies FX3 and FX30 (−7.2 and −5.1), whose picture profiles are not the Standard style.
+
+Picture styles other than Standard are lowered to the Standard curve too where it is darker; Lightroom ignores them as well. Nikon Active D-Lighting, Canon Auto Lighting Optimizer and Fujifilm D-Range settings are likely to have the same effect and are not handled yet. Render cache version 23 redraws thumbnails; smart previews built before keep the brightened tone curve in their header until rebuilt.
+
 ## Nikon crop and preview colour metadata
 
 Nikon maker-note `CropArea` (0x0045) supplies the default `[left, top, width, height]` crop. The decoder validates the rectangle against the active sensor area and falls back to that area for missing or invalid values. The CFA origin is unchanged; cropping follows demosaicing.
@@ -85,9 +107,24 @@ An embedded JPEG with neither ICC nor EXIF metadata uses Nikon maker-note `Color
 
 Synthetic tests cover crop bounds/CFA preservation, colour-space tags, fallback transfer decoding and metadata precedence. A private Nikon Z 8 sample reports an 8256 × 5504 default crop from an 8280 × 5520 sensor. No private sample or Adobe asset is included.
 
+### Samsung SRW
+
+Samsung SRW decoding (uncompressed files) supplies the as-shot white-balance multipliers from the maker note and no colour
+matrix, so SRW takes the same fit, gates and relative white balance.
+
 ### Canon CR2 and Pentax PEF
 
 CR2 and PEF decode without a camera colour matrix too, but were left out of the fit until issue #310 (CR2 files opening
 flat and desaturated: the camera's preview first, then the neutral fallback). They now use the same fit, gates and
 relative white balance. This change was not measured on the corpus: the gates keep the fallback for any file whose fit
 doesn't pass, so a file can only stay as before or move closer to its camera JPEG. Per-model numbers are still to come.
+
+### Olympus ORF
+
+The ORF decoder (uncompressed files) supplies the as-shot white balance (ImageProcessing `WB_RBLevels`) and no colour
+matrix, so ORF takes the same fit, gates and relative white balance. The reference is the camera's preview JPEG (on the
+E-1 the 1280 × 960 one the maker note points to). All three decodable corpus files are accepted (held-out RMS against
+the neutral fallback): E-1 0.126 → 0.014, E-400 0.087 → 0.022, XZ-2 0.061 → 0.023. Compressed ORFs (E-M1, E-M10 III)
+still open from their embedded JPEG. Against Lightroom Classic's render of a CC0 E-1 photo (2000 px, ΔE00 of the
+unedited render) the starting look moved from 11.25 to 8.30. Lightroom frames that E-1 file about 4 × 11 sensor pixels
+differently from the crop the file records (`CropLeft`/`CropTop` 36, 34); the file's own crop is kept.
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index 4247b559..f6af190e 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -30,18 +30,20 @@ mode ([mcp.md](mcp.md)) is a thin layer over this channel. Implementation:
 | `engine.commands` | — | Engine + UI commands: id, label, menu, shortcut, params doc, enabled |
 | `ui.menu.list` | — | Menu entries (flat: id, label, menu path, shortcut, enabled) |
 | `ui.menu.tree` | — | The menu bar as shown (File … Help): items `{id, params?, label, shortcut?, enabled, checked?}`, separators, submenus — the model behind the native macOS menu bar and the in-window menus |
-| `ui.inspect` | — | UI state, window, `loupe` (`source`, and `region: {full, window, pending}` when a zoomed view also renders the window on screen at no more than 100 % — `full` is the frame it is cut from, `window` its `[x, y, w, h]` — and `regionBefore` for the Before side of a Before/After view), canvas/image rects, `scroll: {grid, filmstrip}` (scroll offsets in points, `null` until drawn), active photo, selection, perf (`frameMs` = layout, `logicMs` = per-frame logic before it, `updateMs` = both, `maxUpdateMs`, `fps`, render queue …, `gpu` = adapter in use, `gpuReason` = why renders don't use the GPU, `gpuFallback` = latest render redone on the CPU and why — see `docs/gpu-pipeline.md`), status, memory (bytes per cache, see `library.memory`; plus stage caches — `budgetBytes`, `trimmed`, `sharedSourceBytes` (the one device copy of a big original) — and textures), `export: {running: {total, done, current} \| null, last}`, `notices` (warnings waiting to be shown, e.g. a damaged settings file; OK = `button:noticeOk`), `quitPrompt` (why quitting was stopped: unsaved changes; `button:quitRetry` / `button:quitAnyway` / `button:quitCancel`), `import: {done, total, imported, cancelled} \| null` (an import runs on a worker thread), `tasks` (other background work: `Find Missing Photos`, `Auto Import`), `fileDialogs` (commands waiting on a native file dialog, which runs off the UI thread; they run again with the answer when it closes) |
+| `ui.inspect` | — | UI state, window, `loupe` (`source`, and `region: {full, window, pending}` when a zoomed view also renders the window on screen at no more than 100 % — `full` is the frame it is cut from, `window` its `[x, y, w, h]` — and `regionBefore` for the Before side of a Before/After view), canvas/image rects, `scroll: {grid, filmstrip}` (scroll offsets in points, `null` until drawn), active photo, selection, perf (`frameMs` = layout, `logicMs` = per-frame logic before it, `updateMs` = both, `maxUpdateMs`, `fps`, render queue …, `gpu` = adapter in use, `gpuReason` = why renders don't use the GPU, `gpuFallback` = latest render redone on the CPU and why — see `docs/gpu-pipeline.md`), status, memory (bytes per cache, see `library.memory`; plus stage caches — `budgetBytes`, `trimmed`, `sharedSourceBytes` (the one device copy of a big original) — and textures), `export: {running: {total, done, current} \| null, last}`, `notices` (warnings waiting to be shown, e.g. a damaged settings file; OK = `button:noticeOk`), `quitPrompt` (why quitting was stopped: unsaved changes; `button:quitRetry` / `button:quitAnyway` / `button:quitCancel`), `import: {done, total, imported, cancelled} \| null` (an import runs on a worker thread), `tasks` (other background work: `Find Missing Photos`, `Auto Import`), `fileDialogs` (commands waiting on a native file dialog, which runs off the UI thread; they run again with the answer when it closes), `copied` (the text the UI last put on the clipboard, `null` until something is copied) |
 | `ui.widgets` | `{filter?}` | On-screen widgets `{id, rect: [x, y, w, h]}` (screen points) |
-| `ui.clickWidget` / `ui.dragWidget` / `ui.hoverWidget` | `{id, count?, fx?, fy?}` / `{id, toX?, toY?, dx?, dy?, steps?}` / `{id, fx?, fy?}` | Real egui input on a widget (hover: the pointer rests on it, e.g. for preset/profile previews) |
+| `ui.clickWidget` / `ui.dragWidget` / `ui.hoverWidget` | `{id, count?, button?, fx?, fy?}` (`button: "right"` right-clicks) / `{id, toX?, toY?, dx?, dy?, steps?}` / `{id, fx?, fy?}` | Real egui input on a widget (hover: the pointer rests on it, e.g. for preset/profile previews) |
 | `ui.move` / `ui.click` / `ui.drag` | `{x, y, count?, button?}` / `{x, y, toX, toY, steps?}` | Raw pointer input, screen points |
 | `ui.pointer` | `{events: [{kind: down\|drag\|up, x, y}], alt?, shift?, cmd?}` | Gesture in normalized image coordinates (Detail view) |
 | `ui.key` | `{key, cmd?, shift?, alt?, ctrl?}` | Key press |
 | `ui.text` | `{text}` | Text input |
+| `ui.clipboard` | `{action: cut\|copy\|paste, text?}` | Cut, copy or paste in the focused text field, as the system does for ⌘X / ⌘C / ⌘V; `paste` pastes `text`, or the system clipboard without it. Refused when no text field has the focus (outside one, ⌘C / ⌘V are the commands `develop.copy` / `develop.paste`). In the desktop app cut and copy write the system clipboard. `ui.inspect` → `copied` is the text the UI last put on the clipboard |
 | `ui.scroll` | `{dx, dy, cmd?, ctrl?, shift?, alt?}` | Wheel / two-finger scroll at the current pointer; pans over the image, modifier-scroll zooms |
 | `ui.zoom` | `{factor}` | Pinch zoom at the current pointer (positive scale multiplier; 1 = unchanged). Position it first with `ui.move` or `ui.hoverWidget` |
 | `ui.set` | partial UI state, e.g. `{"view": "detail"}` | Resulting UI state |
 | `ui.dialog.confirm` / `ui.dialog.cancel` | — | Close the open dialog |
 | `ui.resize` | `{width, height}` | Resize the window |
+| `ui.zoomFactor` | `{factor}` | Set the interface scale (0.5–3; egui's zoom keys are off, Cmd+= / Cmd+- zoom the photo) |
 | `ui.screenshot` | `{path?, headless?}` | `{path, width, height}` once the frame (with finished renders) is captured. `headless: true` draws the UI on the CPU (no compositor needed); a windowed capture that gets no frame within 2 s falls back to headless automatically |
 | `engine.execute {command: "app.export", params}` | export params (see `docs/mcp.md`), plus `preset`, `dir` / `path`, `ids`, `background` | Writes the files and returns `{files}`; with `background: true` (what the Export dialog and menus use) it returns `{background: true, total}` at once and the batch runs on a worker thread — poll `ui.inspect` → `export` |
 | `ui.render` | `{id?, size?, path?}` | Render a photo (PNG to `path`), `{width, height}` |
@@ -55,6 +57,12 @@ scrolling pans in both axes and respects the operating system's scrolling direct
 These gestures work in Detail (including editing tools and full-screen preview), Compare and Reference
 views, and only apply over their image areas. Panning stops at the image edges.
 
+Mask brushing uses the UI command `tool.brush` through `engine.execute`. With `{}` it activates
+painting on the current mask. `{"new": true}` creates a separate brush mask; `{"op": "add"}` or
+`{"op": "subtract"}` appends a brush component to the selected mask. Creating either starts in
+paint mode with the overlay visible. Brush Erase (or Alt while painting) removes strokes' coverage
+within that brush component; it is distinct from subtracting the component from the whole mask.
+
 ### When the library can't be saved
 
 With a persistent library, every command that changes something is written to the catalog journal (fsynced) before
@@ -100,7 +108,8 @@ Headless screenshot dimensions must be finite and at least one logical point, wi
 positive scale. Rounded output must be at least one pixel per edge, at most 16,384 pixels
 per edge and 64 million pixels in total. `snapshot` and `ui.resize` reject requests outside
 these limits before layout or rasterization; supplied resize dimensions must be numbers.
-UI zoom changes text and control sizes while preserving the snapshot viewport's requested
+An interface zoom (egui's zoom factor; the keyboard never changes it — ⌘= / ⌘− / ⌘0 zoom the
+photo, issue #566) changes text and control sizes while preserving the snapshot viewport's requested
 physical pixel dimensions. Later `ui.resize` requests use current egui points; validation
 and rasterization both convert them to native viewport points before rounding the output
 pixels. A native edge below one point after zooming out is valid if it rounds to at least
diff --git a/docs/cr3.md b/docs/cr3.md
index 692c209d..ac13d3fd 100644
--- a/docs/cr3.md
+++ b/docs/cr3.md
@@ -5,6 +5,12 @@ The CR3 adapter reads the CRX Bayer track, `CMP1` compression descriptor,
 black/white levels and the default crop come from the file. A Dual Pixel delta
 track is never substituted for the primary Bayer track.
 
+The in-camera aspect ratio (3:2, 4:3, 16:9, 1:1) is not applied to the sensor data. The maker note's
+`AspectInfo` (tag `0x009a`: aspect code, cropped width, height, left, top) gives the shot's rectangle inside the
+recommended crop, and the decoder uses it as the default crop, so the developed image has the shape the photographer
+framed (PowerShot SX70 HS, EOS 250D, PowerShot G5 X Mark II, EOS M6 Mark II and EOS M50 samples). A rectangle that
+is missing or does not fit inside the crop is ignored. The embedded JPEG still shows the whole frame.
+
 The decoder is independent Rust code shared by desktop, CLI and WebAssembly;
 it has no operating-system imaging dependency or external decoder. Its sources
 are the public prose descriptions and patents cited in
@@ -55,7 +61,16 @@ The version `0x200` QP predictor and entropy framing were checked independently.
 Controlled input mutations establish floor averaging of paired QP rows before
 the nonlinear integer table, then multiplication, division by eight, addition
 of the subband base and a minimum step of one. QP values 131–167 are verified;
-unmeasured values and an odd QP-map height are rejected. Partial-subband and
+unmeasured values are rejected.
+
+An odd QP-map height (EOS R7: 4732 sensor rows give 1183 QP rows) leaves the
+last row of the second-level high-frequency bands without a partner row; that
+row's QP is used on its own. The odd-height map decodes to the exact end of its
+entropy stream. This rule is not yet checked against a black-box reference:
+it was checked on paired R7 RAW and C-RAW captures of the same scene (ISO 100
+and 6400), whose developed images match visually and whose sensor means agree
+within 0.1% at ISO 6400. Files with even-height maps never reach this rule, so
+the six verified fixtures are unchanged. Partial-subband and
 rounded-plane coding, vertical C-RAW tiling and adaptive low-frequency gains
 remain unsupported. The decoder bounds image dimensions, sample count,
 tile count, marker headers and temporary allocations. The full sensor buffer is
diff --git a/docs/denoise.md b/docs/denoise.md
index f1196e9b..be208a9b 100644
--- a/docs/denoise.md
+++ b/docs/denoise.md
@@ -88,6 +88,13 @@ from a check tile; this estimate can choose imperfectly on unmeasured hardware.
 Settings offers Automatic, Graphics card and Processor. GPU tests cover supported
 synthetic networks against the scalar executor; a real-model test compares CPU/GPU.
 
+The convolution kernel stores its shared input tile as scalar elements, each with
+one writer, and gathers vectors after a workgroup barrier. Writing separate lanes
+of the same shared vector from different invocations is not safe under WGSL
+([component references](https://www.w3.org/TR/WGSL/#vector-component-reference));
+this caused incorrect Metal results (issue #479). Synthetic equivalence tests include
+repeated partial tiles and concurrent calls, and reject non-finite outputs.
+
 ### Historical performance, measured 2026-10-07
 
 These are the contributor's measurements **before the current upstream integration**,
diff --git a/docs/display-profiles.md b/docs/display-profiles.md
new file mode 100644
index 00000000..63c55710
--- /dev/null
+++ b/docs/display-profiles.md
@@ -0,0 +1,44 @@
+# Display (monitor) profiles
+
+LightCraft can show photos through the monitor's ICC profile, so colours are right on wide-gamut and calibrated
+displays. Without one, previews are sRGB, which a wide-gamut panel shows oversaturated.
+
+## Using it
+
+Settings ▸ Display ▸ **Choose Profile…** picks an `.icc` / `.icm` file (the dialog opens where the system keeps
+them: `~/.local/share/icc` on Linux, ColorSync's folders on macOS, `…\spool\drivers\color` on Windows). **Use sRGB**
+goes back to no profile. The choice is an app setting (`ui.json`, `displayProfile`) and applies at once; a file that
+can't be used is reported there and previews stay sRGB.
+
+Agents and scripts: `app.displayProfile {"path": "/path/to/monitor.icc"}` (`""` or `null`: none; no `path`: report
+only) returns `{path, description, kind: "matrix" | "lut", primaries: {red, green, blue: [x, y]}}`.
+
+## How it works
+
+- **The loupe renders into the display's gamut.** Views (Detail, Before, Compare / Reference, preset and profile
+  hover, the second window) ask the pipeline for a render in the display's own primaries
+  (`lightcraft_pipeline::DisplaySpace`, `RenderRequest::display`): the per-pixel stage converts from the working space
+  to the display's linear RGB, gamut maps into *its* gamut and encodes with the sRGB curve, on the CPU and the GPU
+  alike (only `FinishParams::to_out` / `out_luma` change). Colours an sRGB render would clip stay as saturated as the
+  display can show. For a display that is exactly a standard space the result equals an 8-bit render into that space.
+- **Then to the display's device values** (`lightcraft_codecs::display::DisplayProfile::correct`): for a matrix/TRC
+  profile, three 256-entry tables from the sRGB curve to the profile's tone curves (nothing at all when they are the
+  sRGB curve, as for Display P3); for a LUT-based profile, a `moxcms` transform through its B2A tables. A LUT-only
+  profile (no colorant tags) gets its primaries measured through its A2B tables.
+- **Everything made for sRGB is converted** (`lightcraft_engine::display::present`, on the render workers):
+  thumbnails, cached view previews, embedded camera JPEGs and merge previews.
+- **What stays sRGB:** the histogram (of the same sampled pixels, converted back to sRGB), the rendered-thumbnail and
+  view-preview caches (a profile change doesn't invalidate them), exports, and the UI itself.
+- **Soft proofing:** the blue "display" gamut warning shows what the monitor can't show, from its profile.
+- Conversions are relative colorimetric: the display's white is the image's white.
+
+## Cost
+
+Measured on a 2-core cloud VM, 2560 × 1707 preview: the tone-curve tables take about 5 ms (single-threaded); converting the sampled
+histogram pixels a few ms; the sRGB copy for the view-preview cache (full-quality renders only) about 30 ms; a
+LUT-based profile's correction about 65 ms. Drafts during slider drags skip the full sRGB copy.
+
+## Not yet
+
+- Picking up the profile the operating system assigns (X11 `_ICC_PROFILE`, colord, ColorSync, WCS) and following
+  the window across monitors with different profiles.
diff --git a/docs/gpu-pipeline.md b/docs/gpu-pipeline.md
index 5eb0ce1d..8d747235 100644
--- a/docs/gpu-pipeline.md
+++ b/docs/gpu-pipeline.md
@@ -44,11 +44,33 @@ Overrides (read once at launch):
   the compute device always used Vulkan + DX12 (+ Metal).
 - `LIGHTCRAFT_GPU=0`: GPU rendering off for the process (the window is unaffected).
 
+**DX12 shader compiler (issue #471).** Every instance (window and compute) compiles DX12 shaders with
+FXC (`d3dcompiler_47.dll`, part of Windows; `lightcraft_gpu::backend::backend_options`). wgpu's
+default, `Auto`, loads whichever `dxcompiler.dll` the DLL search path finds first. LightCraft ships
+none, so that copy belongs to another program (a Windows SDK, a folder on `PATH`). An older copy without
+`dxil.dll` beside it (e.g. DXC 1.7) warns that the DXIL is unsigned, wgpu treats the warning as a
+compile error, its indirect-validation pipelines fail, the device is lost, and the window never opened
+(`WGPU error: Parent device is lost`). `WGPU_DX12_COMPILER=dxc | auto | fxc` (wgpu's variable) still
+chooses; with `dxc`, put `dxcompiler.dll` *and* `dxil.dll` (DXC ≥ 1.8.2502) next to `lightcraft.exe`.
+FXC builds the compute kernels somewhat slower than DXC (≈ 9 s vs 7.5 s for the GPU test suite on an
+RTX 4080), off the startup path.
+
 **Off the startup path.** The compute device is created on a background thread once the window is
 up (`gpu::warm_up` from the first frame's settings), and never while GPU rendering is off: with
 Settings ▸ Performance ▸ *Use the GPU for rendering* unchecked (applied before the window opens),
 `LIGHTCRAFT_GPU=0` or `LIGHTCRAFT_GPU_BACKEND=off`, no GPU driver is loaded for rendering at all.
 
+**Quitting.** The devices are never dropped, and renders run on worker threads: a render still inside
+the driver while the process exits crashes there (a SIGSEGV in the NVIDIA Vulkan driver on Linux,
+issue #620), which no panic hook catches. So every entry into a device counts as work in flight
+(`crates/gpu/src/exit.rs`), and the desktop app ends with `LightcraftApp::shutdown` (from `on_exit`,
+after settings and library are saved): `gpu::begin_shutdown()` — from then on `gpu::render` returns
+`None`, no device is created, denoise tiles fail over and a render job gives up instead of rendering
+on the CPU — then the render pool stops (queued jobs dropped, running ones waited for) and
+`gpu::wait_idle` waits for GPU work on other threads (export, denoise, the device warm-up). One
+deadline of 2 s covers it all; past it the app quits anyway. A job pool that is dropped (headless
+hosts, tests) waits for its running jobs the same way (`JobPool::shutdown`, `crates/preview/src/pool.rs`).
+
 **Crash sentinel.** The desktop app writes `gpu-init.marker` into its settings folder (next to
 `ui.json`: `%APPDATA%\LightCraft`, `~/Library/Application Support/LightCraft`,
 `~/.config/lightcraft`) just before the compute device is created and removes it as soon as creation
diff --git a/docs/library-shortcuts.md b/docs/library-shortcuts.md
index 2b4c96f8..414e9166 100644
--- a/docs/library-shortcuts.md
+++ b/docs/library-shortcuts.md
@@ -6,11 +6,12 @@ Select photos in Photo Grid or Square Grid, then use:
 |---|---|
 | `0` | Clear the star rating |
 | `1`–`5` | Set the star rating |
+| `[` / `]` | Decrease / increase each selected photo's rating by one, within 0–5 |
 | `6`, `7`, `8`, `9` | Set a red, yellow, green or blue label |
 | `P` | Flag as a pick |
 | `X` | Flag as rejected |
 | `U` | Clear the flag |
-| `Shift` + any key above | Apply the action and select the next photo |
+| `Shift` + `0`–`9`, `P`, `X` or `U` | Apply the action and select the next photo |
 
 Purple and clearing a colour label are available in Photo → Set Color Label and the photo context
 menu. Purple has no default number key, matching Lightroom Classic. Rejection marks a photo for
@@ -22,6 +23,12 @@ footer (translucent, over the bottom of the photo) and Detail filmstrip surround
 The label confirmation uses a pale matching background with dark text; ratings and errors retain
 their neutral HUD styling. Custom names use the underlying label's colour.
 
+Bracket ratings use each photo's own starting rating, and the changed photos form one Undo / Redo
+step. AutoWrite uses the normal rating metadata path. In Detail, including Masking and Remove,
+`[` / `]` keep resizing the brush and shifted brackets keep adjusting feather. Saved overrides,
+remapping and disabling the default brush bindings take precedence over their grid bracket actions.
+The separate Decrease Rating / Increase Rating commands can also be assigned in Help → Keyboard Shortcuts.
+
 Grid actions apply to all selected photos and support Undo / Redo. In Compare and Survey, culling
 actions apply to the active photo. Auto Advance moves forward after an action; holding Shift with
 Auto Advance on still advances only once. The last photo stays selected. Text fields keep their
diff --git a/docs/lightroom-catalog-import.md b/docs/lightroom-catalog-import.md
index d3d1940e..0c18a652 100644
--- a/docs/lightroom-catalog-import.md
+++ b/docs/lightroom-catalog-import.md
@@ -38,9 +38,16 @@ WITHOUT ROWID or virtual table produces an explicit error, handled as a warning
 Develop settings reuse the existing XMP/preset mapper. Supported sliders, curves and supported
 mask structures remain editable, but this is approximate rendering: camera profiles, Adobe AI
 models, some masking/retouch fields and process-version algorithms are not reproduced. Unmapped
-fields are reported. When a recovery archive is saved, it retains source settings/history/snapshots
+fields are reported. Lightroom's `ProcessVersion` is not mapped: newly imported photos are on
+LightCraft's latest rendering process, and photos already in the library keep theirs
+([process-versions.md](process-versions.md)). When a recovery archive is saved, it retains source settings/history/snapshots
 and original smart-collection rules. Smart collections become regular albums with current
 membership. Archived history and snapshots are source data, not native LightCraft history yet.
+A Custom white balance on a raw LightCraft develops relative to its as-shot look (ARW, NEF, RW2,
+RAF, CR3, CR2, PEF, SRW; Lightroom names them all `RAW`) can't be taken as Kelvin: the catalog keeps no
+as-shot white for Custom photos, so the photo stays As Shot and `Temperature, Tint` are reported
+(issue #510; a DNG keeps the Kelvin value, and an XMP packet with `crs:AsShotTemperature` is
+shifted by the same mired difference, see [xmp-interop.md](xmp-interop.md)).
 Lightroom's `-999999` deferred-adjustment sentinel is omitted from both catalog and XMP mappings;
 it is reported, included in any saved archive, and never clamped into a real slider value. Deferred Adobe Auto Tone
 is not evaluated by the importer; LightCraft's Auto control remains available after migration.
diff --git a/docs/localization-ja.md b/docs/localization-ja.md
index bcfb8a8d..8d406884 100644
--- a/docs/localization-ja.md
+++ b/docs/localization-ja.md
@@ -24,5 +24,9 @@ LightCraft は日本語・簡体字中国語・英語（English）の表示に
 英語の単複数語尾を日本語で省略する場合、対応する文字列引数は `{:.0}` で空にします。
 `LIGHTCRAFT_LANGUAGE=ja lightcraft-cli snapshot ...` で日本語の画面を描画できます。
 
+スマートアルバムの「はい／いいえ」で答える条件（編集、切り抜きなど）の値は、文脈付きキー
+`"smart album value|Yes"`・`"smart album value|No"` で「あり／なし」と表示します。共有の
+`"Yes"`・`"No"`（はい／いいえ）は他の画面でそのまま使います（[`localization.md`](localization.md) の文脈の説明を参照）。
+
 表示・フォント・言語の切り替え・設定の保存・コマンドIDの保持は
 `cargo test -p lightcraft-ui-egui i18n::tests` で検証します（グリフの検査は `CRAFT_FONTS_DIR` 指定時のみ実行）。
diff --git a/docs/localization-zh-hans.md b/docs/localization-zh-hans.md
index 505ac269..4b9d887a 100644
--- a/docs/localization-zh-hans.md
+++ b/docs/localization-zh-hans.md
@@ -12,9 +12,9 @@ LightCraft 的界面支持英语、简体中文、繁体中文（台湾）和日
   `cargo::warning` 提示这一点。
 - 翻译只发生在显示层：命令 ID、照片文件名、用户输入的元数据都不做改动。
 - 尚未翻译的技术性错误、补充说明和发行说明仍以英文显示。
-- 已知限制：**网页版（wasm32）目前只内嵌日文字体**，因此浏览器里的中文仍显示为方框
-  （单个字体文件 16 MB，加上 wasm 会超过托管方 Cloudflare 的 25 MiB 单文件上限）。
-  原生桌面版不受影响。
+- 网页版将 Noto Sans CJK SC 作为独立的 `lightcraft_zh_hans.otf` 文件随站点分发，页面启动时加载；
+  这样可显示简体中文，也避免把约 16 MB 字体放进受单文件大小限制的 WASM。部署时需上传整个
+  `target/web/` 目录。未指定 `CRAFT_FONTS_DIR` 的开发构建仍缺少中文字体。
 - 日期分组标题与拍摄时间按中文格式显示（如 `2026年9月20日 星期日`）。
 
 ## 翻译的维护
diff --git a/docs/localization-zh-hant.md b/docs/localization-zh-hant.md
index 349cb20e..abf1af65 100644
--- a/docs/localization-zh-hant.md
+++ b/docs/localization-zh-hant.md
@@ -22,7 +22,7 @@ CRAFT_FONTS_DIR=../craft-fonts cargo run --release -p lightcraft
 
 craft-fonts 目前沒有繁體中文專用字型：桌面版先以 Noto Sans CJK SC 顯示繁中文字（字形為大陸規範寫法），其次才是日文字型；不在此儲存庫新增字型檔。
 未指定 `CRAFT_FONTS_DIR` 的建置缺少 CJK 字形。
-Web 建置僅嵌入 BIZ UDPGothic Regular，尚未驗證完整繁中文字形覆蓋。
+Web 建置在 WASM 中嵌入 BIZ UDPGothic Regular，並另外載入 Noto Sans CJK SC；繁中文字形仍採用簡中規範寫法。
 
 ## 自動化與維護
 
diff --git a/docs/localization.md b/docs/localization.md
index 123dcaba..715b871a 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -2,7 +2,7 @@
 
 The interface ships in the language it is written in (English) plus every language in the table in
 `crates/ui-egui/src/i18n.rs`. Today that is English, Simplified Chinese (`zh-hans`), Traditional
-Chinese (`zh-hant`, Taiwan), Japanese (`ja`), Brazilian Portuguese (`pt-br`), Spanish (`es`), German (`de`) and Russian (`ru`). This file is the reference for **adding or maintaining a language**; the per-language notes
+Chinese (`zh-hant`, Taiwan), Japanese (`ja`), Brazilian Portuguese (`pt-br`), Spanish (`es`), German (`de`), Russian (`ru`) and French (`fr`). This file is the reference for **adding or maintaining a language**; the per-language notes
 are in [`localization-zh-hans.md`](localization-zh-hans.md), [`localization-zh-hant.md`](localization-zh-hant.md),
 [`localization-ja.md`](localization-ja.md), [`localization-pt-br.md`](localization-pt-br.md), [`localization-es.md`](localization-es.md),
 [`localization-de.md`](localization-de.md) and [`localization-ru.md`](localization-ru.md).
@@ -29,14 +29,17 @@ are in [`localization-zh-hans.md`](localization-zh-hans.md), [`localization-zh-h
        PtBr, "pt-br", "Português (Brasil)", "Latn", include_str!("../locales/pt-br.json");
        De, "de", "Deutsch", "Latn", include_str!("../locales/de.json");
        Ru, "ru", "Русский", "Cyrl", include_str!("../locales/ru.json");
+       Uk, "uk", "Українська", "Cyrl", include_str!("../locales/uk.json");
    }
    ```
 
    The fields are the BCP-47 code (also the settings-file value), the **endonym** shown in the
    Language menu, the ISO 15924 script (`Latn`, `Jpan`, `Hans`, `Hant`, `Kore`…), and the embedded
    catalog. `build.rs` picks up `<code>-formats.json` by name, so the macro and the format lookup
-   follow automatically — nothing else in the UI needs to change. The menus, the settings row, the
-   keyboard-shortcut sheet and the control channel all read the table.
+   follow automatically. Add the corresponding `app.language.<name>` entry to
+   `LANGUAGE_COMMANDS` and `language_from_command` in `src/menus.rs`, and to the
+   `language_commands_cover_every_language` test. Settings read the locale table; menus and
+   the control channel share the language-command mapping.
 3. **Make sure the glyphs exist.** The script drives which craft-fonts faces the UI installs: a
    language whose script has no face in the build shows boxes (the test says so instead of failing).
    Fonts live in [storytold/craft-fonts](https://github.com/storytold/craft-fonts), never here; a
@@ -49,6 +52,14 @@ are in [`localization-zh-hans.md`](localization-zh-hans.md), [`localization-zh-h
 text unchanged when there is no entry; `tr_format!` handles text with runtime values. Both are
 presentation-only: command ids, file names and user-entered metadata are never translated.
 
+A few messages take a **context**, for a word whose shared translation reads wrongly in one place.
+The catalog may then carry `"<context>|<English>"`, which wins there; without it the plain message
+is used, so only the languages that need it add one. Today the one context is `smart album value`:
+the Yes / No of a yes/no rule (Has Edits, Cropped…). Japanese uses it because はい / いいえ answer a
+question rather than describe a photo (`"smart album value|Yes": "あり"`, `"smart album value|No":
+"なし"`); every other language uses its plain Yes / No. A contextual key that names no real value
+fails the i18n tests.
+
 `tr_format!` is generated by `crates/ui-egui/build.rs`: one arm per English message, which formats
 the active language's translation with `format!` (English is the fallback arm). Every catalog's
 format string is therefore checked by Rust against the call site's own arguments:
diff --git a/docs/mcp.md b/docs/mcp.md
index 7e815406..81cbc4bd 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -52,6 +52,53 @@ Or check a project-scoped `.mcp.json` into your repo:
 }
 ```
 
+### Codex
+
+The macOS release includes a separate `lightcraft-cli-<version>-macos-universal.zip`;
+unpack it alongside the desktop app if you do not want to build from source. Use the CLI
+and app from the same release. Verify both downloads against that release's `SHA256SUMS.txt`.
+
+Register the CLI's stdio server with Codex using its **absolute** installed path:
+
+```sh
+# Headless: a persistent library whose edits survive MCP restarts.
+codex mcp add lightcraft -- "/absolute/path/lightcraft-cli" mcp --library "/absolute/path/library"
+
+# Live desktop: start the app on the matching loopback port first.
+"/absolute/path/LightCraft.app/Contents/MacOS/LightCraft" --library "/absolute/path/library" --control 7980
+codex mcp add lightcraft-app -- "/absolute/path/lightcraft-cli" mcp --connect 127.0.0.1:7980
+```
+
+Choose one mode for a library: a headless server cannot open a library already locked by
+the desktop app. Connect mode edits the window's actual library and reconnects after the
+app restarts. An external library path keeps the catalog on that drive. Copy/move imports
+default to the library's `Originals/` folder; add-mode imports keep the originals at their
+existing paths. The library path does not relocate settings, logs or optional models (see
+the README's settings/log locations). Make sure an external drive is mounted before
+starting either process.
+
+`codex mcp list` confirms registration, not a successful tool call. After adding the server,
+restart the client's MCP connections and verify `doc_inspect` or `query_photos` against the
+expected library before editing. Configuration options are in the
+[Codex MCP documentation](https://developers.openai.com/codex/mcp/).
+
+### From an installed release
+
+The release packages ship `lightcraft-cli` alongside the desktop app, so no build is needed:
+
+| Install | CLI |
+|---|---|
+| Windows (MSI) | `C:\Program Files\LightCraft\lightcraft-cli.exe` by default (wherever you installed it otherwise), not on `PATH` |
+| Linux (deb, rpm) | `/usr/bin/lightcraft-cli` |
+| macOS | the separate `lightcraft-cli-<version>-macos-<arch>.zip` release asset (the `.app` holds only the desktop app) |
+
+```sh
+# Windows, default install folder
+claude mcp add lightcraft -- "C:\Program Files\LightCraft\lightcraft-cli.exe" mcp
+# Linux, or macOS with the CLI unzipped onto PATH
+claude mcp add lightcraft -- lightcraft-cli mcp
+```
+
 ### Other clients (Claude Desktop, Cursor, …)
 
 Every stdio MCP client takes the same shape: a `command` plus `args`. For example
@@ -71,6 +118,39 @@ Every stdio MCP client takes the same shape: a `command` plus `args`. For exampl
 During development you can also point the client at `cargo run --release -p lightcraft-cli -- mcp`
 (with `"cwd"` set to the repository), at the cost of a slower start.
 
+## Shared core tools
+
+These follow the same conventions as [filmcraft #28](https://github.com/storytold/filmcraft/pull/28).
+They are listed in both full and compact mode; existing documented helpers remain listed too.
+There are no hidden compatibility aliases.
+
+| Tool | Arguments | Result |
+|---|---|---|
+| `command_list` | `filter?`, `enabled_only?` | Command catalog |
+| `command_run` | `id`, `params?` | Command result |
+| `command_batch` | `steps: [{id, params?}]`, `stop_on_error?` | Counts and per-step results; stops on error by default |
+| `doc_inspect` | none | Library state and catalog counts |
+| `render_preview` | `id?`, `max_side?`, `format?` | Image; neither changes selection nor saves a file |
+
+Each edit in a batch has its own undo step. Connect mode also lists `ui_inspect` and
+`ui_screenshot` (the latter has no output-path argument). The existing `inspect_ui`,
+`screenshot`, `list_commands`, `run_command` and `render_photo` keep their documented arguments.
+Ports and connect mode are unchanged.
+
+Every listed tool has a title and all four MCP hints. Generated command tools are conservatively
+marked as edits. Helpers with optional output paths are marked as writers; `export` is not
+idempotent because the default conflict policy chooses a new filename on repeated calls.
+Unknown helper argument keys return JSON-RPC `-32602` naming the key and accepted arguments.
+Generated `cmd_*` tools and nested command params remain free-form: the registry has prose
+parameter docs, not machine-readable schemas. Existing command validation (including strict
+export options) is preserved. Escaped tool panics return `isError: true`, and the session keeps
+serving; backend panics during resource reads or tool listing return an internal error.
+The headless backend owns its session directly, without a session mutex.
+
+`lightcraft://document` and `lightcraft://commands` contain JSON matching `doc_inspect` and
+`command_list`. Existing resources remain available. Requests declaring MCP 2026-07-28 in
+per-request `_meta` receive `resultType: complete` and list/read cache hints; reads are not cached.
+
 ## Tools
 
 ### Helpers
@@ -83,7 +163,7 @@ During development you can also point the client at `cargo run --release -p ligh
 | `query_photos {filter?, sort?, offset?, limit?}` | Photos in the current view (or matching a catalog `Filter`) |
 | `select_photos {ids, active?, mode?}` | Set the selection / active photo. Every id (and `active`) must be in the library: an unknown id is a tool error (`no such photo 9999`) and the selection and active photo are left as they were |
 | `list_controls {section?}` | Every develop slider: id (`light.exposure`…), range, default, current value |
-| `get_develop {id?}` | Full develop-settings JSON |
+| `get_develop {id?}` | Full develop-settings JSON, with `process`: the rendering process the photo is on ([process-versions.md](process-versions.md)) |
 | `set_develop {id?, values?, settings?, label?}` | `values`: `{controlId: number}`; `settings`: partial develop JSON deep-merged. Undoable |
 | `apply_preset {preset, amount?, ids?}` | Apply a preset (ids from `cmd_presets_list`) |
 | `crop {id?, rect?, angle?, reset?}` | Normalized crop rect `[x0,y0,x1,y1]` and straighten angle; at least one of `rect`, `angle`, `reset: true` |
@@ -99,8 +179,9 @@ Tools taking `id` make that photo active first; without it they act on the activ
 | `screenshot {maxSize?, format?, path?}` | The app window as an image, after pending renders finish |
 | `inspect_ui` | View, panel, window/image rects, selection, status |
 | `set_ui {state}` | Merge UI state, e.g. `{"view": "detail"}` |
-| `list_widgets {filter?}` / `click {widget \| x,y, count?}` | Widgets by automation id; real egui clicks |
+| `list_widgets {filter?}` / `click {widget \| x,y, count?, button?}` | Widgets by automation id; real egui clicks (`button: "right"` right-clicks) |
 | `press_key {key, cmd?, shift?, alt?}` / `type_text {text}` | Keyboard input (shortcuts) |
+| `clipboard {action, text?}` | Cut, copy or paste in the focused text field (⌘X / ⌘C / ⌘V; refused when none has the focus; cut and copy write the system clipboard); `inspect_ui` → `copied` is what was copied |
 | `pointer_gesture {events}` | Gestures in normalized image coordinates (brush strokes, gradients, crop handles) |
 
 In headless mode these return a tool error explaining how to start the app.
@@ -186,3 +267,20 @@ lightcraft-cli calibrate --max 300 ~/Pictures/2026   # camera colour profiles (d
   (`Remote`) against a stand-in control server; also import → render → JPEG export of a real file.
 - `apps/lightcraft-cli/tests/cli.rs` — spawns `lightcraft-cli mcp` with real pipes; `render`;
   `commands`.
+
+## Export progress and cancellation
+
+Headless direct `export`, `command_run` / `run_command` with `app.export`, and `cmd_app_export`
+calls report photo-count progress when `params._meta.progressToken` is a string or number.
+Notifications are strictly increasing, at most ten per second plus the final total. No token
+means no notifications. `ping` is answered at photo boundaries; other requests wait in order
+until the export ends. EOF lets a pending export finish and preserves queued requests.
+
+`notifications/cancelled` with `params.requestId` stops the matching export before its next
+photo, suppressing its response. Unknown/completed request ids are ignored. A photo already
+being processed finishes first: completed photos remain, each written with the existing atomic
+file writer, and there are no partial files to delete. Unrelated outputs and earlier exports
+are untouched. A failed export is an `isError` tool result. Transport mutexes recover poisoning.
+
+Connect mode and exports inside `command_batch` remain synchronous and do not report MCP
+progress or cancellation. Use a direct headless export call for this behavior.
diff --git a/docs/parity.md b/docs/parity.md
index c06dad1b..ad82e3d2 100644
--- a/docs/parity.md
+++ b/docs/parity.md
@@ -26,31 +26,31 @@ and prints the summary; `cargo xtask parity --write` refreshes the summary table
 | C. Views & navigation (VIEW) | 15 | 1 | 1 | 0 | 8/9 (89%) | 4/4 (100%) |
 | D. Search & filter (FILT) | 11 | 1 | 1 | 0 | 4/4 (100%) | 4/4 (100%) |
 | E. Metadata (META) | 5 | 1 | 0 | 0 | 2/2 (100%) | 2/2 (100%) |
-| F. Edit panel — global adjustments (EDIT) | 42 | 2 | 4 | 1 | 28/28 (100%) | 13/14 (93%) |
+| F. Edit panel — global adjustments (EDIT) | 43 | 2 | 3 | 1 | 28/28 (100%) | 13/14 (93%) |
 | G. Profiles (PROF) | 7 | 1 | 3 | 0 | 3/4 (75%) | 3/3 (100%) |
 | H. Crop & rotate (CROP) | 9 | 0 | 0 | 1 | 6/6 (100%) | 3/3 (100%) |
 | I. Remove / healing (REM) | 7 | 1 | 2 | 2 | 4/4 (100%) | 2/3 (67%) |
 | J. Red eye (EYE) | 2 | 0 | 0 | 0 | — | 1/1 (100%) |
-| K. Masking (MASK) | 14 | 4 | 5 | 0 | 8/8 (100%) | 5/5 (100%) |
+| K. Masking (MASK) | 13 | 5 | 5 | 0 | 7/8 (88%) | 5/5 (100%) |
 | L. Presets (PRE) | 6 | 0 | 1 | 1 | 2/2 (100%) | 2/2 (100%) |
 | M. Versions & history (VER) | 5 | 0 | 0 | 0 | 1/1 (100%) | 3/3 (100%) |
 | N. Copy / paste / sync (SYNC) | 5 | 0 | 0 | 0 | 3/3 (100%) | 1/1 (100%) |
 | O. Merge (MERGE) | 4 | 0 | 0 | 0 | — | — |
 | P. Enhance (ENH) | 0 | 0 | 2 | 0 | — | — |
-| Q. HDR (HDR) | 0 | 0 | 5 | 0 | — | — |
+| Q. HDR (HDR) | 2 | 3 | 0 | 0 | — | — |
 | R. Video (VID) | 0 | 0 | 5 | 1 | — | 0/2 (0%) |
-| S. Export (EXP) | 15 | 1 | 2 | 0 | 7/7 (100%) | 7/7 (100%) |
+| S. Export (EXP) | 15 | 2 | 1 | 0 | 7/7 (100%) | 7/7 (100%) |
 | T. Share (SHARE) | 0 | 0 | 0 | 4 | — | — |
 | U. Map & location (MAP) | 0 | 1 | 1 | 0 | — | 0/1 (0%) |
-| V. Preferences (PREF) | 6 | 1 | 2 | 2 | 1/1 (100%) | 4/4 (100%) |
+| V. Preferences (PREF) | 7 | 1 | 2 | 2 | 1/1 (100%) | 5/5 (100%) |
 | W. Cloud & AI infrastructure (CLOUD / AI) | 1 | 0 | 1 | 2 | — | — |
-| X. Cross-cutting behaviours (BEHAV) | 18 | 5 | 1 | 1 | 8/8 (100%) | 6/8 (75%) |
+| X. Cross-cutting behaviours (BEHAV) | 18 | 6 | 1 | 1 | 8/8 (100%) | 6/9 (67%) |
 | Y. Menus | 82 | 0 | 4 | 8 | 47/47 (100%) | 23/23 (100%) |
 | Z. Keyboard shortcuts (desktop) | 75 | 3 | 3 | 1 | 49/52 (94%) | 23/24 (96%) |
 | Lightroom Classic extras | 32 | 11 | 39 | 9 | — | 22/24 (92%) |
-| **Total** | 394 | 38 | 84 | 36 | 193/200 (97%) | 142/152 (93%) |
+| **Total** | 393 | 39 | 84 | 36 | 192/200 (96%) | 142/152 (93%) |
 
-Weighted completion (✅ = 1, 🟡 = ½, 🚫 left out): **80.0%** of 516 in-scope rows — P0 98.2% of 200 · P1 95.7% of 152 · P2 42.9% of 163.
+Weighted completion (✅ = 1, 🟡 = ½, 🚫 left out): **79.9%** of 516 in-scope rows — P0 98.0% of 200 · P1 95.7% of 152 · P2 42.9% of 163.
 <!-- /parity:summary -->
 
 ## Top gaps
@@ -65,13 +65,14 @@ Take the first one nobody is working on.
 2. **LR-IMP-FORMATS** (P0): **CR3** first (every Canon body since ~2018), then compressed ORF, Nikon
 1. **LR-PROF-CAMERACOLOR** (P0): our own camera colour calibration. Sony ARW, Nikon NEF and Panasonic RW2 now get a guarded file-local fit to their own embedded JPEG (colour matrix + hue/saturation/value table + tone and chroma curves, relative WB; per-model profiles pooled from many photos via `lightcraft-cli calibrate` for ARW and NEF; ARW: 7 of 10 public samples accepted, mean ΔE vs the camera JPEG 17–26 → 3–10; NEF: 13 of 13 decodable samples from 6 bodies accepted, ΔE 13–46 → 3–8, one mixed-light scene 13 → 12; RW2: 140 of 174 public samples accepted, from 93 of the 114 bodies with a preview, median ΔE 5.0); measured calibration and fidelity remain missing. Other non-DNG raws and rejected fits still use a neutral matrix. Expand validated preview fitting and use matrices the files carry themselves; never Adobe data.
 2. **LR-IMP-FORMATS** (P0): CR3 lossless Bayer and version 0x100/0x200 C-RAW now decodes (M50/R100/R8 full sensor exact). Remaining unverified CRX variants, compressed RAF / ORF, Nikon
-   "lossy after split" NEF, Canon sRAW; AVIF decode (HEIC decodes behind the codecs' non-default `heif` feature:
+   Canon sRAW; AVIF decode (HEIC decodes behind the codecs' non-default `heif` feature:
    the optional `lightcraft-heif` crate on heic-rs, the same decoder and policy as PhotoCraft). Clean-room, from prose descriptions only (see
    `crates/raw/src/vendor/nefc.rs` for how compressed NEF was done). Until decoded, such photos are `preview_only`.
 3. **LR-IMP-CAMERA-COVERAGE** (P0): per-model verification; grow the CC0 corpus and fix per-model bugs (like the CR2
    colour-filter layout, fixed in #85 by reading the file's own tag).
 4. **LR-BEHAV-RENDER-FIDELITY** (P1): a side-by-side fidelity suite against Lightroom renders (kept local in `plan/`),
-   then tune tone, highlights, texture/clarity/dehaze, NR and sharpening against it.
+   then tune tone, highlights, texture/clarity/dehaze, NR and sharpening against it. A retune that changes how existing
+   settings render ships as a new process version, so existing edits keep their look (`docs/process-versions.md`).
 4b. **LR-VIEW-ZOOM** (P0): finish the sharp zoomed views of issue #323: windows for compare, overlays and soft proofing
    (Before/After has them); check sharpness and the wide-stage margin on real raw photos (only synthetic scenes so far).
 5. **LR-EDIT-OPTICS-PROFILE** (P1): a lens-profile database of our own (corrections embedded in DNG files and the
@@ -82,7 +83,8 @@ Take the first one nobody is working on.
    built-in list is empty, so today users need their own mirror or a manual install). Subject / Sky / People could
    use the same model with fixed prompts; denoise / super-resolution models remain a maintainer decision.
 7. **HDR** (Q. HDR, LR-EXP-HDR), **video** (R. Video), **Classic output modules** (Map view, Book, Slideshow module,
-   Print, publish): large, well understood, lower priority than 1–5.
+   Print, publish): large, well understood, lower priority than 1–5. Contact-sheet PDF export now covers a
+   basic Print workflow; custom picture packages, printer integration and print colour management remain open.
 8. **LR-VIEW-ZOOM** (P0): pinch zoom and two-finger pan now work, with stable image cursors between gesture events.
    The whole-image preview is still capped by
    Settings → Performance → Preview size (2,560 px by default). Render visible regions at native resolution so
@@ -142,8 +144,8 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 | LR-IMP-PROFILES | Import profiles & presets | P1 | ✅ | `cmd:file.importPresets`, `cmd:preset.import`, `cmd:profile.import`, `crates/engine/src/preset_import.rs`, `crates/engine/src/preset_luminar.rs` | presets: .lcpreset, XMP, classic .lrtemplate, photos carrying edits ("DNG presets"), Luminar looks (.lmp, .mplumpack collections; sliders with a counterpart), .zip bundles, folders (folder → group), drag & drop; masks carried over; unmapped settings reported (fields that only describe the preset or photo, e.g. `Cluster`, `SortName`, `SupportsAmount2`, the as-shot white, empty Point Color slots, are not); profiles: .cube 3D LUTs; Adobe profile formats deliberately unsupported |
 | LR-IMP-LOCAL | Work on files in place | P0 | ✅ | `cmd:library.browse`, `cmd:photo.addToLibrary`, `cmd:library.import` (mode add), `cmd:local.addRoot`, `cmd:local.hide`, `cmd:local.restoreHidden`, `crates/engine/src/cmd/browse.rs`, `crates/ui-egui/src/panels/left.rs` (`local_section`), `crates/ui-egui/src/panels/grid.rs` (`folder_header`) | Local: browse Pictures / Desktop / Downloads / Home or any folder without adding it (breadcrumb, Include subfolders, Add N to My Photos); browsed photos stay out of All Photos, albums and counts; folders picked with Browse Folder… (or Keep in Local / Add to Local on a folder row) stay listed across restarts, and browsing a folder inside a listed one highlights it inside that tree (opened down to it, siblings reachable) instead of adding a root; edits go to XMP sidecars; importing promotes them; right-click a top-level location → Remove from Local hides the shortcut only (nothing on disk or in the catalog changes), saved with the UI state, and “Show N hidden locations” (or Browse Folder… on it) brings it back; a folder is one location however its path is spelled (`/` or `\`, trailing separator, `.`/`..`, drive-letter case; `folder_key` in `crates/catalog/src/query.rs`); browsed photos nobody changed are forgotten once their folder has not been browsed for 30 days (Settings → Performance → Local folders, 0 = never; checked when the library opens, or `cmd:library.forgetLocal` with `dryRun`; files and sidecars stay, browsing again brings them back; see `crates/catalog/src/local.rs` for what counts as a change) |
 | LR-IMP-SIDECAR-SPLIT | Separate XMP sidecar variants | P2 | ⬜ | `cmd:library.xmpPreferences` | sidecar naming option exists (stem/full), no split sidecars |
-| LR-IMP-FORMATS | Supported formats | P0 | 🟡 | `crates/codecs/src/lib.rs`, `crates/raw/src/lib.rs`, `crates/raw/src/jxl.rs` | JPEG, PNG, TIFF (1- to 64-bit integer, 16- to 64-bit float, incl. bilevel and CCITT fax), WebP, JXL, PSD, GIF, BMP; DNG (incl. lossy / Smart Preview DNG and DNG 1.7 JPEG XL tiles/strips: lossless ones decode bit-exactly on synthetic CFA and LinearRaw files, lossy ones decode but no real JPEG XL DNG has verified them yet; a single-chunk JPEG XL preview IFD is offered as the embedded preview), CR2 (colour-filter layout from the file's `CR2CFAPattern` tag, issue #85), ARW (pre-2017 bodies: white balance and black level from enciphered maker-note / `SR2SubIFD` data, issue #148; downsized Sony lossless YCbCr 4:2:0 / 4:2:2 tiles decoded to linear RGB, verified on private ILCE-7M4 3:2 & 4:3 examples including 16-bit full-resolution export), NEF (uncompressed, lossless and lossy compressed 12/14-bit, `crates/raw/src/vendor/nefc.rs`), RAF (uncompressed, lossless/lossy compressed Bayer and X-Trans; `crates/raw/src/vendor/rafc.rs`, full sensor verification on 13 bodies, `docs/raf-compression.md`), RW2 / Leica RWL / Panasonic RAW in every raw format (compressed 4 and 6, the prefix-coded strips of format 8 from the GH6 on, packed 2/5/7, the 16-bit words of the 2005–2007 bodies; black levels, in-camera aspect crops and mapped-out defect pixels; 178 CC0 files from 118 bodies checked, `crates/raw/src/vendor/rw2.rs`), PEF, ORF (uncompressed; colour-filter layout from the file's Exif `CFAPattern`). 12-bit NEF black level: maker note `0x003d` is in 14-bit units (D750, D780, D850, D7500, Z 50 checked). Lossy type 2 NEF curves of version `0x44 0x40` (D780, D6, Z 5, Z 6, Z 7, Z 7_2) span a quarter of the sample range, read from the table's own point spacing. CR3 lossless CRX Bayer and version 0x100/0x200 C-RAW decodes to sensor pixels with timed white balance, black/white levels and file crop; full sensor samples match the reference on M50/R100/R8 (`crates/raw/tests/cr3_corpus.rs`, `docs/cr3.md`). Unsupported coding variants retain metadata and use the embedded JPEG when available; HEVC preview decoding remains unsupported. Missing: CR3 unverified CRX variants, compressed ORF, NEFs labelled compressed (34713) but stored uncompressed without a `0x0096` table (Z 6 packed 14-bit, D850 12-bit uncompressed), NEF "lossy after split" (preview only: imported with `preview_only` = the decoder's reason, rendered as a rendered JPEG, flagged by a grid badge and loupe/Edit/Info notices, `previewOnly` in `catalog.query`; Reload clears it once the file decodes), TIFF-based raws whose raw data sits in a private block (Phase One / Leaf IIQ, Canon EOS-1D / 1Ds and Kodak DCS TIFFs: IFD0 is only a reduced RGB image next to a much larger declared picture) are recognised from that structure and import as `preview_only` with the reason, instead of opening as a thumbnail-sized ordinary image (`thumbnail_shell` in `crates/raw/src/lib.rs`), Recognised raws LightCraft cannot decode open as `preview_only` with any usable embedded JPEG, also Canon CRW, Minolta MRW and Sigma X3F (containers recognised by magic, preview found by a structural JPEG scan), Kodak KDC (IFD0 without `ImageWidth`), Leaf MOS and Epson ERF (scan), and any decode failure of a recognised raw, not only an unsupported variant; ones with no JPEG still fail with "without an embedded preview", AVIF decode (HEIC decodes only behind the non-default `heif` feature: `crates/heif`, heic-rs, same policy as PhotoCraft; 8/10-bit, alpha, irot/imir/clap, ICC/EXIF/XMP), palette (indexed-colour) TIFF (refused by the `tiff` crate) |
-| LR-IMP-CAMERA-COVERAGE | Camera coverage, verified per model | P0 | 🟡 | `crates/raw/tests/corpus.rs`, `xtask/src/main.rs` | a supported container is not the same as every camera that writes it decoding correctly: ~55 CC0 corpus files plus 6 exact-sensor CR3 cases (plus ~60 NEFs checked by hand and 178 Panasonic / Leica RW2, RWL and RAW files from 118 bodies, checked against each file's own JPEG) against the >1,000 models Lightroom lists; per-model differences still surface (e.g. the CR2 colour-filter layout differed by model until it was read from the file's own tag, issue #85, checked on 35 CR2 bodies; pre-2017 Sony ARWs opened green until their scrambled white balance / black level were read, issue #148, checked on 16 ARWs from 15 Sony bodies; Canon PowerShot and EOS M CR2s whose `ColorData` is stored as bytes opened green until the bytes were read as 16-bit words, 25 files from 25 bodies checked). Compressed RAF sensor arrays verified on 13 Fujifilm bodies (`docs/raf-compression.md`). Grow the CC0 corpus per model and test each sample decodes with plausible colour. Nikon CropArea and untagged-preview colour-space regression tests; private Z 8 crop verified. |
+| LR-IMP-FORMATS | Supported formats | P0 | 🟡 | `crates/codecs/src/lib.rs`, `crates/raw/src/lib.rs`, `crates/raw/src/jxl.rs` | JPEG, PNG, TIFF (1- to 64-bit integer, 16- to 64-bit float, incl. bilevel and CCITT fax), WebP, JXL, PSD, GIF, BMP; DNG (incl. lossy / Smart Preview DNG and DNG 1.7 JPEG XL tiles/strips: lossless ones decode bit-exactly on synthetic CFA and LinearRaw files, lossy ones are restored to the declared linear primaries without clipping or gamut mapping, checked on one real file with 108 lossy tiles, and any tile that fails to decode makes the file preview-only; DNG 1.7 row/column-interleaved rasters (`RowInterleaveFactor` / `ColumnInterleaveFactor`) are undone before the mosaic is read, so a file from Adobe's converter with a 2×2 interleave no longer decodes as four scaled-down copies in the wrong colours; a dimension the factor does not divide decodes with short trailing fields; verified on 4 real ILCE-6400 JPEG XL DNGs rendering bit-identical to their non-interleaved twins, factors above 2 rest on the plain reading of the tag; a single-chunk JPEG XL preview IFD is offered as the embedded preview; a DNG whose samples pile up at one value well below its stated `WhiteLevel`, as a camera app's 12-bit Bayer DNG that states 4095 and clips at 3567, has those samples raised to the white level on decode, so highlight reconstruction sees the clipped areas instead of white balance tinting them magenta, issue #548, `crates/raw/src/saturation.rs`), CR2 (colour-filter layout from the file's `CR2CFAPattern` tag, issue #85), ARW (pre-2017 bodies: white balance and black level from the encrypted `SR2SubIFD`, issue #148, its `WB_RGGBLevels` being the white balance the camera applied, issue #535; downsized Sony lossless YCbCr 4:2:0 / 4:2:2 tiles decoded to linear RGB, verified on private ILCE-7M4 3:2 & 4:3 examples including 16-bit full-resolution export; Sony DSC-R1 .SR2 decodes, its big-endian 16-bit words read in the order that fits the sample range, checked on the CC0 3221 sample; its crop and white balance live in the SR2SubIFD and are not read yet), NEF (uncompressed, lossless and lossy compressed 12/14-bit, `crates/raw/src/vendor/nefc.rs`), RAF (uncompressed, lossless/lossy compressed Bayer and X-Trans; `crates/raw/src/vendor/rafc.rs`, full sensor verification on 13 bodies, `docs/raf-compression.md`), RW2 / Leica RWL / Panasonic RAW in every raw format (compressed 4 and 6, the prefix-coded strips of format 8 from the GH6 on, packed 2/5/7, the 16-bit words of the 2005–2007 bodies; black levels, in-camera aspect crops and mapped-out defect pixels; 178 CC0 files from 118 bodies checked, `crates/raw/src/vendor/rw2.rs`), PEF, ORF (uncompressed; colour-filter layout from the file's Exif `CFAPattern`; 12.8 bit/px 16-byte blocks of ten 12-bit samples + a zero pad byte, E-300 / E-330 / E-500 verified on CC0 files, E-M5 Mark II / PEN-F high-res files decode smooth but CFA and black unverified), Hasselblad 3FR with uncompressed raw data (X1D, X1D II, X2D, CFV 100C: a TIFF without a DNG version tag that describes its CFA IFD, levels, crop and white balance with DNG's tags; `RawFormat::CfaTiff`, read by `dng::decode_as`, RGGB when the file states no `CFAPattern`; the lossless-JPEG 3FR and FFF files use scan selection value 8 and stay preview-only), Samsung SRW without compression (NX5, NX10, NX11 and the NX20-generation bodies NX20, NX200, NX210, NX1000 and NX1100 as 12-bit packed samples in either bit order, EX1 and WB2000 as 16-bit words; layout, camera-JPEG framing, levels and white balance from the maker note, `crates/raw/src/vendor/srw.rs`; median ΔE vs the camera JPEG 2.2–7.6 on 11 of the 12 files from 10 bodies checked, 10.7 (5.7 registered) on the backlit WB2000 sample). 12-bit NEF black level: maker note `0x003d` is in 14-bit units (D750, D780, D850, D7500, Z 50 checked). Lossy type 2 NEF curves of version `0x44 0x40` (D780, D6, Z 5, Z 6, Z 7, Z 7_2) span a quarter of the sample range, read from the table's own point spacing. CR3 lossless CRX Bayer and version 0x100/0x200 C-RAW decodes to sensor pixels with timed white balance, black/white levels and file crop (the shot's aspect ratio from the maker note's `AspectInfo`); full sensor samples match the reference on M50/R100/R8 (`crates/raw/tests/cr3_corpus.rs`, `docs/cr3.md`). Unsupported coding variants retain metadata and use the embedded JPEG when available; HEVC preview decoding remains unsupported. Missing: CR3 unverified CRX variants, compressed ORF, compressed Samsung SRW (NX1, NX30, NX300, NX500, NX2000, NX3000, NX3300, NX mini: preview only with the reason), NEFs labelled compressed (34713) but stored uncompressed without a `0x0096` table (Z 6 packed 14-bit, D850 12-bit uncompressed), Nikon High Efficiency NEF (HE / HE★ from the Z 8, Z 9, Z 6III and Z f: compression 34713 with a JPEG XS codestream and no `0x0096` table; no public specification, so preview only with the reason "Nikon High Efficiency NEF", issue #193; Lossless compressed NEFs from the same bodies decode), NEF "lossy after split" (preview only: imported with `preview_only` = the decoder's reason, rendered as a rendered JPEG, flagged by a grid badge and loupe/Edit/Info notices, `previewOnly` in `catalog.query`; Reload clears it once the file decodes), TIFF-based raws whose raw data sits in a private block (Phase One / Leaf IIQ, Canon EOS-1D / 1Ds and Kodak DCS TIFFs: IFD0 is only a reduced RGB image next to a much larger declared picture) are recognised from that structure and import as `preview_only` with the reason, instead of opening as a thumbnail-sized ordinary image (`thumbnail_shell` in `crates/raw/src/lib.rs`), Recognised raws LightCraft cannot decode open as `preview_only` with any usable embedded JPEG, also Canon CRW, Minolta MRW and Sigma X3F (containers recognised by magic, preview found by a structural JPEG scan), Kodak KDC (IFD0 without `ImageWidth`), Leaf MOS and Epson ERF (scan), and any decode failure of a recognised raw, not only an unsupported variant; ones with no JPEG still fail with "without an embedded preview", AVIF decode (HEIC decodes only behind the non-default `heif` feature, which the release packages enable: `crates/heif`, heic-rs for the container and HEVC (bit-exact against libde265 on iPhone tiles) plus our own colour conversion, matching libheif within 1 code value on iPhone-style grids (VUI full range, Display P3 ICC, nclx, 10-bit, irot/imir/clap, gain map/depth ignored); 4:2:0/monochrome only, 4:2:2/4:4:4 Canon/Sony HIF refused; same policy as PhotoCraft), palette (indexed-colour) TIFF (refused by the `tiff` crate) |
+| LR-IMP-CAMERA-COVERAGE | Camera coverage, verified per model | P0 | 🟡 | `crates/raw/tests/corpus.rs`, `xtask/src/main.rs` | a supported container is not the same as every camera that writes it decoding correctly: ~55 CC0 corpus files plus 6 exact-sensor CR3 cases (plus ~60 NEFs checked by hand and 178 Panasonic / Leica RW2, RWL and RAW files from 118 bodies, checked against each file's own JPEG) against the >1,000 models Lightroom lists; per-model differences still surface (e.g. the CR2 colour-filter layout differed by model until it was read from the file's own tag, issue #85, checked on 35 CR2 bodies; CR2 black levels were read from border columns light already reaches, left of `SensorInfo`'s border, so CR2s rendered dark with crushed shadows (EOS 6D: 2591 instead of 2047), now measured from the masked columns only, checked on 8 corpus bodies; pre-2017 Sony ARWs opened green until their scrambled white balance / black level were read, issue #148, checked on 16 ARWs from 15 Sony bodies; their white balance now comes from the encrypted `SR2SubIFD`'s `WB_RGGBLevels`, the gains the camera applied, which 14 bodies (DSLR-A450 … A700, NEX-3/5/C3, SLT-A33/A35/A55, ILCE-6001, UMC-R10C) had no other source for and which the maker-note estimate read before missed by up to 100 % on preset shots, issue #535, checked against ExifTool on 100 decoded ARWs from 87 Sony bodies; the encrypted SR2 black level is now read from its directory entry (the DSLR-A450/A500/A550/A700 read 354–975 instead of 512), checked on 126 ARWs from 97 Sony bodies, and downsized lossless M/S ARWs use their measured black level 1024 instead of 512, checked on 12 files from 4 bodies, issue #535; pre-2017 Sony bodies shot in the camera's 16:9 mode (ILCE-7SM2, DSLR-A580) now get the 16:9 crop of their camera JPEG instead of the whole 3:2 frame with padding columns, issue #535; Canon PowerShot and EOS M CR2s whose `ColorData` is stored as bytes opened green until the bytes were read as 16-bit words, 25 files from 25 bodies checked). Compressed RAF sensor arrays verified on 13 Fujifilm bodies (`docs/raf-compression.md`). Sony ILCE-7CR (61 MP): lossless compressed L and M and compressed ARW2 samples of one scene in the corpus (black level, default crop, as-shot gains, lossless vs compressed mosaic agreement, fitted camera look), and all nine public codings (also uncompressed, small and APS-C crop) decode and fit. Grow the CC0 corpus per model and test each sample decodes with plausible colour. Nikon CropArea and untagged-preview colour-space regression tests; private Z 8 crop verified. |
 | LR-IMP-CULL-AT-IMPORT | Culling analysis at import | P2 | 🟡 | `cmd:photo.analyze` | run Assisted Culling on the imported photos (they're selected after an import); not automatic |
 | LR-IMP-MOVE | Move on import [Classic] | P1 | ✅ | `cmd:library.import` (`mode` move), `crates/engine/src/import_move.rs`, `crates/engine/src/tests_import_move.rs`, `crates/ui-egui/src/import.rs` | Transfer ▸ Move with Copy's destination, folders (day / month / one folder / custom template), rename template and example destination; XMP sidecars (both namings) move along; each source is removed only after its destination is written (hard link on the same volume, else copied, synced and compared byte for byte) and its catalog record is saved; failed, duplicate, unchecked files keep their sources, taken names get -1, -2…, never overwritten; files already in the destination/library are added in place; sources that can't be removed (read-only card) are kept and reported (`kept`). Undo removes the photos from the library but leaves the moved files at the destination. No Copy as DNG while moving |
 | LR-IMP-DNG-CONVERT | Convert to DNG on import [Classic] | P2 | ✅ | `cmd:library.import` (`dng`), `crates/ui-egui/src/import.rs` | copy imports: Raw files ▸ Copy as DNG (lossless; the card is untouched); the raw copy is removed only once its DNG is verified and on disk (issue #106) |
@@ -156,23 +158,23 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 | LR-LIB-RECENT-ADDED | Recently added | P1 | ✅ | `cmd:library.source` (`recentlyAdded`), `crates/engine/src/view.rs` (`RECENT_DAYS`) | photos imported in the 30 days up to the latest import, newest import first, grouped by import day |
 | LR-LIB-BYDATE | Browse by date | P1 | ✅ | `cmd:library.filter` (`date`), `crates/ui-egui/src/panels/left.rs` (`date_row`), `crates/catalog/src/query.rs` (`date_groups`) | year → month → day tree with library-wide counts; a row filters the current source by that date. Active filters show as removable chips under the grid header (`crates/ui-egui/src/panels/chips.rs`, with “+N more” and Clear all), the header counts “N of M photos” (matching of the source's total), a badge on the top-bar filter icon counts them, and an empty result says no photos match the active filters |
 | LR-LIB-ALBUM | Albums | P0 | ✅ | `cmd:album.create`, `cmd:album.rename`, `cmd:album.delete`, `cmd:album.addPhotos`, `cmd:album.removePhotos`, `cmd:dialog.newAlbum` | photos dragged from the grid onto an album row are added to it (LR-BEHAV-DRAGDROP) |
-| LR-LIB-FOLDER | Folders of albums | P0 | ✅ | `cmd:album.create` (`folder`, `parent`), `cmd:album.move`, `cmd:album.reorder`, `cmd:album.sort`, `cmd:dialog.newAlbum` / `cmd:dialog.newFolder` / `cmd:dialog.smartAlbum` / `cmd:dialog.newSmartAlbum` (`parent`), `crates/ui-egui/src/panels/left.rs` (`albums_tree`, `folder_menu`, `disclosure_triangle`), `crates/ui-egui/src/tests_panels.rs` | folders nest and fold with the same disclosure triangle as Local / By Date / Folders / Keywords (`albumToggle:<id>`; the row folds them too; open by default); right-click a folder ▸ New ▸ Create Album… / Create Smart Album… / Create Smart Album from Filter… / Create Folder… creates inside it (the `dialog.new*` commands take `parent`), opening the folders down to the new row; creating is only allowed inside folders; moving: drag an album or folder row onto a folder (outlined when allowed; a closed folder opens after 0.6 s under the pointer; the "Albums" header takes an item that sits in a folder back to the top level while it is dragged), the Move to menu or `album.move` — one undo step each; not onto a plain album, itself or something inside it; drop on the top / bottom half of an album or the edge of a folder to place it there by hand (`cmd:album.reorder`, a line shows the place; ordered per folder, folders stay first, new albums go after the ordered ones; right-click ▸ Sort Contents A–Z or ＋ ▸ Sort Albums A–Z = `cmd:album.sort`) |
-| LR-LIB-SMARTALBUM | Smart albums | P1 | ✅ | `cmd:album.createSmart`, `cmd:album.setRules`, `crates/catalog/src/query.rs`, `crates/ui-egui/src/panels/filterbar.rs`, `crates/ui-egui/src/lib.rs` (`album_counts`) | saved filters (rating/flag/label/kind/edited/keyword/camera/lens/date range/text/album), live; match-all only (no any/none rule groups, no rule editor dialog — rules come from the filter bar or `album.setRules`); sidebar counts are cached per catalog revision (and per minute while an “in the last…” rule is used), counted without building id lists |
+| LR-LIB-FOLDER | Folders of albums | P0 | ✅ | `cmd:album.create` (`folder`, `parent`), `cmd:album.move`, `cmd:album.reorder`, `cmd:album.sort`, `cmd:dialog.newAlbum` / `cmd:dialog.newFolder` / `cmd:dialog.smartAlbum` / `cmd:dialog.newSmartAlbum` (`parent`), `crates/ui-egui/src/panels/left.rs` (`albums_tree`, `folder_menu`, `disclosure_triangle`), `crates/ui-egui/src/tests_panels.rs` | Delete removes a folder and its nested albums as one undoable edit, keeps photos in the library and returns a deleted album view to All Photos (issue #501); folders nest and fold with the same disclosure triangle as Local / By Date / Folders / Keywords (`albumToggle:<id>`; the row folds them too; open by default); right-click a folder ▸ New ▸ Create Album… / Create Smart Album… / Create Smart Album from Filter… / Create Folder… creates inside it (the `dialog.new*` commands take `parent`), opening the folders down to the new row; creating is only allowed inside folders; moving: drag an album or folder row onto a folder (outlined when allowed; a closed folder opens after 0.6 s under the pointer; the "Albums" header takes an item that sits in a folder back to the top level while it is dragged), the Move to menu or `album.move` — one undo step each; not onto a plain album, itself or something inside it; drop on the top / bottom half of an album or the edge of a folder to place it there by hand (`cmd:album.reorder`, a line shows the place; ordered per folder, folders stay first, new albums go after the ordered ones; right-click ▸ Sort Contents A–Z or ＋ ▸ Sort Albums A–Z = `cmd:album.sort`) |
+| LR-LIB-SMARTALBUM | Smart albums | P1 | ✅ | `cmd:album.createSmart`, `cmd:album.setRules`, `crates/catalog/src/query.rs`, `crates/ui-egui/src/panels/filterbar.rs`, `crates/ui-egui/src/lib.rs` (`album_counts`) | saved filters (rating/flag/label/kind/edited/keyword/camera/lens/date range/text/album) or a rule set from the rule editor (match all / any / none, nested groups; see LRC-LIB-SMARTCOLL), live; sidebar counts are cached per catalog revision (and per minute while an “in the last…” rule is used), counted without building id lists |
 | LR-LIB-SHARED-ALBUM | Shared albums | P2 | ⬜ | | needs a sharing service |
 | LR-LIB-OFFLINE | Keep album offline | P2 | 🚫 | | not applicable: local-first library |
 | LR-LIB-TARGET | Target album | P2 | ✅ | `cmd:album.setTarget`, `cmd:album.toggleTarget` | see LRC-LIB-COLLECTIONS |
-| LR-LIB-RATING | Star ratings | P0 | ✅ | `cmd:photo.rate` (`advance`), `crates/ui-egui/src/shortcuts.rs` | 0 clears; 1–5 set; Shift+0–5 applies and advances once, including with Auto Advance. Batch grid and undo/redo regressions; macOS native ownership corrected (PR #261) |
+| LR-LIB-RATING | Star ratings | P0 | ✅ | `cmd:photo.rate` (`advance`), `cmd:photo.decreaseRating`, `cmd:photo.increaseRating`, `crates/ui-egui/src/shortcuts.rs` | 0 clears; 1–5 set; Shift+0–5 applies and advances once, including with Auto Advance. Default grid brackets adjust each photo by one, clamped to 0–5; one batch undo and AutoWrite. Batch grid and undo/redo regressions; macOS native ownership corrected (PR #261) |
 | LR-LIB-FLAG | Pick / reject flags | P0 | ✅ | `cmd:photo.pick`, `cmd:photo.reject`, `cmd:photo.unflag`, `cmd:photo.flag` | P pick, X reject, U clear; Shift+P picks and advances in both grids (Presets elsewhere); Shift+X/U and legacy Shift+Z advance; no flag cycle; rejection does not delete the file |
 | LR-LIB-LABEL | Colour labels | P1 | ✅ | `cmd:photo.label`, `cmd:label.setNames`, `cmd:label.names`, `cmd:dialog.labelNames`, keys 6–9 in `crates/ui-egui/src/shortcuts.rs` | Photo menu and grid context menu (coloured, named), Info-panel swatches, label dot plus translucent colour on square-grid/filmstrip surrounds and photo-grid footers (photo pixels unchanged); colour-label toasts have pale matching backgrounds; setting/clearing through keys (including Shift), menus or Info swatches shows the same bottom toast as ratings, with the colour/custom name; editable label names (undoable, journaled); no purple key (as in Lightroom), no custom extra labels |
-| LR-LIB-KEYWORD | Keywords | P0 | ✅ | `cmd:panel.keywords`, `cmd:photo.setMeta` (`addKeywords`/`removeKeywords`), `cmd:keyword.list`, `cmd:keyword.rename`, `cmd:keyword.delete`, `cmd:keyword.merge`, `cmd:keyword.suggest`, `crates/catalog/src/keywords.rs`, `crates/ui-egui/src/panels/left.rs` | left-panel keyword tree with counts (click filters, children included; context menu rename / merge / delete / add / remove); library-wide ops are one undo step and replay from the op log; suggestions (co-occurring / most used / completions) in the Keywords panel; no keyword drag-and-drop |
+| LR-LIB-KEYWORD | Keywords | P0 | ✅ | `cmd:panel.keywords`, `cmd:photo.setMeta` (`addKeywords`/`removeKeywords`), `cmd:keyword.list`, `cmd:keyword.rename`, `cmd:keyword.delete`, `cmd:keyword.merge`, `cmd:keyword.suggest`, `crates/catalog/src/keywords.rs`, `crates/ui-egui/src/panels/left.rs` | left-panel keyword tree with counts (click filters, children included; context menu rename / merge / delete / add / remove); library-wide ops are one undo step and replay from the op log; suggestions (co-occurring / most used / completions) in the Keywords panel; keywords reorganize by drag and drop in the Keyword List (LRC-LIB-KEYWORDS) |
 | LR-LIB-PEOPLE | People / faces | P2 | 🟡 | `cmd:faces.detect`, `cmd:view.people`, `cmd:view.faceBoxes`, `cmd:photo.removeRegion`, `cmd:photo.setRegion`, `cmd:library.filter`, `crates/ui-egui/src/panels/people.rs`, `crates/catalog/src/query.rs` (`people`), `crates/engine/src/media.rs` (`face_job`), `crates/meta/src/xmp.rs` | MVP: named face regions read from XMP (MWG-RS, read-only, see `docs/xmp-interop.md`; clipped to the photo; Lightroom's `Rotation` of ±π/2 and π handled, mirrored orientations taken as written; boxes follow Rotate Left/Right and flips; a sidecar stating `mwg-rs:Regions`, even empty, replaces the photo's on re-read, one without leaves them) become cards in the People view (View ▸ People, or the People button in the toolbar): a close-up of the person's largest face, name and photo count; a click filters the grid (`person` in `library.filter`, `person:` search token, filter chip). Face boxes in the loupe can be switched off (View ▸ Face Boxes, toolbar) resized with eight drag handles and removed with the × shown on hover (catalog-only and undoable, one undo step per drag; the sidecar is never rewritten for either); no moving a box by dragging it yet. Photo ▸ Detect Faces (`cmd:faces.detect`) finds faces with the YuNet detector (pure Rust, about 200 ms a photo, matches OpenCV's own YuNet on a 45-photo test set; the 232 KB model is a one-time download offered in the same step, never part of LightCraft) and adds them as unnamed boxes; names are suggested from the faces already named (recognition models are opt-in downloads, run on the CPU in a background thread; a face is named only when you confirm it); a person's page shows their cropped faces and the unnamed faces that look like them (LRC-LIB-PEOPLE); with recognition on, a background scan finds faces in photos that have none and embeds every face (one to three worker threads, raws through their embedded preview); an Unnamed faces section orders faces by likeness and names a selected group at once; no separated clusters, no manual tagging, no writing regions back |
 | LR-LIB-STACK | Stacks | P1 | ✅ | `cmd:stack.group`, `cmd:stack.ungroup`, `cmd:stack.toggle`, `cmd:stack.setTop`, `cmd:stack.remove`, `cmd:stack.auto`, `crates/catalog/src/stacks.rs` | grid/filmstrip count badges, expand/collapse, auto-stack by capture time; no visual-similarity auto-stack |
 | LR-LIB-VERSIONS | Versions | P1 | ✅ | `cmd:version.create` | see section M |
-| LR-LIB-DELETE | Delete / Recently Deleted | P0 | ✅ | `cmd:photo.delete`, `cmd:photo.restore`, `cmd:photo.deletePermanently` | Restore and Delete Permanently in the Photo menu and the photo context menus for photos in Recently Deleted (before, the UI had no way to restore); adding a file that is in Recently Deleted again selects it there (side panel opened) and says how to restore it or import it afresh; Photo ▸ Empty Recently Deleted (`cmd:library.emptyRecentlyDeleted`, one undo step, shown while the trash is the source); import takes `onDeleted` skip / restore / fresh for files in the trash (`cmd:library.import`; the report flags `existingDeleted` and lists `restored`; the import review dialog offers Leave them / Restore them / Import as new for files that are in the trash; dropped files and Add Photos without a review still skip and point at Restore); no confirmation dialog, no auto-purge after N days (needs a deleted-at date in the catalog) |
+| LR-LIB-DELETE | Delete / Recently Deleted | P0 | ✅ | `cmd:photo.delete`, `cmd:photo.restore`, `cmd:photo.deletePermanently` | Delete and Delete Permanently retain surviving selected photos; if none remain, select the next visible survivor (previous at the end) in the current source/filter/sort; permanent deletion removes catalog records, not files on disk; Restore and Delete Permanently in the Photo menu and the photo context menus for photos in Recently Deleted (before, the UI had no way to restore); adding a file that is in Recently Deleted again selects it there (side panel opened) and says how to restore it or import it afresh; Photo ▸ Empty Recently Deleted (`cmd:library.emptyRecentlyDeleted`, one undo step, shown while the trash is the source); import takes `onDeleted` skip / restore / fresh for files in the trash (`cmd:library.import`; the report flags `existingDeleted` and lists `restored`; the import review dialog offers Leave them / Restore them / Import as new for files that are in the trash; dropped files and Add Photos without a review still skip and point at Restore); no confirmation dialog, no auto-purge after N days (needs a deleted-at date in the catalog) |
 | LR-LIB-REMOVE-ALBUM | Remove from album | P0 | ✅ | `cmd:album.removePhotos` | |
 | LR-LIB-DUPLICATE | Duplicate a photo | P2 | ✅ | `cmd:photo.duplicate` | Photo ▸ Duplicate: a real `-copy` file with the same settings, metadata and albums (virtual copies share the file) |
 | LR-LIB-RENAME | Batch rename | P1 | ✅ | `cmd:photo.rename`, `cmd:photo.renamePreview`, `cmd:photo.renameTokens`, `cmd:dialog.rename`, `crates/engine/src/rename.rs` (`TOKENS`) | template tokens {name} {num} {seq:N} {date:%Y%m%d} {folder} {camera} {lens} {iso} {rating} {title} {creator} {ext} (shared with export naming and import rename); a Tags picker beside every template field (Rename Photos, import Rename, export File name) lists each tag with meaning + live example, the date directives and the rules, and inserts the clicked tag at the text cursor; unknown tags are flagged; preview; renames files on disk with their XMP sidecars (a stem sidecar another file still shares, e.g. raw + JPEG, is copied rather than taken), never overwriting (-1, -2… suffixes; a change of letter case only is checked by file identity, so on case-sensitive volumes `img_1.jpg` next to `IMG_1.JPG` is a collision), rolls back on failure (a file that can't be moved back is reported old → new and the library follows it as an undoable partial rename; the same for undo/redo); undo/redo move the files; virtual copies follow |
-| LR-LIB-CAPTURETIME | Edit capture time | P1 | ✅ | `cmd:photo.setCaptureTime`, `cmd:dialog.captureTime`, `crates/catalog/src/dates.rs` | set (the other selected photos shift by the same amount, or `each`), shift by days/hours/minutes, time-zone shift; one undo step, journaled; Info panel button; no “revert to original capture time” |
+| LR-LIB-CAPTURETIME | Edit capture time | P1 | ✅ | `cmd:photo.setCaptureTime`, `cmd:dialog.captureTime`, `crates/catalog/src/dates.rs` | set (the other selected photos shift by the same amount, or `each`), shift by days/hours/minutes, time-zone shift; one undo step, journaled; Info panel button; no “revert to original capture time”. Impossible calendar dates cannot anchor relative shifts; rejection preserves metadata, selection, Undo and Redo. |
 | LR-LIB-SHOWFINDER | Reveal original in file manager | P0 | ✅ | `cmd:app.showInFinder` | ⌘R (see MENU-FILE-SHOWFINDER) |
 | LR-LIB-COVER | Album cover | P2 | ✅ | `cmd:album.setCover` | |
 | LR-LIB-CULL | Assisted culling | P2 | 🟡 | `cmd:photo.analyze`, `cmd:dialog.cull`, `crates/pipeline/src/cull.rs` | Photo ▸ Assisted Culling…: focus score (0–100), clipping, burst grouping (look-alike shots within 10 s) with the sharpest marked; reject below a focus score, pick each burst's best; classical measures — no eyes-closed / expression detection |
@@ -228,19 +230,19 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 | LR-META-COPYRIGHT-DEFAULT | Default copyright on import | P1 | ✅ | `cmd:library.preferences` (`import.copyright`, `import.creator`), `crates/ui-egui/src/panels/settings.rs` | Settings → Import → Metadata; fills only photos without their own |
 | LR-META-LOCATION | Location editing | P2 | 🟡 | `cmd:photo.setMeta` (`location`, `city`, `state`, `country`, `gps`) | place fields and GPS (decimal or degrees / minutes / seconds) edited in Info, read/written as IPTC Core / Photoshop / EXIF XMP; Show on Map opens OpenStreetMap; no embedded map, no geocoding |
 | LR-META-COPYPASTE | Copy / paste metadata | P2 | ✅ | `cmd:photo.copyMetadata`, `cmd:photo.pasteMetadata` | title, caption, alt text, extended description, copyright (notice, status, usage terms, info URL), creator, place fields, keywords; `fields` picks a subset |
-| LR-META-XMP | XMP read/write | P0 | ✅ | `cmd:photo.saveMetadataToFile`, `cmd:photo.readMetadataFromFile`, `cmd:library.xmpPreferences`, `crates/engine/src/sidecar.rs`, `docs/xmp-interop.md` | sidecar wins for metadata; a sidecar capture time (`exif:DateTimeOriginal` / `photoshop:DateCreated` / `xmp:CreateDate`) fills in only when the file has none; saving merges into an existing sidecar (`crates/meta/src/xmp_merge.rs`): another app's `crs:`, `xmpMM:History` and unknown namespaces are kept byte for byte, an unreadable sidecar is backed up first; with stem naming, files sharing a stem (raw + JPEG) get separate sidecars (`<file>.xmp` for all but the raw) |
+| LR-META-XMP | XMP read/write | P0 | ✅ | `cmd:photo.saveMetadataToFile`, `cmd:photo.readMetadataFromFile`, `cmd:library.xmpPreferences`, `crates/engine/src/sidecar.rs`, `docs/xmp-interop.md` | sidecar wins for metadata; a sidecar capture time (`exif:DateTimeOriginal` / `photoshop:DateCreated` / `xmp:CreateDate`) fills in only when the file has none; saving merges into an existing sidecar (`crates/meta/src/xmp_merge.rs`): another app's `crs:`, `xmpMM:History` and unknown namespaces are kept byte for byte, an unreadable sidecar is backed up first; with stem naming, files sharing a stem (raw + JPEG) get separate sidecars (`<file>.xmp` for all but the raw); a `crs:` custom white balance on a relative-WB raw is shifted from `crs:AsShotTemperature` rather than read as Kelvin, or kept As Shot and reported when the packet has no as-shot white (issue #510) |
 | LR-META-EXIF-FULL | Full EXIF/IPTC [Classic] | P1 | ✅ | `cmd:photo.allMetadata`, `cmd:dialog.allMetadata`, `crates/meta/src/tags.rs`, `crates/meta/src/exif.rs`, `crates/meta/src/iptc.rs` | read and written on export; Info ▸ All Metadata…: every TIFF / EXIF / GPS / interop tag (named, common values spelled out) and the XMP fields, searchable; metadata presets |
 
 ## F. Edit panel — global adjustments (EDIT)
 
 | Id | Feature | Tier | Status | Evidence | Missing / notes |
 |---|---|---|---|---|---|
-| LR-EDIT-AUTO | Auto settings | P0 | ✅ | `cmd:develop.auto`, `crates/pipeline/src/auto.rs` | |
+| LR-EDIT-AUTO | Auto settings | P0 | ✅ | `cmd:develop.auto`, `crates/pipeline/src/auto.rs` | a Lightroom-like recipe calibrated black-box on Lightroom's Auto results for 24 Sony raws: Exposure from the scene's scene-linear log-average luminance (Lightroom's observed slope, -0.41 EV per EV), Highlights -66 and Shadows +52 (Lightroom's average Auto values), Contrast +68 and Vibrance +30 fitted on our scales. Held out one photo at a time: on the 16 photos whose start Sony's DRO doesn't brighten, a median dE76 of 6.4 from Lightroom's Auto results against 8.3 unedited; on all 24, 7.7 against 7.9 (issues #318, #209). Calibrated on Sony files only; Whites and Blacks stay 0 |
 | LR-EDIT-BW | Black & white | P0 | ✅ | `cmd:develop.treatment` | |
-| LR-EDIT-HDR-MODE | HDR editing | P2 | ⬜ | | |
+| LR-EDIT-HDR-MODE | HDR editing | P2 | ✅ | `cmd:develop.hdr`, `ctl:hdr.maxEv`, `crates/ui-egui/src/panels/edit.rs` (`hdr_row`) | HDR switch in the Light panel; see Q. HDR |
 | LR-EDIT-LIGHT-EXPOSURE | Exposure | P0 | ✅ | `ctl:light.exposure` | |
 | LR-EDIT-LIGHT-CONTRAST | Contrast | P0 | ✅ | `ctl:light.contrast` | |
-| LR-EDIT-LIGHT-HIGHLIGHTS | Highlights | P0 | ✅ | `ctl:light.highlights` | |
+| LR-EDIT-LIGHT-HIGHLIGHTS | Highlights | P0 | ✅ | `ctl:light.highlights`, `crates/raw/src/highlight.rs` | sensor-clipped highlights stay neutral when Highlights (or Exposure, Whites) darkens them: fully clipped content is rebuilt to the neutral of the colour model applied after it, partly clipped content takes its colour from reliable unclipped content nearby (not from dark objects, lens fringes or another surface beside it) and white where there is none, and pale partly clipped content (a white sky) turns white on its way to clipping (#523) |
 | LR-EDIT-LIGHT-SHADOWS | Shadows | P0 | ✅ | `ctl:light.shadows` | |
 | LR-EDIT-LIGHT-WHITES | Whites | P0 | ✅ | `ctl:light.whites` | |
 | LR-EDIT-LIGHT-BLACKS | Blacks | P0 | ✅ | `ctl:light.blacks` | |
@@ -267,12 +269,12 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 | LR-EDIT-DETAIL-SHARPEN | Sharpening | P0 | ✅ | `ctl:detail.sharpenAmount`, `ctl:detail.sharpenRadius`, `ctl:detail.sharpenDetail`, `ctl:detail.sharpenMasking` | no Alt-drag mask preview |
 | LR-EDIT-DETAIL-NR | Luminance noise reduction | P0 | ✅ | `ctl:detail.nrLuminance`, `ctl:detail.nrDetail`, `ctl:detail.nrContrast` | |
 | LR-EDIT-DETAIL-CNR | Colour noise reduction | P0 | ✅ | `ctl:detail.nrColor`, `ctl:detail.nrColorDetail`, `ctl:detail.nrColorSmoothness` | |
-| LR-EDIT-DETAIL-DENOISE | AI denoise | P2 | 🟡 | cmd:denoise.toggle, cmd:denoise.models.install, cmd:denoise.queue, ctl:enhance.denoise, `crates/denoise/`, `docs/denoise.md` | non-destructive Bayer RAW, opt-in weights, pure-Rust CPU/GPU; X-Trans/linear RGB, model policy and Lightroom fidelity remain |
+| LR-EDIT-DETAIL-DENOISE | AI denoise | P2 | 🟡 | cmd:denoise.toggle, cmd:denoise.models.install, cmd:denoise.queue, ctl:enhance.denoise, `crates/denoise/`, `docs/denoise.md` | non-destructive Bayer RAW, opt-in weights, pure-Rust CPU/GPU; GPU convolution uses independently written shared scalars (Metal equivalence regression, issue #479); X-Trans/linear RGB, model policy and Lightroom fidelity remain |
 | LR-EDIT-DETAIL-RAWDETAILS | Improved demosaic toggle | P2 | ⬜ | | |
 | LR-EDIT-DETAIL-SUPERRES | Super resolution | P2 | ⬜ | | |
 | LR-EDIT-DETAIL-AISHARPEN | AI sharpen | OOS | 🚫 | | |
 | LR-EDIT-OPTICS-CA | Remove chromatic aberration | P1 | ✅ | `crates/ui-egui/src/panels/edit.rs` (checkbox), `ctl:optics.caRed`, `ctl:optics.caBlue` | |
-| LR-EDIT-OPTICS-PROFILE | Lens profile corrections | P1 | 🟡 | `ctl:optics.profileDistortion`, `ctl:optics.profileVignetting`, `crates/pipeline/src/optics.rs`, `crates/raw/src/vendor/rw2.rs`, `crates/engine/src/crs.rs` | uses corrections embedded in the file: DNG `WarpRectilinear` / `FixVignetteRadial`, and the camera's own distortion correction in Panasonic / Leica RW2 / RWL files (tag `0x0119`, read as the equivalent `WarpRectilinear`; on 79 photos from 13 bodies and 11 lenses the corrected render lines up with the camera JPEG within 0.75 px at 1440 px at the corners, from up to 13 % of the half diagonal uncorrected; issue #256); an imported preset's `LensProfileEnable=0` leaves them on, as Lightroom applies built-in corrections regardless (inferred); vignetting and lateral CA data of other raw formats (Olympus, Fujifilm, Sony) not read yet; no lens-profile database |
+| LR-EDIT-OPTICS-PROFILE | Lens profile corrections | P1 | 🟡 | `ctl:optics.profileDistortion`, `ctl:optics.profileVignetting`, `crates/pipeline/src/optics.rs`, `crates/raw/src/vendor/rw2.rs`, `crates/engine/src/crs.rs` | uses corrections embedded in the file: DNG `WarpRectilinear` / `FixVignetteRadial`, and the camera's own distortion correction in Panasonic / Leica RW2 / RWL files (tag `0x0119`, read as the equivalent `WarpRectilinear`; on 79 photos from 13 bodies and 11 lenses the corrected render lines up with the camera JPEG within 0.75 px at 1440 px at the corners, from up to 13 % of the half diagonal uncorrected; issue #256); an imported preset's `LensProfileEnable=0` leaves them on, as Lightroom applies built-in corrections regardless (inferred); vignetting and lateral CA data of other raw formats (Olympus, Fujifilm, Sony) not read yet; Reload from Disk reads the file's lens data for photos catalogued without it and turns the correction on for those still at import settings (issue #314); no lens-profile database |
 )
 | LR-EDIT-OPTICS-DEFRINGE | Defringe | P1 | ✅ | `ctl:optics.defringe*` | no fringe eyedropper |
 | LR-EDIT-OPTICS-MANUAL | Manual distortion / vignetting | P1 | ✅ | `ctl:optics.distortion`, `ctl:optics.vignetting`, `ctl:optics.vignettingMidpoint` | |
@@ -295,7 +297,7 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 | LR-PROF-ADOBE | Standard raw looks (own equivalents) | P0 | ✅ | `crates/engine/src/presets.rs` (`PROFILES`), `crates/pipeline/src/profiles.rs` | six own looks: Color, Neutral, Vivid, Landscape, Portrait, Monochrome |
 | LR-PROF-ADAPTIVE | Adaptive profiles | P2 | ⬜ | | |
 | LR-PROF-CAMERA | Camera-matching looks | P2 | ⬜ | | |
-| LR-PROF-CAMERACOLOR | Camera colour calibration (own) | P0 | 🟡 | `crates/raw/src/color.rs`, `crates/raw/src/profile.rs`, `crates/raw/src/gaintable.rs`, `crates/engine/src/camera_preview.rs` | DNG files use the colour matrices and the camera-profile look they carry (`ProfileHueSatMap`, `ProfileLookTable`, `ProfileToneCurve`, read from the file at run time per DNG spec ch. 6 — Lightroom-converted DNGs rendered flat and muted without them, issue #138). A DNG's `ProfileGainTableMap` / `ProfileGainTableMap2` (Apple ProRAW's local tone map; both versions, DNG 1.7 precedence, the file's byte order with a big-endian fallback) is read and written back by DNG export but not rendered, as Lightroom Classic renders ProRAW without it (measured on one CC0 iPhone 12 Pro ProRAW); Sony ARW, Nikon NEF, Panasonic RW2, Fujifilm RAF, Canon CR3 and CR2 and Pentax PEF get a guarded file-local fit to their own embedded JPEG — chromaticity matrix + hue/saturation/value table + tone and chroma curves, relative WB — or, with a bundled or local per-model profile pooled from many photos (`lightcraft-cli calibrate`, ARW, NEF and RAF so far, `crates/engine/src/camera_profiles.rs`), the profile's colour and only their own tone/chroma curves (on 29 held-out ILCE-7M4 photos mean ΔE vs the camera JPEG 3.54 → 3.10), kept with smart previews (see docs/camera-preview-colour.md); ARW: on 10 public raw.pixls.us samples from 8 bodies 7 fits were accepted, mean ΔE vs the camera JPEG 17–26 → 3–10; NEF: 13 of 13 decodable samples (D750, D780, D850, D7500, Z 50 and local D7500 shots) accepted, ΔE 13–46 → 3–8 (issue #150); RW2 / RWL: 140 of 174 public samples accepted, from 93 of the 114 bodies with a preview, median ΔE 5.0 with matching lightness (13 of the 14 corpus files with a preview: ΔE 9.6–27 → 2.8–8.9; most rejections are compacts and kit zooms whose camera JPEG is distortion-corrected); a fit that fails the gates on all pixels is retried away from edges, where a lens-corrected camera JPEG still lines up (issue #232: the six distortion-corrected public ILCE-7RM2 samples ΔE 16.6–16.9 → 3.7–3.8, the corpus GX80 19.1 → 7.9); RAF: bundled X-H2S/X-T4 profiles from 201/545 photos; on 150 withheld files mean ΔE improves slightly over per-file fitting (X-H2S 1.70 → 1.62, X-T4 2.43 → 2.34); 23 of 24 references from 13 bodies accepted, including the dark X-H2S samples (8.74 → 2.25) (`docs/camera-preview-colour.md`); this is not measured camera calibration; other raws and rejected fits use a neutral fallback (camera RGB ≈ linear sRGB, `matrix_is_fallback`) with as-shot white balance, so colours are muted and not accurate. Needs our own per-camera calibration: matrices the files carry themselves (e.g. Olympus `ColorMatrix`), fitting each camera to its own embedded JPEG, then chart shots. Adobe matrices / DCPs are never used. Biggest image-quality gap today |
+| LR-PROF-CAMERACOLOR | Camera colour calibration (own) | P0 | 🟡 | `crates/raw/src/color.rs`, `crates/raw/src/profile.rs`, `crates/raw/src/gaintable.rs`, `crates/engine/src/camera_preview.rs` | DNG files use the colour matrices and the camera-profile look they carry (`ProfileHueSatMap`, `ProfileLookTable`, `ProfileToneCurve`, read from the file at run time per DNG spec ch. 6 — Lightroom-converted DNGs rendered flat and muted without them, issue #138). A DNG's `ProfileGainTableMap` / `ProfileGainTableMap2` (Apple ProRAW's local tone map; both versions, DNG 1.7 precedence, the file's byte order with a big-endian fallback) is read and written back by DNG export and not rendered by default, as Lightroom Classic renders ProRAW without it (measured on one CC0 iPhone 12 Pro ProRAW); the Profile option "Camera local tone mapping" (`profile.camera_local_tone`, per photo, off by default, `crates/pipeline/src/local_tone.rs`) renders it as the camera does, per output pixel in the scene-linear stage (CPU, also under the GPU path); Sony ARW, Nikon NEF, Panasonic RW2, Fujifilm RAF, Canon CR3 and CR2, Pentax PEF, Samsung SRW and Olympus ORF get a guarded file-local fit to their own embedded JPEG — chromaticity matrix + hue/saturation/value table + tone and chroma curves, relative WB — or, with a bundled or local per-model profile pooled from many photos (`lightcraft-cli calibrate`, ARW, NEF and RAF so far, `crates/engine/src/camera_profiles.rs`), the profile's colour and only their own tone/chroma curves (on 29 held-out ILCE-7M4 photos mean ΔE vs the camera JPEG 3.54 → 3.10; bundled ILCE-7CR from 125 photos: 26 held-out 4.07 → 3.29, and every one of the 131 photos accepted, 8 of which fell back to neutral without it), kept with smart previews (see docs/camera-preview-colour.md); Sony ARWs shot with DRO on (maker note `0xb025`, on by default) keep that colour but their tone curve is lowered to Sony's curve without DRO, whose lifted shadows are in the camera JPEG only (issue #244: 8 ILCE-7CR photos +6.4 → +0.8 L* from Lightroom's default, median ΔE 7.5 → 3.3); ARW: on 10 public raw.pixls.us samples from 8 bodies 7 fits were accepted, mean ΔE vs the camera JPEG 17–26 → 3–10; NEF: 13 of 13 decodable samples (D750, D780, D850, D7500, Z 50 and local D7500 shots) accepted, ΔE 13–46 → 3–8 (issue #150); RW2 / RWL: 140 of 174 public samples accepted, from 93 of the 114 bodies with a preview, median ΔE 5.0 with matching lightness (13 of the 14 corpus files with a preview: ΔE 9.6–27 → 2.8–8.9; most rejections are compacts and kit zooms whose camera JPEG is distortion-corrected); a fit that fails the gates on all pixels is retried away from edges, where a lens-corrected camera JPEG still lines up (issue #232: the six distortion-corrected public ILCE-7RM2 samples ΔE 16.6–16.9 → 3.7–3.8, the corpus GX80 19.1 → 7.9); RAF: bundled X-H2S/X-T4 profiles from 201/545 photos; on 150 withheld files mean ΔE improves slightly over per-file fitting (X-H2S 1.70 → 1.62, X-T4 2.43 → 2.34); 23 of 24 references from 13 bodies accepted, including the dark X-H2S samples (8.74 → 2.25); ORF: the 3 decodable corpus files (E-1, E-400, XZ-2) accepted (`docs/camera-preview-colour.md`); this is not measured camera calibration; other raws and rejected fits use a neutral fallback (camera RGB ≈ linear sRGB, `matrix_is_fallback`) with as-shot white balance, so colours are muted and not accurate. Needs our own per-camera calibration: matrices the files carry themselves (e.g. Olympus `ColorMatrix`), fitting each camera to its own embedded JPEG, then chart shots. Adobe matrices / DCPs are never used. Biggest image-quality gap today |
 | LR-PROF-CREATIVE | Creative profiles (own) | P2 | ✅ | `cmd:develop.profile`, `crates/pipeline/src/profiles.rs` | 16 own looks in Film / Cinematic / Muted / B&W (tone + point-curve fades, colour grading, mixer / B&W mix); scale with `ctl:profile.amount`; sliders untouched |
 | LR-PROF-LEGACY | Legacy profiles | P2 | ⬜ | | |
 | LR-PROF-NONRAW | Profiles for non-raw files | P0 | ✅ | `cmd:develop.profile` | same looks apply to JPEG/TIFF |
@@ -308,9 +310,9 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 |---|---|---|---|---|---|
 | LR-CROP-RECT | Crop rectangle | P0 | ✅ | `cmd:crop.set`, `cmd:crop.drag`, `crates/geom/src/crop_drag.rs`, `crates/ui-egui/src/panels/detail.rs` | double-click inside the box applies the crop (like Return) |
 | LR-CROP-ASPECT | Aspect ratios | P0 | ✅ | `cmd:crop.aspect`, `cmd:crop.rotateAspect`, `crates/ui-egui/src/panels/right.rs` | menu with presets + custom W × H, visible Lock toggle (also A), button names the active ratio; every handle honours the lock and the drag stops at the image edge instead of shifting the frame (issue #295); "Original" is the photo's own shape (no separate As Shot) |
-| LR-CROP-STRAIGHTEN | Straighten tool | P0 | ✅ | `cmd:crop.straighten`, `cmd:crop.autoStraighten` | Straighten Tool button: drag along a horizon/vertical; double-click or Auto levels automatically |
+| LR-CROP-STRAIGHTEN | Straighten tool | P0 | ✅ | `cmd:crop.straighten`, `cmd:crop.autoStraighten`, `crates/ui-egui/src/panels/detail.rs` (`rotate_cursor`, `angle_readout`), `crates/ui-egui/src/panels/right.rs` (Angle field), `crates/ui-egui/src/tests_crop_rotate.rs` | Straighten Tool button: drag along a horizon/vertical; double-click or Auto levels automatically. Dragging outside the crop box rotates it: there the pointer is a curved double arrow (with ⌘ held, the straighten crosshair), and while rotating the angle shows next to it, kept on the canvas (issue #534); an exact angle goes in the Angle field under Straighten (`cropAngleField`: applies on Return or leaving it, Esc keeps the old angle, takes a decimal comma; a drag on it is one undo step) or by clicking the Straighten value (its hover says so) |
 | LR-CROP-AUTO | Auto straighten | P1 | ✅ | `cmd:crop.autoStraighten` | crop-angle leveling from detected horizon/plumb lines (consensus required) |
-| LR-CROP-ANGLE | Angle slider | P0 | ✅ | `ctl:crop.angle` | |
+| LR-CROP-ANGLE | Angle slider | P0 | ✅ | `ctl:crop.angle`, `crates/ui-egui/src/panels/right.rs` | the Straighten slider; an exact angle can also be typed in the Angle field under it (see LR-CROP-STRAIGHTEN) |
 | LR-CROP-ROTATE90 | Rotate 90° | P0 | ✅ | `cmd:photo.rotateLeft`, `cmd:photo.rotateRight` | |
 | LR-CROP-FLIP | Flip | P0 | ✅ | `cmd:photo.flipHorizontal`, `cmd:photo.flipVertical` | |
 | LR-CROP-OVERLAY | Crop overlays | P1 | ✅ | `cmd:view.cropOverlay`, `cmd:view.cropOverlayOrientation`, `crates/ui-egui/src/panels/crop_overlay.rs` | thirds, grid, golden ratio, diagonal, triangle, golden spiral (mirrored with ⇧O while cropping); no aspect-ratio overlays |
@@ -352,18 +354,18 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 | LR-MASK-OBJECTS | Object selection | P2 | 🟡 | `cmd:mask.add` (`object`, `prompt`), `cmd:mask.objectPoint`, `cmd:mask.refineDetail`, `cmd:segment.prepare`, `cmd:segment.model.status`, `cmd:segment.model.download`, `cmd:segment.model.cancel`, `crates/segment`, `crates/engine/src/segment/mod.rs` | SAM 3 in pure Rust (candle; Metal on macOS, CPU elsewhere): Object tile → click to include, ⌥-click to leave out; Describe tile → a text prompt selects every instance ("sky", "the red car"); both also as Add/Subtract/Intersect components; + / − under the selected mask; comma lists (`car, road`); a zoomed-in detail pass for 5–10× finer edges on small objects; per-selection Edge (hard ↔ soft). The model runs on its own worker thread (the UI never waits; panics become errors), is unloaded after 10 min idle, and is optional: the segmentation is stored with the mask (288² logits), so renders and exports never need it. Weights are never bundled (SAM License): without them the app offers a consented background download (mirrors, resume, timeouts, SHA-256) — **but no default download location is configured yet** (users set `LIGHTCRAFT_SAM3_MIRRORS` or install by hand: the dialog names the three files, shows the model folder and links docs/ai-masks.md). Not verified against Lightroom's Select Object; no brush/box object mode; the first click on a photo waits for its analysis (~4 s on an M4 Pro, much longer on CPU) |
 | LR-MASK-PEOPLE | People parts | P2 | ⬜ | | shape exists (no UI): uses the photo's person / skin / hair / teeth / glasses mattes when it carries them (DNG semantic masks), else the subject heuristic |
 | LR-MASK-LANDSCAPE | Landscape classes | P2 | ⬜ | | shape exists, evaluates empty |
-| LR-MASK-BRUSH | Brush mask | P0 | ✅ | `cmd:tool.brush`, `cmd:mask.brushStroke` (`autoMask`), `crates/pipeline/src/masks.rs` | size/feather/flow/density/erase; Auto Mask: dabs weighted by similarity to the colour under the dab centre, refined by a guided filter on luminance (CPU + GPU); no A/B brushes, no pressure |
+| LR-MASK-BRUSH | Brush mask | P0 | 🟡 | `cmd:tool.brush`, `cmd:mask.brushStroke` (`autoMask`), `crates/pipeline/src/masks.rs` | size/feather/flow/density/erase; Create New Mask starts a separate brush in paint mode; live-preview gaps (#517) and stationary accumulation (#518) remain; Auto Mask: dabs weighted by similarity to the colour under the dab centre, refined by a guided filter on luminance (CPU + GPU); no A/B brushes, no pressure |
 | LR-MASK-LINEAR | Linear gradient | P0 | ✅ | `cmd:tool.linear`, `cmd:mask.update` | |
-| LR-MASK-RADIAL | Radial gradient | P0 | ✅ | `cmd:tool.radial`, `cmd:mask.update` | |
+| LR-MASK-RADIAL | Radial gradient | P0 | ✅ | `cmd:tool.radial`, `cmd:mask.update`, `crates/ui-egui/src/panels/detail.rs` | drag the selected ellipse's body or centre pin to move; edge grips resize, outer grip rotates; rotated and compound radial components, hidden pins, outside hit rejection and one-step undo tested |
 | LR-MASK-COLORRANGE | Colour range | P1 | ✅ | `cmd:mask.add` (`colorRange`), `cmd:mask.sampleColor`, `cmd:mask.update`, `crates/pipeline/src/lib.rs` (`color_range_sample`) | Color tile → click the photo to sample (⇧-click adds, up to 5; samples taken in the space the mask compares in), Pick button, Refine slider |
 | LR-MASK-LUMRANGE | Luminance range | P1 | ✅ | `cmd:mask.add` (`luminanceRange`), `cmd:mask.update`, `crates/ui-egui/src/panels/masking.rs` (`range_controls`) | range bar with two handles (one undo step per drag), Smoothness, Show Luminance Map (B&W photo with the range tinted) |
 | LR-MASK-DEPTHRANGE | Depth range | P2 | ⬜ | | shape exists, needs depth data |
-| LR-MASK-COMBINE | Add / subtract / intersect | P0 | ✅ | `cmd:mask.addComponent` | |
+| LR-MASK-COMBINE | Add / subtract / intersect | P0 | ✅ | `cmd:mask.addComponent`, `cmd:tool.brush` | Add/Subtract > Brush creates a component with the chosen operation; Erase removes paint within that brush component |
 | LR-MASK-INVERT | Invert | P0 | ✅ | `cmd:mask.invert` | |
 | LR-MASK-AMOUNT | Mask amount | P1 | ✅ | `cmd:mask.adjust` (`amount`), `crates/ui-egui/src/panels/masking.rs` | |
 | LR-MASK-FEATHER-EDGE | Refine mask edges | P2 | ✅ | `cmd:mask.refine`, `crates/pipeline/src/masks.rs` (`evaluate_one`) | Refine Edges slider per mask: guided filter on the photo's luminance snaps soft mask edges to the photo's edges (rendered on the CPU) |
 | LR-MASK-SLIDERS | Local adjustment sliders | P0 | ✅ | `cmd:mask.adjust`, `crates/pipeline/src/finish.rs` | every slider renders (CPU + GPU), incl. Noise, Moiré, Defringe (negative Defringe has no effect); no local curve or effect presets |
-| LR-MASK-OVERLAY | Mask overlay | P0 | ✅ | `cmd:view.maskOverlay`, `cmd:view.maskOverlayMode`, `cmd:view.maskOverlayColor`, `crates/pipeline/src/visualize.rs` | rendered alpha of the selected mask (CPU + GPU): colour, colour on B&W, image on black/white, white on black; ⇧O cycles while masking; no auto-show on hover |
+| LR-MASK-OVERLAY | Mask overlay | P0 | ✅ | `cmd:view.maskOverlay`, `cmd:view.maskOverlayMode`, `cmd:view.maskOverlayColor`, `crates/pipeline/src/visualize.rs` | rendered alpha of the selected mask (CPU + GPU): colour, colour on B&W, image on black/white, white on black; ⇧O cycles while masking; successful local adjustments (including Amount) hide the overlay until manually shown again with O / the eye; shape/edge edits retain it; no auto-show on hover |
 | LR-MASK-PINS | Pins | P1 | ✅ | `cmd:view.maskPins`, `crates/ui-egui/src/panels/detail.rs` | a pin per radial/linear/brush component: click selects its mask, drag moves it; no pins for range/AI components, no Auto mode |
 | LR-MASK-UPDATE | Recompute AI masks | P2 | ⬜ | | |
 | LR-MASK-SYNC | Copy masks to other photos | P1 | ✅ | `cmd:develop.copy` (`groups`) | |
@@ -422,11 +424,11 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 
 | Id | Feature | Tier | Status | Evidence | Missing / notes |
 |---|---|---|---|---|---|
-| LR-HDR-EDIT | HDR editing | P2 | ⬜ | | |
-| LR-HDR-SDRPREVIEW | SDR preview of HDR | P2 | ⬜ | | |
-| LR-HDR-VISUALIZE | Visualize HDR range | P2 | ⬜ | | |
-| LR-HDR-LIMIT | HDR headroom limit | P2 | ⬜ | | |
-| LR-HDR-EXPORT | HDR export | P2 | ⬜ | | |
+| LR-HDR-EDIT | HDR editing | P2 | 🟡 | `cmd:develop.hdr`, `crates/pipeline/src/tone.rs` (`ToneMap::hdr`), `crates/pipeline/src/tests_hdr.rs` | HDR tone map (SDR curve through the midtones, highlights up to the headroom limit) and float HDR render, CPU only; no on-screen HDR display yet (LR-VIEW-HDR-DISPLAY); HDR settings not yet read from crs XMP |
+| LR-HDR-SDRPREVIEW | SDR preview of HDR | P2 | 🟡 | `ctl:hdr.sdr*` | SDR rendition sliders (brightness, contrast, highlights, shadows, whites, clarity) used by every SDR view and export; no separate SDR-preview toggle until HDR display lands |
+| LR-HDR-VISUALIZE | Visualize HDR range | P2 | ✅ | `cmd:view.visualizeHdr`, `crates/pipeline/src/visualize.rs` (`hdr_range`) | grey below SDR white, four colour bands by stops above it |
+| LR-HDR-LIMIT | HDR headroom limit | P2 | ✅ | `ctl:hdr.maxEv`, `cmd:develop.hdr` | 0 to 5 stops |
+| LR-HDR-EXPORT | HDR export | P2 | 🟡 | `cmd:app.export`, `crates/codecs/src/gainmap.rs`, `crates/engine/src/export.rs` (`encode_gain_map_jpeg`) | `hdr` export option: ISO 21496-1 gain map JPEG (plus Adobe hdrgm and Apple XMP), 10-bit Rec. 2020 PQ AVIF, 32-bit float TIFF; no HLG yet; no HEIC (no permissive HEVC encoder) |
 
 ## R. Video (VID)
 
@@ -450,7 +452,7 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 | LR-EXP-BITDEPTH | Bit depth | P1 | ✅ | `cmd:app.export` (`bitDepth`), `crates/pipeline/src/output.rs` (`OutputDepth`), `crates/engine/src/export.rs` | 16-bit PNG/TIFF rendered at 16 bits (TIFF defaults to 16), 32-bit float linear TIFF with a linear profile, 10-bit AVIF; high-bit-depth renders run on the CPU |
 | LR-EXP-COMPRESSION | TIFF compression | P1 | ✅ | `cmd:app.export` (`tiffCompression`: none / lzw / zip) | |
 | LR-EXP-COLORSPACE | Output colour space | P0 | ✅ | `cmd:app.export` (`colorSpace`), `crates/pipeline/src/output.rs`, `crates/engine/src/export.rs` | sRGB, Display P3, Adobe RGB (1998) compatible, ProPhoto RGB, Rec. 2020: rendered from the working space with gamut mapping into the target gamut (CPU + GPU), own ICC profile embedded; AVIF stays sRGB (muxer has no ICC) |
-| LR-EXP-HDR | HDR output | P2 | ⬜ | | |
+| LR-EXP-HDR | HDR output | P2 | 🟡 | `cmd:app.export`, `crates/ui-egui/src/panels/dialogs.rs` | HDR output checkbox in the export dialog: gain map JPEG, PQ AVIF, float TIFF; no HDR presets yet |
 | LR-EXP-SHARPEN | Output sharpening | P1 | ✅ | `cmd:app.export` (`sharpen`, `sharpenAmount`) | |
 | LR-EXP-METADATA | Metadata policy | P1 | ✅ | `cmd:app.export` (`metadata`, `removeLocation`) | |
 | LR-EXP-WATERMARK | Watermark | P1 | ✅ | `cmd:app.export` (`watermark`: text, or `{text, vertical, size, opacity, anchor, inset, color, shadow, image, imageWidth}`), `crates/engine/src/export.rs` (`Watermark`, `WATERMARK_PARAMS`) | text (`size` = height as a fraction of the short edge, 0.005..0.5, default 0.035; `color` sRGB `[r,g,b]`; `shadow`; Japanese vertical glyph forms and origins, tested by `biz_ud_vertical_watermarks_place_punctuation_at_the_top_right`; extended grapheme cells keep decomposed dakuten/handakuten and Latin accents together, tested by `vertical_watermarks_keep_combining_marks_in_one_cell` and `upright_watermark_cell_retains_multiple_glyphs` (see `docs/vertical-watermarks.md`)) or a graphic with transparency (`image` path, `imageWidth` = fraction of the photo's width, 0.01..1, converted to the output colour space); `anchor`, `inset` (fraction of the short edge, 0..0.4), `opacity` 0..1. Unknown keys and out-of-range values are errors (issue #183) |
@@ -482,10 +484,11 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 
 | Id | Feature | Tier | Status | Evidence | Missing / notes |
 |---|---|---|---|---|---|
-| LR-PREF-GENERAL | General settings | P0 | ✅ | `cmd:app.settings`, `cmd:app.openLibrary`, `crates/ui-egui/src/panels/settings.rs`, `crates/ui-egui/src/panels/notices.rs` | General / Import / Performance / Interface tabs; app settings in ui.json (written atomically, saved when the library changes and every few seconds), library settings in prefs.json; a damaged settings file is kept as `.corrupt-<time>` and reported, an unreadable one is not overwritten that session (`library.info` → `settingsWarnings`); quitting with unsaved changes retries, then asks |
+| LR-PREF-GENERAL | General settings | P0 | ✅ | `cmd:app.settings`, `cmd:app.openLibrary`, `crates/ui-egui/src/panels/settings.rs`, `crates/ui-egui/src/panels/notices.rs` | General / Import / Performance / Display / Interface tabs; app settings in ui.json (written atomically, saved when the library changes and every few seconds), library settings in prefs.json; a damaged settings file is kept as `.corrupt-<time>` and reported, an unreadable one is not overwritten that session (`library.info` → `settingsWarnings`); quitting with unsaved changes retries, then asks |
 | LR-PREF-LOCALSTORAGE | Storage & cache | P1 | ✅ | `cmd:library.preferences`, `cmd:library.clearPreviews`, `cmd:library.compact` | thumbnail cache size + clear in Settings → Performance; library location + Open Library… in General |
 | LR-PREF-ACCOUNT | Account | OOS | 🚫 | | |
 | LR-PREF-INTERFACE | Interface options | P1 | ✅ | `cmd:app.settings` | filmstrip names/badges, grid badges (auto/always/never), square-grid names, navigator, info overlay |
+| LR-PREF-DISPLAY | Monitor (display) colour management | P1 | 🟡 | `cmd:app.displayProfile`, `crates/codecs/src/display.rs`, `crates/engine/src/display.rs`, `crates/ui-egui/src/panels/settings.rs`, `docs/display-profiles.md` | Settings ▸ Display: a monitor ICC profile (matrix/TRC exactly, LUT-based through the CMS) chosen by hand; the loupe, Before, Compare, hover previews and the second window render into the display's primaries (its full gamut, CPU and GPU), thumbnails and stand-ins are converted from sRGB; histogram, preview caches and exports stay sRGB; soft proofing's display gamut warning uses the display's gamut. Missing: picking up the profile the OS assigns (X11 `_ICC_PROFILE`, colord, ColorSync, WCS), per-monitor profiles |
 | LR-PREF-PERFORMANCE | GPU / performance | P1 | ✅ | `cmd:app.gpu`, `cmd:app.memoryBudget`, `cmd:app.settings` | GPU on/off, preview size (Automatic = the whole-frame loupe render at canvas size, up to 2560 px; or a 1600–5120 px size for it; zoomed views add a window at up to 100 %, issue #323), memory budget (a quarter of it is the idle per-view stage caches' share; the open photo's views are counted and reported, and cut only past four times that, the before side's and the zoom window's first — a Before/After at 1:1 on a 2800 px canvas holds about 1 GB of GPU stages, plus the one 288 MB copy of the original, which `ui.inspect` reports as `sharedSourceBytes`), thumbnail cache size in Settings |
 | LR-PREF-PEOPLE | Face recognition | P2 | 🟡 | `cmd:faces.enable`, `cmd:faces.models.list`, `cmd:faces.models.inspect`, `cmd:faces.models.install`, `cmd:faces.models.download`, `cmd:faces.models.downloads`, `cmd:faces.models.downloadCancel`, `cmd:faces.models.remove`, `cmd:faces.models.select`, `cmd:dialog.faceModel`, `crates/faces/src/lib.rs`, `crates/ui-egui/src/panels/faces.rs` | Settings ▸ Faces: an off-by-default toggle and the face model list. Models are opt-in and never bundled, the 232 KB YuNet detector included. Press Download (terms first; then a pinned address, size and SHA-256 checked, fetched over pure-Rust https with `lightcraft-fetch`), or add any `.onnx` by picking or dropping it: it is recognised by hash or described from its shape, shows its licence terms and training-data note, runs a self-test, and installs only after an "I accept" box; an installed model is chosen and recognition switched on at once (the newest wins, each model keeps its own embedding cache). Non-commercial models are add-by-file only, never offered for download. Suggestions of names run on the shared pure-Rust CPU interpreter (`crates/faces/src/net.rs`, `crates/faces/src/runtime.rs`; bounded im2col/GEMM, checked ONNX shapes/operators; no external inference runtime; 40 public crops agree within 2.1e-6, one-thread SFace 34–36 ms / AuraFace 233–252 ms, see docs/faces.md) in a background worker and are never applied automatically. Thresholds are starting points calibrated on busts, not yet on live faces
 | LR-PREF-WATERMARK | Watermark settings | P1 | ✅ | `cmd:export.savePreset`, `crates/ui-egui/src/panels/dialogs.rs` | set in the Export dialog; kept with Export with Previous and in saved export presets |
@@ -513,21 +516,22 @@ under the UI command that wraps it (a no-op error); the UI command now wins.
 | LR-BEHAV-BATCH | Batch apply to selection | P0 | ✅ | `cmd:photo.rate`, `cmd:develop.paste`, `cmd:preset.apply`, `cmd:app.export` | |
 | LR-BEHAV-PREVIEW-HOVER | Hover previews | P1 | ✅ | `crates/ui-egui/src/panels/presets.rs`, `crates/ui-egui/src/panels/profiles.rs`, `crates/ui-egui/src/panels/right.rs` (`versions`), `crates/ui-egui/src/panels/detail.rs` | presets, profile menu, profile browser and versions preview in the loupe |
 | LR-BEHAV-PROGRESSIVE | Progressive rendering | P0 | ✅ | `crates/engine/src/media.rs`, `crates/preview/src/lib.rs` | |
-| LR-BEHAV-BG-TASKS | Background tasks | P0 | ✅ | `crates/preview/src/lib.rs` (`JobPool`), `crates/ui-egui/src/export_task.rs`, `crates/ui-egui/src/import.rs` | renders off the UI thread; exports started from the UI run on a worker thread with a progress panel and Cancel (`ui.inspect` → `export`); imports show a progress window. No combined activity centre |
+| LR-BEHAV-BG-TASKS | Background tasks | P0 | ✅ | `crates/preview/src/lib.rs` (`JobPool`), `crates/ui-egui/src/export_task.rs`, `crates/ui-egui/src/import.rs` | renders off the UI thread; exports started from the UI run on a worker thread with a progress panel and Cancel (`ui.inspect` → `export`), several photos of a batch side by side (`export_parallelism`, memory-gated; files, names and order as one at a time, #496); imports show a progress window. No combined activity centre |
 | LR-BEHAV-OFFLINE | Offline editing | P1 | ✅ | | local-first: everything works offline |
 | LR-BEHAV-WEB-SAFETY | Library safety in the browser build | P1 | 🟡 | `cmd:file.backupLibrary`, `cmd:file.restoreLibrary`, `apps/lightcraft-web/src/safety.rs`, `apps/lightcraft-web/src/backup.rs`, `apps/lightcraft-web/src/files.rs` | web only (experimental): Back Up Library (zip of the catalog and every stored original) and a non-destructive Restore; failed saves show as unsaved and are retried; a photo that can't be stored isn't added; one tab per library (Web Locks); notices for storage that isn't persistent and for a library that can't open; `?reset` asks first; a panic shows a message. Missing: `?safe` start, deleting originals of removed photos, zip64 (backups > 4 GB) |
-| LR-BEHAV-GPU | GPU acceleration | P0 | ✅ | `crates/gpu/src/render.rs`, `cmd:app.gpu`, `docs/gpu-pipeline.md` | CPU fallback per render on device limits, out of memory, device errors / loss, incomplete or black results (`perf.gpuReason`, `perf.gpuFallback`); short submissions for slow iGPUs; backend choice (DX12 only on Windows, `LIGHTCRAFT_GPU_BACKEND` / `WGPU_BACKEND`), device created after the window opens, crash sentinel (issue #136); no tiling beyond the buffer limit (CPU) |
-| LR-BEHAV-RENDER-FIDELITY | Rendering matches Lightroom | P1 | 🟡 | `crates/pipeline/src/lib.rs`, `crates/pipeline/src/tone.rs` | every slider exists and works, but the character of the result (tone curve shape, highlight recovery, texture / clarity / dehaze, noise reduction, sharpening, default look) is tuned by eye; there is no systematic side-by-side comparison against Lightroom on the same CC0 raws. Needs a fidelity suite: Lightroom reference renders kept only in the local `plan/` (never committed), compared per slider and preset with a perceptual metric |
+| LR-BEHAV-GPU | GPU acceleration | P0 | ✅ | `crates/gpu/src/render.rs`, `cmd:app.gpu`, `docs/gpu-pipeline.md` | CPU fallback per render on device limits, out of memory, device errors / loss, incomplete or black results (`perf.gpuReason`, `perf.gpuFallback`); short submissions for slow iGPUs; backend choice (DX12 only on Windows, `LIGHTCRAFT_GPU_BACKEND` / `WGPU_BACKEND`), device created after the window opens, crash sentinel (issue #136); quitting waits (up to 2 s) for renders in flight and starts no new GPU work, so none is inside the driver when the process exits (`crates/gpu/src/exit.rs`, issue #620; seen crashing only on Linux + NVIDIA, other drivers unverified); no tiling beyond the buffer limit (CPU) |
+| LR-BEHAV-RENDER-FIDELITY | Rendering matches Lightroom | P1 | 🟡 | `crates/pipeline/src/lib.rs`, `crates/pipeline/src/tone.rs` | every slider exists and works, but the character of the result (tone curve shape, highlight recovery, texture / clarity / dehaze, noise reduction, sharpening, default look) is tuned by eye; there is no systematic side-by-side comparison against Lightroom on the same CC0 raws. Needs a fidelity suite: Lightroom reference renders kept only in the local `plan/` (never committed), compared per slider and preset with a perceptual metric. Tuning that changes how existing settings render ships as a new process version (LRC-DEV-PROCESS, `docs/process-versions.md`) |
 | LR-BEHAV-DRAGDROP | Drag and drop | P1 | ✅ | `crates/ui-egui/src/lib.rs`, `crates/ui-egui/src/panels/grid.rs` (`drag_feedback`), `crates/ui-egui/src/panels/left.rs` (`drop_target`, `album_drag_over`, `top_level_drop_target`, `drag_auto_scroll`) | files → app (import); grid photos → an album row (adds the selection, with a count badge while dragging); sidebar album / folder rows → a folder (moves it; its name follows the pointer); a drag of albums or grid photos near the top or bottom edge of the sidebar scrolls it (faster nearer the edge, only while the pointer is over the sidebar) |
 | LR-BEHAV-TOAST | Toast notifications | P1 | ✅ | `crates/ui-egui/src/panels/mod.rs` | |
 | LR-BEHAV-SIDEBAR-COLLAPSE | Collapsible left-sidebar sections | P2 | ✅ | `crates/ui-egui/src/panels/left.rs` (`sidebar_section_header`), `crates/ui-egui/src/state.rs` (`collapsed_sidebar`), `crates/ui-egui/src/tests_panels.rs` | click the Albums, Local, By Date or Keywords header (or drive `ui.clickWidget` `sidebarSection:<albums\|local\|byDate\|keywords>`) to fold or unfold the section; a chevron after the title shows the state; the choice is kept across restarts (`collapsedSidebar` in the UI state). UI-only (no command), like the By Date / Keywords disclosure triangles; photos dropped on a folded Albums section have no target |
 | LR-BEHAV-PANEL-RESIZE | Resizable side panels | P1 | ✅ | `crates/ui-egui/src/panels/mod.rs` (`resizable_side`), `crates/ui-egui/src/state.rs` (`LEFT_WIDTH`, `RIGHT_WIDTH`), `crates/ui-egui/src/tests_panels.rs` | drag the left sidebar's right edge (200–480 pt) or the right panel's left edge (250–520 pt); the photo area keeps ≥ 360 pt; widths are kept across panels, views and restarts (`leftWidth` / `rightWidth` in the UI state); the Presets column stays fixed |
 | LR-BEHAV-EMPTY-STATES | Empty states | P1 | ✅ | `crates/ui-egui/src/panels/mod.rs` (`empty_message`) | |
 | LR-BEHAV-TOOLTIPS | Tooltips with shortcuts | P0 | ✅ | `crates/ui-egui/src/panels/bottombar.rs` | |
+| LR-BEHAV-TEXTFIELD | Text fields behave alike | P1 | 🟡 | `crates/ui-egui/src/text_field.rs`, `crates/ui-egui/src/panels/topbar.rs`, `crates/ui-egui/src/widgets.rs`, `crates/ui-egui/src/panels/right.rs` (`meta_field`), `crates/ui-egui/src/panels/dialogs.rs`, `crates/ui-egui/src/panels/unnamed.rs` | one shared field: right-click Cut / Copy / Paste / Select All (no Paste in the browser), Esc gives back the text from before the edit, Return / leaving / Esc reported to the caller, optional select-on-focus; agents use `ui.clipboard` (MCP `clipboard`) and `ui.inspect` → `copied`. Used by Search Photos, slider values, the Info panel's metadata fields (multi-line captions), the one-field dialogs (New / Rename Album, New Smart Album, Rename / Merge Keywords, text prompts) and the unnamed faces' name field so far; the other text fields (most dialogs, import, settings, masking, keywords …) still use egui's own and have no menu |
 | LR-BEHAV-HEADLESS | Headless UI snapshots | P2 | ✅ | `apps/lightcraft-cli/src/main.rs`, `crates/ui-egui/src/headless.rs`, `docs/control-protocol.md` | `snapshot` rasterizes the UI and defaults photo development to the CPU before the first frame, without adapter discovery; scaled dimensions are validated before allocation, and UI zoom preserves the requested physical viewport; JSON-lines control scripts are supported |
 | LR-BEHAV-ACCESS | Accessibility | P2 | 🟡 | `crates/ui-egui/src/widgets.rs`, `crates/ui-egui/src/panels/grid.rs` | AccessKit (VoiceOver / Narrator / AT-SPI): sliders announce control and value, buttons / icon buttons / dropdowns / section headers / sources their labels and state, grid thumbnails file name, rating, flag and label; the canvas tools (crop, masks) are pointer-only; not audited with a screen reader |
-| LR-BEHAV-LOCALE | Language options | P2 | ✅ | `cmd:app.language.english`, `cmd:app.language.simplifiedChinese`, `cmd:app.language.traditionalChinese`, `cmd:app.language.japanese`, `cmd:app.language.portuguese`, `cmd:app.language.spanish`, `cmd:app.language.german`, `cmd:app.language.russian` | Edit > Language lists every language in the table and the active one is checked; shared with Settings > General (docs/localization.md) |
-| LR-BEHAV-LOCALIZE | Localisation | P2 | 🟡 | `crates/ui-egui/src/i18n.rs`, `crates/ui-egui/locales/`, `docs/localization.md`, `docs/localization-zh-hans.md`, `docs/localization-zh-hant.md`, `docs/localization-ja.md`, `docs/localization-pt-br.md`, `docs/localization-es.md`, `docs/localization-de.md`, `docs/localization-ru.md` | One table entry per language (code, endonym, ISO 15924 script, catalog): English, Simplified Chinese, Traditional Chinese (Taiwan), Japanese, Brazilian Portuguese, Spanish, German and Russian UI with a persisted language preference and craft-fonts regular/bold faces per script; menus, edit, crop/masks, settings, import/export and primary progress messages. Adding a language is a table entry plus two catalogs. Stock presets/profiles, history steps, library headings, date headings and capture times are localised (user-named items stay verbatim); the German catalog covers every existing catalog key, command/control label and rule-editor label; the other catalogs fall back to English for messages they lack. Technical errors remain English; release notes are translated in German; Traditional Chinese borrows the Simplified Chinese face (no TC face in craft-fonts yet), and the web build embeds only the Japanese face. |
+| LR-BEHAV-LOCALE | Language options | P2 | ✅ | `cmd:app.language.english`, `cmd:app.language.simplifiedChinese`, `cmd:app.language.traditionalChinese`, `cmd:app.language.japanese`, `cmd:app.language.portuguese`, `cmd:app.language.french`, `cmd:app.language.spanish`, `cmd:app.language.german`, `cmd:app.language.russian`, `cmd:app.language.ukrainian` | Edit > Language lists every language in the table and the active one is checked; shared with Settings > General (docs/localization.md) |
+| LR-BEHAV-LOCALIZE | Localisation | P2 | 🟡 | `crates/ui-egui/src/i18n.rs`, `crates/ui-egui/locales/`, `docs/localization.md`, `docs/localization-zh-hans.md`, `docs/localization-zh-hant.md`, `docs/localization-ja.md`, `docs/localization-pt-br.md`, `docs/localization-es.md`, `docs/localization-de.md`, `docs/localization-ru.md` | One table entry per language (code, endonym, ISO 15924 script, catalog): English, Simplified Chinese, Traditional Chinese (Taiwan), Japanese, Brazilian Portuguese, Spanish, German, Russian and Ukrainian UI with a persisted language preference and craft-fonts regular/bold faces per script; menus, edit, crop/masks, settings, import/export and primary progress messages. Adding a language registers the locale and its language command, plus two catalogs. Stock presets/profiles, history steps, library headings, date headings and capture times are localised (user-named items stay verbatim); the Ukrainian catalog covers every existing catalog key, command/control label and rule-editor label; the German catalog reports newly added gaps; the other catalogs fall back to English for messages they lack. Technical errors remain English; release notes are translated in German and Ukrainian; Traditional Chinese borrows the Simplified Chinese face (no TC face in craft-fonts yet), and the web build embeds the Japanese face in WASM while loading the Simplified Chinese face from a separate font file. |
 | LR-BEHAV-LEARN | Tutorials | OOS | 🚫 | | |
 | LR-BEHAV-WHATSNEW | What's new | P2 | ✅ | `cmd:app.whatsNew`, `docs/whats-new.md` | Help ▸ What's New: release highlights |
 | LR-BEHAV-AI-EA | Early-access badges | P2 | ⬜ | | |
@@ -633,7 +637,7 @@ visible menu bar yet: the menu model is only exposed through the control channel
 | MENU-CTX-PRESET | Preset menu | P1 | ✅ | `crates/ui-egui/src/panels/presets.rs` | favourite, update with current settings, rename, move to group, delete; group: export |
 | MENU-CTX-PROFILE | Profile favourites | P2 | ✅ | `cmd:profile.favorite`, `crates/ui-egui/src/panels/profiles.rs` | star in the profile browser; Favorites group first |
 | MENU-CTX-VERSION | Version menu | P1 | ✅ | `crates/ui-egui/src/panels/right.rs` (`versions`) | restore, update with current settings, rename, set as before, delete |
-| MENU-CTX-KEYWORD | Keyword chip menu | P1 | ✅ | `crates/ui-egui/src/panels/right.rs`, `cmd:keyword.delete` | remove from photo, show photos with keyword, rename keyword, delete keyword |
+| MENU-CTX-KEYWORD | Keyword chip menu | P1 | ✅ | `crates/ui-egui/src/panels/keywording.rs` (`menu`) | acts on the selected photos: add to all selected photos (a keyword only some have), remove from selected photos, show photos with keyword, Edit Keyword Tag…; deleting a keyword from the library is the Keyword List's |
 
 ## Z. Keyboard shortcuts (desktop)
 
@@ -649,13 +653,13 @@ From `06-shortcuts.md` part 1. Evidence is our binding; conflicts are explained
 | KEY-GRID | Grid — G | P0 | ✅ | `cmd:view.gridToggle`, `cmd:view.photoGrid` | G toggles Photo Grid ↔ Square Grid |
 | KEY-INFO | Info — I | P0 | ✅ | `cmd:panel.info` | |
 | KEY-KEYWORDS | Keywords — K | P0 | ✅ | `cmd:panel.keywords` | |
-| KEY-CLIPBOARD | Copy / paste edit settings — ⌘C / ⌘V | P0 | ✅ | `cmd:develop.copy`, `cmd:develop.paste` | ⌘X has nothing to cut outside text fields |
+| KEY-CLIPBOARD | Copy / paste edit settings — ⌘C / ⌘V | P0 | ✅ | `cmd:develop.copy`, `cmd:develop.paste`, `crates/ui-egui/src/shortcuts.rs` (`matches`) | ⌘X has nothing to cut outside text fields; on Windows and Linux, where the windowing layer sends Ctrl+C / Ctrl+V as clipboard events rather than key presses, those run the shortcuts too (⇧Insert pastes plainly); there Ctrl+V only arrives while the system clipboard holds text (egui-winit drops it otherwise), so with an empty clipboard Paste Settings needs the menu |
 | KEY-UNDOREDO | Undo / redo — ⌘Z / ⇧⌘Z | P0 | ✅ | `cmd:edit.undo`, `cmd:edit.redo` | |
 | KEY-MINIMIZE | Minimize — ⌘M | P1 | ✅ | `apps/lightcraft/src/native_menu.rs` | native Window ▸ Minimize |
 | KEY-AUTO | Auto — ⇧A | P0 | ✅ | `cmd:develop.auto` | |
 | KEY-PHOTOSHOP | External editor — ⇧⌘E | P2 | ✅ | `cmd:photo.editInExternal` | ⇧⌘E as observed; the export dialog is ⇧E |
 | KEY-ROTATE | Rotate — ⌘[ / ⌘] | P0 | ✅ | `cmd:photo.rotateLeft`, `cmd:photo.rotateRight` | |
-| KEY-ZOOM | Zoom in / out — ⌘= / ⌘− | P0 | ✅ | `cmd:view.zoomIn`, `cmd:view.zoomOut` | |
+| KEY-ZOOM | Zoom in / out — ⌘= / ⌘− | P0 | ✅ | `cmd:view.zoomIn`, `cmd:view.zoomOut`, `crates/ui-egui/src/tests_zoom_keys.rs` | the keys zoom the photo only: egui's own interface zoom on ⌘= / ⌘− / ⌘0 (Ctrl on Windows and Linux, where no native menu bar took the keys first) is off (issue #566) |
 | KEY-SELECTALL | Select all — ⌘A | P0 | ✅ | `cmd:library.selectAll` | |
 | KEY-SELECTNONE | Select none — ⌘D | P0 | ✅ | `cmd:library.selectNone` | secondary binding (primary ⌘⇧A) |
 | KEY-PASTESELECTED | Paste selected — ⇧⌘V | P0 | ✅ | `cmd:dialog.pasteSettings` | |
@@ -739,18 +743,18 @@ From `08-lightroom-classic-extras.md` (Classic-only features) and part 2 of `06-
 | LRC-LIB-SURVEY | Survey view | P2 | ✅ | `cmd:view.survey` | N |
 | LRC-LIB-REFVIEW | Reference view | P2 | ✅ | `cmd:view.reference`, `cmd:photo.setReference`, `crates/ui-egui/src/panels/compare.rs` (`show_reference`) | View ▸ Reference View (⇧R): the reference photo beside the active one (edited with the Edit panel); photo menu ▸ Set as Reference Photo |
 | LRC-LIB-CATALOG-PANEL | Catalog sets | P1 | ✅ | `cmd:library.source` (`missing`) | all, recently added, picks, recently deleted, missing photos (when any) |
-| LRC-LIB-CATALOG-IMPORT | Native Lightroom Classic catalog import | P1 | 🟡 | `cmd:library.inspectLightroom`, `cmd:library.importLightroom`, `crates/engine/src/lightroom_catalog.rs`, `docs/lightroom-catalog-import.md` | read-only `.lrcat` plus committed WAL pages, in-tree read-only Rust SQLite B-tree reader; background inspection/import with progress/cancellation, per-open library identity checks; originals in place, ratings/flags/labels, XMP, hierarchical keywords, collection sets/regular collections, virtual copies, mapped develop settings; stable reimport identities, undo, missing-file placeholders, existing edits preserved. Best-effort deduplicated recovery archives retain settings/history/snapshots/collection rules (32 MiB each, eight archives/128 MiB aggregate); archive limits/write failures and optional-table limits warn without blocking photo import; unrelated unsupported tables and opaque SQL BLOBs skipped. Adobe rendering, AI data and native history replay remain incomplete; no writes to Lightroom catalogs |
+| LRC-LIB-CATALOG-IMPORT | Native Lightroom Classic catalog import | P1 | 🟡 | `cmd:library.inspectLightroom`, `cmd:library.importLightroom`, `crates/engine/src/lightroom_catalog.rs`, `docs/lightroom-catalog-import.md` | read-only `.lrcat` plus committed WAL pages, in-tree read-only Rust SQLite B-tree reader; background inspection/import with progress/cancellation, per-open library identity checks; originals in place, ratings/flags/labels, XMP, hierarchical keywords, collection sets/regular collections, virtual copies, mapped develop settings; stable reimport identities, undo, missing-file placeholders, existing edits preserved. Best-effort deduplicated recovery archives retain settings/history/snapshots/collection rules (32 MiB each, eight archives/128 MiB aggregate); archive limits/write failures and optional-table limits warn without blocking photo import; unrelated unsupported tables and opaque SQL BLOBs skipped. Custom white balance on relative-WB raws (`RAW` in Lightroom's terms) stays As Shot and is reported, since the catalog keeps no as-shot white to shift from (issue #510). Adobe rendering, AI data and native history replay remain incomplete; no writes to Lightroom catalogs |
 | LRC-LIB-CATALOG-LOCK | Catalog open in one program at a time | P1 | ✅ | `cmd:app.openLibrary`, `crates/catalog/src/lock.rs`, `crates/engine/src/library.rs` (`open_library`) | exclusive OS lock on `catalog.lock` for the session (app and `lightcraft-cli --library`); a second opener is refused with who has it (`catalog.lock.owner`: program, process, computer); released by the OS on a crash, so never stale; file systems without locks open unprotected with a warning (the app's notices, `library.info` → `settingsWarnings`, and the CLI's stderr; issue #171); no read-only mode; the browser build (OPFS) has no guard across tabs yet. A library that can't be opened at launch (locked, unreadable, newer format, drive missing) shows a window — Try Again, Choose Another Library…, Continue Without Saving (then a banner; nothing written), Quit — instead of a silent demo session (`crates/ui-egui/src/panels/library_problem.rs`) |
 | LRC-LIB-FOLDERS | Disk folder tree | P1 | ✅ | `cmd:library.browse`, `cmd:folder.rename`, `cmd:folder.move`, `crates/ui-egui/src/panels/left.rs` (`local_section`, `folder_tree`) | standard places + the browsed folder + Browse Folder…, each an expandable tree of subfolders, breadcrumb navigation; context menu: Rename Folder…, Move Folder To…, Show in Finder (on disk, photos relinked; one undo step each: undo / redo move the folder back and forth, refused when the destination is taken) |
-| LRC-LIB-LIBFOLDERS | Library folders | P1 | ✅ | `cmd:library.folders`, `cmd:library.source` (`libraryFolder`), `cmd:library.filter` (`libraryFolder`), `cmd:library.removeFolder`, `cmd:folder.rename`, `cmd:folder.move`, `crates/catalog/src/folders.rs`, `crates/ui-egui/src/panels/left.rs` (`folders_section`, `folder_menu_for_library`, `row_menu`), `crates/ui-egui/src/tests_panels.rs` | sidebar Folders: the folders the library's photos were imported from, with photo counts (subfolders included), as another way to explore the library next to By Date and Keywords; Local stays the way to browse any folder on disk. Each disk is a row of its own and starts open: a drive letter, a Windows share (`\\server\share`, `\\?\UNC\…`, `\\wsl$\…`), a macOS share or disk (`/Volumes/tokyo`), a Linux mount (`/media`, `/run/media`, `/mnt`, gvfs `smb-share:…`, `/net/<host>`), NFS (`/Network/Servers/<host>`), else “This Computer” — told apart from the stored paths alone, so an offline share lists like a mounted one and the sidebar never waits on a network. Only folders that hold imported photos are listed (browsed, deleted and demo photos don't count); every folder is a row of its own (`Users` → `me` → `Pictures`), and a folder that holds nothing itself and leads to one folder starts open; every level indents one step more than its parent however deep it goes: the whole sidebar (Albums, Local, By Date, Folders, Keywords) scrolls sideways when its widest row is wider than the panel (rows are measured one frame behind; Create Album and the counts stay at the visible edge); a name that does not fit ends in an ellipsis at the count (the full name on hover; a row asks for room for at most 140 pt of its name, so depth, not one long name, makes the sidebar scroll), as does the grid title; selection and hover bars end at the panel's edge; click makes the folder the source, like an album or a Local folder (its photos and those of the folders inside it fill the grid, titled “photos/travel”; the filter bar narrows it further; `library.source` `libraryFolder` + `path`; kept with the library's view), and its row is always opened into view; the shown folder follows a rename or move and their undo (engine-tested; the sidebar test covers rename), is dropped back to All Photos when it is removed or no longer holds a photo, and a smart album made from the view keeps it, also when its rules are edited (the editor has no folder field). Only a folder that shows exactly its own photos can be shown (not the startup disk, not `/Volumes`-like folders above disks, not an empty one). A row that would cover other disks' photos too (the startup disk, `/Volumes`, `/mnt`…) only opens. Right-click (row or triangle): Rename Folder…, Move Folder To…, Show in Finder (on disk, photos relinked, as in Local) and Remove from Library… (asks; moves the folder's photos to Recently Deleted, one undo step, no file touched); a disk row offers Remove Disk from Library… (the command needs `disk: true` for a whole disk or a folder spanning several). Limits: names are compared as written (macOS `/Volumes/tokyo` vs `/Volumes/TOKYO` are two disks; `/Volumes/Macintosh HD/…` and `/…` two rows); no disk capacity / online status; no “include subfolders” switch (a folder always includes the ones inside it); creating a folder and moving photos between folders are not here |
+| LRC-LIB-LIBFOLDERS | Library folders | P1 | ✅ | `cmd:library.folders`, `cmd:library.source` (`libraryFolder`), `cmd:library.filter` (`libraryFolder`), `cmd:library.removeFolder`, `cmd:folder.rename`, `cmd:folder.move`, `cmd:folder.label`, `cmd:folder.scanChanges`, `cmd:folder.synchronize`, `crates/catalog/src/folders.rs`, `crates/engine/src/sync.rs`, `crates/ui-egui/src/sync.rs`, `crates/ui-egui/src/panels/left.rs` (`folders_section`, `folder_menu_for_library`, `row_menu`), `crates/ui-egui/src/tests_panels.rs` | sidebar Folders: the folders the library's photos were imported from, with photo counts (subfolders included), as another way to explore the library next to By Date and Keywords; Local stays the way to browse any folder on disk. Each disk is a row of its own and starts open: a drive letter, a Windows share (`\\server\share`, `\\?\UNC\…`, `\\wsl$\…`), a macOS share or disk (`/Volumes/tokyo`), a Linux mount (`/media`, `/run/media`, `/mnt`, gvfs `smb-share:…`, `/net/<host>`), NFS (`/Network/Servers/<host>`), else “This Computer” — told apart from the stored paths alone, so an offline share lists like a mounted one and the sidebar never waits on a network. Only folders that hold imported photos are listed (browsed, deleted and demo photos don't count); every folder is a row of its own (`Users` → `me` → `Pictures`), and a folder that holds nothing itself and leads to one folder starts open; every level indents one step more than its parent however deep it goes: the whole sidebar (Albums, Local, By Date, Folders, Keywords) scrolls sideways when its widest row is wider than the panel (rows are measured one frame behind; Create Album and the counts stay at the visible edge); a name that does not fit ends in an ellipsis at the count (the full name on hover; a row asks for room for at most 140 pt of its name, so depth, not one long name, makes the sidebar scroll), as does the grid title; selection and hover bars end at the panel's edge; click makes the folder the source, like an album or a Local folder (its photos and those of the folders inside it fill the grid, titled “photos/travel”; the filter bar narrows it further; `library.source` `libraryFolder` + `path`; kept with the library's view), and its row is always opened into view; the shown folder follows a rename or move and their undo (engine-tested; the sidebar test covers rename), is dropped back to All Photos when it is removed or no longer holds a photo, and a smart album made from the view keeps it, also when its rules are edited (the editor has no folder field). Only a folder that shows exactly its own photos can be shown (not the startup disk, not `/Volumes`-like folders above disks, not an empty one). A row that would cover other disks' photos too (the startup disk, `/Volumes`, `/mnt`…) only opens. Right-click (row or triangle): Rename Folder…, Move Folder To…, Show in Finder (on disk, photos relinked, as in Local), Set Color Label ▸ (the five colours with their custom names, None, Edit Label Names…; `folder.label`, one undo step; the row shows the label's dot before its count and says it with its name; kept in the catalog as a folder record under the folder's identity, so it follows Rename / Move and their undo and redo, the folders inside going along), Synchronize Folder… (the dialog opens at once and scans the folder and the folders inside it on a worker thread — the look for new files beside parallel checks of the library's photos — then offers Import new photos (checked; files only browsed in Local count as new), Relink photos whose file was renamed or moved within the folder (checked; matched by content — a Duplicate's too — or, for a photo with no hash on record such as one from a Lightroom catalog, by file size and dimensions when exactly one file agrees), Remove missing photos from the library (to Recently Deleted) and Read metadata updates from XMP sidecars (saved after the photo came in or was last edited here, and saying something the library doesn't; the sidecar wins), with counts and skipped duplicates / unreadable files; `folder.scanChanges` / `folder.synchronize`, which acts on exactly the scan shown — a scan whose folder's photos changed meanwhile is refused and made again in the background — and is one undo step, also with a full history; a folder that isn't there (an unplugged disk) is reported as such, not as every photo missing; a whole disk or a folder holding disks needs `disk: true`; Esc stops the scan; Synchronize hands everything to a worker thread — the import, the checks that moved and missing files are still as found, the sidecar reads — and commits its steps between frames under a progress window with Cancel, so no file is touched on the UI thread) and Remove from Library… (asks; moves the folder's photos to Recently Deleted, one undo step, no file touched); a disk row (not the startup disk) offers Set Color Label ▸, Synchronize Folder… and Remove Disk from Library… (the command needs `disk: true` for a whole disk or a folder spanning several). Limits: names are compared as written (macOS `/Volumes/tokyo` vs `/Volumes/TOKYO` are two disks; `/Volumes/Macintosh HD/…` and `/…` two rows); no disk capacity / online status; no “include subfolders” switch (a folder always includes the ones inside it); creating a folder and moving photos between folders are not here; folders can't be filtered or sorted by label, and a label stays with the old path when the folder is moved outside LightCraft (Find Missing relinks photos, not folder records); Synchronize has no “show import dialog first” or “show missing photos” option, and only knows when a photo came in or was last developed here: a rating, label or metadata change made here (auto-write off) after another app saved the sidecar is listed as an update, and reading it restores the sidecar's older value (reading is never the default); the walk for new files isn't cancelled midway and its depth/entry limits are only logged |
 | LRC-LIB-COLLECTIONS | Collections & sets | P1 | ✅ | `cmd:album.create`, `cmd:album.createSmart`, `cmd:album.toggleTarget`, `cmd:album.setTarget`, `cmd:album.clearQuick` | albums + folders (sets), smart albums (rule editor; rules incl. File Path — the whole string, either separator, case-insensitive), Quick Collection and target album (B in the grids adds / removes the selection; album menu ▸ Set as Target Album; the target is marked +) |
-| LRC-LIB-SMARTCOLL | Smart-collection rules | P1 | ✅ | `cmd:album.createSmart`, `cmd:album.setRules`, `cmd:album.ruleFields`, `cmd:dialog.smartAlbum`, `crates/catalog/src/rules.rs`, `crates/ui-egui/src/panels/rules_editor.rs` | rule editor: match all / any / none, nested groups (⌥+ or + Group), 30 fields (rating, flag, label, type, edits, keywords, any text, filename, file path, format, title, caption, camera, lens, location, creator, copyright, copyright status, capture / import / edit date, ISO, aperture, focal length, megapixels, GPS, virtual copy, album) with text / number / date / in-the-last operators; live match count; also usable as a library filter (`ruleSet`) |
+| LRC-LIB-SMARTCOLL | Smart-collection rules | P1 | ✅ | `cmd:album.createSmart`, `cmd:album.setRules`, `cmd:album.ruleFields`, `cmd:dialog.smartAlbum`, `crates/catalog/src/rules.rs`, `crates/ui-egui/src/panels/rules_editor.rs` | rule editor: match all / any / none, nested groups (⌥+ or + Group), 47 fields. The field menu shows Rating, Pick Flag, Color Label and Any Searchable Text, then one submenu per group (`FIELD_GROUPS`; `album.ruleFields` reports each field's `group`): Source (album — a plain or a smart album, so one smart album can include or exclude another; a rule that would make an album include itself, directly or through others, is refused, and a loop saved anyway can't recurse: inside it, the album being evaluated counts as holding no photos, so an "isn't" rule on it matches every photo, and the sidebar marks it ⚠ —, virtual copy, copy name, in a stack), File (filename, extension, file path, type, format, video duration), Date (capture / import / edit), Keywords & People (keywords, keyword count, people on named faces, people count), Description (title, caption, alt text, creator, copyright, copyright status), Camera Info (camera, lens, focal length, aperture, shutter speed as 1/250, ISO), Location (any, city, state / province, country, GPS), Size (long / short edge, aspect ratio and megapixels, all of the photo as shown: oriented and cropped), Develop (has edits, cropped, treatment), Assisted Culling (focus, best of similar shots); text / number / date / in-the-last operators; live match count; also usable as a library filter (`ruleSet`). Missing vs Classic: develop preset, flash, exposure bias, camera serial, colour profile / bit depth, IPTC Job, smart-preview status. Choice values read as words in every language (Public Domain, Black & White; `album.ruleFields` gives `choiceLabels`), while rules store the ids; yes/no fields read Yes / No and take `true`/`false`, `"yes"`/`"no"`, `"true"`/`"false"` or 1/0. Every value is checked against its field (`RuleSet::check`): numbers (rating 0–5), shutter speeds, dates (`2026`, `2026-08`, `2026-08-14`, then `T10`, `T10:00` or `T10:00:00`, a space working as the `T`, and after whole seconds a fraction and a time zone as imported capture times carry them (`.250+02:00`); no 30 February; `rules::rule_date` is the one reading for the check and the matcher; each date field has a calendar picker, `crates/ui-egui/src/date_picker.rs`, that picks a year, a month or a day and keeps a "between" in order), between = two bounds in order, in the last = more than 0 of a known unit, choices (ids, the flag's picked / rejected, a colour label's custom name), text with something to look for, an existing album (plain or smart, not a folder), no empty groups; each problem names its rule (`rule 2.1: no rating 0–5 is 9`), and album.createSmart / setRules / library.filter refuse them. The editor marks each bad rule under its row (inside groups too), keeps OK disabled until they are fixed (and its confirm refuses them before renaming anything), picks an Album rule's album with an album picker (`crates/ui-egui/src/album_picker.rs`: the sidebar's tree with folders, or type part of a name or folder; ↑ / ↓ / Enter; albums that can't be picked shown greyed with the reason) (is / isn't; a folder can't be tested), and drawing it never changes a rule: a rating of 9, "in the last 0 days" or 20,000 days, a "between" that isn't a pair all stay as stored (and are marked where they can't match) until edited. Album rules saved with an old operator (≥, between) are read as the "isn't" they always meant (`RuleSet::upgrade`). Saved smart albums whose rules no longer check are marked ⚠ in the sidebar (tooltip: what to fix; `albums.list` `problems`, `Catalog::smart_album_problems`); the name and rules of an album are saved as one undo step (`album.setRules` `name`). Problems read as the field's name and the issue in the editor's language (“Titel: braucht einen Suchbegriff”; `Problem::issue` / `field`, `Issue::text`, translated in every locale), while commands keep the English `rule 2.1: …` message for agents |
 | LRC-LIB-PUBLISH | Publish services | P2 | ⬜ | | |
 | LRC-LIB-FILTERBAR | Library filter bar | P1 | ✅ | `cmd:view.filterBar`, `cmd:filter.applyPreset`, `cmd:library.filter` (`labels`, `ruleSet`), `crates/ui-egui/src/panels/filterbar.rs` | rating/flag/label (several labels at once = any of them)/kind/edited/camera/lens/keyword, clear, save as smart album, filter presets; the filter stays as you change albums (always locked, as in the desktop app); arbitrary conditions via the smart-album rule editor |
 | LRC-LIB-STACKS | Stacks (full) | P1 | ✅ | `crates/catalog/src/stacks.rs`, `cmd:stack.group`, `cmd:stack.split`, `cmd:stack.moveUp`, `cmd:stack.moveDown` | group / ungroup / toggle / set top / remove / auto by time / split / move up and down |
 | LRC-LIB-VC | Virtual copies | P1 | ✅ | `cmd:photo.virtualCopy` | ⌘' |
 | LRC-LIB-LABELS | Colour-label sets | P1 | ✅ | `cmd:label.sets`, `cmd:label.applySet`, `cmd:label.saveSet`, `cmd:label.deleteSet`, `cmd:label.setNames`, `crates/engine/src/cmd/manage.rs` | built-in Colors / Review sets + user sets (Photo ▸ Set Color Label, Edit Label Names… dialog); names written to and read from `xmp:Label` |
-| LRC-LIB-KEYWORDS | Hierarchical keywords, sets, painter | P1 | ✅ | `crates/catalog/src/keywords.rs`, `cmd:keyword.list`, `cmd:keyword.sets`, `cmd:keyword.toggleFromSet`, `cmd:keyword.saveSet`, `cmd:tool.keywordPainter` | hierarchical `a\|b\|c` keywords (tree, parent filters include children, rename moves children); keyword sets + Recent Keywords (⌥1–⌥9); keyword painter (Keywords panel ▸ Paint: click photos in the grid to toggle a keyword, Esc stops) |
+| LRC-LIB-KEYWORDS | Hierarchical keywords, sets, painter, Keyword List | P1 | ✅ | `crates/catalog/src/keywords.rs`, `crates/ui-egui/src/panels/keyword_list.rs`, `cmd:keyword.list`, `cmd:keyword.create`, `cmd:keyword.edit`, `cmd:keyword.move`, `cmd:keyword.info`, `cmd:keyword.purgeUnused`, `cmd:keyword.setDefaultParent`, `cmd:keyword.sets`, `cmd:keyword.toggleFromSet`, `cmd:keyword.saveSet`, `cmd:tool.keywordPainter` | hierarchical `a\|b\|c` keywords (tree, parent filters include children, rename moves children); keyword sets + Recent Keywords (⌥1–⌥9); keyword painter (Keywords panel ▸ Paint: click photos in the grid to toggle a keyword, Esc stops). Keyword List (Keywords panel): every keyword, those without photos too (a keyword list in the catalog, format version 4), with counts, a filter box, a tri-state tick box for the selection and an arrow to show its photos; + / Create Keyword Tag (name, synonyms, put inside, add to selected photos), double-click / Edit Keyword Tag, − / Delete with confirmation, context menu (create inside, Put New Keywords Inside This Keyword, purge unused keywords); drag a keyword onto another to nest it or onto the list's title for the top level (a merge asks first), drag photos onto a keyword to tag them. The list is there without a selection too; Put New Keywords Inside This Keyword (kept with the keyword in the library, undoable) also places new keywords typed in the Keywords panel. Keyword tag options include on export, export containing keywords and export synonyms shape exported files (names in `dc:subject`, paths in `lr:hierarchicalSubject`), and files' `lr:hierarchicalSubject` paths come back as keywords on import and from sidecars; Person is stored only. Keywording box (`crates/ui-egui/src/panels/keywording.rs`): the selection's keywords as chips (one only some selected photos have marked with an asterisk; × only removes, from every selected photo; with no selection, the active photo's), a Keywords / & Containing / Will Export switch (Lightroom Classic's Keyword Tags views: the keywords to edit, them with their parents, what exported files carry), keyword-set buttons and suggestions that follow the selection, shared text fields for typing and painting. Edit Keyword Set (Keyword Set ▸ Edit Set…): a set's name and nine slots typed in place, empty slots kept so each keyword stays on its ⌥ key, a set renamed in place (`cmd:keyword.saveSet` `replace`) or saved as a new set (`new`, a taken name refused). File ▸ Import Keywords… / Export Keywords… (`cmd:keyword.import`, `cmd:keyword.export`): keyword list files in Lightroom Classic's format (tab-indented, `{synonym}`, `[left out of export]`), which Capture One, darktable, Bridge and Photo Supreme (its Formatted Vocabulary File) read and write too; import adds what is missing in one undo step, export names the keywords Capture One refuses (; , < >). Not yet: synonyms in search, person keywords tied to faces, Keyword Shortcut, IPTC keywords in exported files (Piwigo, RawTherapee), hierarchy from digiKam / ACDSee / Microsoft XMP fields |
 | LRC-LIB-METADATA | Metadata panel & presets | P1 | ✅ | `cmd:photo.setMeta`, `cmd:metadata.savePreset`, `cmd:metadata.applyPreset`, `cmd:metadata.presets`, `cmd:metadata.deletePreset`, `cmd:dialog.captureTime` | IPTC core, accessibility, place, capture-time edit; copyright status (unknown / copyrighted / public domain), rights usage terms and copyright info URL (`photo.setMeta` `copyrightStatus`, `usageTerms`, `copyrightUrl`; XMP Rights Management fields, kept by "copyright only" exports, a smart-album rule); metadata presets (Photo → Metadata Preset, Save Metadata Preset… from the active photo; applied on import from Settings) |
 | LRC-LIB-QUICKDEV | Quick develop | P2 | ✅ | `cmd:develop.quickAdjust`, `crates/ui-egui/src/panels/edit.rs` (`quick_develop`) | grid with several photos selected: Edit panel ▸ Quick Develop steps (exposure ⅓ / 1 stop, contrast, highlights, shadows, whites, blacks, clarity, vibrance, temperature) added to each photo's own value, one undo step |
 | LRC-LIB-PEOPLE | People view | P2 | 🟡 | `cmd:view.people`, `cmd:view.person`, `cmd:faces.person`, `cmd:faces.unnamed`, `cmd:faces.nameFaces`, `crates/ui-egui/src/panels/people.rs`, `crates/ui-egui/src/panels/person.rs`, `crates/ui-egui/src/panels/unnamed.rs` | Named People cards (face close-up, the photo count on the picture, name) for the photos the active filters let through, with the filter chips shown above them, sized by the thumbnail slider. Below them the **Unnamed faces**: every face nobody has named as a cropped picture, look-alikes next to each other once recognition has looked at them, a suggested name on a face the named ones recognise; click or Shift-click to select, type a name, Enter names the whole group in one undo step. A click on a person opens their page: only cropped faces, then **More** (unnamed faces that look like them, best first; click to confirm, × to hide). Every face is shown by the detector's box where the scan has one, so faces are equally close. Until recognition is set up a line at the top offers the next step (Settings ▸ Faces, or Turn on), as does the loupe's name box. No clusters with separators between groups, no persistent reject, no merge of two people
@@ -762,12 +766,13 @@ From `08-lightroom-classic-extras.md` (Classic-only features) and part 2 of `06-
 | LRC-LIB-SLIDESHOW-IMPROMPTU | Impromptu slideshow | P2 | ✅ | `cmd:view.slideshow` | see LR-VIEW-SLIDESHOW |
 | LRC-DEV-SNAPSHOTS | Named snapshots | P1 | ✅ | `cmd:version.create`, `cmd:version.restore` | = versions |
 | LRC-DEV-HISTORY | Full history panel | P1 | ✅ | `cmd:history.list`, `cmd:history.restore`, `cmd:history.clear` | row menu: copy step to before, create version from step, clear history |
-| LRC-DEV-SOFTPROOF | Soft proofing | P2 | 🟡 | `cmd:view.softProof`, `crates/pipeline/src/output.rs` (`Proof`), `crates/ui-egui/src/panels/edit.rs` (`soft_proofing`) | S in the loupe (in grids S stays Expand/Collapse Stack): paper-white surround and "Proof Preview", proof profile (sRGB / Display P3 / Adobe RGB / ProPhoto / Rec. 2020), destination (red) and display (blue) gamut warnings, Create Proof Copy (a named virtual copy). Missing: printer ICC profiles, rendering intent, Simulate Paper & Ink |
+| LRC-DEV-SOFTPROOF | Soft proofing | P2 | 🟡 | `cmd:view.softProof`, `crates/pipeline/src/output.rs` (`Proof`), `crates/ui-egui/src/panels/edit.rs` (`soft_proofing`) | S in the loupe (in grids S stays Expand/Collapse Stack): paper-white surround and "Proof Preview", proof profile (sRGB / Display P3 / Adobe RGB / ProPhoto / Rec. 2020), destination (red) and display (blue) gamut warnings (the display's gamut is the monitor profile's, `cmd:app.displayProfile`, else sRGB), Create Proof Copy (a named virtual copy). Missing: printer ICC profiles, rendering intent, Simulate Paper & Ink |
 | LRC-DEV-AUTOSYNC | Sync / auto sync / paste previous | P1 | ✅ | `cmd:develop.sync`, `cmd:develop.autoSync`, `cmd:develop.pastePrevious` | Edit ▸ Sync Settings / Auto Sync (⌥⇧⌘A): only the changed settings carry over, one undo step, slider drags sync on release, spots / red eye stay per photo; Edit panel banner |
 | LRC-DEV-MATCHEXP | Match total exposures | P2 | ✅ | `cmd:develop.matchExposure` | Photo ▸ Match Total Exposures: the selected photos' Exposure set so shutter × ISO ÷ aperture² plus the slider matches the active photo's |
 | LRC-DEV-CALIB | Calibration panel | P1 | ✅ | `ctl:calibration.*` | |
 | LRC-DEV-TAT | Targeted adjustment tools | P1 | ✅ | `cmd:develop.targeted` (`target`: curve / hue / sat / lum) | |
 | LRC-DEV-DEFAULTS | Per-camera raw defaults | P1 | ✅ | `cmd:library.preferences` (`camera`, `import.perCamera`), `crates/ui-egui/src/panels/settings.rs` | Settings → Import: raw default and per-camera presets |
+| LRC-DEV-PROCESS | Process versions, Update to Current Process | P1 | ✅ | `cmd:develop.updateProcess`, `cmd:develop.reset`, `cmd:develop.get`, `crates/develop/src/settings.rs`, `crates/pipeline/src/finish.rs`, `docs/process-versions.md` | each photo records the rendering process its settings are interpreted by: settings saved before this existed load as V1, new photos and Reset get the latest, virtual copies inherit, copy / paste / sync / presets keep each photo's own; Photo ▸ Update to Current Process (one undo step, enabled while a selected photo is on an older process); a number from a newer LightCraft is kept and renders with the newest known process. Only V1 exists so far: this is what lets a retuned default tone (#146) or stronger Light sliders (#196) ship without changing existing edits |
 | LRC-DEV-VIEWOPTIONS | Develop view options | P2 | ⬜ | | |
 | LRC-DEV-VIDEO | Video frame capture | P2 | ⬜ | | |
 | LRC-MAP-VIEW | Map view | P2 | ⬜ | | |
@@ -795,13 +800,13 @@ From `08-lightroom-classic-extras.md` (Classic-only features) and part 2 of `06-
 | LRC-SS-MUSIC | Slideshow music | P2 | ⬜ | | |
 | LRC-SS-PLAYBACK | Slideshow playback | P2 | ⬜ | | |
 | LRC-SS-EXPORT | Slideshow export | P2 | ⬜ | | |
-| LRC-PRINT-LAYOUTSTYLE | Print layout styles | P2 | ⬜ | | |
+| LRC-PRINT-LAYOUTSTYLE | Print layout styles | P2 | 🟡 | `cmd:dialog.contactSheet`, `cmd:export.contactSheet`, `crates/engine/src/contact_sheet.rs` | paginated contact sheets; single-image/custom package layouts missing |
 | LRC-PRINT-IMAGESETTINGS | Print image settings | P2 | ⬜ | | |
-| LRC-PRINT-LAYOUT | Print layout | P2 | ⬜ | | |
+| LRC-PRINT-LAYOUT | Print layout | P2 | 🟡 | `cmd:export.contactSheet`, `crates/ui-egui/src/panels/dialogs.rs` | A4/Letter, portrait/landscape, 1–8 columns and 1–10 rows; fixed margins and spacing |
 | LRC-PRINT-GUIDES | Print guides | P2 | ⬜ | | |
 | LRC-PRINT-CELLS | Picture-package cells | P2 | ⬜ | | |
-| LRC-PRINT-PAGE | Print page options | P2 | ⬜ | | |
-| LRC-PRINT-JOB | Print job & colour management | P2 | ⬜ | | |
+| LRC-PRINT-PAGE | Print page options | P2 | 🟡 | `cmd:export.contactSheet`, `crates/engine/src/contact_sheet.rs` | optional filename captions; no page backgrounds/identity plates |
+| LRC-PRINT-JOB | Print job & colour management | P2 | 🟡 | `cmd:export.contactSheet`, `cmd:app.contactSheet`, `crates/ui-egui/src/export_task.rs` | PDF export at fixed 150 dpi in sRGB, current edits, background progress/cancel and original protection; no native printer integration, ICC soft proof/print profiles or selectable resolution |
 | LRC-PRINT-TEMPLATES | Print templates | P2 | ⬜ | | |
 | LRC-WEB-LAYOUT | Web gallery layouts | OOS | 🚫 | | |
 | LRC-WEB-SITEINFO | Web gallery site info | OOS | 🚫 | | |
diff --git a/docs/process-versions.md b/docs/process-versions.md
new file mode 100644
index 00000000..f9831b7a
--- /dev/null
+++ b/docs/process-versions.md
@@ -0,0 +1,75 @@
+# Process versions
+
+Every photo's develop settings record the **rendering process** they are interpreted by
+(`DevelopSettings::process`, a `ProcessVersion` in `crates/develop/src/settings.rs`). Lightroom calls
+this the process version. It lets the look of LightCraft improve (a new default tone curve, issue #146;
+stronger Light sliders, issue #196) without changing a single photo someone has already edited.
+
+Today there is one process, **V1**: LightCraft's rendering from before process versions existed.
+
+## The rule
+
+**A change that alters how existing settings render ships as a new process. V1 is frozen.**
+
+- A deliberate change of look (tone model, slider response, default curve, how a stage interprets a
+  value) goes into a new process. Photos stay on the process they have until someone runs Update to
+  Current Process (or Reset).
+- Bug fixes that make output correct where it was broken (a crash, NaN or black output, a decoder
+  error, CPU and GPU disagreeing) are not looks and can land in place, as before.
+- Changes to how a file is decoded or which camera colour it gets change the source, not how settings
+  are interpreted; the process doesn't reach that stage today.
+
+## Adding a process
+
+1. Add a variant to `Process` (`V2`), append it to `Process::ALL` (oldest first), give it its number in
+   `Process::version` and make it `Process::LATEST`.
+2. The compiler then points at every `match` on `Process`. The base tone map is chosen in one place,
+   `lightcraft_pipeline::finish::base_tone` (both the CPU and the GPU renderer take it from there): give
+   V2 its own arm and leave V1's alone. A process that changes another stage branches there the same
+   way, on `s.process.process()`; if that stage is cached (`Plan::lin_key`, the planes in `local.rs`),
+   add the process to its key.
+3. Keep `settings_saved_before_process_versions_load_as_v1` (`crates/develop/src/tests_process.rs`)
+   passing: settings saved without the field must stay V1, not become the new latest. That is the
+   field's `#[serde(default = "ProcessVersion::legacy")]`; the struct-level `Default` gives new
+   settings the latest instead.
+4. Render a few procedural scenes on both processes and compare, and update `docs/parity.md`.
+
+## What gets which process
+
+| | Process |
+|---|---|
+| A newly imported, merged or Lightroom-imported photo | the latest |
+| Settings saved without the field (catalogs and their snapshots, versions and history, `lc:settings` in XMP sidecars, browser libraries: everything from before process versions), or with a damaged value | V1 |
+| Reset (`develop.reset`) | the latest |
+| Reset of a section or a slider | unchanged |
+| Update to Current Process (`develop.updateProcess`) | the latest, for photos on an older one; one undo step. The menu item follows the selection; a call with `ids` / `id` acts on those photos whatever is selected |
+| Virtual copy, duplicate | the source's |
+| Copy / paste / sync / Auto Sync / presets | unchanged (see below) |
+| `crs:` edits (XMP from other raw developers, Lightroom catalogs, imported presets) | unchanged; a new photo has the latest |
+| Restoring a version or history step | the one it had |
+
+**Copy, paste, sync and presets** never carry the process: it is in no settings group, so the photos
+they change keep their own and interpret the pasted values with it. (Lightroom offers the process
+version as a separate checkbox when syncing; LightCraft's groups are coarser and keep it out.) Partial
+settings JSON that names `process` itself (`develop.merge`, a hand-written preset) sets it.
+
+**Lightroom edits** are re-interpreted by LightCraft's mapper (`crates/engine/src/crs.rs`), which is
+written against the current rendering. `crs:ProcessVersion` numbers Adobe's renderer, not ours, and is
+ignored; a photo imported with Lightroom edits is on LightCraft's latest process, and an existing
+LightCraft photo that receives them keeps its own.
+
+**A number this build doesn't know** (a library or sidecar written by a newer LightCraft) loads, is
+kept when saved, and renders with the newest process this build has. Update to Current Process never
+moves a photo to an older process; Reset does move it to this build's latest.
+
+**A damaged value** (anything but a whole number from 0 to 2^32 - 1; `2.0` counts as 2) reads as V1,
+like a missing field, and costs nothing else: the rest of the settings load from the catalog, a
+snapshot, the op log or an `lc:settings` sidecar as usual. The damaged value isn't kept: the photo is
+saved as V1.
+
+## Storage
+
+The process is saved as `"process": <number>` in the settings JSON, except V1, which is left out.
+Settings made before process versions existed are therefore saved exactly as before, and their
+preview-cache keys (`DevelopSettings::hash64`) don't change. `develop.get` (MCP `get_develop`) always
+states the process.
diff --git a/docs/releasing.md b/docs/releasing.md
index 84b016c0..de348811 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -57,7 +57,9 @@ workflow, and bump it (in `release.yml`, five jobs, and `freebsd.yml`) whenever
 shipped language needs: a stale pin still builds, it just ships tofu (issue #319: v0.4.0 pinned a revision
 from before Noto Sans CJK SC, so Simplified Chinese had no glyphs). Before a release, check the pin against
 craft-fonts' `fonts/manifest.txt` and run `CRAFT_FONTS_DIR=../craft-fonts cargo test -p lightcraft-ui-egui i18n`,
-whose glyph-coverage test fails when a language's characters have no face.
+whose glyph-coverage test checks the characters in available faces. `CRAFT_FONTS_REQUIRED=1` now also makes
+the native build fail if the pinned manifest lacks Noto Sans CJK SC Regular (`Hans`) or BIZ UDPGothic Regular;
+the web build requires BIZ UDPGothic Regular and packages Noto Sans CJK SC as a separate asset.
 
 ## Signing credentials
 
diff --git a/docs/web.md b/docs/web.md
index 6d3283c8..2e26f749 100644
--- a/docs/web.md
+++ b/docs/web.md
@@ -52,13 +52,14 @@ codecs) at opt-level 3 and the rest (egui, eframe, serde, glue) at "s". What goe
 is the brotli column: 3.1 MB, 11 % less than the old build's brotli size and 41 % less than its
 gzip size (5.25 MB). `wasm-opt -Oz`, when installed, shrinks it further.
 
-**Fonts.** The browser has no system fonts to fall back on, so Japanese text comes from
+**Fonts.** The browser has no system fonts to fall back on, so CJK text comes from
 [craft-fonts](https://github.com/storytold/craft-fonts), the optional `CRAFT_FONTS_DIR` build
 input (`CRAFT_FONTS_DIR=../craft-fonts cargo xtask web`; release builds always set it). On wasm32
-`crates/engine/build.rs` embeds only BIZ UDPGothic Regular (UI, and the watermark fallback), so
-the module stays well under Cloudflare's 25 MiB per-file limit: measured 2026-10-06, 17.1 MB
-without craft-fonts and 21.8 MB with it (brotli 3.8 MB / 6.3 MB). Without it the web build
-works, but Japanese text has no glyphs.
+`crates/engine/build.rs` embeds only BIZ UDPGothic Regular (UI and watermark fallback). The web
+bundle also ships Noto Sans CJK SC Regular as `lightcraft_zh_hans.otf` and loads it before the UI
+starts. Keeping the 16 MB Chinese face separate leaves the module under Cloudflare's 25 MiB
+per-file limit (the older Japanese-only module measured 21.8 MB). Without `CRAFT_FONTS_DIR`, the
+web build still works, but Chinese and Japanese text lack glyphs.
 
 ## Deploying: headers
 
@@ -111,9 +112,10 @@ are the same in every version, so serve them with `Cache-Control: no-cache` (not
     (`originals/<hash>/<file name>`, so an unzipped backup is browsable; entries are stored, not
     compressed; at most 4 GB). **File ▸ Restore Library from Backup…** reads such a zip into a
     new library folder (`library-restored-<time>/`; originals already stored are skipped, every
-    entry's checksum is verified) and only then switches to it (`active-library` names the
-    folder in use) and reloads: the previous library stays in storage. Both are web-only
-    (`file.backupLibrary`, `file.restoreLibrary`; the desktop library is a folder).
+    entry's checksum is verified, and each restored original must match its content hash) and
+    only then switches to it (`active-library` names the folder in use) and reloads: the previous
+    library stays in storage. Both are web-only (`file.backupLibrary`, `file.restoreLibrary`; the
+    desktop library is a folder).
   - A failed save (quota exceeded, storage cleared) is not silent: the catalog then refuses new
     writes, so commands report `saved in memory but not written`, the top bar shows the unsaved
     warning (as on the desktop, see `docs/control-protocol.md`), and saving is retried every
@@ -122,8 +124,8 @@ are the same in every version, so serve them with `Cache-Control: no-cache` (not
     a reload); a notice says why.
   - One tab at a time: the page holds a Web Lock (`navigator.locks`, `lightcraft-library`); a
     second tab or window shows "LightCraft is already open in another tab" instead of loading
-    its own copy (two copies would overwrite each other's saves). Browsers without Web Locks
-    aren't protected.
+    its own copy (two copies would overwrite each other's saves). Browsers without Web Locks, or
+    that refuse the lock request, aren't protected: the app starts without the guard.
   - If the stored library can't be opened, a notice says the session is temporary and nothing
     is saved; the stored library is left as it was.
   - A panic (wasm is built with `panic = "abort"`) replaces the page with a message saying the
diff --git a/docs/whats-new.md b/docs/whats-new.md
index ccb0be80..8ae60a7e 100644
--- a/docs/whats-new.md
+++ b/docs/whats-new.md
@@ -2,6 +2,124 @@
 
 ## October 2026
 
+### Smart album rules
+- The rule editor's field menu is grouped: Rating, Pick Flag, Color Label and Any Searchable Text at the top, then
+  submenus for Source, File, Date, Keywords & People, Description, Camera Info, Location, Size, Develop and Assisted
+  Culling.
+- New fields: Keyword Count ("2 or more", "exactly 2"…), People and People Count (named faces), Shutter Speed (written
+  as 1/250), File Extension, Video Duration, Copy Name, In a Stack, Alt Text, City, State / Province, Country, Long
+  Edge, Short Edge, Aspect Ratio (landscape / portrait / square), Cropped and Treatment (in color / black & white).
+  Size rules measure the photo as shown: Megapixels now counts the cropped photo, like Long Edge, Short Edge and
+  Aspect Ratio (a 24 MP photo cropped to a square is 16 MP).
+- Choice values read as words in every language: "Public Domain", "Picked", "Black & White" rather than ids like
+  `publicDomain` (rules and agents keep using the ids; `album.ruleFields` adds `choiceLabels`).
+- Rule values are checked: a rating of 9, a date like 2026-13 or "banana", a "between" whose dates are the wrong
+  way round, "in the last 0 days", a colour label that doesn't exist, "contains" with nothing to look for, an
+  album that is gone, or an empty group is reported with its rule ("rule 2.1: no rating 0–5 is 9")
+  instead of quietly matching nothing or everything. New date rules start at the current year.
+- A smart album can include or exclude another smart album: "Keywords contain travel" and "Album isn't Excluded Photos"
+  leaves out whatever Excluded Photos matches, as its rules change. The album picker shows your albums as in the sidebar
+  (folders open on click) or finds them as you type part of a name or folder (↑ / ↓ and Enter to pick); albums that
+  can't be picked, such as one that would make an album include itself, are greyed with the reason. Esc with a dropdown or calendar open in a dialog
+  closes just that.
+- Date rules have a calendar button: pick a day, a month or a whole year (Year / Month / Day), in your language; the
+  two dates of a "between" can't be picked out of order; Esc closes just the calendar. It picks dates, not times (a
+  time is typed, and picking a day replaces one). Typing still works, and "2026-10-01 10:00" (a space for the
+  T) now matches.
+- Rule problems are shown in your language and name the field the way the menu does ("Title: needs something to look
+  for").
+- A smart album whose rules no longer check (an album they test was deleted) is marked ⚠ in the sidebar; its tooltip
+  says what to fix, and `albums.list` reports `problems`.
+- Editing a smart album's name and rules is one step: both or neither, and one undo takes both back
+  (`album.setRules` takes `name`).
+- The rule editor marks each rule that needs fixing right under it and keeps OK disabled until they are fixed. An
+  Album rule is "is" or "isn't" an album, picked with the album picker.
+- Yes/no fields (Has Edits, Cropped, Has GPS…) read Yes / No instead of true / false. A rule sent as `"false"` now
+  means no (it used to count as yes), and a value that is neither yes nor no is refused.
+- Any Searchable Text also finds the state / province, alt text, people and a virtual copy's name.
+
+### Keyword lists
+- File ▸ Import Keywords… and Export Keywords… read and write keyword list files as Lightroom Classic does (a keyword
+  a line, a tab per level, synonyms in braces, keywords left out of export in brackets). Capture One, darktable, Adobe
+  Bridge and Photo Supreme (its Formatted Vocabulary File) use the same files, so keyword lists move between them and
+  LightCraft. Importing adds the keywords you don't have, in one undo step; a file it can't read says which line, or
+  to save it as UTF-8. Exporting warns about keywords Capture One won't import, and names any keyword the format can't
+  hold (such as a name in brackets), which it leaves out so the file always reads back.
+
+### Keyword sets
+- Keyword Set ▸ Edit Set… edits a set's nine keywords in place, one field per ⌥ key, and renames it (or saves the edits as a new
+  set). An empty field leaves its key empty instead of moving the keywords after it; editing Recent Keywords and naming
+  them saves a new set.
+
+### Keywording box
+- The chips at the top of the Keywords panel are the keywords of every selected photo, not only the active one's; a
+  keyword only some of them have is marked with an asterisk (hover: how many). Only the × removes a keyword, from
+  every selected photo; a chip's menu acts on the selection (add to all, remove, show photos, edit) and no longer
+  deletes a keyword from the whole library.
+- Switch to & Containing to see the keywords with the keywords containing them, or to Will Export to see what
+  exported files will carry for the selection.
+- The keyword set's buttons and the suggestions follow the selection too; the typing boxes get the Cut / Copy / Paste
+  menu, and Return in the painter's box starts painting.
+
+### Keyword List
+- The Keywords panel ends with a Keyword List, as in Lightroom Classic: every keyword with its photo count, those no
+  photo has yet too. Filter it, tick a keyword to give it to the selected photos (a dash: only some have it), or click
+  the arrow to see its photos.
+- Create keywords with + (inside the one you picked, with synonyms, and given to the selection if you like), edit one
+  by double-clicking it, delete one with − after a confirmation. Right-click for more: create inside, Put New Keywords
+  Inside This Keyword, Purge Unused Keywords.
+- Drag a keyword onto another to nest it, or onto the list's title to bring it back to the top level; photos dragged
+  from the grid onto a keyword get it.
+- Right-click ▸ Put New Keywords Inside This Keyword: new keywords, made with + or typed in the box above, go inside
+  it. The list is there with no photo selected too, to set up keywords first.
+- Keyword tag options decide what exported files carry: Include on Export, Export Containing Keywords, Export
+  Synonyms. Exports now write keyword names to `dc:subject` and their paths to `lr:hierarchicalSubject`, and keywords
+  imported from files (or read from sidecars) keep the hierarchy `lr:hierarchicalSubject` gives them.
+
+### Text fields
+- Right-click Search Photos, a slider's typed value, the Info panel's fields, the name field of New Album, Rename
+  Album, New Smart Album, Rename Keyword, Merge Keywords and similar dialogs, or the name field under unnamed faces for
+  Cut, Copy, Paste and Select All. Esc in them gives back the text from before you started typing (in the Info panel it
+  no longer saves it). Return in those dialogs now confirms them, and their name opens selected. More fields will
+  follow.
+- On Windows and Linux, Ctrl+C outside a text field copies edit settings and Ctrl+V pastes them (⇧Ctrl+V: Paste
+  Selected Settings). Ctrl+V only reaches LightCraft while the system clipboard holds text; otherwise use Edit ▸ Paste Edit
+  Settings.
+
+### Synchronize Folder
+- Right-click a folder (or a disk other than the startup disk) in the sidebar's Folders section ▸ Synchronize
+  Folder…. The folder and the folders inside it are scanned in the background for photos added on disk, photos whose
+  file is gone, photos whose file was renamed or moved within the folder, and XMP sidecars changed by other apps; then
+  choose what to do: import the new photos and relink the moved ones (the defaults), move the missing ones to Recently
+  Deleted, read the metadata updates. A folder on a disk that isn't connected is reported as such. Synchronizing
+  runs in the background with a progress window and Cancel; everything it does is one undo step, and no file on disk
+  is touched. Agents use `folder.scanChanges` and `folder.synchronize`.
+
+### Folder colour labels
+- Right-click a folder (or a disk other than the startup disk) in the sidebar's Folders section ▸ Set Color Label ▸ a colour or None. The row
+  shows the label's dot before its photo count. Agents use `folder.label` (`path`, `label`); `library.folders`
+  reports each row's `label`.
+- A label follows its folder when it is renamed or moved in LightCraft, together with the labels of the folders
+  inside it; undo and redo carry them back and forth.
+- The catalog format is now version 4 (`Catalog.folder_records`, `Op::SetFolderRecord`). Once this version has
+  opened a library, older versions refuse it, as with every format change.
+
+### Monitor profiles
+- Settings ▸ Display ▸ Choose Profile… shows photos through your monitor's ICC profile (matrix/TRC or LUT-based), so
+  colours are right on wide-gamut and calibrated displays instead of oversaturated. The Detail view renders straight
+  into the display's own gamut; thumbnails and other previews are converted to it. Histograms, the preview caches
+  and exports don't change. Agents use `app.displayProfile`. See [display profiles](display-profiles.md).
+
+### Masking
+- Drag anywhere inside the selected radial gradient's ellipse to move it, including rotated
+  ellipses and radial components in compound masks. Edge and rotation handles keep their existing
+  functions, and one Undo restores the entire drag.
+
+### Crop rotation
+- Outside the crop box, where dragging rotates the photo, the pointer is a curved double arrow, and the angle is shown
+  next to it while you rotate (issue #534). For an exact angle, type it in the new Angle field under Straighten and press Return
+  (Esc keeps the old angle; a decimal comma works too), or click the Straighten value; hovering any slider's value now says it can be typed.
+
 ### Albums tree
 - Album folders fold with the same disclosure triangle as Local, By Date, Folders and Keywords.
 - Right-click a folder ▸ New ▸ Create Album… / Create Smart Album… / Create Smart Album from Filter… / Create Folder…
@@ -32,13 +150,27 @@
   belonged to another command moves to the new one. Menus show the new keys; agents use `app.setShortcut`.
 
 ### RAW decoding
+- Olympus ORF raws get the starting look fitted to the camera's own JPEG too, instead of opening flat and grey (the
+  E-1, E-400 and XZ-2 corpus files: all accepted), with white balance relative to the as-shot look as for the other
+  formats. On an E-1 photo the starting render moved from ΔE00 11.3 to 8.3 against Lightroom's. Photos already
+  imported pick it up when re-rendered.
+- Samsung SRW files without compression now open as raws: NX5, NX10, NX11, NX20, NX200, NX210, NX1000, NX1100, EX1
+  and WB2000. The compressed ones (NX1, NX30, NX300, NX500, NX2000, NX3000, NX3300, NX mini) still open from their
+  camera JPEG. Photos already imported pick the change up on Reload.
+- Canon CR2 raws no longer open too dark with blocked-up shadows: the black level was measured over border columns
+  that light already reaches (left of the image area Canon records), 4 % of the range too high on the EOS 6D. It is
+  now measured on the masked columns alone (8 corpus bodies, EOS 40D to 5DS R). On a 6D photo the starting render
+  moved from ΔE00 7.6 to 5.2 against Lightroom's.
 - Canon CR2 and Pentax PEF raws get the same starting look fitted to the camera's own JPEG as ARW, NEF, RW2, RAF
   and CR3, instead of opening flat and desaturated (issue #310). Photos already imported pick it up when re-rendered.
 - JPEG XL compressed DNGs (DNG 1.7) now open: lossless tiles decode sample for sample (checked on synthetic files);
-  lossy tiles decode too, but no real file has checked them yet. A JPEG XL preview stored in the DNG is used like an
+  lossy tiles decode too, keeping the raw values above 1.0 instead of clipping them (checked on one real file). A tile that cannot be decoded makes the file open from its embedded
+  preview, with the reason, instead of showing a black tile. A JPEG XL preview stored in the DNG is used like an
   embedded JPEG.
 - Apple ProRAW's gain table map (its local tone mapping, `ProfileGainTableMap`) is now read and kept when a photo is
-  exported or converted to DNG. It is not applied to the render: Lightroom Classic renders ProRAW without it.
+  exported or converted to DNG. It is not applied by default: Lightroom Classic renders ProRAW without it. To see a
+  ProRAW the way the iPhone renders it, turn on Profile ▸ Camera local tone mapping (shown for photos that carry the
+  map); the option is per photo, so presets and Copy Settings carry it.
 - iPhone ProRAW and other DNGs that carry their own segmentation mattes (DNG semantic masks) use them for the Select
   Sky, Subject and Background masks instead of our heuristics, so the sky is selected where the camera found it
   (checked on one CC0 iPhone 12 Pro ProRAW). Photos without mattes are unchanged.
@@ -49,6 +181,8 @@
   are unchanged; photos imported before this change get it when imported again.
 - Canon CR3 raws now develop from their sensor data: lossless RAW and C-RAW, checked sample for sample on the EOS
   M50, R100 and R8. CR3 files the decoder can't read yet still open from their embedded JPEG, as before.
+- Canon EOS R7 C-RAW files develop from their sensor data too, instead of opening from their embedded JPEG. For R7
+  C-RAWs imported earlier, Photo ▸ Reload from Disk picks up the raw data.
 - Canon CRW, Minolta MRW, Sigma X3F, Kodak KDC, Leaf MOS and Epson ERF files that LightCraft can't decode yet
   now import as "preview only" with their embedded JPEG instead of failing. A raw whose data is damaged but whose
   preview is intact does the same.
@@ -70,6 +204,12 @@
 - HEIC / HEIF photos (iPhone and Mac) open now: the optional `lightcraft-heif` crate (heic-rs, pure Rust) behind
   codecs' `heif` feature — 8- and 10-bit, alpha, grid tiles, the container's rotation/mirror/crop, ICC, EXIF and XMP.
   Off by default (HEVC patents are the distributor's call, same as PhotoCraft); official builds pass `--features heif`.
+- HEIC colours now match libheif to within one code value (they were up to ~10 off): the HEVC stream's own
+  full-range/matrix signalling is honoured (iPhone photos are full range), chroma is upsampled like libheif, grids
+  take their tiles' ICC profile, and `imir` mirrors the way libheif writes it. Importing a HEIC reads its size from
+  the container instead of decoding it; small previews use the file's embedded thumbnail. The release packages
+  (macOS, Windows, Linux, FreeBSD, Nix) now really are built with HEIC support; a build without it reports
+  "HEIC/HEIF support isn't included in this build" for each `.heic`/`.heif` at import.
 
 ### Presets and profiles
 - Import presets from other editors: XMP presets, classic `.lrtemplate` files, "DNG presets" from mobile apps and `.zip`
@@ -81,7 +221,8 @@
   white, empty Point Color slots…) as settings that couldn't be carried over.
 - A preset whose lens-profile switch is off no longer turns off the lens corrections built into a DNG (iPhone ProRAW
   and other files with embedded distortion / vignetting corrections), matching what the preset does elsewhere.
-- A red / green / blue curve in an XMP preset without the master curve is ignored, as Lightroom ignores it.
+- XMP presets apply their red / green / blue curves only when they also have the master curve and all three channel
+  curves, as Lightroom does: a preset with just one channel curve (or no master curve) leaves the channels alone.
 - Imported `.cube` LUT profiles appear in the Profile menu and the profile browser, grouped by their folder, and stay
   favourites across restarts (issue #328).
 
@@ -127,6 +268,10 @@
 )
 
 ### Reliability
+- The Windows installer asks where to install LightCraft (Program Files by default; upgrades keep the folder you
+  chose) and ends on a page saying it was installed, with a "Launch LightCraft" box. It used to finish without a word,
+  so a successful install looked like nothing had happened (issues #18, #399). Silent installs (`/qn`, `/passive`)
+  show no dialogs and take `INSTALLFOLDER=...`.
 - If the desktop app can't open its window (for example when no graphics device can be used), it now says so in a
   message box that names the log file, instead of quitting without a trace (issue #260).
 - On macOS, single-key shortcuts that appear in the menu bar now work: E, C, H, M, ⇧P, I, K, D, ratings 0–5,
@@ -149,6 +294,9 @@
   ignored before) chooses the graphics backend; `off` renders on the CPU. The GPU now starts after the window
   is up, and only when Settings ▸ Performance ▸ Use the GPU for rendering is on; if LightCraft ever dies while
   starting the GPU, the next launch starts with GPU rendering off and says how to turn it back on.
+- The Windows app no longer quits at launch with "Parent device is lost" when another program's `dxcompiler.dll` is
+  on the DLL search path without its `dxil.dll` (issue #471): DirectX 12 shaders now always compile with the
+  compiler built into Windows (FXC). `WGPU_DX12_COMPILER=dxc` uses a `dxcompiler.dll` instead.
 - Exports and renders never write over a photo's original (issue #93): exporting into the photo's own folder with
   the same name and "Overwrite" (or Export with Previous repeating it), an exact output path from the control
   channel or MCP, a merge preview path or `lightcraft-cli render IMG.jpg -o IMG.jpg` is refused with a clear
diff --git a/docs/xmp-interop.md b/docs/xmp-interop.md
index 73543231..59ce22b3 100644
--- a/docs/xmp-interop.md
+++ b/docs/xmp-interop.md
@@ -26,7 +26,7 @@ What we write (standard namespaces, so other tools can read the metadata):
 | Capture time, GPS | `exif:DateTimeOriginal`, `photoshop:DateCreated`, `exif:GPSLatitude`/`GPSLongitude` |
 | Pick / reject flag | `lc:flag` (`pick`, `reject`, `none`) |
 | Location | `lc:location` |
-| Develop settings | `lc:settings` — our complete `DevelopSettings` as JSON (exact round trip, incl. masks, spots, crop) |
+| Develop settings | `lc:settings` — our complete `DevelopSettings` as JSON (exact round trip, incl. masks, spots, crop and the rendering process; settings without `process` are V1, see [process-versions.md](process-versions.md)) |
 
 `lc:` is `http://ns.lightcraft.app/lc/1.0/`.
 
@@ -100,15 +100,17 @@ Our pipeline renders differently, so **values carry over but the look is approxi
 We read these fields; we never write them. Only fields in the packet are applied: the result is a partial settings
 object that gets merged like a preset, so everything else keeps its current or default value. Packets marked
 `crs:AlreadyApplied="True"` are skipped, because those pixels already contain the edit. Only process-version 2012+ field
-names are read (e.g. `Exposure2012`, not the older `Exposure`).
+names are read (e.g. `Exposure2012`, not the older `Exposure`). `crs:ProcessVersion` itself numbers the other
+application's renderer and is ignored: the photo keeps LightCraft's own process, the latest for a newly imported photo
+([process-versions.md](process-versions.md)).
 
 | `crs:` field(s) | LightCraft control | Notes |
 |---|---|---|
 | `Exposure2012` | `light.exposure` | EV, 1:1 |
 | `Contrast2012`, `Highlights2012`, `Shadows2012`, `Whites2012`, `Blacks2012` | `light.contrast` … `light.blacks` | −100..100, 1:1 |
 | `WhiteBalance` | `wb.mode` | `As Shot`, `Auto`, `Daylight`, `Cloudy`, `Shade`, `Tungsten`, `Fluorescent`, `Flash`; other names → custom |
-| `Temperature`, `Tint` | `wb.temp`, `wb.tint` | Kelvin / tint for raw files (and presets) |
-| `IncrementalTemperature`, `IncrementalTint` | `wb.temp`, `wb.tint` | rendered files: −100..100 on our relative scale (mired shift around 6500 K, same as the Temp slider) |
+| `Temperature`, `Tint` | `wb.temp`, `wb.tint` | Kelvin / tint as written for raws with a measured illuminant (DNG) and for presets. Raws LightCraft develops relative to their as-shot look (ARW, NEF, RW2, RAF, CR3, CR2, PEF, SRW: 6500 K / 0 means as shot) take the same mired shift from the packet's `AsShotTemperature` / `AsShotTint` instead; without that reference a custom Kelvin stays As Shot and is reported (`Temperature, Tint (custom white balance without AsShotTemperature: kept As Shot)`), because read on the relative scale it would be a large colour cast (issue #510) |
+| `IncrementalTemperature`, `IncrementalTint` | `wb.temp`, `wb.tint` | rendered files: −100..100 on our relative scale (mired shift around 6500 K, same as the Temp slider); a rendered file with only `Temperature` shifts from `AsShotTemperature` like the raws above when it is present |
 | `Vibrance`, `Saturation` | `color.vibrance`, `color.saturation` | 1:1 |
 | `Texture`, `Clarity2012`, `Dehaze` | `effects.texture`, `effects.clarity`, `effects.dehaze` | 1:1 |
 | `HueAdjustment<Band>`, `SaturationAdjustment<Band>`, `LuminanceAdjustment<Band>` | `mixer.<band>.hue/sat/lum` | bands Red, Orange, Yellow, Green, Aqua, Blue, Purple, Magenta |
@@ -117,7 +119,7 @@ names are read (e.g. `Exposure2012`, not the older `Exposure`).
 | `ParametricShadows`, `ParametricDarks`, `ParametricLights`, `ParametricHighlights` | `curve.shadows/darks/lights/highlights` | |
 | `ParametricShadowSplit`, `ParametricMidtoneSplit`, `ParametricHighlightSplit` | `curve.split_shadows/split_mid/split_highlights` | |
 | `CurveRefineSaturation` | `curve.refine_saturation` | 0..100 (100 = curve saturation unchanged) |
-| `ToneCurvePV2012`, `ToneCurvePV2012Red/Green/Blue` | `curve.master/red/green/blue` | `"x, y"` points in 0..255 → 0..1; a straight 0→255 line = no curve; the red / green / blue curves are read only with `ToneCurvePV2012` (Lightroom Classic ignores them without it) |
+| `ToneCurvePV2012`, `ToneCurvePV2012Red/Green/Blue` | `curve.master/red/green/blue` | `"x, y"` points in 0..255 → 0..1; a straight 0→255 line = no curve; the red / green / blue curves are read only when `ToneCurvePV2012` and all three channel curves are present (Lightroom Classic ignores them otherwise: a master + red-only packet renders without the red curve) |
 | `SplitToningShadowHue/Saturation`, `SplitToningHighlightHue/Saturation` | `grading.shadows/highlights.hue/sat` | |
 | `ColorGradeShadowLum`, `ColorGradeHighlightLum` | `grading.shadows/highlights.lum` | |
 | `ColorGradeMidtoneHue/Sat/Lum`, `ColorGradeGlobalHue/Sat/Lum` | `grading.midtones/global.*` | |
diff --git a/flake.lock b/flake.lock
index 5c94f166..ecf87d37 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,17 +3,17 @@
     "craft-fonts": {
       "flake": false,
       "locked": {
-        "lastModified": 1791295400,
-        "narHash": "sha256-e+6HpOYoAFTh6mNfGBBw2njnBzcE8W8+Jybv1+dKOCA=",
+        "lastModified": 1791311399,
+        "narHash": "sha256-4E9OrthE5z39xFXpvpwn4Fn6RH3wX2sF56rZZejZT+I=",
         "owner": "storytold",
         "repo": "craft-fonts",
-        "rev": "abb83316d96aa59c1cf64784289e378fe9fa5695",
+        "rev": "8dcdacd5153e64560d109541a47d806f26f048c0",
         "type": "github"
       },
       "original": {
         "owner": "storytold",
         "repo": "craft-fonts",
-        "rev": "abb83316d96aa59c1cf64784289e378fe9fa5695",
+        "rev": "8dcdacd5153e64560d109541a47d806f26f048c0",
         "type": "github"
       }
     },
diff --git a/flake.nix b/flake.nix
index 6869abf4..e12b1f8a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,7 +12,7 @@
     # glyphs. Pinned to the revision the release workflow uses — bump deliberately
     # (`nix flake update craft-fonts`); craftrules standards/fonts.md.
     craft-fonts = {
-      url = "github:storytold/craft-fonts/abb83316d96aa59c1cf64784289e378fe9fa5695";
+      url = "github:storytold/craft-fonts/8dcdacd5153e64560d109541a47d806f26f048c0";
       flake = false;
     };
   };
diff --git a/nix/package.nix b/nix/package.nix
index b364b5c4..9e769602 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -75,6 +75,12 @@ let
     "lightcraft"
     "lightcraft-cli"
   ];
+
+  # HEIC/HEIF decoding (opt-in upstream: HEVC patents are the distributor's call), as the release builds.
+  buildFeatures = [
+    "lightcraft/heif"
+    "lightcraft-cli/heif"
+  ];
 in
 rustPlatform.buildRustPackage {
   pname = "lightcraft";
diff --git a/omastore.toml b/omastore.toml
new file mode 100644
index 00000000..c0036893
--- /dev/null
+++ b/omastore.toml
@@ -0,0 +1,11 @@
+kind = "app"
+categories = ["Graphics", "Photography"]
+icon = "assets/app-icon/hicolor/256x256/apps/ai.storyteller.lightcraft.png"
+
+[linux.x86_64]
+asset = "lightcraft-{version}-linux-x86_64.tar.gz"
+exec = "lightcraft-{version}-linux-x86_64/bin/lightcraft"
+
+[linux.aarch64]
+asset = "lightcraft-{version}-linux-aarch64.tar.gz"
+exec = "lightcraft-{version}-linux-aarch64/bin/lightcraft"
diff --git a/packaging/freebsd/package.sh b/packaging/freebsd/package.sh
index 0f3b928a..665444f8 100755
--- a/packaging/freebsd/package.sh
+++ b/packaging/freebsd/package.sh
@@ -47,7 +47,7 @@ echo "==> LightCraft $VERSION for FreeBSD $ARCH"
 # The release VM has 12 GB; full parallelism on the biggest crates runs it out of memory.
 export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-4}"
 if [ "$SKIP_BUILD" = 0 ]; then
-  (cd "$ROOT" && cargo build --release --locked -p lightcraft -p lightcraft-cli)
+  (cd "$ROOT" && cargo build --release --locked -p lightcraft -p lightcraft-cli --features lightcraft/heif,lightcraft-cli/heif)
 fi
 WORK="$CARGO_TARGET_DIR/freebsd-package"
 STAGE="$WORK/$BASENAME"
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index e03cab5c..441cd69c 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -42,7 +42,7 @@ BASENAME="lightcraft-$VERSION-linux-$ARCH"
 echo "==> LightCraft $VERSION for Linux $ARCH ($FORMATS)"
 
 if [ "$SKIP_BUILD" = 0 ]; then
-  (cd "$ROOT" && cargo build --release --locked -p lightcraft -p lightcraft-cli)
+  (cd "$ROOT" && cargo build --release --locked -p lightcraft -p lightcraft-cli --features lightcraft/heif,lightcraft-cli/heif)
 fi
 BIN="$CARGO_TARGET_DIR/release"
 WORK="$CARGO_TARGET_DIR/linux-package"
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 5416e0db..b43166f1 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -58,7 +58,7 @@ echo "==> LightCraft $VERSION for macOS ($ARCH), identity: $IDENTITY, notarize:
 if [ "$SKIP_BUILD" = 0 ]; then
   args=()
   for t in "${TARGETS[@]}"; do args+=(--target "$t"); done
-  (cd "$ROOT" && cargo build --release --locked -p lightcraft -p lightcraft-cli "${args[@]}")
+  (cd "$ROOT" && cargo build --release --locked -p lightcraft -p lightcraft-cli --features lightcraft/heif,lightcraft-cli/heif "${args[@]}")
 fi
 
 rm -rf "$WORK"
diff --git a/packaging/web/README.md b/packaging/web/README.md
index 924f32e5..77797242 100644
--- a/packaging/web/README.md
+++ b/packaging/web/README.md
@@ -15,6 +15,8 @@ static site in `lightcraft-web-<version>/`:
 | `lightcraft_web.js` | wasm-bindgen glue (generated, ES module) |
 | `lightcraft_web_bg.wasm` | The app, about 13 MB (about 3 MB with brotli) |
 | `worker.js` | Starts the render workers (each runs the same module) |
+| `lightcraft_zh_hans.otf` | Simplified Chinese UI font, included when built with `CRAFT_FONTS_DIR` |
+| `OFL-noto-sans-cjk-sc.txt` | The bundled Chinese font's SIL Open Font License |
 | `*.gz`, `*.br` | Precompressed copies of the files above (optional to serve) |
 | `_headers`, `.htaccess` | Sample header rules for Netlify/Cloudflare Pages and Apache |
 
diff --git a/packaging/windows/lightcraft.wxs b/packaging/windows/lightcraft.wxs
index 37510455..ce98a714 100644
--- a/packaging/windows/lightcraft.wxs
+++ b/packaging/windows/lightcraft.wxs
@@ -1,10 +1,13 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
-  LightCraft MSI (WiX Toolset v5: `dotnet tool install -g wix`). Built by package.ps1:
+  LightCraft MSI (WiX Toolset v5: `dotnet tool install -g wix`, plus the UI and Util extensions:
+  `wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2`). Built by package.ps1:
 
-    wix build lightcraft.wxs -arch x64 -d Version=1.2.3 -d BinDir=... -d IconPath=... -o out.msi
+    wix build lightcraft.wxs -arch x64 -ext WixToolset.UI.wixext/5.0.2 -ext WixToolset.Util.wixext/5.0.2
+      -d Version=1.2.3 -d BinDir=... -d IconPath=... -d UiDialogBmp=... -d UiBannerBmp=... -o out.msi
 
-  Per-machine install into Program Files, a Start Menu shortcut, `.pcraft` owned by LightCraft,
+  Per-machine install into Program Files (or the folder chosen in the installer, or
+  `INSTALLFOLDER=...` on the msiexec command line; upgrades keep it), a Start Menu shortcut, `.pcraft` owned by LightCraft,
   and LightCraft offered under "Open with" for PSD/PSB and the image formats it reads (without
   taking over the user's default app for them).
 -->
@@ -33,13 +36,133 @@
     <StandardDirectory Id="ProgramFiles6432Folder">
       <Directory Id="INSTALLFOLDER" Name="LightCraft" />
     </StandardDirectory>
+    <!-- The folder of the installed version (written by LightcraftApp), so an upgrade installs
+         where the user chose instead of moving back to Program Files (issue #399). Searched into
+         its own property: AppSearch would otherwise overwrite INSTALLFOLDER=... given to msiexec. -->
+    <Property Id="PREVIOUSINSTALLFOLDER">
+      <RegistrySearch Id="PreviousInstallFolder" Root="HKLM" Key="Software\LightCraft" Name="InstallFolder" Type="raw" />
+    </Property>
+    <SetProperty Id="INSTALLFOLDER" Value="[PREVIOUSINSTALLFOLDER]" After="AppSearch" Sequence="both"
+        Condition="PREVIOUSINSTALLFOLDER AND NOT INSTALLFOLDER" />
     <StandardDirectory Id="ProgramMenuFolder" />
 
     <Feature Id="Main" Title="LightCraft" Level="1">
       <ComponentGroupRef Id="LightcraftFiles" />
     </Feature>
+
+    <UIRef Id="LightcraftUI" />
   </Package>
 
+  <!--
+    Interactive install UI: Welcome -> Destination Folder -> Ready to install -> progress ->
+    "Completed" (Finish), with a "Launch LightCraft" checkbox (checked by default). Destination
+    Folder (issue #399) shows Program Files\LightCraft, or the installed version's folder on an
+    upgrade; Change... browses, and a folder that can't be used (InvalidDirDlg) is refused before
+    anything is installed. Failure and cancellation end on WiX's standard FatalError / UserExit
+    dialogs instead of the completion page. Maintenance (running the MSI again, Repair/Remove from
+    Apps) uses the standard maintenance dialogs.
+
+    This is WixUI_InstallDir without its licence-acceptance page: LightCraft is MIT OR Apache-2.0,
+    which ask nothing of people who just install and run it, so a click-through EULA would only
+    add a step. Silent (/qn) and basic-UI (/passive, /qb) installs never show these dialogs, so
+    they are unaffected, and nothing is launched.
+
+    The dialogs, strings and error/cancel pages come from WixToolset.UI.wixext; the side and
+    banner bitmaps are plain panels generated by package.ps1 (no third-party artwork).
+  -->
+  <Fragment>
+    <WixVariable Id="WixUIDialogBmp" Value="$(var.UiDialogBmp)" />
+    <WixVariable Id="WixUIBannerBmp" Value="$(var.UiBannerBmp)" />
+
+    <Property Id="WIXUI_EXITDIALOGOPTIONALTEXT"
+        Value="LightCraft has been installed. You can start it at any time from the Start menu." />
+    <Property Id="WIXUI_EXITDIALOGOPTIONALCHECKBOXTEXT" Value="Launch LightCraft" />
+    <Property Id="WIXUI_EXITDIALOGOPTIONALCHECKBOX" Value="1" />
+
+    <!-- "Launch LightCraft" on Finish. WixUnelevatedShellExec (Util extension) asks the desktop
+         shell (Explorer) to start the program, so it runs as the signed-in user at normal
+         integrity even when the installer UI itself is elevated (e.g. msiexec started from an
+         admin prompt); it never runs from the elevated/SYSTEM server side. It is a UI-only control
+         event, so silent and passive installs never run it. Return="ignore": a failed launch must
+         not turn a successful install into an error. -->
+    <Property Id="WixUnelevatedShellExecTarget" Value="[#LightcraftExe]" />
+    <CustomAction Id="LaunchLightcraft" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)"
+        DllEntry="WixUnelevatedShellExec" Execute="immediate" Impersonate="yes" Return="ignore" />
+
+    <UI Id="LightcraftUI">
+      <TextStyle Id="WixUI_Font_Normal" FaceName="Tahoma" Size="8" />
+      <TextStyle Id="WixUI_Font_Bigger" FaceName="Tahoma" Size="12" />
+      <TextStyle Id="WixUI_Font_Title" FaceName="Tahoma" Size="9" Bold="yes" />
+      <Property Id="DefaultUIFont" Value="WixUI_Font_Normal" />
+
+      <DialogRef Id="ErrorDlg" />
+      <DialogRef Id="FatalError" />
+      <DialogRef Id="FilesInUse" />
+      <DialogRef Id="MsiRMFilesInUse" />
+      <DialogRef Id="PrepareDlg" />
+      <DialogRef Id="ProgressDlg" />
+      <DialogRef Id="ResumeDlg" />
+      <DialogRef Id="UserExit" />
+      <DialogRef Id="WelcomeDlg" />
+      <DialogRef Id="InstallDirDlg" />
+      <DialogRef Id="BrowseDlg" />
+      <DialogRef Id="InvalidDirDlg" />
+      <DialogRef Id="DiskCostDlg" />
+      <DialogRef Id="VerifyReadyDlg" />
+      <DialogRef Id="MaintenanceWelcomeDlg" />
+      <DialogRef Id="MaintenanceTypeDlg" />
+
+      <!-- The folder InstallDirDlg edits. -->
+      <Property Id="WIXUI_INSTALLDIR" Value="INSTALLFOLDER" />
+
+      <!-- First install / upgrade: Welcome -> Destination Folder -> Ready to install. A patch skips
+           the folder (it can't move an installed product). -->
+      <Publish Dialog="WelcomeDlg" Control="Next" Event="NewDialog" Value="InstallDirDlg" Condition="NOT Installed" />
+      <Publish Dialog="WelcomeDlg" Control="Next" Event="NewDialog" Value="VerifyReadyDlg" Condition="Installed AND PATCH" />
+
+      <!-- Destination Folder, as in WixUI_InstallDir: Next sets the folder, validates it (WiX's
+           WixUIValidatePath) and refuses one that can't be used; Change... opens the folder browser,
+           whose OK validates too. -->
+      <Publish Dialog="InstallDirDlg" Control="Back" Event="NewDialog" Value="WelcomeDlg" />
+      <Publish Dialog="InstallDirDlg" Control="Next" Event="SetTargetPath" Value="[WIXUI_INSTALLDIR]" Order="1" />
+      <Publish Dialog="InstallDirDlg" Control="Next" Event="DoAction" Value="WixUIValidatePath_$(sys.BUILDARCHSHORT)" Order="2"
+          Condition="NOT WIXUI_DONTVALIDATEPATH" />
+      <Publish Dialog="InstallDirDlg" Control="Next" Event="SpawnDialog" Value="InvalidDirDlg" Order="3"
+          Condition="NOT WIXUI_DONTVALIDATEPATH AND WIXUI_INSTALLDIR_VALID&lt;&gt;&quot;1&quot;" />
+      <Publish Dialog="InstallDirDlg" Control="Next" Event="NewDialog" Value="VerifyReadyDlg" Order="4"
+          Condition="WIXUI_DONTVALIDATEPATH OR WIXUI_INSTALLDIR_VALID=&quot;1&quot;" />
+      <Publish Dialog="InstallDirDlg" Control="ChangeFolder" Property="_BrowseProperty" Value="[WIXUI_INSTALLDIR]" Order="1" />
+      <Publish Dialog="InstallDirDlg" Control="ChangeFolder" Event="SpawnDialog" Value="BrowseDlg" Order="2" />
+      <Publish Dialog="BrowseDlg" Control="OK" Event="DoAction" Value="WixUIValidatePath_$(sys.BUILDARCHSHORT)" Order="3"
+          Condition="NOT WIXUI_DONTVALIDATEPATH" />
+      <Publish Dialog="BrowseDlg" Control="OK" Event="SpawnDialog" Value="InvalidDirDlg" Order="4"
+          Condition="NOT WIXUI_DONTVALIDATEPATH AND WIXUI_INSTALLDIR_VALID&lt;&gt;&quot;1&quot;" />
+
+      <Publish Dialog="VerifyReadyDlg" Control="Back" Event="NewDialog" Value="InstallDirDlg" Order="1"
+          Condition="NOT Installed" />
+      <Publish Dialog="VerifyReadyDlg" Control="Back" Event="NewDialog" Value="WelcomeDlg" Order="3"
+          Condition="Installed AND PATCH" />
+
+      <!-- Maintenance: Welcome -> Repair / Remove -> Ready. -->
+      <Publish Dialog="MaintenanceWelcomeDlg" Control="Next" Event="NewDialog" Value="MaintenanceTypeDlg" />
+      <Publish Dialog="MaintenanceTypeDlg" Control="RepairButton" Event="NewDialog" Value="VerifyReadyDlg" />
+      <Publish Dialog="MaintenanceTypeDlg" Control="RemoveButton" Event="NewDialog" Value="VerifyReadyDlg" />
+      <Publish Dialog="MaintenanceTypeDlg" Control="Back" Event="NewDialog" Value="MaintenanceWelcomeDlg" />
+      <Publish Dialog="VerifyReadyDlg" Control="Back" Event="NewDialog" Value="MaintenanceTypeDlg" Order="2"
+          Condition="Installed AND NOT PATCH" />
+
+      <!-- Completion page: optionally launch, then close. -->
+      <Publish Dialog="ExitDialog" Control="Finish" Event="DoAction" Value="LaunchLightcraft" Order="1"
+          Condition="WIXUI_EXITDIALOGOPTIONALCHECKBOX = 1 AND NOT Installed" />
+      <Publish Dialog="ExitDialog" Control="Finish" Event="EndDialog" Value="Return" Order="999" />
+
+      <!-- One feature, nothing to change: no "Change" in Apps & features. -->
+      <Property Id="ARPNOMODIFY" Value="1" />
+    </UI>
+
+    <UIRef Id="WixUI_Common" />
+  </Fragment>
+
   <Fragment>
     <ComponentGroup Id="LightcraftFiles" Directory="INSTALLFOLDER">
       <Component Id="LightcraftApp" Guid="8A1D3A39-F7C1-47B1-97AE-40C80BF82F4A">
@@ -50,6 +173,7 @@
         </File>
 
         <RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\lightcraft.exe" Value="[#LightcraftExe]" Type="string" />
+        <RegistryValue Root="HKLM" Key="Software\LightCraft" Name="InstallFolder" Value="[INSTALLFOLDER]" Type="string" />
       </Component>
 
       <Component Id="LightcraftCli">
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index dae31757..e2cd2a8e 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -13,6 +13,8 @@
 
   Needs: Rust (MSVC toolchain + the target), the Windows SDK (rc.exe, signtool.exe),
   and WiX v5: dotnet tool install --global wix --version 5.0.2
+  The WiX UI and Util extensions (installer dialogs, "Launch LightCraft" on Finish) are added to
+  the global WiX extension cache by this script (wix extension add -g ..., needs network once).
 
 .EXAMPLE
   pwsh packaging/windows/package.ps1 -Arch x64
@@ -32,6 +34,29 @@ function Invoke-Native([string] $What, [scriptblock] $Block) {
   if ($LASTEXITCODE -ne 0) { throw "$What failed with exit code $LASTEXITCODE" }
 }
 
+# A 24-bit BMP of two flat colours: $SplitX pixels of $Left, then $Right (colours as R,G,B).
+# Used for the installer's side/banner bitmaps so the MSI ships no third-party artwork.
+function New-PanelBitmap([string] $Path, [int] $Width, [int] $Height, [int] $SplitX, [byte[]] $Left, [byte[]] $Right) {
+  $stride = [int][Math]::Ceiling($Width * 3 / 4) * 4
+  $row = New-Object byte[] $stride
+  for ($x = 0; $x -lt $Width; $x++) {
+    $c = if ($x -lt $SplitX) { $Left } else { $Right }
+    $row[$x * 3] = $c[2]; $row[$x * 3 + 1] = $c[1]; $row[$x * 3 + 2] = $c[0]   # BMP pixels are B,G,R
+  }
+  $pixels = $stride * $Height
+  $ms = [IO.MemoryStream]::new()
+  $w = [IO.BinaryWriter]::new($ms)
+  $w.Write([byte]0x42); $w.Write([byte]0x4D)                                # 'BM'
+  $w.Write([uint32](54 + $pixels)); $w.Write([uint32]0); $w.Write([uint32]54)
+  $w.Write([uint32]40); $w.Write([int32]$Width); $w.Write([int32]$Height)   # BITMAPINFOHEADER
+  $w.Write([uint16]1); $w.Write([uint16]24); $w.Write([uint32]0); $w.Write([uint32]$pixels)
+  $w.Write([int32]2835); $w.Write([int32]2835); $w.Write([uint32]0); $w.Write([uint32]0)
+  for ($y = 0; $y -lt $Height; $y++) { $w.Write($row) }
+  $w.Flush()
+  [IO.File]::WriteAllBytes($Path, $ms.ToArray())
+  $w.Dispose()
+}
+
 # The version lives in one place: [workspace.package] version in the root Cargo.toml.
 $Version = $env:LIGHTCRAFT_VERSION
 if (-not $Version) {
@@ -62,7 +87,7 @@ if (-not $SkipBuild) {
   [Environment]::SetEnvironmentVariable($flagVar, '-C target-feature=+crt-static')
   # Fail the build (rather than warn) if the icon/VERSIONINFO can't be embedded.
   $env:LIGHTCRAFT_REQUIRE_WINRES = '1'
-  Invoke-Native "cargo build ($Target)" { cargo build --release --locked -p lightcraft -p lightcraft-cli --target $Target }
+  Invoke-Native "cargo build ($Target)" { cargo build --release --locked -p lightcraft -p lightcraft-cli --features lightcraft/heif,lightcraft-cli/heif --target $Target }
 }
 
 $Bin = Join-Path $TargetDir "$Target\release"
@@ -91,10 +116,26 @@ Copy-Item (Join-Path $Bin 'lightcraft.exe'), (Join-Path $Bin 'lightcraft-cli.exe
 & (Join-Path $PSScriptRoot 'sign.ps1') (Join-Path $Stage 'lightcraft.exe') (Join-Path $Stage 'lightcraft-cli.exe')
 
 # ---- MSI ---------------------------------------------------------------------------------------
+# Extensions must match the WiX tool version (5.0.2, see release.yml). Re-adding is harmless.
+$WixVersion = '5.0.2'
+$WixExtensions = 'WixToolset.UI.wixext', 'WixToolset.Util.wixext'
+foreach ($ext in $WixExtensions) {
+  Invoke-Native "wix extension add $ext/$WixVersion" { wix extension add -g "$ext/$WixVersion" }
+}
+$ExtArgs = foreach ($ext in $WixExtensions) { '-ext'; "$ext/$WixVersion" }
+
+# Installer dialog bitmaps (WixUI sizes): a brand-blue side panel on the welcome/finish pages and
+# a plain white banner on the inner pages. Generated here, never committed.
+$UiDialogBmp = Join-Path $Stage 'ui-dialog.bmp'
+$UiBannerBmp = Join-Path $Stage 'ui-banner.bmp'
+New-PanelBitmap $UiDialogBmp 493 312 164 ([byte[]](0x4E, 0x7B, 0xFB)) ([byte[]](0xFF, 0xFF, 0xFF))
+New-PanelBitmap $UiBannerBmp 493 58 0 ([byte[]](0xFF, 0xFF, 0xFF)) ([byte[]](0xFF, 0xFF, 0xFF))
+
 $Msi = Join-Path $Dist "lightcraft-$Version-windows-$Arch.msi"
 Invoke-Native 'wix build' {
-  wix build (Join-Path $PSScriptRoot 'lightcraft.wxs') -arch $Arch `
+  wix build (Join-Path $PSScriptRoot 'lightcraft.wxs') -arch $Arch -culture en-us @ExtArgs `
     -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "IconPath=$(Join-Path $Root 'assets\app-icon\lightcraft.ico')" `
+    -d "UiDialogBmp=$UiDialogBmp" -d "UiBannerBmp=$UiBannerBmp" `
     -o $Msi
 }
 # wix writes its debug symbols (.wixpdb) next to the MSI; keep them out of the release assets.
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
index 940bd02b..0f1b1f77 100644
--- a/xtask/Cargo.toml
+++ b/xtask/Cargo.toml
@@ -10,6 +10,8 @@ workspace = true
 
 [dependencies]
 serde_json = { workspace = true }
+# corpus download checksums
+sha2 = { workspace = true }
 # precompressed web bundle (`cargo xtask web`); pure Rust
 flate2 = "1"
 brotli = { version = "8", default-features = false, features = ["std"] }
diff --git a/xtask/src/assets.rs b/xtask/src/assets.rs
index 1680e08c..777dd652 100644
--- a/xtask/src/assets.rs
+++ b/xtask/src/assets.rs
@@ -9,8 +9,8 @@ use std::process::Command;
 /// Extensions treated as assets (lower-case).
 const ASSET_EXT: &[&str] = &[
     "png", "jpg", "jpeg", "gif", "webp", "avif", "svg", "ico", "icns", "bmp", "ttf", "otf", "woff", "woff2", "wav", "mp3", "ogg", "flac", "mp4",
-    "mov", "tif", "tiff", "dng", "cr2", "cr3", "nef", "arw", "raf", "orf", "rw2", "rwl", "raw", "pef", "heic", "jxl", "psd", "cube", "icc", "icm",
-    "xmp",
+    "mov", "tif", "tiff", "dng", "cr2", "cr3", "nef", "arw", "raf", "orf", "rw2", "rwl", "raw", "pef", "srw", "heic", "jxl", "psd", "cube", "icc",
+    "icm", "xmp",
 ];
 /// Adobe-specific formats we never ship (camera/lens profiles, Lightroom templates).
 const FORBIDDEN_EXT: &[&str] = &["dcp", "lcp", "lrtemplate", "lrcat", "lrsmcol", "aco", "ase", "abr"];
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 0db8f6b2..c0a97f59 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -12,7 +12,7 @@ mod stats;
 mod version;
 mod web;
 
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::process::{Command, ExitCode};
 
 const USAGE: &str = "\
@@ -35,7 +35,7 @@ commands:
                   --serve serves it on http://127.0.0.1:<port> (default 8080)
   ci              fmt --check, clippy -D warnings, heif, test, parity refs, layers, assets, wasm (stops at first failure)
   corpus [--download]
-                  show where test corpora live; --download fetches PngSuite and CC0 raw samples (raw.pixls.us) into corpus/
+                  show where test corpora live; --download fetches PngSuite and CC0 raw samples (raw.pixls.us) into corpus/ and checks their sha256
   stats [--exact] count tests and lines per crate (--exact: ask the test harness via `-- --list`)
 ";
 
@@ -268,7 +268,11 @@ fn cmd_ci() -> Result<(), String> {
                 run(c, "cargo clippy -p lightcraft-codecs --features heif --all-targets -- -D warnings")?;
                 let mut c = cargo();
                 c.args(["test", "-p", "lightcraft-codecs", "-p", "lightcraft-heif", "--features", "lightcraft-codecs/heif"]);
-                run(c, "cargo test -p lightcraft-codecs -p lightcraft-heif --features lightcraft-codecs/heif")
+                run(c, "cargo test -p lightcraft-codecs -p lightcraft-heif --features lightcraft-codecs/heif")?;
+                // the engine's HEIC import test, with the decoder (the workspace run checks the error)
+                let mut c = cargo();
+                c.args(["test", "-p", "lightcraft-engine", "--lib", "--features", "lightcraft-codecs/heif", "heic"]);
+                run(c, "cargo test -p lightcraft-engine --lib --features lightcraft-codecs/heif heic")
             }),
         ),
         (
@@ -305,162 +309,521 @@ fn cmd_ci() -> Result<(), String> {
 }
 
 /// CC0 raw samples (raw.pixls.us). Small, representative set; extend freely (CC0 only).
-/// CC0 raw samples from raw.pixls.us (each verified CC0 on the site; files matched by their published SHA-256).
+/// CC0 raw samples from raw.pixls.us (each verified CC0 on the site).
+/// The third field is the SHA-256 of the file as downloaded; `cargo xtask corpus --download` checks it.
 /// One per format / compression variant we decode or deliberately report as unsupported (preview only).
-const RAW_SAMPLES: &[(&str, &str)] = &[
+const RAW_SAMPLES: &[(&str, &str, &str)] = &[
     (
         "arw-sony-a7m3-compressed.arw",
         "https://raw.pixls.us/getfile.php/2414/nice/Sony%20-%20ILCE-7M3%20-%2014bit%2014bit%20compressed%20%283:2%29.ARW",
+        "250784580ea527442c09004417bb0eead484f2bf3ee8f9121a776ac65bb50d0f",
     ),
     (
         "arw-sony-a7m3-uncompressed.arw",
         "https://raw.pixls.us/getfile.php/2418/nice/Sony%20-%20ILCE-7M3%20-%2014bit%2014bit%20uncompressed%20%283:2%29.ARW",
+        "ece80551abf64949dbe826985a80f1d9b265401ee4ea6b989e1829549616fdcd",
+    ),
+    (
+        "arw-sony-a7m4-14bit.arw",
+        "https://raw.pixls.us/getfile.php/6936/nice/Sony%20-%20ILCE-7M4%20-%2014bit%20%283:2%29.ARW",
+        "639a6d4db881f1359e3ea7e1137b314e59417d24e6d4d862b7202111a2c823b2",
     ),
-    ("arw-sony-a7m4-14bit.arw", "https://raw.pixls.us/getfile.php/6936/nice/Sony%20-%20ILCE-7M4%20-%2014bit%20%283:2%29.ARW"),
     // lossless compressed (Compression 7): L is 2×2 CFA cells per LJ92 sample; M and S are subsampled
-    ("arw-sony-a7m4-lossless-l.arw", "https://raw.pixls.us/data/Sony/ILCE-7M4/ILCE-7M4_DSC06674_FullFrame-LossLess-Compressed-Large.ARW"),
-    ("arw-sony-a7m4-lossless-m.arw", "https://raw.pixls.us/data/Sony/ILCE-7M4/ILCE-7M4_DSC06675_FullFrame-LossLess-Compressed-Medium.ARW"),
-    ("arw-sony-a7m4-lossless-s.arw", "https://raw.pixls.us/data/Sony/ILCE-7M4/ILCE-7M4_DSC06676_FullFrame-LossLess-Compressed-Small.ARW"),
-    // pre-2017 bodies: white balance only in the enciphered maker note, black level only in the SR2SubIFD (#148)
-    ("arw-sony-rx100m3.arw", "https://raw.pixls.us/data/Sony/DSC-RX100M3/DSC00734.ARW"),
-    ("arw-sony-rx100.arw", "https://raw.pixls.us/data/Sony/DSC-RX100/DSC00838.ARW"),
-    ("arw-sony-a7rm2-12bit-uncompressed.arw", "https://raw.pixls.us/data/Sony/ILCE-7RM2/12-bit-uncompressed.ARW"),
+    (
+        "arw-sony-a7m4-lossless-l.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7M4/ILCE-7M4_DSC06674_FullFrame-LossLess-Compressed-Large.ARW",
+        "851b43c2116c4139104a5036f83ac3b6a148789b2142214dd7192c13972b25b6",
+    ),
+    (
+        "arw-sony-a7m4-lossless-m.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7M4/ILCE-7M4_DSC06675_FullFrame-LossLess-Compressed-Medium.ARW",
+        "d453005714327addd75bcb99c1c6223173dc92f2a59542d82e6761ef0e0e7571",
+    ),
+    (
+        "arw-sony-a7m4-lossless-s.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7M4/ILCE-7M4_DSC06676_FullFrame-LossLess-Compressed-Small.ARW",
+        "cbbd0930c7d8706dff84c68a2004454266e6fd0d8354f5f76a106b5d776e0223",
+    ),
+    // ILCE-7CR (61 MP), one scene in three codings: lossless compressed L (2×2 CFA cells per LJ92 sample) and M
+    // (subsampled YCbCr), and compressed ARW2
+    (
+        "arw-sony-a7cr-lossless-l.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7CR/DSC00795.ARW",
+        "3e1642f3a1ae7c9f93228c5f09f27e362608e6a4ca1b3e5d8dd9eb8fae576997",
+    ),
+    (
+        "arw-sony-a7cr-lossless-m.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7CR/DSC00796.ARW",
+        "5bcba4acc52a5b902074581b4a2f5fb3c79ec56bd0fdc1746b9e2c0f9d3e9c88",
+    ),
+    (
+        "arw-sony-a7cr-compressed.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7CR/DSC00798.ARW",
+        "f5096e8fbccf0842c8a57763cabd2836608f019eb7fd54f7b22260c2f5bc4da5",
+    ),
+    // a dusk sky clipped in green behind a poplar: the clipped-highlight colour of issue #523
+    (
+        "arw-sony-a7rm4-14bit-compressed.arw",
+        "https://raw.pixls.us/getfile.php/3480/nice/Sony%20-%20ILCE-7RM4%20-%2014bit%2014bit%20compressed%20%283:2%29.ARW",
+        "e6dafe42643f69ab9d1fd00414b7a1f5104df354bb589201600ac934b29b5e4a",
+    ),
+    // pre-2017 bodies: white balance and black level only in the encrypted SR2SubIFD (#148)
+    (
+        "arw-sony-rx100m3.arw",
+        "https://raw.pixls.us/data/Sony/DSC-RX100M3/DSC00734.ARW",
+        "cb81392e3a8810231ce341fb45de3e4d1b9e2f87bc47f3c314d084041ccfd138",
+    ),
+    (
+        "arw-sony-rx100.arw",
+        "https://raw.pixls.us/data/Sony/DSC-RX100/DSC00838.ARW",
+        "579a485b5126a25cbd55cbd5dadfa7d09cf021c99cc7d4869f9e56e3f759390b",
+    ),
+    (
+        "arw-sony-a7rm2-12bit-uncompressed.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7RM2/12-bit-uncompressed.ARW",
+        "71e0888396ef52c7e6a990b4e72ebb4d8413a1fc1c35bada449870539cef6e39",
+    ),
+    // older DSLRs whose SR2SubIFD keeps the black level elsewhere than the bodies above (#535): A500 (27152-byte
+    // layout, like the A450/A550), A700 (62112 bytes)
+    (
+        "arw-sony-a500.arw",
+        "https://raw.pixls.us/data/Sony/DSLR-A500/DSC02421.ARW",
+        "1407fb596a391df67c15b90026a1a76702a2e7386dbdff2f0815b903ea49cead",
+    ),
+    (
+        "arw-sony-a700.arw",
+        "https://raw.pixls.us/data/Sony/DSLR-A700/DSC07249.ARW",
+        "3159e28892bf0771d01525cd4b6190f9c15bbb19fa2fab6d2515ced0594e8f40",
+    ),
+    // SR2SubIFD white balance (#535): the A500 and A700 above, a third layout of a body that had none before
+    // (SLT-A33, 29000 bytes), and two shots whose maker-note gains differ from the preset applied (5600 K, Shade)
+    ("arw-sony-a33.arw", "https://raw.pixls.us/data/Sony/SLT-A33/DSC01867.ARW", "1a59856394f10d4fadb40f5ab9c6d1c89f473f4dbcdefd216fbbbbf1ad8d21f9"),
+    (
+        "arw-sony-a3500-5600k.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-3500/DSC06923.ARW",
+        "04c4fe04425c3e6fff7c8af0f811923c35e750300373357bd54342150c5505d8",
+    ),
+    (
+        "arw-sony-a7s-shade.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7S/DSC04125.ARW",
+        "7cc338a0abc8fdad32d61006f1f8f412297b93e040c7efba572eb2bd8f8e8be2",
+    ),
+    // pre-2017 bodies in the camera's 16:9 mode (#535): the ILCE-7SM2 records it in FullImageSize, the DSLR-A580 only
+    // in the Exif image size
+    (
+        "arw-sony-a7sm2-16x9.arw",
+        "https://raw.pixls.us/data/Sony/ILCE-7SM2/DSC01005.ARW",
+        "46044fb6a9c805f2b4915cd4970316b4d04b0566bcf5287afaad3ef648d7a3db",
+    ),
+    (
+        "arw-sony-a580-16x9.arw",
+        "https://raw.pixls.us/data/Sony/DSLR-A580/RAW_SONY_A580.ARW",
+        "5b0924d39151239dce19e92e08318f4f62a5a8ac276bd7180ec8463d2cfee709",
+    ),
     // CR2 colour-filter layouts differ by model (issue #85): CR2CFAPattern 3 (GBRG) and 1 (RGGB) samples
-    ("cr2-canon-40d.cr2", "https://raw.pixls.us/data/Canon/EOS%2040D/_MG_0153.CR2"),
-    ("cr2-canon-550d.cr2", "https://raw.pixls.us/data/Canon/EOS%20550D/IMG_4047.CR2"),
-    ("cr2-canon-5d2.cr2", "https://raw.pixls.us/data/Canon/EOS%205D%20Mark%20II/08.canon.raw.cr2"),
-    ("cr2-canon-5dsr.cr2", "https://raw.pixls.us/data/Canon/EOS%205DS%20R/_DSR2002.CR2"),
-    ("cr2-canon-6d.cr2", "https://raw.pixls.us/data/Canon/EOS%206D/EOS_6D_RAW.CR2"),
-    ("cr2-canon-7d.cr2", "https://raw.pixls.us/data/Canon/EOS%207D/RAW_CANON_EOS_7D-raw.CR2"),
-    ("cr2-canon-5d3-sraw2.cr2", "https://raw.pixls.us/getfile.php/773/nice/Canon%20-%20EOS%205D%20Mark%20III%20-%20sRAW2%20%28sRAW%29.CR2"),
-    ("cr2-canon-5d3.cr2", "https://raw.pixls.us/getfile.php/771/nice/Canon%20-%20EOS%205D%20Mark%20III.CR2"),
-    ("cr2-canon-80d.cr2", "https://raw.pixls.us/getfile.php/1294/nice/Canon%20-%20EOS%2080D%20-%20RAW%20%283:2%29.CR2"),
-    ("cr3-canon-m50-craw.cr3", "https://raw.pixls.us/getfile.php/2663/nice/Canon%20-%20EOS%20M50%20-%20CRAW%20%283:2%29.CR3"),
-    ("cr3-canon-m50-raw.cr3", "https://raw.pixls.us/getfile.php/4657/nice/Canon%20-%20EOS%20M50%20-%203:2.CR3"),
-    ("cr3-canon-r100-raw.cr3", "https://raw.pixls.us/getfile.php/7896/nice/Canon%20-%20EOS%20R100%20-%20RAW%20%283:2%29.CR3"),
-    ("cr3-canon-r100-craw.cr3", "https://raw.pixls.us/getfile.php/7897/nice/Canon%20-%20EOS%20R100%20-%20CRAW%20%283:2%29.CR3"),
-    ("cr3-canon-r8-raw.cr3", "https://raw.pixls.us/getfile.php/6585/nice/Canon%20-%20EOS%20R8%20-%203:2.CR3"),
-    ("cr3-canon-r8-craw.cr3", "https://raw.pixls.us/getfile.php/6587/nice/Canon%20-%20EOS%20R8%20-%203:2.CR3"),
+    (
+        "cr2-canon-40d.cr2",
+        "https://raw.pixls.us/data/Canon/EOS%2040D/_MG_0153.CR2",
+        "775c806358fedddec7622113a5e399a3330bd5a65e35e37ae1108d8bf58067be",
+    ),
+    (
+        "cr2-canon-550d.cr2",
+        "https://raw.pixls.us/data/Canon/EOS%20550D/IMG_4047.CR2",
+        "f390e0ba566f0be9af2d8e7f955b815996630c0c3cb13fcfb95d98baec1890f6",
+    ),
+    (
+        "cr2-canon-5d2.cr2",
+        "https://raw.pixls.us/data/Canon/EOS%205D%20Mark%20II/08.canon.raw.cr2",
+        "12b3ad6aed9fbcd19ba3bfffcd0769aa5a041d610205eee840bf4b2c420dffae",
+    ),
+    (
+        "cr2-canon-5dsr.cr2",
+        "https://raw.pixls.us/data/Canon/EOS%205DS%20R/_DSR2002.CR2",
+        "01b94b0586419d64894ccdf2e7b9f1defeedc7b51dfcd306c622fe784181a9b8",
+    ),
+    (
+        "cr2-canon-6d.cr2",
+        "https://raw.pixls.us/data/Canon/EOS%206D/EOS_6D_RAW.CR2",
+        "360842779d08fe4805b4a2fe4979f06fdc6da982c85c3acb181f25bcf4c9f536",
+    ),
+    (
+        "cr2-canon-7d.cr2",
+        "https://raw.pixls.us/data/Canon/EOS%207D/RAW_CANON_EOS_7D-raw.CR2",
+        "b5e47c5fcf7332ac03e0134926f17a338a42e68c1fd7f83e16f45f4b767544e8",
+    ),
+    (
+        "cr2-canon-5d3-sraw2.cr2",
+        "https://raw.pixls.us/getfile.php/773/nice/Canon%20-%20EOS%205D%20Mark%20III%20-%20sRAW2%20%28sRAW%29.CR2",
+        "a79065e78a6c5bdbc8726e786ade02d54a7d496cc3cb4504d804c924a3d999da",
+    ),
+    (
+        "cr2-canon-5d3.cr2",
+        "https://raw.pixls.us/getfile.php/771/nice/Canon%20-%20EOS%205D%20Mark%20III.CR2",
+        "ec069b178b9383d80c72f8cdc1b79bd54ca451e7c20793b109d8ad73bef6bdf6",
+    ),
+    (
+        "cr2-canon-80d.cr2",
+        "https://raw.pixls.us/getfile.php/1294/nice/Canon%20-%20EOS%2080D%20-%20RAW%20%283:2%29.CR2",
+        "8f28465cee09844ffad95dbd3ec91923717a329c5ec4f3f405f5b4fce83aaea3",
+    ),
+    (
+        "cr3-canon-m50-craw.cr3",
+        "https://raw.pixls.us/getfile.php/2663/nice/Canon%20-%20EOS%20M50%20-%20CRAW%20%283:2%29.CR3",
+        "15384b775867ec4c42b11882837f1e368cedc0561832ffab271221e6bb80be4c",
+    ),
+    (
+        "cr3-canon-m50-raw.cr3",
+        "https://raw.pixls.us/getfile.php/4657/nice/Canon%20-%20EOS%20M50%20-%203:2.CR3",
+        "1ba9ad6b51b315b88820eb0fe5fd7f52bc136ba37b1a5ca76825ebfe25b18058",
+    ),
+    (
+        "cr3-canon-r100-raw.cr3",
+        "https://raw.pixls.us/getfile.php/7896/nice/Canon%20-%20EOS%20R100%20-%20RAW%20%283:2%29.CR3",
+        "6d83217d58a5e6d2dabcf470430e91a16676b60531c025b81fa7453fc74b0521",
+    ),
+    (
+        "cr3-canon-r100-craw.cr3",
+        "https://raw.pixls.us/getfile.php/7897/nice/Canon%20-%20EOS%20R100%20-%20CRAW%20%283:2%29.CR3",
+        "0b66842b2fe00329ebc05fe8ab9357ddbbe1a0a2d2e69a2893102de7fdf5c942",
+    ),
+    (
+        "cr3-canon-r8-raw.cr3",
+        "https://raw.pixls.us/getfile.php/6585/nice/Canon%20-%20EOS%20R8%20-%203:2.CR3",
+        "7d5c6dbb11ff7e6ee58715d90a20f5d801e8b103f4711ff6ea329ceafcef254c",
+    ),
+    (
+        "cr3-canon-r8-craw.cr3",
+        "https://raw.pixls.us/getfile.php/6587/nice/Canon%20-%20EOS%20R8%20-%203:2.CR3",
+        "df33cf394573645ce03dea1b2e9f0b5cc2b7734e9e3391ee7114151414cf2812",
+    ),
     (
         "dng-adobe-canon-5d3-linear-lj92.dng",
         "https://raw.pixls.us/getfile.php/1032/nice/Adobe%20DNG%20Converter%20-%20Canon%20EOS%205D%20Mark%20III%20-%20Lossless%20JPEG%20compression%2C%20rgb%20%283:2%29.DNG",
+        "0608c9f277307b745530e61b589c465540611df22f9a1fe2d01237c5b2b4c13b",
     ),
     (
         "dng-adobe-canon-5d3-lj92.dng",
         "https://raw.pixls.us/getfile.php/1024/nice/Adobe%20DNG%20Converter%20-%20Canon%20EOS%205D%20Mark%20III%20-%2016bit%2016bit%20Lossless%20JPEG%20compression%20%283:2%29.DNG",
+        "3118116735d4f6dd01fd9d6a80ee9aac52a2c2debdc6dcd112bd5e3059044a55",
     ),
     (
         "dng-adobe-canon-5d3-lossy.dng",
         "https://raw.pixls.us/getfile.php/1023/nice/Adobe%20DNG%20Converter%20-%20Canon%20EOS%205D%20Mark%20III%20-%20Lossy%20JPEG%20compression%20%283:2%29.DNG",
+        "159326856c29073e845c3c5a9ecf98c6474f43ca15798a88ad5e2baecd0664b7",
     ),
     // Apple ProRAW (iPhone 12 Pro, iOS 14.3): LinearRaw LJ92 tiles, ProfileToneCurve, ProfileGainTableMap, a sky matte.
-    // sha256 e91e77a4533ed7cce551d83330676ea5c47dd5e55fb38adda7819366afdbdfc2
-    ("dng-apple-iphone12pro-proraw.dng", "https://raw.pixls.us/data/Apple/iPhone%2012%20Pro/IMG_1361.DNG"),
+    (
+        "dng-apple-iphone12pro-proraw.dng",
+        "https://raw.pixls.us/data/Apple/iPhone%2012%20Pro/IMG_1361.DNG",
+        "e91e77a4533ed7cce551d83330676ea5c47dd5e55fb38adda7819366afdbdfc2",
+    ),
     (
         "dng-canon-5d3-14bit-small.dng",
         "https://raw.pixls.us/getfile.php/2204/nice/Canon%20-%20EOS%205D%20Mark%20III%20-%2014bit%2014bit%20%282.3471882640587%29.dng",
+        "1d77dcc6cdb839b10c1948f0b4471984ab48cf15e973fb77520584cee72b603e",
+    ),
+    (
+        "dng-canon-5d3-16bit-169.dng",
+        "https://raw.pixls.us/getfile.php/2649/nice/Canon%20-%20EOS%205D%20Mark%20III%20-%2016bit%20%2816:9%29.dng",
+        "bc29ac8a37c800346749b9a5a1adc2722357f7f0e49df05a7104454881604b92",
+    ),
+    (
+        "dng-canon-5d3-16bit.dng",
+        "https://raw.pixls.us/getfile.php/885/nice/Canon%20-%20EOS%205D%20Mark%20III%20-%2016bit%2016bit%20RAW.dng",
+        "6275226bfa2d86ba479130999d045ea0b8da6be4b011130c9eb91cd6a0eb2233",
+    ),
+    (
+        "dng-google-pixel2xl.dng",
+        "https://raw.pixls.us/getfile.php/2206/nice/Google%20-%20Pixel%202%20XL%20-%2016bit%20%284:3%29.dng",
+        "5541093a369f0487fef92bcd1f5fef1be6e4e3cec2aa4d52ad38d2211f3309d7",
+    ),
+    (
+        "dng-ricoh-gr3.dng",
+        "https://raw.pixls.us/getfile.php/3115/nice/Ricoh%20-%20GR%20III%20-%2014bit%20%283:2%29.DNG",
+        "05513ee72f7cac4165534c9f64995412084f414a033c80c473c79fd94154292e",
     ),
-    ("dng-canon-5d3-16bit-169.dng", "https://raw.pixls.us/getfile.php/2649/nice/Canon%20-%20EOS%205D%20Mark%20III%20-%2016bit%20%2816:9%29.dng"),
-    ("dng-canon-5d3-16bit.dng", "https://raw.pixls.us/getfile.php/885/nice/Canon%20-%20EOS%205D%20Mark%20III%20-%2016bit%2016bit%20RAW.dng"),
-    ("dng-google-pixel2xl.dng", "https://raw.pixls.us/getfile.php/2206/nice/Google%20-%20Pixel%202%20XL%20-%2016bit%20%284:3%29.dng"),
-    ("dng-ricoh-gr3.dng", "https://raw.pixls.us/getfile.php/3115/nice/Ricoh%20-%20GR%20III%20-%2014bit%20%283:2%29.DNG"),
     (
         "nef-nikon-d5100-lossless.nef",
         "https://raw.pixls.us/getfile.php/1597/nice/Nikon%20-%20D5100%20-%2014bit%2014bit%20compressed%20%28Lossless%29%20%283:2%29.nef",
+        "3ce328830942381648be26b372a54b317fdb27b63c1aa9c2ee1fce076a2e1b4f",
     ),
     (
         "nef-nikon-d5100-uncompressed.nef",
         "https://raw.pixls.us/getfile.php/1598/nice/Nikon%20-%20D5100%20-%2014bit%2014bit%20uncompressed%20%283:2%29.nef",
+        "2fb2f1b87a3b89de5ba9e56527f21a912ca624f2fa2a594cef108ee8d7180412",
     ),
     (
         "nef-nikon-d7000-lossy12.nef",
         "https://raw.pixls.us/getfile.php/961/nice/Nikon%20-%20D7000%20-%2012bit%2012bit%20compressed%20%28Lossy%20%28type%202%29%29%20%283:2%29.NEF",
+        "986db2bf9ed08cf095bb94cfbaf02f0e89d123edad28b63c05133e7815749486",
     ),
     (
         "nef-nikon-d7500-lossless12.nef",
         "https://raw.pixls.us/getfile.php/1532/nice/Nikon%20-%20D7500%20-%2012bit%2012bit%20compressed%20%28Lossless%29%20%283:2%29.NEF",
+        "1f4e58a961d3d317fa39a7e1c8948b825651e968c8cd06e49e4239f612faccad",
     ),
     (
         "nef-nikon-d7500-lossless14.nef",
         "https://raw.pixls.us/getfile.php/1534/nice/Nikon%20-%20D7500%20-%2014bit%2014bit%20compressed%20%28Lossless%29%20%283:2%29.NEF",
+        "430b4f1be4e53a011861b63294ad19fdc0353ec3ea62104f77d4c193e3dd3fc8",
+    ),
+    (
+        "nef-nikon-zf-he.nef",
+        "https://raw.pixls.us/download/data/Nikon/Z%20f/DSC_0043.NEF",
+        "98d6ca8e6c98048ca7ffed68ccaeda7b2b9f03807f0d320d97d5678db21748c2",
+    ),
+    (
+        "nef-nikon-zf-lossless.nef",
+        "https://raw.pixls.us/download/data/Nikon/Z%20f/DSC_0040.NEF",
+        "83c82be0be8865d796096dfbcc8ef2abf5af1bd37db44dfad6715070b0c99d15",
     ),
     (
         "nrw-nikon-b700-uncompressed.nrw",
         "https://raw.pixls.us/getfile.php/1621/nice/Nikon%20-%20COOLPIX%20B700%20-%2012bit%2012bit%20uncompressed%20%284:3%29.NRW",
+        "a175d5892304e79282add07eacf4bdc498ca3f050af48cf989c080355b4735ec",
+    ),
+    (
+        "orf-olympus-e1.orf",
+        "https://raw.pixls.us/getfile.php/1800/nice/Olympus%20-%20E-1%20-%2016bit%20%284:3%29.ORF",
+        "042286653fbae5b085bef4a4e626145385ea6e82e817f166b4904abcef64457c",
+    ),
+    (
+        "orf-olympus-e400.orf",
+        "https://raw.pixls.us/getfile.php/2151/nice/Olympus%20-%20E-400%20-%2016bit%20%284:3%29.ORF",
+        "1354e0ac98ea90820227650031d8215637a2aaabd15de995c5a1e00b1986261b",
+    ),
+    (
+        "orf-olympus-em1.orf",
+        "https://raw.pixls.us/getfile.php/1051/nice/Olympus%20-%20E-M1%20-%2016bit%20%284:3%29.orf",
+        "19ba17e778ae802d4039f0e88bb1cd68825780788b8058c479067e32b9a63eda",
+    ),
+    (
+        "orf-olympus-em10iii.orf",
+        "https://raw.pixls.us/getfile.php/1787/nice/Olympus%20-%20E-M10%20Mark%20III%20-%2016bit%20%284:3%29.ORF",
+        "11d90cbb564ad2c660c7a8d5d81d99c2c018aa27fdec45ed6c461fa5d24f942b",
+    ),
+    (
+        "orf-olympus-xz2.orf",
+        "https://raw.pixls.us/getfile.php/1432/nice/Olympus%20-%20XZ-2%20-%2012bit%20%284:3%29.orf",
+        "675fefe7c9e99281783b987889d723b5f46692f5c20e19fed5e422c7c6d2636b",
+    ),
+    (
+        "pef-pentax-k10d.pef",
+        "https://raw.pixls.us/getfile.php/2239/nice/Pentax%20-%20K10D%20-%2012bit%2012bit%20compressed%20%283:2%29.PEF",
+        "e35ae4154a468be3154f5f462e884ba5941f010d3e8f23d347fbec14809f44d3",
+    ),
+    (
+        "pef-pentax-k3.pef",
+        "https://raw.pixls.us/getfile.php/1075/nice/Pentax%20-%20K-3%20-%2014bit%20%283:2%29.PEF",
+        "abfb3907b53734b5f353e8de0c6173470c7aad07f9cecc10f723d222a49dec9a",
+    ),
+    (
+        "pef-pentax-k5iis.pef",
+        "https://raw.pixls.us/getfile.php/1198/nice/Pentax%20-%20K-5%20II%20s%20-%2014bit%20%283:2%29.PEF",
+        "e579e7360c35e512f9c3a5c0eb9519575b87b489c6f86be82590f7706a7ed17b",
+    ),
+    // Samsung SRW, one file per packing: 12-bit MSB-first (NX10), 12-bit LSB-first (NX20), 16-bit words (EX1).
+    (
+        "srw-samsung-nx10.srw",
+        "https://raw.pixls.us/getfile.php/5913/nice/Samsung%20-%20NX10%20-%2012bit%20%283:2%29.SRW",
+        "dead7b4ad83b739ff7b8a1218882589f66cb14efc09f79eeba7a1dcbf7abd29f",
+    ),
+    (
+        "srw-samsung-nx20.srw",
+        "https://raw.pixls.us/getfile.php/5370/nice/Samsung%20-%20NX20%20-%2012bit%20%283:2%29.SRW",
+        "8a367db506b8f7a6661a6f33a730467cfb3bfd7e46020a9f0df702330a7b45bb",
+    ),
+    (
+        "srw-samsung-ex1.srw",
+        "https://raw.pixls.us/getfile.php/1204/nice/Samsung%20-%20EX1%20-%2014bit%20%284:3%29.SRW",
+        "a084890fd9d7995ceb746c18ecf5be48c95baf14286d5c0c480cc3daa25f3e37",
     ),
-    ("orf-olympus-e1.orf", "https://raw.pixls.us/getfile.php/1800/nice/Olympus%20-%20E-1%20-%2016bit%20%284:3%29.ORF"),
-    ("orf-olympus-e400.orf", "https://raw.pixls.us/getfile.php/2151/nice/Olympus%20-%20E-400%20-%2016bit%20%284:3%29.ORF"),
-    ("orf-olympus-em1.orf", "https://raw.pixls.us/getfile.php/1051/nice/Olympus%20-%20E-M1%20-%2016bit%20%284:3%29.orf"),
-    ("orf-olympus-em10iii.orf", "https://raw.pixls.us/getfile.php/1787/nice/Olympus%20-%20E-M10%20Mark%20III%20-%2016bit%20%284:3%29.ORF"),
-    ("orf-olympus-xz2.orf", "https://raw.pixls.us/getfile.php/1432/nice/Olympus%20-%20XZ-2%20-%2012bit%20%284:3%29.orf"),
-    ("pef-pentax-k10d.pef", "https://raw.pixls.us/getfile.php/2239/nice/Pentax%20-%20K10D%20-%2012bit%2012bit%20compressed%20%283:2%29.PEF"),
-    ("pef-pentax-k3.pef", "https://raw.pixls.us/getfile.php/1075/nice/Pentax%20-%20K-3%20-%2014bit%20%283:2%29.PEF"),
-    ("pef-pentax-k5iis.pef", "https://raw.pixls.us/getfile.php/1198/nice/Pentax%20-%20K-5%20II%20s%20-%2014bit%20%283:2%29.PEF"),
     (
         "raf-fuji-xa2-12bit-bayer.raf",
         "https://raw.pixls.us/getfile.php/2883/nice/Fujifilm%20-%20X-A2%20-%2012bit%2012bit%20uncompressed%20%283:2%29.RAF",
+        "58ad687b23138c3c49ebeb6c1f80daf13185349be364b947e2bf27e39a462d2f",
     ),
     (
         "raf-fuji-xa5-14bit-bayer.raf",
         "https://raw.pixls.us/getfile.php/2526/nice/Fujifilm%20-%20X-A5%20-%2014bit%2014bit%20uncompressed%20%283:2%29.RAF",
+        "46daaf8c2b07f40bd01f737181d048a497bb0a87615a1fde65809fdd5de86bf1",
+    ),
+    (
+        "raf-fuji-xe1-12bit.raf",
+        "https://raw.pixls.us/getfile.php/3098/nice/Fujifilm%20-%20X-E1%20-%2012bit%2012bit%20uncompressed%20%283:2%29.RAF",
+        "0fa01fa1a674bcfa40f659225b4e66c5bedf15d2f78407ca1966dc8f38cd0e9f",
+    ),
+    (
+        "raf-fuji-xt20-14bit.raf",
+        "https://raw.pixls.us/getfile.php/1177/nice/Fujifilm%20-%20X-T20%20-%2014bit%2014bit%20uncompressed%20%283:2%29.RAF",
+        "afe552f4a2794c7aa2376dd826165354b243dcf6f2296b01505dded8c8e4be76",
     ),
-    ("raf-fuji-xe1-12bit.raf", "https://raw.pixls.us/getfile.php/3098/nice/Fujifilm%20-%20X-E1%20-%2012bit%2012bit%20uncompressed%20%283:2%29.RAF"),
-    ("raf-fuji-xt20-14bit.raf", "https://raw.pixls.us/getfile.php/1177/nice/Fujifilm%20-%20X-T20%20-%2014bit%2014bit%20uncompressed%20%283:2%29.RAF"),
     (
         "raf-fuji-xt20-compressed.raf",
         "https://raw.pixls.us/getfile.php/1178/nice/Fujifilm%20-%20X-T20%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF",
+        "a23045101b2912e64f154100d646c228c0d16585d21e95e0d1a006e537f7784c",
+    ),
+    (
+        "raw-panasonic-fz50.raw",
+        "https://raw.pixls.us/getfile.php/2234/nice/Panasonic%20-%20DMC-FZ50%20-%204:3.RAW",
+        "a776a941758214bf4d1342e2b89ed756bfcad5877e038cf9df3bdda502c432ea",
+    ),
+    (
+        "raw-panasonic-fz8.raw",
+        "https://raw.pixls.us/getfile.php/2282/nice/Panasonic%20-%20DMC-FZ8%20-%204:3.RAW",
+        "a11f1534f3092a4d5f2b57d182f6b06f8d26cf766eb463c3e02b26a338b63b8b",
+    ),
+    (
+        "rw2-panasonic-fz1000m2-4x3.rw2",
+        "https://raw.pixls.us/getfile.php/4706/nice/Panasonic%20-%20DC-FZ10002%20-%204:3.RW2",
+        "ab30922774bd829a992471d89eeefe1e829565a886d1477958130a2fa4fb77a1",
     ),
-    ("raw-panasonic-fz50.raw", "https://raw.pixls.us/getfile.php/2234/nice/Panasonic%20-%20DMC-FZ50%20-%204:3.RAW"),
-    ("raw-panasonic-fz8.raw", "https://raw.pixls.us/getfile.php/2282/nice/Panasonic%20-%20DMC-FZ8%20-%204:3.RAW"),
-    ("rw2-panasonic-fz1000m2-4x3.rw2", "https://raw.pixls.us/getfile.php/4706/nice/Panasonic%20-%20DC-FZ10002%20-%204:3.RW2"),
     // Fujifilm predictive compression: older X-Trans, 40 MP X-Trans, 14/16-bit GFX; both compression modes.
     (
         "raf-fuji-gfx100-3773.raf",
         "https://raw.pixls.us/getfile.php/3773/nice/Fujifilm%20-%20GFX%20100%20-%2016bit%2016bit%20compressed%20%284:3%29.RAF",
+        "018781e126842596fcf3876b3fb6cd8973dc3936ccc753ee8648618be8889287",
     ),
     (
         "raf-fuji-gfx100-3775.raf",
         "https://raw.pixls.us/getfile.php/3775/nice/Fujifilm%20-%20GFX%20100%20-%2014bit%2014bit%20compressed%20%284:3%29.RAF",
+        "0e7dad9819a748bb3d3be26bbf5770d4968e2d80b9cb41d97036bf7c27f7bfe7",
+    ),
+    (
+        "raf-fuji-gfx100rf-8091.raf",
+        "https://raw.pixls.us/getfile.php/8091/nice/Fujifilm%20-%20GFX100RF%20-%2016bit%20compressed%20%284:3%29.RAF",
+        "14bed5ac8191d6f2a7c82984e3bf6470ad4740df329293eac42b8018cc6a668a",
     ),
-    ("raf-fuji-gfx100rf-8091.raf", "https://raw.pixls.us/getfile.php/8091/nice/Fujifilm%20-%20GFX100RF%20-%2016bit%20compressed%20%284:3%29.RAF"),
     (
         "raf-fuji-gfx100s-4495.raf",
         "https://raw.pixls.us/getfile.php/4495/nice/Fujifilm%20-%20GFX100S%20-%2016bit%2016bit%20lossless%20compressed%20%284:3%29.RAF",
+        "a7bf8f061b603f7ef5fd29276eb6b2ac57355ca2f589a340117bfff0d03c065c",
     ),
     (
         "raf-fuji-gfx100s-4503.raf",
         "https://raw.pixls.us/getfile.php/4503/nice/Fujifilm%20-%20GFX100S%20-%2016bit%2016bit%20compressed%20%284:3%29.RAF",
+        "1bb4608b61861a3d9e85b0ca6c00689b8ba4620cbe8579374d958c21ed08edf0",
     ),
     (
         "raf-fuji-gfx50s-1435.raf",
         "https://raw.pixls.us/getfile.php/1435/nice/Fujifilm%20-%20GFX%2050S%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF",
+        "a7124d13910e0241a6b035154bc1fcdb7be4439371d043b1e1950a0251feb51e",
+    ),
+    (
+        "raf-fuji-xe5-8509.raf",
+        "https://raw.pixls.us/getfile.php/8509/nice/Fujifilm%20-%20X-E5%20-%2014bit%20lossy%20compressed%20%283:2%29.RAF",
+        "28f56cc9784164209e92fae209bdcc78267bd692aa2fb964595485f7e93692ab",
+    ),
+    (
+        "raf-fuji-xh2-6001.raf",
+        "https://raw.pixls.us/getfile.php/6001/nice/Fujifilm%20-%20X-H2%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF",
+        "caeadb2666f6c5d9bbe32fbe692c2079b6a7e028f8514a13173f360656d08507",
+    ),
+    (
+        "raf-fuji-xh2-6002.raf",
+        "https://raw.pixls.us/getfile.php/6002/nice/Fujifilm%20-%20X-H2%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF",
+        "109be38f59963c9b8ff289ebe1f5ec9168c52f609e5b601432bd194520b4605b",
+    ),
+    (
+        "raf-fuji-xm5-7748.raf",
+        "https://raw.pixls.us/getfile.php/7748/nice/Fujifilm%20-%20X-M5%20-%2014bit%20compressed%20%283:2%29.RAF",
+        "c76ce546e15727abb4ba201471010c554403176963a1a6b8cc017462606429e5",
+    ),
+    (
+        "raf-fuji-xt2-865.raf",
+        "https://raw.pixls.us/getfile.php/865/nice/Fujifilm%20-%20X-T2%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF",
+        "f756ad5be551a8b3e1b503a8a6f7e8e637fba519c0b0f8c79dd58e94b0287602",
     ),
-    ("raf-fuji-xe5-8509.raf", "https://raw.pixls.us/getfile.php/8509/nice/Fujifilm%20-%20X-E5%20-%2014bit%20lossy%20compressed%20%283:2%29.RAF"),
-    ("raf-fuji-xh2-6001.raf", "https://raw.pixls.us/getfile.php/6001/nice/Fujifilm%20-%20X-H2%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF"),
-    ("raf-fuji-xh2-6002.raf", "https://raw.pixls.us/getfile.php/6002/nice/Fujifilm%20-%20X-H2%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF"),
-    ("raf-fuji-xm5-7748.raf", "https://raw.pixls.us/getfile.php/7748/nice/Fujifilm%20-%20X-M5%20-%2014bit%20compressed%20%283:2%29.RAF"),
-    ("raf-fuji-xt2-865.raf", "https://raw.pixls.us/getfile.php/865/nice/Fujifilm%20-%20X-T2%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF"),
     (
         "raf-fuji-xt4-3914.raf",
         "https://raw.pixls.us/getfile.php/3914/nice/Fujifilm%20-%20X-T4%20-%2014bit%2014bit%20lossless%20compressed%20%283:2%29.RAF",
+        "07ea642656074834ffe5c661870a612ffa2e80fc1218a05166ee966bbe5f6fae",
+    ),
+    (
+        "raf-fuji-xt4-3918.raf",
+        "https://raw.pixls.us/getfile.php/3918/nice/Fujifilm%20-%20X-T4%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF",
+        "871836938ffa695f4c41765ddb107c2703ce755f7f3ced7e10f9e04746f1734e",
+    ),
+    (
+        "raf-fuji-xt5-6122.raf",
+        "https://raw.pixls.us/getfile.php/6122/nice/Fujifilm%20-%20X-T5%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF",
+        "b2a067e7fda16338f15c2532caa12b238b2415dc1c75a96a6d24d3445cfd0ae3",
+    ),
+    (
+        "raf-fuji-xt5-6123.raf",
+        "https://raw.pixls.us/getfile.php/6123/nice/Fujifilm%20-%20X-T5%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF",
+        "cddd7ae0c43f9280876e5fdcbdf8878718972ebd3d034d8affc8cfc6752d33dc",
+    ),
+    (
+        "raf-fuji-xt50-7807.raf",
+        "https://raw.pixls.us/getfile.php/7807/nice/Fujifilm%20-%20X-T50%20-%2014bit%20compressed%20%283:2%29.RAF",
+        "3a8a9ac6d92274969aaa1f55ea669191b98bb8f588d00ec8ec17afd8b3963dea",
+    ),
+    (
+        "rw2-panasonic-g9-b.rw2",
+        "https://raw.pixls.us/getfile.php/2348/nice/Panasonic%20-%20DC-G9%20-%204:3.RW2",
+        "16282357ce0143ff7d36737f82074662db7aa0790ecd309196f406baf0f586a7",
+    ),
+    (
+        "rw2-panasonic-g9.rw2",
+        "https://raw.pixls.us/getfile.php/2585/nice/Panasonic%20-%20DC-G9%20-%204:3.RW2",
+        "7a56babeb19f9bde3eaa532a4c8d1b11637a0f550963a1182ec845722c65583d",
+    ),
+    (
+        "rw2-panasonic-gh1.rw2",
+        "https://raw.pixls.us/getfile.php/1323/nice/Panasonic%20-%20DMC-GH1%20-%204:3.RW2",
+        "2b846f932c665f196af9af97b18469730331b60b2c62811969be7db245ce6cce",
+    ),
+    (
+        "rw2-panasonic-gh5.rw2",
+        "https://raw.pixls.us/getfile.php/1517/nice/Panasonic%20-%20DC-GH5%20-%204:3.RW2",
+        "dae2281df393d8c3c1b8c513d00985f1834ae0e69ce18fbd571370c25d95d22b",
+    ),
+    (
+        "rw2-panasonic-gh5m2.rw2",
+        "https://raw.pixls.us/getfile.php/5082/nice/Panasonic%20-%20DC-GH5M2%20-%204:3.RW2",
+        "0ea0efd2a9442d8c68508e4196e29f1da4577407dc3df5add4cf360f70493c7b",
+    ),
+    (
+        "rw2-panasonic-gh5s.rw2",
+        "https://raw.pixls.us/getfile.php/2603/nice/Panasonic%20-%20DC-GH5S%20-%204:3.RW2",
+        "b617151876e62b492641cef14b8c98ee3797e5014d24c6af1c780715a501fa53",
+    ),
+    (
+        "rw2-panasonic-gh6.rw2",
+        "https://raw.pixls.us/getfile.php/5876/nice/Panasonic%20-%20DC-GH6%20-%204:3.RW2",
+        "07996bca904a178d02c5f56ee03a8dce775a0e1150c1beeaec51d72ff5e700d0",
+    ),
+    (
+        "rw2-panasonic-gx80.rw2",
+        "https://raw.pixls.us/getfile.php/1569/nice/Panasonic%20-%20DMC-GX80%20-%204:3.RW2",
+        "6e9a419c70c2124630912b2934027c635d3871e3d22dd91fed0655d58cfb5382",
+    ),
+    (
+        "rw2-panasonic-s1.rw2",
+        "https://raw.pixls.us/getfile.php/3038/nice/Panasonic%20-%20DC-S1%20-%203:2.RW2",
+        "45309a096d6010281e2fa310e6ec2fe1bcc02947fa37b1a2414cfc7377ce4ac6",
+    ),
+    (
+        "rw2-panasonic-s5-format7.rw2",
+        "https://raw.pixls.us/getfile.php/6339/nice/Panasonic%20-%20DC-S5%20-%203:2.RW2",
+        "3615c85207097180b231f0c89d018eb3f1a71988780612921eb0a05246bca706",
+    ),
+    (
+        "rw2-panasonic-s5m2.rw2",
+        "https://raw.pixls.us/getfile.php/7790/nice/Panasonic%20-%20DC-S5M2%20-%2014bit%20%283:2%29.RW2",
+        "53a171521a7f9af6910b4ab61c5a4a42de0cceb24166e15b07eee1e00675028f",
+    ),
+    (
+        "rw2-panasonic-s9.rw2",
+        "https://raw.pixls.us/getfile.php/7702/nice/Panasonic%20-%20DC-S9%20-%203:2.RW2",
+        "290ad5b4e396cb241a59459b2613d2b0659a03ff654e5d5368b3376d35812e50",
+    ),
+    (
+        "rwl-leica-dlux7.rwl",
+        "https://raw.pixls.us/getfile.php/4204/nice/Leica%20-%20D-Lux%207%20-%204:3.RWL",
+        "4f6db6492da83f7f2a5012591e370557249d1ed44d4c948784016605b799327c",
     ),
-    ("raf-fuji-xt4-3918.raf", "https://raw.pixls.us/getfile.php/3918/nice/Fujifilm%20-%20X-T4%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF"),
-    ("raf-fuji-xt5-6122.raf", "https://raw.pixls.us/getfile.php/6122/nice/Fujifilm%20-%20X-T5%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF"),
-    ("raf-fuji-xt5-6123.raf", "https://raw.pixls.us/getfile.php/6123/nice/Fujifilm%20-%20X-T5%20-%2014bit%2014bit%20compressed%20%283:2%29.RAF"),
-    ("raf-fuji-xt50-7807.raf", "https://raw.pixls.us/getfile.php/7807/nice/Fujifilm%20-%20X-T50%20-%2014bit%20compressed%20%283:2%29.RAF"),
-    ("rw2-panasonic-g9-b.rw2", "https://raw.pixls.us/getfile.php/2348/nice/Panasonic%20-%20DC-G9%20-%204:3.RW2"),
-    ("rw2-panasonic-g9.rw2", "https://raw.pixls.us/getfile.php/2585/nice/Panasonic%20-%20DC-G9%20-%204:3.RW2"),
-    ("rw2-panasonic-gh1.rw2", "https://raw.pixls.us/getfile.php/1323/nice/Panasonic%20-%20DMC-GH1%20-%204:3.RW2"),
-    ("rw2-panasonic-gh5.rw2", "https://raw.pixls.us/getfile.php/1517/nice/Panasonic%20-%20DC-GH5%20-%204:3.RW2"),
-    ("rw2-panasonic-gh5m2.rw2", "https://raw.pixls.us/getfile.php/5082/nice/Panasonic%20-%20DC-GH5M2%20-%204:3.RW2"),
-    ("rw2-panasonic-gh5s.rw2", "https://raw.pixls.us/getfile.php/2603/nice/Panasonic%20-%20DC-GH5S%20-%204:3.RW2"),
-    ("rw2-panasonic-gh6.rw2", "https://raw.pixls.us/getfile.php/5876/nice/Panasonic%20-%20DC-GH6%20-%204:3.RW2"),
-    ("rw2-panasonic-gx80.rw2", "https://raw.pixls.us/getfile.php/1569/nice/Panasonic%20-%20DMC-GX80%20-%204:3.RW2"),
-    ("rw2-panasonic-s1.rw2", "https://raw.pixls.us/getfile.php/3038/nice/Panasonic%20-%20DC-S1%20-%203:2.RW2"),
-    ("rw2-panasonic-s5-format7.rw2", "https://raw.pixls.us/getfile.php/6339/nice/Panasonic%20-%20DC-S5%20-%203:2.RW2"),
-    ("rw2-panasonic-s5m2.rw2", "https://raw.pixls.us/getfile.php/7790/nice/Panasonic%20-%20DC-S5M2%20-%2014bit%20%283:2%29.RW2"),
-    ("rw2-panasonic-s9.rw2", "https://raw.pixls.us/getfile.php/7702/nice/Panasonic%20-%20DC-S9%20-%203:2.RW2"),
-    ("rwl-leica-dlux7.rwl", "https://raw.pixls.us/getfile.php/4204/nice/Leica%20-%20D-Lux%207%20-%204:3.RWL"),
 ];
 
 fn cmd_corpus(download: bool) -> Result<(), String> {
@@ -479,16 +842,41 @@ Tests that use a corpus skip cleanly when it is absent.
     }
     let dest = corpus.join("raw");
     std::fs::create_dir_all(&dest).map_err(|e| format!("create {}: {e}", dest.display()))?;
-    for (name, url) in RAW_SAMPLES {
+    let mut bad = Vec::new();
+    for (name, url, sha256) in RAW_SAMPLES {
         let out = dest.join(name);
-        if out.exists() {
-            continue;
+        if !out.exists() {
+            let mut curl = Command::new("curl");
+            curl.args(["-fsSL", "-o"]).arg(&out).arg(url);
+            run(curl, &format!("curl {url}"))?;
+        }
+        let actual = file_sha256(&out)?;
+        if actual != *sha256 {
+            // delete it, so the next run downloads it again instead of trusting it
+            std::fs::remove_file(&out).map_err(|e| format!("remove {}: {e}", out.display()))?;
+            bad.push(format!("{name}: sha256 is {actual}, expected {sha256} (file deleted; source {url})"));
         }
-        let mut curl = Command::new("curl");
-        curl.args(["-fsSL", "-o"]).arg(&out).arg(url);
-        run(curl, &format!("curl {url}"))?;
     }
-    Ok(())
+    if bad.is_empty() {
+        return Ok(());
+    }
+    Err(format!(
+        "{} corpus file(s) do not match their pinned sha256:
+  {}",
+        bad.len(),
+        bad.join(
+            "
+  "
+        )
+    ))
+}
+
+fn file_sha256(path: &Path) -> Result<String, String> {
+    use sha2::{Digest, Sha256};
+    let mut file = std::fs::File::open(path).map_err(|e| format!("open {}: {e}", path.display()))?;
+    let mut hash = Sha256::new();
+    std::io::copy(&mut file, &mut hash).map_err(|e| format!("read {}: {e}", path.display()))?;
+    Ok(format!("{:x}", hash.finalize()))
 }
 
 #[cfg(test)]
@@ -507,3 +895,19 @@ mod ci_jobs_tests {
         assert_eq!(ci_jobs(None, 2), 2);
     }
 }
+
+#[cfg(test)]
+mod corpus_tests {
+    use super::RAW_SAMPLES;
+
+    #[test]
+    fn every_sample_has_a_unique_name_and_a_sha256() {
+        let mut names: Vec<_> = RAW_SAMPLES.iter().map(|s| s.0).collect();
+        names.sort_unstable();
+        names.dedup();
+        assert_eq!(names.len(), RAW_SAMPLES.len(), "duplicate file name");
+        for (name, _, sha256) in RAW_SAMPLES {
+            assert!(sha256.len() == 64 && sha256.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')), "{name}: not a lowercase sha256");
+        }
+    }
+}
diff --git a/xtask/src/web.rs b/xtask/src/web.rs
index 41d086c3..4e690d63 100644
--- a/xtask/src/web.rs
+++ b/xtask/src/web.rs
@@ -13,6 +13,8 @@ use std::process::Command;
 use crate::{cargo, metadata, root, run as step};
 
 const TARGET: &str = "wasm32-unknown-unknown";
+const CHINESE_FONT_FILE: &str = "lightcraft_zh_hans.otf";
+const CHINESE_FONT_LICENSE_FILE: &str = "OFL-noto-sans-cjk-sc.txt";
 
 /// Files copied from `apps/lightcraft-web/` into the bundle as they are.
 const STATIC_FILES: [&str; 2] = ["index.html", "worker.js"];
@@ -20,6 +22,51 @@ const STATIC_FILES: [&str; 2] = ["index.html", "worker.js"];
 /// Bundle files that get precompressed copies.
 const COMPRESSED: [&str; 4] = ["index.html", "worker.js", "lightcraft_web.js", "lightcraft_web_bg.wasm"];
 
+/// The Noto face is shipped beside the WASM rather than embedded in it: hosts such as Cloudflare
+/// Pages cap individual files at 25 MiB, while the complete site can contain larger assets.
+fn chinese_font_in_manifest(manifest: &str) -> Option<(&str, &str)> {
+    manifest.lines().find_map(|line| {
+        let fields: Vec<_> = line.split('|').map(str::trim).collect();
+        if fields.len() >= 6 && fields[0] == "Noto Sans CJK SC" && fields[1] == "Regular" && !fields[2].is_empty() && !fields[5].is_empty() {
+            Some((fields[2], fields[5]))
+        } else {
+            None
+        }
+    })
+}
+
+fn copy_chinese_font(out: &Path) -> Result<bool, String> {
+    // A previous font-enabled build must not leave an unlicensed/stale asset in a font-free one.
+    for name in [CHINESE_FONT_FILE, CHINESE_FONT_LICENSE_FILE, "lightcraft_zh_hans.otf.gz", "lightcraft_zh_hans.otf.br"] {
+        let path = out.join(name);
+        match std::fs::remove_file(&path) {
+            Ok(()) => (),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => (),
+            Err(e) => return Err(format!("{}: {e}", path.display())),
+        }
+    }
+    let Some(dir) = std::env::var_os("CRAFT_FONTS_DIR") else {
+        if std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() {
+            return Err("CRAFT_FONTS_REQUIRED is set but CRAFT_FONTS_DIR is missing".into());
+        }
+        return Ok(false);
+    };
+    let dir = PathBuf::from(dir);
+    let dir = if dir.is_absolute() { dir } else { root().join(dir) };
+    let manifest_path = dir.join("fonts/manifest.txt");
+    let manifest = std::fs::read_to_string(&manifest_path).map_err(|e| format!("{}: {e}", manifest_path.display()))?;
+    let (font, licence) =
+        chinese_font_in_manifest(&manifest).ok_or_else(|| format!("{}: Noto Sans CJK SC Regular is missing", manifest_path.display()))?;
+    let licence = dir.join(licence);
+    let licence_target = out.join(CHINESE_FONT_LICENSE_FILE);
+    std::fs::copy(&licence, &licence_target).map_err(|e| format!("{} → {}: {e}", licence.display(), licence_target.display()))?;
+    let source = dir.join(font);
+    let target = out.join(CHINESE_FONT_FILE);
+    std::fs::copy(&source, &target).map_err(|e| format!("{} → {}: {e}", source.display(), target.display()))?;
+    println!("web Chinese font: {} → {}", source.display(), target.display());
+    Ok(true)
+}
+
 /// The `wasm-bindgen` version pinned in Cargo.lock (the CLI must match it exactly).
 fn locked_bindgen_version() -> Result<String, String> {
     let lock = std::fs::read_to_string(root().join("Cargo.lock")).map_err(|e| format!("Cargo.lock: {e}"))?;
@@ -84,10 +131,11 @@ pub fn run(args: &[&str]) -> Result<(), String> {
     for f in STATIC_FILES {
         std::fs::copy(root().join("apps/lightcraft-web").join(f), out.join(f)).map_err(|e| format!("copy {f}: {e}"))?;
     }
+    let chinese_font = copy_chinese_font(&out)?;
 
     // precompressed copies (skipped for --dev: they'd only slow the edit loop down)
     println!("\n{:<26} {:>12} {:>12} {:>12}", "file", "bytes", "gzip -9", "brotli -11");
-    for f in COMPRESSED {
+    for f in COMPRESSED.into_iter().chain(chinese_font.then_some(CHINESE_FONT_FILE)) {
         let p = out.join(f);
         let raw = std::fs::read(&p).map_err(|e| format!("{}: {e}", p.display()))?;
         let (gz, br) = if dev {
@@ -138,6 +186,8 @@ fn mime(path: &Path) -> &'static str {
         "json" => "application/json",
         "png" => "image/png",
         "jpg" | "jpeg" => "image/jpeg",
+        "otf" => "font/otf",
+        "txt" => "text/plain; charset=utf-8",
         "svg" => "image/svg+xml",
         _ => "application/octet-stream",
     }
@@ -242,6 +292,16 @@ mod tests {
         assert_eq!(mime(Path::new("a/lightcraft_web_bg.wasm")), "application/wasm");
         assert_eq!(mime(Path::new("index.html")), "text/html; charset=utf-8");
         assert_eq!(mime(Path::new("worker.js")), "text/javascript; charset=utf-8");
+        assert_eq!(mime(Path::new(CHINESE_FONT_FILE)), "font/otf");
+    }
+
+    #[test]
+    fn web_bundle_selects_the_chinese_face_from_the_font_manifest() {
+        let manifest = "# family | style | path | scripts | licence | licence file\n\
+            BIZ UDPGothic | Regular | fonts/biz.ttf | Jpan,Latn | OFL-1.1 | fonts/biz/OFL.txt\n\
+            Noto Sans CJK SC | Regular | fonts/noto/NotoSansCJKsc-Regular.otf | Hans,Latn | OFL-1.1 | fonts/noto/OFL.txt\n";
+        assert_eq!(chinese_font_in_manifest(manifest), Some(("fonts/noto/NotoSansCJKsc-Regular.otf", "fonts/noto/OFL.txt")));
+        assert_eq!(chinese_font_in_manifest("BIZ UDPGothic | Regular | fonts/biz.ttf | Jpan,Latn | OFL-1.1 | fonts/biz/OFL.txt"), None);
     }
 
     #[test]