diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 226b94b..adc5a1f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -59,3 +59,24 @@ jobs:
 
       - name: Build app
         run: npm run build
+
+  # ===========================================================================
+  # egui prototype (input_viewer_egui). macOS rather than Linux: the camera and
+  # windowing crates need system packages on Linux, and macOS is where the
+  # GPU path is developed.
+  # ===========================================================================
+  egui:
+    name: egui test & build
+    runs-on: macos-latest
+    defaults:
+      run:
+        working-directory: input_viewer_egui
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+
+      - name: Unit tests
+        run: cargo test --locked
+
+      - name: Build
+        run: cargo build --release --locked
+
diff --git a/.github/workflows/release-egui.yml b/.github/workflows/release-egui.yml
new file mode 100644
index 0000000..8a82ef0
--- /dev/null
+++ b/.github/workflows/release-egui.yml
@@ -0,0 +1,337 @@
+name: Release (egui)
+
+# Installers and auto-update packages for input_viewer_egui, built with
+# Velopack. Same shape as release.yml: manual dispatch, version derived from
+# Conventional Commits, tests gate the publish.
+#
+# It shares GitHub Releases with the Electron app, and two rules keep the two
+# from interfering:
+#
+#   1. Tags are `egui-v*`. release.yml finds its last tag with
+#      `git describe --match 'v[0-9]*'`, so these never become its baseline.
+#   2. Releases are published with `make_latest: false`. electron-updater
+#      resolves /releases/latest; if an egui release were "latest", every
+#      Electron install would look there for a latest.yml that is not there.
+#
+# Unlike release.yml there is no version-bump commit: the tag is the source of
+# truth, and the version is written into Cargo.toml and Info.plist at build
+# time only.
+#
+# `publish: false` (the default) builds and uploads the installers as workflow
+# artifacts and stops. Pull requests touching the egui app get the same build
+# automatically (version 0.0.0-pr.N, never published), which is also how this
+# workflow gets exercised before it reaches main: GitHub only offers
+# workflow_dispatch for workflows already on the default branch.
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'input_viewer_egui/**'
+      - '.github/workflows/release-egui.yml'
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: 'Publish a GitHub release (main only). Off = build artifacts only.'
+        required: false
+        type: boolean
+        default: false
+      bump:
+        description: 'Version bump (auto = derive from commits touching input_viewer_egui/)'
+        required: false
+        type: choice
+        default: auto
+        options: [auto, patch, minor, major]
+
+env:
+  VPK_VERSION: '1.2.161'   # keep equal to the velopack crate in Cargo.lock
+  PACK_ID: InputViewerEgui
+  PACK_TITLE: Input Viewer (egui)
+
+jobs:
+  analyze:
+    name: Analyze commits
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      last_tag: ${{ steps.version.outputs.last_tag }}
+      publish: ${{ steps.version.outputs.publish }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Compute version
+        id: version
+        run: |
+          set -euo pipefail
+          LAST_TAG=$(git tag -l 'egui-v*' --sort=-v:refname | head -n1)
+          CURRENT=${LAST_TAG#egui-v}
+          CURRENT=${CURRENT:-0.0.0}
+          IFS=. read -r MA MI PA <<< "$CURRENT"
+
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
+            # A pre-release of the next minor. Not 0.0.0-pr.N: vpk requires
+            # >= 0.0.1, and a pre-release sorts below its release, so
+            # 0.0.1-pr.N fails too.
+            VERSION="$MA.$((MI + 1)).0-pr.${{ github.event.pull_request.number }}"
+            echo "Pull request: packaging check only, as $VERSION"
+            {
+              echo "version=$VERSION"
+              echo "last_tag="
+              echo "publish=false"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          BUMP="${{ inputs.bump }}"
+          if [ "$BUMP" = "auto" ]; then
+            # Only commits that touch the egui app count; an Electron fix must
+            # not bump the egui version.
+            RANGE=${LAST_TAG:+$LAST_TAG..HEAD}
+            COMMITS=$(git log "${RANGE:-HEAD}" --pretty=format:%s --no-merges -- input_viewer_egui)
+            BUMP=none
+            if echo "$COMMITS" | grep -qiE '^.+!:|BREAKING CHANGE'; then BUMP="major"
+            elif echo "$COMMITS" | grep -qiE '^feat(\(.+\))?:'; then BUMP="minor"
+            elif echo "$COMMITS" | grep -qiE '^(fix|perf|refactor|build|ci)(\(.+\))?:'; then BUMP="patch"
+            fi
+          fi
+          if [ "$BUMP" = "none" ]; then
+            echo "::error::No releasable commits touch input_viewer_egui/ since ${LAST_TAG:-the start}. Pick a bump explicitly to release anyway."
+            exit 1
+          fi
+
+          case $BUMP in
+            major) VERSION="$((MA + 1)).0.0" ;;
+            minor) VERSION="$MA.$((MI + 1)).0" ;;
+            patch) VERSION="$MA.$MI.$((PA + 1))" ;;
+          esac
+
+          PUBLISH=false
+          if [ "${{ inputs.publish }}" = "true" ]; then
+            if [ "$GITHUB_REF" != "refs/heads/main" ]; then
+              echo "::error::Publishing is only allowed from main (this run is on $GITHUB_REF)."
+              exit 1
+            fi
+            PUBLISH=true
+          fi
+
+          echo "${LAST_TAG:-none} -> $VERSION ($BUMP), publish=$PUBLISH"
+          {
+            echo "version=$VERSION"
+            echo "last_tag=$LAST_TAG"
+            echo "publish=$PUBLISH"
+          } >> "$GITHUB_OUTPUT"
+
+  build-windows:
+    name: Build Windows
+    needs: analyze
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: input_viewer_egui
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: '8.0.x'
+
+      # Cargo.toml and Cargo.lock both, or --locked refuses to build; CRLF-safe
+      # for the Windows checkout. See the script.
+      - name: Set version
+        run: packaging/set-version.sh "${{ needs.analyze.outputs.version }}"
+
+      - name: Test
+        run: cargo test --release --locked
+
+      - name: Build
+        run: cargo build --release --locked
+
+      - name: Install vpk
+        run: |
+          dotnet tool install -g vpk --version "$VPK_VERSION"
+          echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
+
+      # The previous release's full package lets vpk generate a delta, so an
+      # update downloads only what changed.
+      - name: Fetch previous release for deltas
+        if: needs.analyze.outputs.last_tag != ''
+        continue-on-error: true
+        run: |
+          vpk download http --channel windows --outputDir releases \
+            --url "https://github.com/${{ github.repository }}/releases/download/${{ needs.analyze.outputs.last_tag }}/"
+
+      - name: Pack
+        run: |
+          mkdir -p publish
+          cp target/release/input-viewer.exe publish/
+          vpk pack \
+            --packId "$PACK_ID" \
+            --packVersion "${{ needs.analyze.outputs.version }}" \
+            --packTitle "$PACK_TITLE" \
+            --packAuthors "Schuberg Philis / Lab271" \
+            --packDir publish \
+            --mainExe input-viewer.exe \
+            --icon ../input_viewer_electron/build/icon.ico \
+            --channel windows \
+            --outputDir releases
+          ls -la releases
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: egui-windows
+          path: input_viewer_egui/releases/*
+          if-no-files-found: error
+
+  build-mac:
+    name: Build macOS
+    needs: analyze
+    runs-on: macos-latest
+    defaults:
+      run:
+        working-directory: input_viewer_egui
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: '8.0.x'
+
+      # Cargo.toml and Cargo.lock both, or --locked refuses to build; CRLF-safe
+      # for the Windows checkout. See the script.
+      - name: Set version
+        run: packaging/set-version.sh "${{ needs.analyze.outputs.version }}"
+
+      - name: Test
+        run: cargo test --release --locked
+
+      # Universal, like the Electron DMG: one download for Intel and Apple silicon.
+      - name: Build universal binary
+        run: |
+          rustup target add aarch64-apple-darwin x86_64-apple-darwin
+          cargo build --release --locked --target aarch64-apple-darwin
+          cargo build --release --locked --target x86_64-apple-darwin
+          lipo -create -output input-viewer \
+            target/aarch64-apple-darwin/release/input-viewer \
+            target/x86_64-apple-darwin/release/input-viewer
+          lipo -info input-viewer
+
+      # Built by hand rather than left to vpk, so Info.plist carries
+      # NSCameraUsageDescription. Without it macOS kills the app on first
+      # camera access.
+      - name: Assemble app bundle
+        run: |
+          APP="publish/Input Viewer (egui).app"
+          mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
+          cp input-viewer "$APP/Contents/MacOS/"
+          cp ../input_viewer_electron/build/icon.icns "$APP/Contents/Resources/icon.icns"
+          sed 's/@VERSION@/${{ needs.analyze.outputs.version }}/g' packaging/macos/Info.plist > "$APP/Contents/Info.plist"
+          plutil -lint "$APP/Contents/Info.plist"
+          # Ad-hoc signature. Unsigned like the Electron build (no Developer ID
+          # in this repo), but Apple silicon will not run an arm64 binary
+          # without at least this.
+          codesign --force --deep --sign - "$APP"
+
+      - name: Install vpk
+        run: |
+          dotnet tool install -g vpk --version "$VPK_VERSION"
+          echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
+
+      - name: Fetch previous release for deltas
+        if: needs.analyze.outputs.last_tag != ''
+        continue-on-error: true
+        run: |
+          vpk download http --channel macos --outputDir releases \
+            --url "https://github.com/${{ github.repository }}/releases/download/${{ needs.analyze.outputs.last_tag }}/"
+
+      - name: Pack
+        run: |
+          vpk pack \
+            --packId "$PACK_ID" \
+            --packVersion "${{ needs.analyze.outputs.version }}" \
+            --packTitle "$PACK_TITLE" \
+            --packAuthors "Schuberg Philis / Lab271" \
+            --packDir "publish/Input Viewer (egui).app" \
+            --mainExe input-viewer \
+            --channel macos \
+            --outputDir releases
+          ls -la releases
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: egui-macos
+          path: input_viewer_egui/releases/*
+          if-no-files-found: error
+
+  publish:
+    name: Publish release
+    needs: [analyze, build-windows, build-mac]
+    if: needs.analyze.outputs.publish == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: egui-windows
+          path: artifacts/windows
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: egui-macos
+          path: artifacts/macos
+
+      # Both platforms upload into one release, where asset names must be
+      # unique. The custom channels (windows/macos rather than the default
+      # win/osx) are what make vpk put the channel in every file name; this
+      # fails the run if that ever stops being true, rather than letting one
+      # platform's package silently replace the other's.
+      #
+      # The previous release's packages fetched for delta generation are
+      # dropped: they already live on that release.
+      - name: Collect assets
+        run: |
+          set -euo pipefail
+          VERSION="${{ needs.analyze.outputs.version }}"
+          mkdir upload
+          for f in artifacts/*/*; do
+            name=$(basename "$f")
+            case "$name" in
+              *.nupkg) [[ "$name" == *"-$VERSION-"* ]] || { echo "skip $name (previous release)"; continue; } ;;
+            esac
+            if [ -e "upload/$name" ]; then
+              echo "::error::Both platforms produced $name"
+              exit 1
+            fi
+            cp "$f" upload/
+          done
+          ls -la upload
+
+      - name: Create release
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        with:
+          tag_name: egui-v${{ needs.analyze.outputs.version }}
+          target_commitish: ${{ github.sha }}
+          name: Input Viewer (egui) ${{ needs.analyze.outputs.version }}
+          # Never "latest": that slot belongs to the Electron app's updater.
+          make_latest: 'false'
+          body: |
+            Prototype of Input Viewer built on egui. Installs alongside the Electron app.
+
+            - **Windows:** the `-Setup.exe`. Installs per user, no admin rights needed.
+            - **macOS:** the `-Setup.pkg`. Unsigned, like the Electron build: right-click → Open the first time.
+
+            Installed copies update themselves from releases tagged `egui-v*`.
+          files: upload/*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Summary
+        run: |
+          {
+            echo "### Input Viewer (egui) ${{ needs.analyze.outputs.version }}"
+            echo ""
+            echo "Tag \`egui-v${{ needs.analyze.outputs.version }}\`, not marked latest."
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c31d178..bf54739 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,7 +63,10 @@ jobs:
             exit 0
           fi
 
-          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          # --match: release-egui.yml tags egui-v* in this same repo, and an
+          # unfiltered describe would take the newest of those as the baseline,
+          # analysing only the commits since the last *egui* release.
+          LAST_TAG=$(git describe --tags --abbrev=0 --match 'v[0-9]*' 2>/dev/null || echo "")
 
           if [ -z "$LAST_TAG" ]; then
             COMMITS=$(git log --pretty=format:"%s" --no-merges)
diff --git a/docs/adr/0000-template.md b/docs/adr/0000-template.md
new file mode 100644
index 0000000..b525860
--- /dev/null
+++ b/docs/adr/0000-template.md
@@ -0,0 +1,33 @@
+# NNNN. Title in the imperative
+
+| | |
+|---|---|
+| **Status** | Proposed · Accepted · Superseded by NNNN · Open |
+| **Date** | YYYY-MM-DD (when the decision was made, from the PR or issue) |
+| **Area** | Product · Capture · Signal · Screensavers · UI · Platform · Delivery |
+| **Evidence** | #issue, PR, commit, `path:line` |
+| **egui verdict** | Keep · Adapt · Drop · Decide |
+| **egui status** | Done · Partial · Not started · N/A |
+
+## Context
+
+The problem, the forces, and the incident or measurement that settled it.
+Numbers where they exist. "Rationale not recorded" where it does not --
+never a reconstructed reason presented as the original one.
+
+## Decision
+
+What was decided, concretely enough to reimplement: thresholds, timings,
+sizes, precedence.
+
+## Consequences
+
+What it enables, what it costs, what it constrains.
+
+## Porting to egui
+
+- **Verdict** -- *Keep*: same behaviour, port as is. *Adapt*: same goal,
+  different mechanism. *Drop*: an Electron or browser artefact with nothing
+  to carry over. *Decide*: a product question to answer before porting.
+- **What carries over**, **what changes**, and where the prototype
+  (`input_viewer_egui/`) stands.
diff --git a/docs/adr/0001-record-architecture-decisions.md b/docs/adr/0001-record-architecture-decisions.md
new file mode 100644
index 0000000..fc766dc
--- /dev/null
+++ b/docs/adr/0001-record-architecture-decisions.md
@@ -0,0 +1,51 @@
+# 0001. Record architecture decisions, and port by them
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-12 |
+| **Area** | Product |
+| **Evidence** | This directory |
+| **egui verdict** | Keep |
+| **egui status** | N/A |
+
+## Context
+
+Input Viewer's design lives in four places: `.claude/CLAUDE.md`, code
+comments, 117 issues and 208 merged PRs. The "why" behind a threshold is
+usually in a PR body or an issue comment, and some of it has drifted: the
+same fact is stated differently in the docs and the code in at least a dozen
+places (see [open-questions.md](open-questions.md)).
+
+A rewrite on Rust and egui ([0002](0002-port-to-rust-and-egui.md)) has to
+decide, decision by decision, what to keep. Reading the Electron app to find
+out would repeat the research every time, and would miss what is only in the
+issue tracker.
+
+## Decision
+
+- One ADR per decision a rewrite must consciously keep, change or drop. The
+  Electron app's decisions are recorded as **Accepted**, dated from the PR or
+  issue that made them.
+- Every ADR ends with **Porting to egui**: a verdict (Keep / Adapt / Drop /
+  Decide) and where the prototype stands. The index in [README.md](README.md)
+  collects those into the port's status board.
+- Evidence is cited, not paraphrased from memory: issue and PR numbers,
+  commits, `path:line`. Where the rationale was never written down the ADR
+  says so.
+- Defects and doc drift found while writing these go in
+  [open-questions.md](open-questions.md), not into the ADRs as if they were
+  decisions.
+- An ADR is changed by superseding it, not by editing history: a new ADR, and
+  the old one's status set to "Superseded by NNNN".
+
+## Consequences
+
+- The port has a checklist with a reason attached to every item.
+- These were reconstructed in 2026-10 from code and history, not written at
+  the time. Where a reason is inferred, the ADR says "inferred".
+- Line numbers are from `main` at 787375b (v3.4.1) and will drift.
+
+## Porting to egui
+
+Keep. New egui-only decisions get their own ADRs, numbered after these.
diff --git a/docs/adr/0002-port-to-rust-and-egui.md b/docs/adr/0002-port-to-rust-and-egui.md
new file mode 100644
index 0000000..e410592
--- /dev/null
+++ b/docs/adr/0002-port-to-rust-and-egui.md
@@ -0,0 +1,67 @@
+# 0002. Port Input Viewer to Rust and egui
+
+| | |
+|---|---|
+| **Status** | Proposed |
+| **Date** | 2026-10-12 |
+| **Area** | Product |
+| **Evidence** | #249 (Tauri, "recorded, not recommended"), #225, #62, `input_viewer_egui/` |
+| **egui verdict** | Decide |
+| **egui status** | Prototype |
+
+## Context
+
+The Electron app works and is in production on the wall. The case for moving
+is about what Electron costs on a single-purpose wall PC:
+
+- **Size and update surface.** A 95 MB installer and a 211 MB DMG (#249),
+  carrying a Chromium whose security fixes reach the wall only by
+  redeploying (labs-videowall-config `docs/software.md`), while Dependabot's
+  Electron bumps never trigger a release on their own
+  ([0045](0045-release-by-hand-bump-from-commits.md)).
+- **Workarounds that exist only because the UI is a web page.** CORS
+  proxies through the main process ([0043](0043-keep-privileged-work-in-one-place.md)),
+  WebRTC constraint negotiation that once locked a card at 640x480 (#34),
+  one capture session shared between two `<video>` elements
+  ([0008](0008-one-capture-session-per-device.md)), PowerShell compiling C#
+  on every volume read (#283), `object-view-box` for cropping.
+- **A device API that Chromium hides.** #340 wants the source resolution
+  from the Elgato driver instead of guessing it from black bars; that is a
+  KS property query, out of reach from a renderer.
+
+#249 looked at Tauri and recommended against it. Its argument was that the
+cost is not the IPC but the ~30 WebGL2 shaders tuned against ANGLE, plus
+rebuilding auto-update (#86) and signing (#56). Those are the questions a
+port has to answer.
+
+## Decision (proposed)
+
+Port to Rust with eframe/egui on the glow (OpenGL) backend, keeping the
+product behaviour these ADRs record and dropping the browser workarounds.
+
+The prototype in `input_viewer_egui/` was built to test #249's objections:
+
+| #249's concern | Prototype result |
+|---|---|
+| Shaders tuned against ANGLE | Plasma and its post-FX chain run as the **same GLSL**, extracted from the JS at build time (`shaders/extract.mjs`), on desktop GL 3.3. Six of 29 savers are pure fragment shaders and port this way; the rest need their JS orchestration rewritten ([0026](0026-share-glsl-and-work-in-world-space.md)). |
+| Compositing cost | Two synthetic 3840x2160@60 inputs: 60.0 fps shown, 0 skipped/s, ~7 ms capture-to-upload, UI ~95 fps (M3 Pro, `--test-pattern --hud`). #62 had already shown compositing is not the bottleneck in Electron either. |
+| Auto-update | Velopack with a custom update source, alongside the Electron releases ([0048](0048-package-and-update-from-the-public-repo.md)). Windows `Setup.exe` and macOS `Setup.pkg` **build in CI** (#346); an install-then-update cycle is **not yet tested** (needs two releases). |
+| Capture | `nokhwa` (AVFoundation / Media Foundation). Compiles on Windows and macOS in CI; frames flow from mock inputs; capture health and reopen ported ([0012](0012-judge-health-by-counting-frames.md), [0013](0013-reopen-by-releasing-the-device-with-two-backoffs.md)). **Not tested against an Elgato 4K60 Pro MK.2**, and nokhwa rejects BGRA-only devices (OBS Virtual Camera). |
+
+The release binary is ~16 MB.
+
+## Consequences
+
+- Everything in "egui status: Not started" in the [index](README.md) is the
+  remaining work; the biggest pieces are audio, black-bar cropping,
+  reference detection, 23 screensavers, Art-Net and the remote keyboard.
+- Two codebases during the transition. The GLSL stays single-sourced in the
+  Electron tree until the port owns it.
+- **Go/no-go gate:** run `--test-pattern --hud` and real capture on the wall's
+  Windows host with both Elgato cards. Media Foundation behaviour through
+  nokhwa is the largest unknown, and every figure so far is from a Mac.
+
+## Porting to egui
+
+This is the decision the rest depend on. It stays Proposed until the wall
+test above has been run.
diff --git a/docs/adr/0003-model-the-wall-as-two-halves.md b/docs/adr/0003-model-the-wall-as-two-halves.md
new file mode 100644
index 0000000..4343159
--- /dev/null
+++ b/docs/adr/0003-model-the-wall-as-two-halves.md
@@ -0,0 +1,47 @@
+# 0003. Model the wall as two halves, never N panels
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2025-12-30 (77acd52); reaffirmed 2026-08-20 (#261, #244, #245 closed not planned) |
+| **Area** | Product |
+| **Evidence** | `renderer.js` `setLayout` :2104, `state.layoutMode` :106; #261, #244, #245; #243 |
+| **egui verdict** | Keep |
+| **egui status** | Done |
+
+## Context
+
+The wall is a 6000x1200 strip. From the first commit the app showed either
+one picture across it (single) or two side by side (dual). In 2026-08 three
+proposals tried to generalise that: an N-feed refactor (#261), per-panel
+layouts (#244) and picture-in-picture (#245). All three were closed as not
+planned on 2026-08-20: "the wall is not going to be used this way".
+
+Cost was part of it. Two capture streams already cost 1.83 cores in
+Chromium's `VideoCaptureService` (#243), and four had never been measured on
+the wall host.
+
+## Decision
+
+- Two slots, `left` and `right`.
+- **Dual** shows both. **Single** shows the left slot across the whole wall.
+- The same device may be on both slots.
+- Anything N-shaped -- dropdown thumbnails for other inputs -- is done
+  without holding more streams ([0032](0032-input-thumbnails-are-snapshots.md)).
+
+## Consequences
+
+- In single view with Multi-view on, the right slot keeps its own input,
+  which reappears on `D` ([0031](0031-what-a-picker-tap-sets.md)).
+- Starting in single view once left the right slot with no stream, so `D`
+  showed a black half on the wall; `ensureRightStream()` (PR #324,
+  2026-10-02) fixes that.
+
+## Porting to egui
+
+**Keep.** The prototype holds `sides: [Option<String>; 2]` and paints one or
+two halves (`app.rs`). Electron's per-side field duplication (10 fields, 15
+ternaries per #261) is an implementation shape, not the decision: an array
+of two keeps the constraint without the duplication. `ensureRightStream`'s
+lesson is honoured by opening streams for whatever the visible sides show,
+every frame (`sync_streams`).
diff --git a/docs/adr/0004-one-fullscreen-window-wall-composition-is-external.md b/docs/adr/0004-one-fullscreen-window-wall-composition-is-external.md
new file mode 100644
index 0000000..8fd78da
--- /dev/null
+++ b/docs/adr/0004-one-fullscreen-window-wall-composition-is-external.md
@@ -0,0 +1,40 @@
+# 0004. One borderless fullscreen window; the wall's composition is someone else's job
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2025-12-30 (3b5bd3d) |
+| **Area** | Product |
+| **Evidence** | `src/main/index.js:217-243, 537-548`; labs-videowall-config `startup/startup.ps1` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+The wall is several projectors made to look like one 6000x1200 display by
+NVIDIA Mosaic and Scalable Warp, which the wall's own startup script
+engages before launching the app ([0006](0006-app-and-wall-setup-live-in-separate-repos.md)).
+
+## Decision
+
+- One window, black background, borderless on Windows and Linux
+  (`hiddenInset` title bar on macOS), fullscreen on whichever display the OS
+  gives it.
+- No display selection, no multi-monitor logic, no kiosk mode, no
+  always-on-top. Rationale for avoiding kiosk mode is not recorded.
+- The operator can leave fullscreen (Esc, F, F11) and quit (Q).
+
+## Consequences
+
+- Entirely dependent on Mosaic. If Mosaic is not up at launch, the app is
+  fullscreen on whatever single display exists -- which is why the startup
+  script waits for a stable 6000x1200 desktop first.
+- Nothing pins the window above other windows.
+
+## Porting to egui
+
+**Keep.** `ViewportCommand::Fullscreen` already backs F/F11/Esc and
+`ViewportCommand::Close` backs Q. The prototype still opens as a 1500x500
+window rather than fullscreen and borderless; set
+`ViewportBuilder::with_fullscreen(true).with_decorations(false)` for
+release builds, keep the windowed default for development.
diff --git a/docs/adr/0005-no-single-instance-sleep-inhibit-or-relaunch.md b/docs/adr/0005-no-single-instance-sleep-inhibit-or-relaunch.md
new file mode 100644
index 0000000..8c0bfd9
--- /dev/null
+++ b/docs/adr/0005-no-single-instance-sleep-inhibit-or-relaunch.md
@@ -0,0 +1,45 @@
+# 0005. Single instance, display sleep and crash relaunch are not the app's job (by omission)
+
+| | |
+|---|---|
+| **Status** | Open |
+| **Date** | n/a -- never decided, observed as absent |
+| **Area** | Product |
+| **Evidence** | No `requestSingleInstanceLock`, `powerSaveBlocker` or `wakeLock` in `src/`; `index.js:300-306, 346-366`; `startup.ps1` relaunch-once |
+| **egui verdict** | Decide |
+| **egui status** | Not started |
+
+## Context
+
+None of these was ever discussed in an issue or PR. What exists:
+
+- A second launch opens a second window that competes for the same capture
+  devices.
+- Main only logs `render-process-gone`, `unresponsive` and
+  `child-process-gone`; nothing restarts the app.
+- The wall's startup script relaunches the app **once** if it is gone 20 s
+  after launch, and takes a named mutex so the script itself does not run
+  twice. It does not watch the app after that.
+- Display sleep is presumably the wall OS's configuration.
+
+## Decision
+
+None recorded. In effect: rely on the startup script and the OS.
+
+## Consequences
+
+Two instances fighting over the Elgato cards is a possible failure. A crash
+after the first 20 s leaves a dark wall until someone notices.
+
+## Porting to egui
+
+**Decide**, for each:
+
+- **Single instance** -- cheap in Rust (a named mutex on Windows, a lock
+  file elsewhere). Recommended: a second launch logs and exits, so the cards
+  are never contended.
+- **Display sleep** -- leave to the wall's OS config unless it is shown to
+  be a problem.
+- **Crash relaunch** -- belongs in the startup script or a Windows service
+  wrapper, not in the app. If it moves there, record it in
+  labs-videowall-config.
diff --git a/docs/adr/0006-app-and-wall-setup-live-in-separate-repos.md b/docs/adr/0006-app-and-wall-setup-live-in-separate-repos.md
new file mode 100644
index 0000000..9968da5
--- /dev/null
+++ b/docs/adr/0006-app-and-wall-setup-live-in-separate-repos.md
@@ -0,0 +1,54 @@
+# 0006. The app and the wall's setup live in separate repos; the startup script owns launch order
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-01 (labs-videowall-config a98bb1a, ded2efa) |
+| **Area** | Product |
+| **Evidence** | labs-videowall-config README, `startup/README.md`, `startup/startup.ps1`, `edid/README.md`; `.claude/CLAUDE.md` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+The wall PC is Windows 11 with two PCIe Elgato 4K60 Pro MK.2 cards, NVIDIA
+Mosaic and Scalable Warp. Getting it to a usable state is ordered: the
+desktop must be 6000x1200 and stable before warping, and warping before the
+app opens the cards.
+
+## Decision
+
+- `LAB271/labs-videowall-config` owns the machine: Mosaic, Warp, EDID,
+  startup. Input Viewer is explicitly out of its scope ("deploy from its own
+  repo"), and this repo is the application only.
+- At logon `startup.ps1` waits for Mosaic (>= 6000x1200, stable for three
+  polls), engages Warp, logs both cards' PnP status without blocking, then
+  launches `C:\Program Files\Input Viewer\Input Viewer.exe`. It relaunches
+  once if the app is gone after 20 s, runs unelevated, and takes a named
+  mutex.
+- It does **not** restart the cards: `pnputil /restart-device` returns 3010
+  because `audiodg.exe` holds the audio endpoint. Recovering a card is the
+  app's job ([0013](0013-reopen-by-releasing-the-device-with-two-backoffs.md)).
+
+## Consequences
+
+- The executable's path and name are an interface between the two repos.
+- The Elgato utility and Input Viewer cannot hold the cards at the same time
+  ("Close Input Viewer (it holds the cards)", `edid/README.md`).
+- Since 2026-10-02 the presenter arrives over a 15 m HDMI cable, not
+  HDBaseT (labs-videowall-config #5). Docs here still say HDBaseT.
+
+## Porting to egui
+
+**Keep** the split, but the interface **breaks** as things stand:
+
+- `startup.ps1` launches `C:\Program Files\Input Viewer\Input Viewer.exe`.
+  The prototype's Velopack installer installs per user under
+  `%LocalAppData%\InputViewerEgui\` with `input-viewer.exe`.
+- Note also that Electron's NSIS config is `perMachine: false`, whose
+  default location is `%LocalAppData%\Programs`, not `C:\Program Files` --
+  so how the wall's current install got there is itself undocumented
+  ([open questions](open-questions.md)).
+
+Decide the install location and change `startup.ps1` in the same release
+that switches the wall, in labs-videowall-config.
diff --git a/docs/adr/0007-capture-at-native-resolution.md b/docs/adr/0007-capture-at-native-resolution.md
new file mode 100644
index 0000000..a315bd6
--- /dev/null
+++ b/docs/adr/0007-capture-at-native-resolution.md
@@ -0,0 +1,58 @@
+# 0007. Capture at the card's native resolution, and log what was negotiated
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-01-16 (#5, #7, #8, #9); 2026-04-16 (#34); 2026-08-09 (#152, #166) |
+| **Area** | Capture |
+| **Evidence** | `renderer.js:855-860` (constraints), `:875-883` (video-only fallback), `:899-945` (low-res retry); 427ae10, afd9a22, a158a56, 5cb79c0, 75c56d7 |
+| **egui verdict** | Adapt |
+| **egui status** | Partial |
+
+## Context
+
+The constraint went through five versions in a day and more later: ideal
+1920x1080@30, ideal 4096x2160@60, `min` constraints (the stream "failed
+entirely"), `exact` 1920x1200 (too rigid), then ideal 4096x2160 with a retry.
+
+Two separate problems hid behind "the card opens at 640x480":
+
+- A permission-probe MediaStream that was never stopped locked an Elgato Cam
+  Link at 640x480 (#34). Some GPU flags added to fix "poor quality" were
+  partly that misdiagnosis and were removed again
+  ([0018](0018-composite-on-the-gpu.md)).
+- Some USB cards really do negotiate low by default.
+
+The wall's PCIe 4K60 Pro MK.2 always negotiates 3840x2160 (measured
+2026-10-01). Why the request says 4096 rather than 3840 is not recorded.
+
+## Decision
+
+- Request `{deviceId: exact, width: ideal 4096, height: ideal 2160,
+  frameRate: ideal 60}`.
+- If the result is <= 640 wide: stop the tracks, wait 300 ms, retry at
+  min(capabilities, 1920x1080) -- capped there "to prefer uncompressed
+  formats over MJPEG" on USB cards. Missing `getCapabilities()` means
+  "unknown, try anyway" (#152). If that fails, open with no constraints.
+- Log the settings and capabilities that were agreed.
+
+## Consequences
+
+The retry path only matters for USB and virtual cameras. It carries a bug:
+it requests audio with the **video** device id (`renderer.js:927-929`, #347), the
+mistake #151 fixed on the main path ([open questions](open-questions.md)).
+
+## Porting to egui
+
+**Adapt.** Constraint negotiation is a WebRTC concept; natively the formats
+are enumerable. Keep the product rule -- native resolution, uncompressed
+where offered, log the chosen format -- and replace the guesswork with an
+explicit choice from the device's format list.
+
+**Lesson to keep from #34:** release any probe stream before opening the
+real one.
+
+Prototype: `capture.rs` asks nokhwa for `AbsoluteHighestResolution` in RGBA
+and logs `stream: WxH`. It does not prefer uncompressed over MJPEG, does not
+log the frame rate or pixel format, and fails outright on devices that only
+offer BGRA (OBS Virtual Camera: `Unknown FourCharCode 1111970369`).
diff --git a/docs/adr/0008-one-capture-session-per-device.md b/docs/adr/0008-one-capture-session-per-device.md
new file mode 100644
index 0000000..8fee3e6
--- /dev/null
+++ b/docs/adr/0008-one-capture-session-per-device.md
@@ -0,0 +1,44 @@
+# 0008. One capture session per device, shared by both halves
+
+| | |
+|---|---|
+| **Status** | Accepted (Electron shape: one track per side) |
+| **Date** | 2026-01-11 (69fa6d5, detection per unique device); 2026-08-20 (#261) |
+| **Area** | Capture |
+| **Evidence** | `renderer.js` `startVideoStream` :768-985, `selectInputForBoth` :2924, `getUniqueActiveDevices` :4855, detection mirroring :4758-4769 |
+| **egui verdict** | Adapt |
+| **egui status** | Done |
+
+## Context
+
+The wall usually shows the same card on both halves (`.claude/CLAUDE.md`).
+Chromium shares one capture session between tracks on the same device,
+which is why opening the device twice works -- and why a reopen must release
+both sides first ([0013](0013-reopen-by-releasing-the-device-with-two-backoffs.md)).
+
+## Decision
+
+- Each side owns a MediaStream and a `<video>`, even when both show the
+  same device. Switching a side stops that side's previous tracks.
+- Detection runs once per unique device and mirrors the verdict to the
+  twin side.
+- A per-side generation token (`streamGen`) stops a late reopen from
+  overwriting a switch the operator made meanwhile.
+
+## Consequences
+
+With the same device on both sides, each side has its own audio track; the
+audio may play twice. Nothing addresses or documents that
+([open questions](open-questions.md)).
+
+## Porting to egui
+
+**Adapt** to the native shape the Electron one approximates: open **one**
+session per physical device and fan its frames out to both halves. That
+makes the "release every side first" workaround implicit, and gives one
+health verdict and one audio stream per device for free.
+
+Prototype: done. `slots: HashMap<device_id, Slot>`; both halves draw from
+the same texture; streams no visible side needs are dropped each frame
+(`sync_streams`). The generation-token concern disappears because a slot is
+keyed by device, not by side.
diff --git a/docs/adr/0009-pair-audio-with-its-video-card.md b/docs/adr/0009-pair-audio-with-its-video-card.md
new file mode 100644
index 0000000..26eebb2
--- /dev/null
+++ b/docs/adr/0009-pair-audio-with-its-video-card.md
@@ -0,0 +1,43 @@
+# 0009. Pair audio with its video card; missing audio never blocks video
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-09 (#151, PR #169) |
+| **Area** | Capture |
+| **Evidence** | `renderer.js:836-866`; `mock-capture.js:44-47` |
+| **egui verdict** | Adapt |
+| **egui status** | Not started |
+
+## Context
+
+Audio used to be requested with the **video** device id. That always failed
+with OverconstrainedError, so every input switch cost two `getUserMedia`
+calls and logged a misleading error (#151).
+
+## Decision
+
+- Find the `audioinput` with the same `groupId` as the video device; request
+  audio only if one exists.
+- If the combined open fails, open video alone: "video alone is still worth
+  having".
+- Mock inputs get a **distinct** `groupId` each, so mock mode cannot make a
+  pairing bug look correct.
+
+## Consequences
+
+One `getUserMedia` call in the common case. The retry path in
+[0007](0007-capture-at-native-resolution.md) still has the old bug.
+
+## Porting to egui
+
+**Adapt.** `groupId` is WebRTC's. Natively, pair through the device's
+container id (Windows `DEVPKEY_Device_ContainerId`; the Elgato exposes a
+matching audio endpoint) and CoreAudio's equivalent on macOS. Keep the two
+rules: audio follows its card, and a missing or failing audio device never
+blocks video.
+
+Prototype: no audio at all. With one session per device
+([0008](0008-one-capture-session-per-device.md)) the "plays twice" question
+answers itself: one audio stream per device, mixed per side by volume
+([0010](0010-volume-belongs-to-a-side.md)).
diff --git a/docs/adr/0010-volume-belongs-to-a-side.md b/docs/adr/0010-volume-belongs-to-a-side.md
new file mode 100644
index 0000000..d42f83b
--- /dev/null
+++ b/docs/adr/0010-volume-belongs-to-a-side.md
@@ -0,0 +1,40 @@
+# 0010. Volume belongs to a side; the OS volume is shown and set directly
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-01-24 (#25, 6caf489); 2026-08-25 (#283) |
+| **Area** | Capture |
+| **Evidence** | `renderer.js:1329-1404` (gain node per side), `:1436-1489` (polling), `buildPickerVolume` :2885; `src/main/index.js:682-795`; USER_GUIDE |
+| **egui verdict** | Adapt |
+| **egui status** | Not started |
+
+## Context
+
+Each half has a volume slider in its picker, and the capsule has an output
+volume control. The OS volume was read by shelling out: AppleScript on
+macOS, PowerShell compiling an inline C# `IAudioEndpointVolume` interop on
+Windows, every 2 s for the app's life. PID churn on the wall confirmed it
+(#283).
+
+## Decision
+
+- `<video>` elements are muted; audio goes MediaStreamSource -> GainNode ->
+  destination, one per side. Volume 0..1 per side, persisted as
+  `leftVolume` / `rightVolume`. It belongs to the half, "so it stays put
+  when you switch inputs" (USER_GUIDE). A both-halves picker sets both.
+- OS master volume is polled every 2 s **only while the dropdown is open**,
+  once at startup, with a 30 s safety stop (#283).
+
+## Consequences
+
+The volume UI is accurate only while visible, which is the only time it
+matters.
+
+## Porting to egui
+
+**Adapt.** Keep per-side volume and the OS volume control as product
+behaviour. Replace the shell-out with WASAPI (`windows` crate) and CoreAudio
+calls; the polling concern disappears, since a native read costs
+microseconds. Keep `leftVolume` / `rightVolume` and `systemVolume` in
+`settings.json`. Not started in the prototype.
diff --git a/docs/adr/0011-choose-startup-inputs-by-precedence.md b/docs/adr/0011-choose-startup-inputs-by-precedence.md
new file mode 100644
index 0000000..10cfe76
--- /dev/null
+++ b/docs/adr/0011-choose-startup-inputs-by-precedence.md
@@ -0,0 +1,55 @@
+# 0011. Choose each half's input by a fixed precedence, and keep it across hot-plug
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-01 (PR #318, 8cb7e0a); 2026-10-02 (PR #324) |
+| **Area** | Capture |
+| **Evidence** | `renderer.js` `openInitialStreams` :4910-4940, `getVideoDevices` :654-766 (keep-side :713-747), `devicechange` :4282-4296, `ensureRightStream` :2096 |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+Two incidents on the wall:
+
+- **2026-10-01.** An EDID write in the Elgato utility fired `devicechange`
+  with no hardware change. The re-pick started from null saved settings and
+  relabelled the left half "Apple TV" while it still showed the presenter;
+  the next health reopen would have switched the wall.
+- **2026-10-02.** Starting in single view opened only the left stream, so
+  `D` showed a black right half.
+
+## Decision
+
+For each half, in order:
+
+1. Keep the current input if that device is still present (hot-plug).
+2. Else the saved `leftDeviceId` / `rightDeviceId`.
+3. Else the first enabled device (left), and the second enabled device or a
+   duplicate of the first (right).
+4. At startup only, `defaultInputId` overrides left -- and right in dual --
+   if it is present and enabled.
+5. With Multi-view off, right always follows left.
+
+Settings are saved only after the inputs are chosen (writing null over the
+saved choice is how the wall once forgot its input). On `devicechange`,
+re-enumerate and immediately reopen any side that is `open-failed`, `ended`
+or `no-frames`, skipping its backoff. Dual view always ensures a live right
+stream.
+
+## Consequences
+
+A device-change event can fire with no hardware change; the precedence makes
+that harmless.
+
+## Porting to egui
+
+**Keep.** Prototype: the precedence is `choose_sides()` in `app.rs`, unit
+tested against these rules (startup default, hot-plug keeps the screen,
+disabled default ignored, Multi-view off). The "not overwritten with None"
+rule is in the frame loop's settings sync.
+
+Missing: hot-plug is a 10 s re-enumeration poll, not an OS device-arrival
+notification, and a device returning does not short-circuit the reopen
+backoff.
diff --git a/docs/adr/0012-judge-health-by-counting-frames.md b/docs/adr/0012-judge-health-by-counting-frames.md
new file mode 100644
index 0000000..65b3cde
--- /dev/null
+++ b/docs/adr/0012-judge-health-by-counting-frames.md
@@ -0,0 +1,62 @@
+# 0012. Judge capture health by counting frames, never by measuring motion
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-01 (PR #311); motion rejected 2026-08-09 (#159) |
+| **Area** | Signal |
+| **Evidence** | `stream-health.js` (constants :40-57), `renderer.js:989-1263`; #311, #159, #314 |
+| **egui verdict** | Keep |
+| **egui status** | Done |
+
+## Context
+
+A card sometimes boots showing black with a live source plugged in. On
+2026-10-01 the app started at 12:12:27 and someone restarted it by hand at
+12:22:35. The split-flap board never appeared: **the wall has no no-signal
+references** ([0014](0014-detect-no-signal-against-references.md)), and the
+stream had opened fine. The Elgato driver exposes no signal-lock state
+(registry and services checked), so the picture is the only evidence.
+
+Motion detection was rejected in #159: "the wall shows presentations, so a
+held slide IS a frozen feed."
+
+## Decision
+
+Sample every 2000 ms: a frame counter (`track.stats.totalFrames`, falling
+back to `getVideoPlaybackQuality`) and the luma mean and spread of a
+thumbnail. Statuses:
+
+| Status | Rule |
+|---|---|
+| `opening` | not yet decided |
+| `ok` | frames arriving |
+| `no-frames` | no frame within 8000 ms of opening |
+| `stalled` | counter stopped for 6000 ms, **only if the feed had reached >= 5 fps first** |
+| `ended` | track ended |
+| `open-failed` | open rejected |
+| `dark` | luma spread <= 3 for 6000 ms |
+
+A counter going backwards is a new baseline. "Was flowing first" keeps a
+static virtual camera, which really sends one frame, from being reopened in
+a loop.
+
+## Consequences
+
+This, not reference detection, is what keeps the wall working. The dark
+check uses the 384x216 crop thumbnail since #314; comments and CLAUDE.md
+still say 32x18 ([open questions](open-questions.md)).
+
+## Porting to egui
+
+**Keep** the statuses, thresholds and the no-motion rule. Natively the frame
+counter is the capture callback itself, which is simpler than Chromium's
+stats.
+
+**Done.** `health.rs` is a line-for-line port of `stream-health.js` --
+constants, statuses, backoffs -- with its unit tests ported case for case.
+Sampled every 2 s per device from the frame counter and the luma of a
+**box-averaged** 384x216 thumbnail (averaged as Electron's canvas downscale
+is, so a card's noisy no-signal screen still reads flat). A stream error is
+acted on at once, as a rejected open or an ended track is in Electron.
+Verified end to end with `--mock-fault=dark|stall|fail`.
diff --git a/docs/adr/0013-reopen-by-releasing-the-device-with-two-backoffs.md b/docs/adr/0013-reopen-by-releasing-the-device-with-two-backoffs.md
new file mode 100644
index 0000000..2ffddeb
--- /dev/null
+++ b/docs/adr/0013-reopen-by-releasing-the-device-with-two-backoffs.md
@@ -0,0 +1,59 @@
+# 0013. Reopen a sick device by releasing it fully, on separate backoffs for faults and for dark
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-01 (PR #311) |
+| **Area** | Signal |
+| **Evidence** | `stream-health.js:52-54, 238-262`; `renderer.js:1266-1297` (`reopenDevice`), `REOPEN_RELEASE_MS` :995, `:1183-1203` |
+| **egui verdict** | Keep |
+| **egui status** | Done |
+
+## Context
+
+The startup script cannot restart the cards (`pnputil` returns 3010 because
+`audiodg.exe` holds the audio endpoint), so recovery is the app's job
+([0006](0006-app-and-wall-setup-live-in-separate-repos.md)). Reopening a
+flat feed is safe because its blank moment cannot be seen. "Nothing plugged
+in all night" is the steady state, so dark must not be retried fast.
+
+## Decision
+
+- **Faults** (`open-failed`, `ended`, `no-frames`, `stalled`): reopen after
+  2 s, 5 s, 15 s, 30 s, then every 60 s.
+- **Dark:** 5 s, 15 s, 30 s, 60 s, 5 min, then every 10 min.
+- The attempt count resets after 60 s healthy. Delays run from the last
+  reopen or from the open.
+- A reopen stops **every side** using the device, closes all frame sources,
+  waits 500 ms "so the driver sees the device closed rather than a
+  handover", then reopens each side unless the operator switched it
+  meanwhile. One reopen in flight per device.
+- No devices at all: re-enumerate at 5 s, 10 s, then every 30 s.
+- Not started under `--no-signal`.
+
+## Consequences
+
+A reopen fixes card and driver-session hangs. It does not fix a dead HDMI or
+HDBaseT link ("Input Viewer reopening the card: no", `edid/README.md`).
+Whether it ever cured the original "boots dark" symptom is not recorded.
+
+## Porting to egui
+
+**Keep** both schedules, the 60 s reset, the 500 ms release gap and
+one-in-flight. "Release every side" is implicit with one session per device
+([0008](0008-one-capture-session-per-device.md)).
+
+**Done.** On a reopen the slot drops its stream -- closing the device -- and
+opens it again after the 500 ms gap; the health state outlives the stream,
+so attempts accumulate. Measured with `--mock-fault`:
+
+| Fault | Observed |
+|---|---|
+| stall | stalled 6 s after the last frame; closed; reopened 0.5 s later; recovers; repeats |
+| dark | dark after 6 s flat; first reopen at once (5 s since open had passed), second 15 s after the first |
+| fail | open-failed immediately; reopens at +2 s, then +5 s |
+
+Decisions are taken at the 2 s sample, as in Electron. Not ported: the
+no-devices re-enumeration at 5 s / 10 s / 30 s (the prototype polls every
+10 s), and skipping the backoff when a device-change event brings a device
+back ([0011](0011-choose-startup-inputs-by-precedence.md)).
diff --git a/docs/adr/0014-detect-no-signal-against-references.md b/docs/adr/0014-detect-no-signal-against-references.md
new file mode 100644
index 0000000..9b29f63
--- /dev/null
+++ b/docs/adr/0014-detect-no-signal-against-references.md
@@ -0,0 +1,64 @@
+# 0014. Detect no-signal by comparing against operator-captured reference screenshots
+
+| | |
+|---|---|
+| **Status** | Accepted -- but dormant on the wall |
+| **Date** | 2026-01-11 (69fa6d5); several references 2026-08-09 (#161, PRs #160, #162, #166, #167); loop 2026-08-05 (#60, #61, PR #129) |
+| **Area** | Signal |
+| **Evidence** | `detection-simple.js:10-22, 31-43, 140-212, 406-616, 636-713`; `frame-source.js`; `renderer.js:4518-4845`; #83, #104, #150, #163 |
+| **egui verdict** | Decide |
+| **egui status** | Not started |
+
+## Context
+
+A capture card with nothing plugged in still sends frames: its own "no
+signal" screen. The app learns what that looks like by having the operator
+capture it. Approaches tried before: a vision model and template matching in
+the Python v1 (d42a80e, 2d59fda), an OpenCV.js spike (a570933; why it was
+dropped is not recorded). Motion detection was rejected (#159).
+
+A card has several no-signal screens -- no cable, unsupported mode, HDCP
+error -- so one reference was not enough (#161). Storing references at full
+resolution made `settings.json` 21 MB for 12 references.
+
+## Decision
+
+- **Compare:** downscale the frame to <= 480x270 (nearest neighbour), compare
+  every 4th pixel (32,400 samples). A sample matches if |dR|, |dG|, |dB| are
+  each <= 30; the frame matches at >= 95% of samples. Early exit once a
+  match is impossible (#104: 1.47 ms to 0.065 ms at 1080p).
+- **Several references per device:** matching ANY one means no-signal.
+  Stored as 480x270 PNG data URLs under
+  `settings.noSignalReferences[deviceId].references[]` (28.4 MB to 3.11 MB
+  for 20). Orphans (device id changed) are logged and offered for pruning,
+  never auto-deleted.
+- **Probe first:** 32 golden-ratio points, reject after > 5 misses -- tuned so
+  it "must never reject what the full scan would match".
+- **Debounce:** two agreeing results flip the state. No reference means "has
+  signal".
+- **Loop:** every 1600 ms wall clock, paced by `requestVideoFrameCallback`
+  with a watchdog at 2x (rVFC never fires on a static feed). Frames via
+  MediaStreamTrackProcessor, canvas fallback: "a working slow path beats a
+  broken fast one".
+
+## Consequences
+
+- **The production wall runs with no references** (`.claude/CLAUDE.md`, PR
+  #311). When and why they were removed is not recorded.
+- The thresholds date from 2026-01 with no recorded tuning data.
+- Two defects: the probe saves nothing because the full scan runs anyway for
+  the diagnostic trace (`detection-simple.js:436-442`); and the legacy
+  `checkNoSignal()` is dead and would always return false
+  ([open questions](open-questions.md)).
+- `VideoFrame.copyTo({rect})` crops rather than resizes; detection once
+  compared a corner against the whole frame and never fired (#150, #163).
+
+## Porting to egui
+
+**Decide first:** is reference detection still a product requirement, or a
+feature for hardware other than the wall? If kept, the algorithm and
+thresholds are pure arithmetic and port as is; store references as PNG files
+keyed by device id rather than base64 in JSON. The whole frame-source layer
+(rVFC, WebCodecs, canvas fallback, the copyTo trap) is Chromium-specific
+and disappears: the capture thread already has CPU frames. Keep the ~1.6 s
+cadence that continues when frames stop.
diff --git a/docs/adr/0015-crop-black-bars-by-snapping-to-shapes.md b/docs/adr/0015-crop-black-bars-by-snapping-to-shapes.md
new file mode 100644
index 0000000..fecdc8b
--- /dev/null
+++ b/docs/adr/0015-crop-black-bars-by-snapping-to-shapes.md
@@ -0,0 +1,59 @@
+# 0015. Crop the card's black bars by snapping to known shapes
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-01 (PR #314); #321, #326 (2026-10-02); #329 (2026-10-03) |
+| **Area** | Signal |
+| **Evidence** | `content-box.js`; `renderer.js:1081-1127`; open: #316 (parked), #340 |
+| **egui verdict** | Keep, and reconsider the source |
+| **egui status** | Not started |
+
+## Context
+
+The Elgato 4K60 Pro MK.2 always delivers 3840x2160 (measured 2026-10-01:
+`left stream: 3840x2160`). A source of another shape arrives fitted inside
+it with pure black around it. A laptop at 3840x768 -- the wall's own 5:1 --
+arrives as a band a third of the frame tall, and single view showed a 16:9
+frame in the middle of a 5:1 wall.
+
+A 96x54 thumbnail could not tell "dual half" (2.433:1) from 21:9 (2.370:1);
+both measured 2.400. A mirrored Mac matched nothing until "MacBook" (1.542)
+was added.
+
+## Decision
+
+- Measure on a 384x216 thumbnail every 2 s, shared with the health check
+  ([0012](0012-judge-health-by-counting-frames.md)).
+- A pixel is bar if luma <= 10; a row or column is picture if > 2% of it is
+  above that. Bars must be symmetric within 4%.
+- **Snap, never crop to the measurement.** The shape must be within 6% of
+  one of `SHAPES` (5:1, 32:9, dual half, 21:9, 2:1, 16:9, 16:10, MacBook,
+  3:2, 4:3, 5:4). One-axis bars get the exact centred crop; bars on both
+  axes (a windowbox) get the shape's box, rounded down so picture is never
+  cut.
+- Change only after **3 identical results** (~6 s), 1% jitter tolerated.
+  Undecidable samples are ignored. Reset on every new stream. An all-black
+  or unmatched frame changes nothing -- which is what keeps a dark slide
+  from being cropped.
+- Applied as CSS `object-view-box`; `cropLetterbox: false` disables it.
+
+## Consequences
+
+- `drawImage` reads the full decoded frame whatever the crop shows, so
+  detection keeps seeing the bars after cropping.
+- **Known failures:** a false crop on dark content (#316, parked), and on
+  2026-10-05 a mirrored MacBook cropped **into** the picture on the wall
+  (undiagnosed; its `[Crop]` log lines are still needed).
+
+## Porting to egui
+
+**Keep** the maths (pure, unit tested) and the snapping rules. The crop
+becomes UV coordinates on the textured quad -- a one-line change in the
+paint call, and the freeze path gets it for free
+([0017](0017-freeze-shows-the-live-picture.md)).
+
+**Reconsider the source:** #340 proposes asking the Elgato driver for the
+source resolution instead of inferring it from black bars. That is a KS
+property query, hard from Electron and ordinary from Rust. Check first that
+the query works while the app holds the card ([0006](0006-app-and-wall-setup-live-in-separate-repos.md)).
diff --git a/docs/adr/0016-laptop-resolution-hint-off-by-default.md b/docs/adr/0016-laptop-resolution-hint-off-by-default.md
new file mode 100644
index 0000000..e2255a3
--- /dev/null
+++ b/docs/adr/0016-laptop-resolution-hint-off-by-default.md
@@ -0,0 +1,35 @@
+# 0016. Keep the "set your laptop to 3840x768" hint off by default
+
+| | |
+|---|---|
+| **Status** | Accepted (premise weakened since 2026-10-02) |
+| **Date** | 2026-10-01 (on in PR #314, off in PR #319) |
+| **Area** | Signal |
+| **Evidence** | `renderer.js:1129-1169`, `ASPECT_HINT_MS`; labs-videowall-config `edid/README.md` (08f8a82) |
+| **egui verdict** | Keep |
+| **egui status** | Not started |
+
+## Context
+
+Once cropping knew a laptop was sending a narrower-than-16:9 picture, a hint
+could ask the presenter to switch to 3840x768. On the wall, changing
+resolution dropped the HDBaseT link until the HDMI at the card was replugged:
+picture lost for up to **156 s** over HDBaseT. On a 15 m HDMI cable there
+were no drops in 20 switches. The EDID now makes 3840x768 a laptop's default
+mode, and since 2026-10-02 the presenter link is HDMI, not HDBaseT.
+
+## Decision
+
+Off unless `aspectHint: true`. When on: single view only, for a cropped
+source narrower than 16:9, for 15 s, 28 px at 6% from the top. The Apple TV
+is native 16:9 and never triggers it.
+
+## Consequences
+
+The original reason for keeping it off -- the HDBaseT drop -- no longer
+applies to the presenter link.
+
+## Porting to egui
+
+**Keep** off by default, behind the same setting. Revisit the default with
+the wall's current cabling. Needs [0015](0015-crop-black-bars-by-snapping-to-shapes.md) first.
diff --git a/docs/adr/0017-freeze-shows-the-live-picture.md b/docs/adr/0017-freeze-shows-the-live-picture.md
new file mode 100644
index 0000000..5cca19b
--- /dev/null
+++ b/docs/adr/0017-freeze-shows-the-live-picture.md
@@ -0,0 +1,37 @@
+# 0017. Freeze shows exactly the picture that was live
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-01 (PR #314, it used to stretch); 2026-10-03 (PR #332, centre gap) |
+| **Area** | Signal |
+| **Evidence** | `renderer.js:538-610` (`toggleFreeze`, `drawFitted`, `captureFrame`) |
+| **egui verdict** | Adapt |
+| **egui status** | Done |
+
+## Context
+
+Freeze (Space) holds the picture -- for a presenter changing slides
+privately, for example. It snapshotted each feed into a canvas, and twice
+that snapshot differed from the live view: it stretched the frame over the
+whole area (fixed in #314), and it read a nonexistent `layoutGap` and drew
+solid black (fixed in #332).
+
+## Decision
+
+Snapshot both visible feeds with the same crop and contain-fit as the live
+view, keeping the dual-view gap. Hide the live videos while frozen. Detection
+pauses; the health monitor keeps running. Show a green "LIVE" for 1 s on
+unfreeze.
+
+## Consequences
+
+Freeze needs its own copy of the layout geometry, which is how it drifted
+twice.
+
+## Porting to egui
+
+**Adapt:** natively, freeze is "stop uploading new textures". The picture
+cannot differ from the live one because it **is** the live one, drawn by the
+same code. Prototype: done (`update_frames` skips the upload while frozen,
+a FROZEN badge shows). Missing: the 1 s LIVE flash on unfreeze.
diff --git a/docs/adr/0018-composite-on-the-gpu.md b/docs/adr/0018-composite-on-the-gpu.md
new file mode 100644
index 0000000..56f6ea6
--- /dev/null
+++ b/docs/adr/0018-composite-on-the-gpu.md
@@ -0,0 +1,57 @@
+# 0018. Composite video on the GPU, with good downscaling
+
+| | |
+|---|---|
+| **Status** | Accepted (Electron: CSS `<video>`; WebGPU path evaluated and not adopted) |
+| **Date** | 2026-01-16 (#6 GPU switches); 2026-04-16 (#34); 2026-08-19 (#62 closed) |
+| **Area** | Signal |
+| **Evidence** | `src/main/index.js:10-12`; `styles.css:147-154`; `gpu-compositor.js`; `renderer.js:4378-4473`; `scripts/bench-compositing.mjs`; #62, PRs #129, #137, #200 |
+| **egui verdict** | Drop (decided by the platform) |
+| **egui status** | Done |
+
+## Context
+
+Electron composites with CSS: two `<video>` elements with `object-fit:
+contain` and `image-rendering: high-quality`, plus Chromium switches
+`ignore-gpu-blocklist` and `enable-gpu-rasterization`. Two other switches
+added for quality, `enable-accelerated-mjpeg-decode` and
+`enable-native-gpu-memory-buffers`, were removed because they "could
+interfere with UVC device format negotiation" (#34).
+
+#62 benchmarked three paths at 6000x1200 on an M3 Pro:
+
+| Path | Quiet | With a 120 ms/s main-thread stall |
+|---|---|---|
+| CSS | 20 fps (capture-bound) | 18.9 |
+| WebGPU in-page | 120 composites/s | 107.2 |
+| OffscreenCanvas worker | 120 | 120.1 |
+
+"Compositing is not the bottleneck." WebGPU stayed opt-in
+(`gpuCompositing`), off on the wall, without the crop, and silently drops a
+third feed.
+
+## Decision
+
+CSS compositing, GPU-accelerated through Chromium switches; WebGPU as an
+experiment only.
+
+## Consequences
+
+On the wall, `gpu-report.txt` confirms ANGLE on the NVIDIA RTX PRO 4000 with
+GPU compositing enabled (#271).
+
+## Porting to egui
+
+**Drop** -- a native egui app **is** a GPU compositor; the switches, the CSS
+and the WebGPU experiment have nothing to carry over.
+
+**One finding from the port to keep as a rule:** plain bilinear filtering
+skips source pixels beyond 2x reduction, and a 4K card on a ~2133x1200 half
+is 1.8x down. With `--test-pattern` the 1px line pairs turned to moiré.
+The prototype uses trilinear mipmaps for video textures (`VIDEO_TEXTURE` in
+`app.rs`): the lines render as flat grey, and two 4K60 inputs still run at
+60 fps with no skipped frames. Chromium's `high-quality` hid this in
+Electron.
+
+Also keep #34's lesson: render settings must never affect capture format
+negotiation.
diff --git a/docs/adr/0019-one-no-signal-state-machine.md b/docs/adr/0019-one-no-signal-state-machine.md
new file mode 100644
index 0000000..c654709
--- /dev/null
+++ b/docs/adr/0019-one-no-signal-state-machine.md
@@ -0,0 +1,51 @@
+# 0019. One no-signal state machine per side, with a downtime clock
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-21 (#154, PR #270); #248 (2026-08-19) |
+| **Area** | Signal |
+| **Evidence** | `renderer.js:1663-1702` (`showNoSignal` / `hideNoSignal`), `:1510-1660` (boards, `formatDowntime`, `boardShouldRun`), `:1718-1757` (screensaver trigger) |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+Many paths can make a side go dark: a detection verdict, a failed open, a
+disabled input, a missing device, a failed enumeration. Each used to manage
+the overlay itself.
+
+## Decision
+
+- `showNoSignal(side)` is idempotent and stamps `noSignalSince` only on the
+  transition, so a mirrored twin side does not reset the clock.
+  `hideNoSignal(side)` clears it and stops the board.
+- **`--no-signal` is enforced in exactly one place:** `hideNoSignal()`
+  returns early. Every path that would clear the overlay goes through it,
+  so one guard covers all of them; pushing the check out to callers is how
+  one gets missed ([0042](0042-test-mode-flags.md)).
+- The board shows `<INPUT NAME> / NO SIGNAL / DOWN mm:ss` -- `DOWN hH mmM`
+  past an hour, `DOWN dD hhH` past a day -- refreshed every 5 s.
+- The board runs only while its side is dark and no screensaver covers it.
+- The screensaver starts after 5 min with every visible side dark
+  ([0023](0023-start-after-5-min-rotate-every-10.md)).
+
+## Consequences
+
+A disabled input and a failed open show the same board.
+
+## Porting to egui
+
+**Keep.** Prototype: `side_no_signal(i)` is the single seam -- forced, no
+input, a missing or disabled device, or a device that cannot be opened --
+and `board_since` is the per-side clock. As in Electron, a dark, stalled or
+frameless stream does **not** put the board up; it is reopened and stays
+black meanwhile. Only reference detection
+([0014](0014-detect-no-signal-against-references.md)) turns a live-but-dark
+card into the board -- so without it, a wall whose cards are dark at night
+shows black, never the board or a screensaver. That is today's Electron
+behaviour on the wall too, and a reason to settle D1 in
+[open-questions.md](open-questions.md).
+Missing: the DOWN line, and keeping the clock across a twin side (moot with
+one session per device). The board text is "NO SIGNAL / <label>" without the
+downtime.
diff --git a/docs/adr/0020-split-flap-board-is-the-no-signal-display.md b/docs/adr/0020-split-flap-board-is-the-no-signal-display.md
new file mode 100644
index 0000000..e11dc46
--- /dev/null
+++ b/docs/adr/0020-split-flap-board-is-the-no-signal-display.md
@@ -0,0 +1,49 @@
+# 0020. The split-flap board is the no-signal display, not a screensaver
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-08 (#147); moved out of rotation 2026-08-09 (PR #148, #92); live rows 2026-08-21 (#154, PR #270) |
+| **Area** | Screensavers |
+| **Evidence** | `screensavers/split-flap.js:1-20, 105-117, 224-300`; `renderer.js:51-53, 1520-1620`; `index.html` fallback text |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+#92 asked for a no-signal screen that "reads as intentional rather than as a
+crashed app". The board was first built as screensaver number 22, which
+meant it appeared only after five minutes of darkness -- the opposite of the
+intent: an abstract animation the instant a feed dies reads as a crash.
+
+A random palette made it green or magenta. "NO SIGNAL" was clipped to "NO
+SIGNA" at 16:9. Two hidden boards were found still rendering behind an
+opaque screensaver.
+
+## Decision
+
+- One board per dark half, shown immediately; removed from the screensaver
+  list.
+- Fixed cream-on-near-black, by construction.
+- Columns: at least the longest built-in line + 2. Live text truncates with
+  a trailing "." -- 16 columns per half, 22 for the whole wall.
+- Live rows are pushed through `setMessages()` rather than passing app state
+  into the saver (#154 options 1 and 2 rejected). A malformed push restores
+  the built-in list.
+- An HTML "NO SIGNAL / Connect your device to the presenter booth" stays as
+  the fallback if WebGL fails, hidden only once the board runs.
+- Boards stop while a screensaver covers them.
+
+## Consequences
+
+The board is information, not decoration: what is dark, and for how long.
+
+## Porting to egui
+
+**Keep.** Prototype: a painter-drawn board (`paint_split_flap`, no GL), one
+per dark half, flipping into place, cream and amber rows. It needs the DOWN
+row ([0019](0019-one-no-signal-state-machine.md)), the column rules, and the
+"Connect your device to the presenter booth" line. Porting the GL board
+itself needs a glyph atlas from a Rust font rasteriser
+([0029](0029-text-through-a-baked-glyph-atlas.md)); the painter version may
+simply be good enough.
diff --git a/docs/adr/0021-screensaver-registry-contract.md b/docs/adr/0021-screensaver-registry-contract.md
new file mode 100644
index 0000000..08b8687
--- /dev/null
+++ b/docs/adr/0021-screensaver-registry-contract.md
@@ -0,0 +1,51 @@
+# 0021. Screensavers are modules behind one synchronous contract, with a safe fallback
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-06-07 (aa71c72); seed argument 2026-08-06 (PR #132); `isAvailable` 2026-08-11 (PR #198, #101) |
+| **Area** | Screensavers |
+| **Evidence** | `screensavers/registry.js:3-20, 53-83, 107-136, 179-248, 265-277`; `weather.js:18-23, 45-60, 691` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+29 savers draw on one shared canvas, one at a time. A shader that fails to
+compile on unknown wall hardware must not leave the wall black. Weather is
+the first saver that depends on something outside itself; an async start
+would leave a blank canvas while a fetch failed.
+
+## Decision
+
+- Contract: `{ name, create(canvas, seed) -> { start, stop }, isAvailable? }`.
+  `startScreensaver()` is **synchronous**.
+- `create()` / `start()` are wrapped in try/catch. On failure, `stop()` the
+  partly started instance to release its GL resources and start
+  `SCREENSAVERS[0]`, the DVD logo.
+- `isAvailable()` is optional and gates **only the random rotation**; a
+  throw counts as false. Explicit selection (stepping keys, preview,
+  shadercheck) ignores it, so such a saver must render something defensible
+  with no data -- Weather's `FALLBACK` is a calm half-clouded day.
+- Rejected on #101: an async `prepare()` (every caller becomes async, an HTTP
+  round trip before the first no-signal), and a saver reporting its own
+  failure mid-frame (re-entrancy, and still blank while it fails).
+- Selection by name ignores case and whitespace; the active index is read
+  from the registry, never cached by callers.
+
+## Consequences
+
+The fallback makes failures invisible to callers -- which is how the first
+shadercheck reported 60/60 while the driver rejected a shader
+([0028](0028-verify-shaders-and-measure-on-a-real-gpu.md)). Why the DVD logo
+is the fallback, beyond being first and simplest, is not recorded.
+
+## Porting to egui
+
+**Keep** as a Rust trait: `fn create(seed) -> Result<Box<dyn Saver>>`,
+`start/stop/paint`, optional `is_available()`. Prototype: four savers in a
+`State` enum in `screensaver.rs`; Plasma falls back to the DVD logo if its
+GL setup fails (`plasma::failed()`). Missing: `is_available`, a stepping
+order that matches the Electron registry, and `stop()` releasing GL
+resources (the prototype keeps compiled programs for the context's life,
+deliberately, to avoid recompiling).
diff --git a/docs/adr/0022-seed-every-activation.md b/docs/adr/0022-seed-every-activation.md
new file mode 100644
index 0000000..9a6d9ac
--- /dev/null
+++ b/docs/adr/0022-seed-every-activation.md
@@ -0,0 +1,49 @@
+# 0022. Seed every activation from the clock, log the seed, and perturb within curated ranges
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-06 (PR #132, 4d60750) |
+| **Area** | Screensavers |
+| **Evidence** | `screensavers/seed.js:1-24, 74-76`; `gl-base.js:13-24, 44-52, 507-529`; `registry.js:218-227`; `plasma.js:64-73`; `test/screensaver-seed.test.js:309-370` |
+| **egui verdict** | Adapt |
+| **egui status** | Partial |
+
+## Context
+
+`gl-base.js` resets `iTime` and `iFrame` to 0 on every start. PR #132 found
+**7 of the then 12 savers replayed bit for bit**; Strange Attractor used
+`Math.random()` but converged on the same attractor within a second anyway.
+
+Free randomness is no better: "most of these parameter spaces are
+degenerate". PR #132's first Gray-Scott regimes were wrong for 4 of 8.
+
+## Decision
+
+- Seed: FNV-1a over `String(Date.now())` (hashed because a timestamp's high
+  bits barely change), into mulberry32. Logged by the registry on every
+  activation; `?seed=` in the preview reproduces it.
+- Shader savers get `uniform vec4 iSeed` -- four uncorrelated values, fixed
+  per activation. JS savers get `createRng(seed)` with
+  `range/around/int/pick/chance/sign/phase`, built in `create()` so choices
+  survive a stop/start.
+- **Perturb, don't randomise.** Seed only what changes the look
+  meaningfully, from curated lists or tight bands (Plasma's `baseHue` table,
+  the Gray-Scott regime table with a test). Comment every bound that carries
+  weight.
+
+## Consequences
+
+Any look on the wall can be reproduced from its log line. The constants are
+tuning; re-deriving them in Rust would lose it.
+
+## Porting to egui
+
+**Adapt.** `iSeed` and the curated GLSL tables carry over unchanged with the
+shader source. JS-side ranges must be ported by hand, verbatim.
+
+Prototype: a seed per activation from the clock, logged and shown for 4 s on
+screen, `iSeed` passed to Plasma. **But it uses xorshift64\*, not mulberry32 +
+FNV-1a**, so an Electron seed does not reproduce in the egui app. Port
+mulberry32 if seeds should be shareable between the two -- they should,
+while both run.
diff --git a/docs/adr/0023-start-after-5-min-rotate-every-10.md b/docs/adr/0023-start-after-5-min-rotate-every-10.md
new file mode 100644
index 0000000..afc4e18
--- /dev/null
+++ b/docs/adr/0023-start-after-5-min-rotate-every-10.md
@@ -0,0 +1,46 @@
+# 0023. Start a screensaver after 5 minutes dark, rotate every 10, never repeat the last
+
+| | |
+|---|---|
+| **Status** | Accepted -- dismissal is Open |
+| **Date** | 2026-08-06 (PR #132, rotation); 2026-08-09 (#158, stepping keys); 2026-01-24 (#25, shake to dismiss) |
+| **Area** | Screensavers |
+| **Evidence** | `renderer.js:144, 149` (`dvdScreensaverDelay`, `screensaverRotateDelay`), `:1765-1766` (crossfade), `:1945-1970`; `registry.js:89-92, 158-177`; USER_GUIDE |
+| **egui verdict** | Keep; Decide on dismissal |
+| **egui status** | Partial |
+
+## Context
+
+No-signal can last days. Without rotation a fresh seed is seen once per
+no-signal event and then frozen for hours; a repeat pick "reads as the
+rotation being broken". The 5-minute delay predates the framework; the
+10-minute rotation value's rationale is not recorded.
+
+## Decision
+
+- Start after 5 min with every visible side dark; `--screensaver-delay`
+  overrides it.
+- Rotate every 10 min. `pickRandomIndex(avoid)` excludes the previous index
+  and unavailable savers; if nothing is left it ignores availability ("same
+  saver twice is a much smaller problem than a blank one"). No retry loop.
+- Crossfade between savers: 300 ms out, 520 ms in.
+- `V` toggles a saver on demand; `+` / `-` step, and stepping restarts the
+  rotation countdown.
+- **Dismissal:** signal returning, `V`, or **shaking the mouse** (4 reversals
+  of > 10 px within 500 ms).
+
+## Consequences
+
+**USER_GUIDE says** "move the mouse / press any key / touch the screen" ends
+the screensaver. **The code does not**: only shake, `V` or signal restore do.
+
+## Porting to egui
+
+**Keep** the timings and never-repeat rule. Prototype: 5 min delay, 10 min
+rotation, `index_except` never repeats (tested), `V` and `+`/`-`. Missing:
+the crossfade, `is_available`, and shake.
+
+**Decide dismissal** before porting it: either the guide is right (any input
+dismisses) or the code is (shake only, so a nudged mouse or a passing touch
+does not drop the wall back to the board). Then fix whichever is wrong in
+Electron too.
diff --git a/docs/adr/0024-scale-by-area-and-room.md b/docs/adr/0024-scale-by-area-and-room.md
new file mode 100644
index 0000000..d901d86
--- /dev/null
+++ b/docs/adr/0024-scale-by-area-and-room.md
@@ -0,0 +1,46 @@
+# 0024. Scale savers by area and by room light, not by axis
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-03 (b6fb632, #87); 2026-08-04 (bc88fec #106, e0c2e31 #110, #88); supersample caps 2026-08-07 (#116, PR #134) |
+| **Area** | Screensavers |
+| **Evidence** | `gl-base.js:80-104` (`resolveSampleCount`), `:932-1086`; `plasma.js:9-24, 182-198`; #88 |
+| **egui verdict** | Keep |
+| **egui status** | Not started |
+
+## Context
+
+#88: "particle screensavers are near-invisible on the 6000x1200 videowall".
+The wall is 10 m x 2 m: one pixel is 1.67 mm, and a 1-2 px dot is about 1.3
+arcmin at 8 m. Its area is 3.47x 1080p but its short axis barely more. The
+room is lit, which lifts the black floor; 12% washout is the sizing case.
+
+## Decision
+
+- **Point size:** scale by sqrt(area / 1080p), clamped 1-4x, minimum 4 px
+  above 1.5x 1080p area.
+- **Particle count:** texture side scaled by sqrt(area ratio), multiples of
+  8, capped, never scaled down.
+- **Brightness:** x1.6 only above 3x 1080p ("big room"), so desk monitors
+  are unchanged.
+- **Supersampling goes the other way:** at most 2 samples above 3x HD and 4
+  above 1.4x HD -- at the wall, 4 samples would cost ~14x a single-sampled
+  1080p frame.
+- **Art direction for a 5:1 lit wall** (stated in Plasma, echoed in others):
+  put fine detail in lightness and vary hue only at low frequency; dim whole
+  stretches with a slow low-frequency energy mask so the eye can rest; keep
+  a floor ("a quiet region should be dim plasma, not an absence of image" --
+  a black patch reads as a dead panel); add highlights after the mask so
+  they exceed 1.0 for bloom.
+
+## Consequences
+
+Thresholds are hard-coded against 1920x1080. The art rules live in shader
+comments, not in a written policy.
+
+## Porting to egui
+
+**Keep.** The scaling functions depend only on pixel dimensions: port them
+verbatim as pure functions with tests. The art rules travel inside the GLSL.
+Not started -- Plasma is a pure fragment shader and needs none of them.
diff --git a/docs/adr/0025-hdr-post-chain-owns-tonemapping.md b/docs/adr/0025-hdr-post-chain-owns-tonemapping.md
new file mode 100644
index 0000000..17b8a1a
--- /dev/null
+++ b/docs/adr/0025-hdr-post-chain-owns-tonemapping.md
@@ -0,0 +1,52 @@
+# 0025. An HDR post chain owns tonemapping; savers emit linear HDR; supersample in the shader
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-07 (post chain #112, #113; double-tonemap fix PR #140; supersampling #116, PR #134) |
+| **Area** | Screensavers |
+| **Evidence** | `post-fx.js:1-43, 122-200`; `gl-base.js:61-129, 697-720, 826-895`; `raymarch.js:17-37, 674-677`; `plasma.js:214-229` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+- An 8-bit framebuffer gave no glow and clipped highlights; fading 8-bit
+  trails by 0.04 alpha left permanent ghosts; a 6000 px bloom falloff banded.
+- Only Raymarch encoded sRGB, so every other saver showed linear values as
+  sRGB. Raymarch then got tonemapped and encoded **twice**, "lifting blacks
+  by over 100%" (#140).
+- WebGL's `antialias: true` is MSAA, which samples polygon edges; a
+  fullscreen quad has none, so fractal filigree shimmered (#116).
+
+## Decision
+
+- Savers render linear HDR into an RGBA16F target. **Only the chain**
+  tonemaps and encodes: soft-knee bright pass, 6-mip dual-filter bloom,
+  composite with exposure, ACES (Narkowicz) or Reinhard-Jodie,
+  `pow(1/2.2)`, and interleaved-gradient-noise dither of +-1/2 LSB.
+- Bloom thresholds tuned per saver to ~70% of the **measured** peak (LDR
+  savers peak at 0.36-0.80, accumulating ones up to ~119).
+- Without float targets, a saver keeps an 8-bit direct path.
+- Supersampling is generated in JS (`makeSupersampleFooter`): `main()` calls
+  `mainImage` at 2, 4 or 8 rotated-grid offsets (8 is a rook pattern) and
+  averages. Raymarch adds temporal jitter accumulated in the HDR target,
+  turning itself off when frames take over a second.
+
+## Consequences
+
+Every saver shares one tonemap and one dither, so the wall's look is
+consistent and tunable in one place (the preview's bloom keys).
+
+## Porting to egui
+
+**Keep.** Prototype: done for Plasma. `plasma.rs` runs the four post-FX
+passes extracted verbatim from `post-fx.js`, into RGBA16F, with
+`FRAMEBUFFER_SRGB` disabled so gamma is not applied twice (the #140 trap,
+egui edition), and blits into egui's framebuffer.
+
+Missing: the supersample footer is generated in JS, so `extract.mjs` does not
+see it -- port `makeSupersampleFooter` to Rust before Julia Family and
+Burning Ship (`antialias: 4`). Raymarch's accumulation loop needs its own
+port. On desktop GL 3.3 float targets are core, so the 8-bit fallback is a
+WebGL concern only.
diff --git a/docs/adr/0026-share-glsl-and-work-in-world-space.md b/docs/adr/0026-share-glsl-and-work-in-world-space.md
new file mode 100644
index 0000000..bbdb5e8
--- /dev/null
+++ b/docs/adr/0026-share-glsl-and-work-in-world-space.md
@@ -0,0 +1,55 @@
+# 0026. Share GLSL through one library, and work in world space divided by the short axis
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-07 (PR #138, #115, #114) |
+| **Area** | Screensavers |
+| **Evidence** | `glsl-lib.js:4-48, 51-86, 243-250, 262-318, 405-414` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+- Clip space is stretched 5:1 on the wall: Boids' 0.06 separation radius
+  became a 180x36 px ellipse (#114).
+- Value noise shows lattice artefacts at wall scale.
+- `fract(sin(dot(...)) * 43758.5453)` shows structure and correlates
+  neighbouring samples (Boids neighbour sampling, White Particles respawns).
+- Without a torus delta the flock tore at the screen edges.
+- GLSL has no imports, so snippets were being copied.
+
+## Decision
+
+- `glsl-lib.js` holds snippets spliced into shaders as strings: integer
+  bit-mixing hashes (Jarzynski & Olano, JCGT 2020) via `floatBitsToUint`,
+  simplex 2D/3D, fbm with analytic derivatives, OKLab, `worldSpace`,
+  `torusDelta` / `torusWrap`.
+- World y runs -0.5..0.5 and x +-aspect/2; aspect returns only at
+  `gl_Position`. A wider canvas shows **more**, not a magnified copy.
+- New snippets are appended at the end of the file to avoid merge conflicts.
+
+## Consequences
+
+Snippets must be deduplicated when composed -- GLSL rejects a function
+defined twice.
+
+## Porting to egui
+
+**Keep**, and the prototype already relies on it: `shaders/extract.mjs`
+imports `glsl-lib.js`, substitutes `${GLSL.x}`, and writes a `.frag` that
+runs on GLSL 3.30 unchanged (`floatBitsToUint`, `uint` and `gl_InstanceID`
+are all core there).
+
+Its limits, per saver:
+
+| Kind | Savers | Port |
+|---|---|---|
+| Pure fragment shader | Plasma (done), Flow Field, Julia Family, Burning Ship, Moire, Bicycle Horizon | extract as is (+ supersample footer for two) |
+| Shader with JS constants interpolated (`${SAMPLES}` etc.) | Boids, Aquarium, Pong, Starfield, Metaballs, ... | evaluate the template, not a regex |
+| JS orchestration: ping-pong, instancing, CPU simulation | the other ~20 | rewrite the orchestration in Rust, keep the GLSL |
+| Glyph atlas | Matrix Rain, ASCII Doughnut, Weather, Split Flap | Rust font rasteriser ([0029](0029-text-through-a-baked-glyph-atlas.md)) |
+
+When the port owns the shaders, move them out of JS template literals into
+`.frag` files -- which also retires the backtick hazard
+([0028](0028-verify-shaders-and-measure-on-a-real-gpu.md)).
diff --git a/docs/adr/0027-network-access-outside-savers.md b/docs/adr/0027-network-access-outside-savers.md
new file mode 100644
index 0000000..21650f9
--- /dev/null
+++ b/docs/adr/0027-network-access-outside-savers.md
@@ -0,0 +1,41 @@
+# 0027. Keep network access outside the savers; weather is opt-in and coarsened
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-11 (c16bc06, PR #198, #101) |
+| **Area** | Screensavers |
+| **Evidence** | `weather-source.js:1-99`; `weather.js:45-60, 83-86`; `weather-states.js`; `src/main/index.js:142-147` |
+| **egui verdict** | Keep |
+| **egui status** | Not started |
+
+## Context
+
+The registry's `try { create(); start() }` cannot catch a fetch that rejects
+after `start()` returns. A timer owned by a saver would leak through `stop()`
+into every later saver. And the request sends the wall's location to a
+third party.
+
+## Decision
+
+- A module-level poller (`installWeatherSource`) independent of the saver
+  lifecycle; the saver only reads `currentReading()`.
+- Open-Meteo: no key, no account, CC-BY. Every 15 min; backoff 1 min to 1 h;
+  10 s timeout; stale after 30 min; expire after 12 h. Coordinates rounded to
+  2 decimals before they leave the machine.
+- **Off by default** (`weatherEnabled: false`) -- "the only feature here that
+  reaches a third party". Default location 52.37 / 4.89.
+- The scene eases between readings over 25 s. Canned states in
+  `weather-states.js` exist for review only.
+
+## Consequences
+
+Works from the renderer only because Open-Meteo sends permissive CORS
+headers.
+
+## Porting to egui
+
+**Keep** the split, the opt-in default, the rounding, the backoff and
+staleness rules. The poller becomes a background thread (`ureq` is already a
+dependency, for the updater). CORS stops mattering. The weather saver itself
+is multi-pass with glyphs and needs a real port. Not started.
diff --git a/docs/adr/0028-verify-shaders-and-measure-on-a-real-gpu.md b/docs/adr/0028-verify-shaders-and-measure-on-a-real-gpu.md
new file mode 100644
index 0000000..caed18a
--- /dev/null
+++ b/docs/adr/0028-verify-shaders-and-measure-on-a-real-gpu.md
@@ -0,0 +1,66 @@
+# 0028. Verify shaders with a direct harness and structure baselines; measure speed only on a real GPU
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-06 (shadercheck, PR #132); baselines 2026-08-09 (#156) to 2026-08-18 (#227); #155 (backtick check); #225 (open) |
+| **Area** | Screensavers |
+| **Evidence** | `scripts/shader-check.mjs:9-80`; `screensavers/shadercheck.js:1-140`; `structure-baselines.js`; `scripts/update-structure-baselines.mjs`; `test/screensaver-seed.test.js:273-345`; `scripts/check-glsl-templates.mjs`; `raymarch.js:39-64, 113-131, 206-208` |
+| **egui verdict** | Adapt |
+| **egui status** | Not started |
+
+## Context
+
+- `npm test` has no WebGL2 context, and headless-gl would add a native build
+  to `npm ci`.
+- The first shadercheck went through the registry and reported **60/60
+  passing while the driver rejected a shader** -- the fallback
+  ([0021](0021-screensaver-registry-contract.md)) hid it.
+- Raymarch compiled cleanly and rendered wrongly (#140); an unguarded
+  `normalize()` gave NaN only on a real GPU.
+- Physarum rendered a flat gradient that passed every pixel check.
+- A backtick inside a GLSL comment ends the JS template literal; it "broke
+  the build four times in one session" (#155).
+- Several PRs claimed frame cost "cannot be measured headlessly" because
+  they had seen SwiftShader numbers. Headless Chrome gives ANGLE/Metal on an
+  M3 Pro, and every figure in #225 was measured that way.
+
+## Decision
+
+- **shadercheck** forces SwiftShader (a deterministic yes/no beats a fast
+  one), calls `create()`/`start()` **directly**, runs each saver with a
+  pinned seed twice and a fresh one, and checks pixels: no NaN, <= 0.1%
+  negative, <= 90% blown out, at least one lit pixel. If you touch it,
+  re-verify by injecting a type error and confirming a non-zero exit.
+- **Structure baselines:** per-saver edge density, minimum over seeds of the
+  maximum over frames 5 and 12, failing on a 35% drop (and an absolute 0.0015).
+  `npm run baselines` regenerates all 29 lines from one noisy measurement, so
+  a deliberately redesigned saver's line is edited by hand instead; entries
+  stay in descending order (tested).
+- **Static checks in `npm test`:** GLSL extractable, balanced braces,
+  malformed literals, `iSeed` declared, used and validly swizzled; the user
+  guide's saver list matches the registry.
+- **Speed is measured on a real GPU at 6000x1200.** Raymarch's loop budgets
+  lowered one at a time gained nothing (16.3 to 16.4 fps); lowered together,
+  16.3 to 31.3 fps (register occupancy). Budgets change as a set.
+
+## Consequences
+
+- **shadercheck is not in CI**; a shader regression merges unless someone
+  runs it locally.
+- No saver has been measured on the wall host (#225 open; the measuring
+  script `shot.mjs` is not committed). The Art-Net readback cost was measured
+  at 4% on Apple Silicon and was 1.4 vs 118.9 fps on the wall's discrete GPU
+  ([0030](0030-art-net-reactive-lighting.md)).
+- Low baselines (Plasma 0.0001, Wave Tank 0.0007, Julia 0.0001) and Tree
+  Growth (0) are unprotected by the drop rule.
+
+## Porting to egui
+
+**Adapt.** Compile every extracted shader in `cargo test` -- a hidden 1x1
+glow context, or naga/glslang validation -- which closes the not-in-CI gap.
+Keep the direct-call rule and the pixel checks; the prototype's
+`INPUT_VIEWER_SCREENSHOT` hook (`review.rs`) already renders headlessly.
+Re-measure baselines and frame cost in the Rust build on the wall's NVIDIA
+driver: budgets tuned against ANGLE/Metal may not hold under desktop GL.
+Retire the backtick check once shaders live in `.frag` files.
diff --git a/docs/adr/0029-text-through-a-baked-glyph-atlas.md b/docs/adr/0029-text-through-a-baked-glyph-atlas.md
new file mode 100644
index 0000000..0c295b7
--- /dev/null
+++ b/docs/adr/0029-text-through-a-baked-glyph-atlas.md
@@ -0,0 +1,34 @@
+# 0029. Draw text in savers through a baked glyph atlas
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-08 (b2d5689) |
+| **Area** | Screensavers |
+| **Evidence** | `screensavers/glyph-atlas.js:6-19`; `artnet-sync.js:17-24` |
+| **egui verdict** | Adapt |
+| **egui status** | Not started |
+
+## Context
+
+`getContext('2d')` returns null on a canvas that has ever been WebGL2, and
+rasterising and uploading a 6000x1200 frame of text every frame dominated
+the cost.
+
+## Decision
+
+Bake glyphs once on a detached 2D canvas (browser `monospace` font), index
+them in the shader, and share one atlas between ASCII Doughnut, Split Flap,
+Matrix Rain and Weather.
+
+## Consequences
+
+The glyphs depend on the system's monospace font.
+
+## Porting to egui
+
+**Adapt.** The one-context-per-canvas problem does not exist in egui, but
+bake-once is still the right performance choice. Rasterise with egui's own
+font system (`epaint` already builds an atlas) or `ab_glyph`, and keep the
+fonts redistributable ([0039](0039-visual-language.md)). The prototype draws
+its painter-based savers' text with egui directly.
diff --git a/docs/adr/0030-art-net-reactive-lighting.md b/docs/adr/0030-art-net-reactive-lighting.md
new file mode 100644
index 0000000..317b884
--- /dev/null
+++ b/docs/adr/0030-art-net-reactive-lighting.md
@@ -0,0 +1,53 @@
+# 0030. Drive the room's lights from the screensaver: sparse readback, 1 Hz, only when enabled
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-11 (41513aa, PR #199, #59); 2026-08-21 (49707c5, PR #275); GET snapshot 2026-08-25 (PR #293) |
+| **Area** | Screensavers |
+| **Evidence** | `gl-base.js:165-302, 400-457, 603-622`; `artnet-sync.js:1-150, 300-345, 440-470, 783-787`; `src/main/index.js:442-504` |
+| **egui verdict** | Keep |
+| **egui status** | Not started |
+
+## Context
+
+Art-Net fixtures in the room can follow the screensaver's colours through an
+`artnet-relay` HTTP service.
+
+- `blitFramebuffer` from WebGL's RGB8 default framebuffer to an RGBA8 target
+  returns INVALID_OPERATION with LINEAR, NEAREST and no scaling alike.
+- The first version read back every frame and was registered
+  unconditionally. On the wall's RTX PRO 4000, two split-flap boards did 64
+  `readPixels` stalls per frame and ran at **1.4 fps against 118.9**. The cost
+  had been measured on Apple Silicon at 4% and dismissed (#275).
+- Averaging the whole frame gives grey.
+
+## Decision
+
+- Read an 8x4 grid of 8x8 tiles straight from the default framebuffer, once
+  per second per runtime, inside the frame. Observers register only while
+  Art-Net is enabled.
+- Colour is a saturation- and brightness-weighted circular mean of hue.
+  Modes: reactive, spot, spatial (<= 8 strip writes per tick, change
+  threshold 6), scene, effect; per-saver scene defaults.
+- POSTs go through the main process (the relay sends no CORS headers), 2 s
+  timeout, no transport retry; the renderer backs off 5 s doubling to 5 min.
+  GET is allowed only to snapshot and restore the room; a GET whose body does
+  not parse is a failure, because restoring from nothing would leave the
+  room lit.
+- **Off with no URL by default** -- "the URL is the entire capability". On
+  release fixtures keep their last colour; blackout was rejected because the
+  room may be occupied.
+
+## Consequences
+
+Readback cost must be measured on a discrete GPU, never only on Apple
+Silicon.
+
+## Porting to egui
+
+**Keep** the 1 Hz cap, enabled-only registration, colour maths, modes,
+backoff and defaults. CORS and the main-process hop disappear: any thread
+can POST. Since the Rust savers already render into their own RGBA8 target
+before the blit, a GPU downscale plus an async PBO read becomes possible.
+Not started.
diff --git a/docs/adr/0031-what-a-picker-tap-sets.md b/docs/adr/0031-what-a-picker-tap-sets.md
new file mode 100644
index 0000000..c74aea5
--- /dev/null
+++ b/docs/adr/0031-what-a-picker-tap-sets.md
@@ -0,0 +1,46 @@
+# 0031. What a picker tap sets depends on view and Multi-view; key chips only where the key does the same
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-03 (`multiView`, PR #334); chips rule 2026-08-19 (PR #263) |
+| **Area** | UI |
+| **Evidence** | `renderer.js` `pickerPlan()` :2751, `setMultiView` :456; `test/settings-panel.test.js:222-250`; PR #263 |
+| **egui verdict** | Keep |
+| **egui status** | Done |
+
+## Context
+
+`multiView` (default on: "that is how the wall has always worked") lets the
+two halves show different inputs. The number keys `1`-`4` call
+`selectInput(side='both')`; a tap in the Left half picker sets one side. A
+key chip next to a per-half picker documented "a key that does something
+different from the control beside it" (#263).
+
+## Decision
+
+| View | Multi-view | Pickers | A tap sets | Key chips |
+|---|---|---|---|---|
+| dual | on | Left half, Right half | that half | none |
+| dual | off | Both halves | both | 1-4 |
+| single | on | Whole wall | left | 1-4 |
+| single | off | Whole wall | both | 1-4 |
+
+Turning Multi-view off brings the right half in line with the left; startup
+enforces the same.
+
+## Consequences
+
+- `1`-`4` set both halves even with Multi-view on, silently discarding a
+  per-half choice. Deliberate and documented; a per-side key scheme would be
+  the alternative.
+- The name collides with #244's "multi-view" (per-panel layouts, closed not
+  planned, 2026-08-18); `multiView` only means "the halves may differ". It
+  shipped in #334 without a record of the reversal.
+
+## Porting to egui
+
+**Keep** as a pure function with its table as the test. Prototype: done --
+`picker_plan()` in `app.rs` with
+`picker_plan_matches_the_electron_table`; `set_multi_view(false)` aligns the
+right half.
diff --git a/docs/adr/0032-input-thumbnails-are-snapshots.md b/docs/adr/0032-input-thumbnails-are-snapshots.md
new file mode 100644
index 0000000..ddb35b3
--- /dev/null
+++ b/docs/adr/0032-input-thumbnails-are-snapshots.md
@@ -0,0 +1,48 @@
+# 0032. Input thumbnails are snapshots, swept one stream at a time
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-20 (#242 decision, PR #265, 10b6fd2) |
+| **Area** | UI |
+| **Evidence** | `input-thumbnails.js` (`FRAME_TIMEOUT_MS = 2500`, 256x144 JPEG q0.72); `styles.css:34`; #242, #261 |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+Operators wanted to see what each input carries before switching. Live
+previews would have meant holding N streams -- the #261 refactor, closed
+unbuilt ([0003](0003-model-the-wall-as-two-halves.md)). The first layout used
+full-width tiles and measured 292x164 each, 1166 px of content against a
+640 px cap.
+
+## Decision
+
+- An input already on screen is snapshotted from its live picture: no
+  stream, no negotiation.
+- Any other input gets a temporary capture, released the moment a frame is
+  drawn. **At most one extra stream at a time**; the sweep is sequential and
+  rows fill in as stills land. A second sweep while one runs is ignored.
+- A device that never presents a frame times out at 2500 ms and stays a
+  placeholder -- as does an exclusive-access device. **A failed capture is a
+  normal outcome, not an error.**
+- Stills are cached by device id, so re-opening shows the last one
+  immediately while a fresh sweep replaces it. Staleness is accepted: no
+  refresh timer.
+- Tiles are a fixed 128x72 with the name underneath; the strip scrolls
+  sideways. Thumbnails use cover (the tile is not the wall).
+- Mock inputs take their own branch, or the feature would be untestable in
+  test mode.
+
+## Consequences
+
+2500 ms is a guess, never verified on real cards.
+
+## Porting to egui
+
+**Keep.** Prototype: 128x72 tiles from a cache of the last frame each device
+showed on screen (`stills`), so on-screen inputs are right and others show
+"no preview" until they have been seen. Missing: the one-at-a-time sweep of
+off-screen inputs -- natively, open the device, take one frame, drop it,
+which fits the slot model.
diff --git a/docs/adr/0033-controls-laid-over-the-wall.md b/docs/adr/0033-controls-laid-over-the-wall.md
new file mode 100644
index 0000000..5378235
--- /dev/null
+++ b/docs/adr/0033-controls-laid-over-the-wall.md
@@ -0,0 +1,49 @@
+# 0033. Controls are laid over the wall from the top edge, and close themselves
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-03 (dropdown 2b, PR #334); earlier panel 2026-01-23 (PR #23); touch 2026-01-24 (PR #25) |
+| **Area** | UI |
+| **Evidence** | `renderer.js` `openDropdown` :3752, `CLOSE_BELOW_MARGIN_PX` :3785, `dropdownCloseLine` :3787, `DROPDOWN_IDLE_MS` :3808, `buildPicker` :2765-2880; `index.html` `#wall-pickers`; `test/settings-panel.test.js:341-374` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+The wall is operated with a mouse, a touch screen, a clicker or a keyboard,
+often from a distance, and is often left unattended. The earlier dropdown
+was a 400 px panel with left and right columns. The 2b redesign (a Claude
+Design handoff) removed the panel.
+
+## Decision
+
+- **No panel.** Opening fills the wall with one picker per half -- label,
+  current input, a strip of tiles, that half's volume -- plus a capsule at
+  the top: Dual/Single, output volume, Settings.
+- **Opens** on hover over the top-edge tab (mouse), on tap (touch), with
+  Enter/Space (keyboard).
+- **Closes** when the pointer goes below the lowest picker row + 48 px --
+  the lowest row is the volume slider, so reaching for it does not close
+  them; on touch, a tap below that line. Also with Esc, and after **30 s with
+  no pointer, touch or key activity**, so the controls never sit over an
+  unattended wall. There is no close button (a 56 px Close pill was removed
+  in review).
+- Opening Settings closes the controls; they refuse to open while Settings
+  is.
+- The input-name toast is suppressed while they are open.
+
+## Consequences
+
+**Open design issue:** at 6000x1200 everything is the handoff's size and
+fills only the top-left corner of each ~3000 px half. "It probably wants
+scaling on the wall" (PR #334).
+
+## Porting to egui
+
+**Keep.** Prototype: open at the top edge, close below the area + 48 px, Esc,
+30 s idle, toast suppressed, Settings button closes them. Missing: per-half
+volume and output volume ([0010](0010-volume-belongs-to-a-side.md)), an
+explicit touch tap-to-toggle and keyboard open, and the scaling question --
+which egui makes cheap to answer (`pixels_per_point`, or a scale factor on
+the area alone).
diff --git a/docs/adr/0034-one-shortcut-list.md b/docs/adr/0034-one-shortcut-list.md
new file mode 100644
index 0000000..e38fdf0
--- /dev/null
+++ b/docs/adr/0034-one-shortcut-list.md
@@ -0,0 +1,51 @@
+# 0034. One shortcut list drives the keys, the legend and the docs
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-19 (#258, PR #260); legend 2026-08-20 (PR #266); keyboard rules 2026-10-03 (PR #334); rebinding rejected 2026-08-20 (#246) |
+| **Area** | UI |
+| **Evidence** | `shortcuts.js` (`SHORTCUTS`, `SHORTCUTS_BY_KEY`, `inputKeyFor`); `renderer.js` `SHORTCUT_ACTIONS` :4026, `isTypingTarget` :4084, Esc :4053; `test/docs-shortcut-list.test.js`; `styles.css:1118` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+There were four lists of shortcuts and three had drifted: the Settings table
+lacked Q, V, +/- and F11; the README lacked the remote-keyboard row; the user
+guide lacked F11. D and S had been documented for months but never wired up
+(#157). Nothing failed; they were just quietly wrong.
+
+## Decision
+
+- `shortcuts.js` is data only -- id, keys, chips, label, note,
+  preventDefault -- and imports nothing. Actions are keyed by id elsewhere.
+  A duplicate key throws at load. A list entry with no action fails a test.
+- Consumers: the key handler, the dropdown's chips, the legend; README and
+  USER_GUIDE stay hand-written but a test asserts every chip appears in both.
+- No chip past the fourth input: "labelling a fifth row '5' would promise a
+  binding that does not exist." `=` and `_` are bound as the unshifted +/-.
+- **Legend:** a dropup on the bottom edge showing **every** row -- an
+  "important ones" subset would be another hand-kept list. Labels wrap, never
+  truncate (at 1100 px, 3 of 12 ellipsised, including both "(if the remote
+  keyboard is enabled)" caveats).
+- **Keyboard rules:** shortcuts ignore every form control, not just `<input>`
+  (with a `<select>` focused, Q quit the app). **Esc does one thing per
+  press:** with any panel open it closes panels and stops; only with nothing
+  open does it unfreeze and leave fullscreen.
+- Chips have a 12 px floor: 10 px at 0.55 opacity "read fine on a laptop and
+  was invisible on the wall".
+- Rebindable keys: not wanted (#246).
+
+## Consequences
+
+The legend is the only rendered copy since #334 removed the Settings table.
+
+## Porting to egui
+
+**Keep.** Prototype: `shortcuts.rs` is a `const` table of `(Key, Action)`
+that both the handler and the legend read; tests check for duplicate keys
+and for actions with no key. Esc one-thing-per-press and the typing guard
+(`egui_wants_keyboard_input()`, and everything except Esc while Settings is
+open) are done. Missing: the remote-keyboard rows
+([0040](0040-remote-keyboard.md)) and the README/USER_GUIDE test.
diff --git a/docs/adr/0035-settings-is-a-side-nav-modal.md b/docs/adr/0035-settings-is-a-side-nav-modal.md
new file mode 100644
index 0000000..7760d49
--- /dev/null
+++ b/docs/adr/0035-settings-is-a-side-nav-modal.md
@@ -0,0 +1,46 @@
+# 0035. Settings is a side-nav modal that autosaves and reports its own status
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-03 (PR #334); modal 2026-01-23 (PR #23); references UI 2026-08-09 (#161, PR #167) |
+| **Area** | UI |
+| **Evidence** | `settings-status.js`; `renderer.js` input table :3013, `renderLayoutDiagram` :2187; `index.html` Settings panes |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+#161 found that "a device with no reference is silently inert"; before
+`settings-status.js`, a wrong remote-keyboard hostname or a dead Art-Net relay
+was "only visible in the log file".
+
+## Decision
+
+- A 920x680 modal with four panes: **Inputs, Layout, Remote keyboard,
+  Art-Net**. The shortcut table and the separate no-signal section were
+  removed: the legend has the shortcuts, and capture moved into each input.
+- **Autosave**, no Apply; sliders debounce at 300 ms.
+- **Inputs:** Key (`1`-`4`, `·` past four, `–` when disabled), On, Name (an
+  empty name restores the hardware label, shown as the placeholder), Startup
+  (a radio that can be cleared), No-signal (capture from the half the
+  device is on; "Put this input on the wall first" when it is not). A
+  disabled input still on screen says "Still on the wall until you switch".
+- **Nav dots** report state: inputs with no reference, integrations On/Off,
+  orange when on but broken.
+- **Layout** has a to-scale drawing of the wall.
+- Names are rendered with `textContent`, never `innerHTML` (an XSS test).
+- Pure status logic lives in `settings-status.js`.
+
+## Porting to egui
+
+**Keep.** Prototype (`app/settings_ui.rs`, `settings_status.rs`): Inputs and
+Layout panes; autosave; the Key column rules; names trimmed on leaving the
+field; a start-up choice with "the inputs last on screen" as the cleared
+state; a live status line and dot per input; the wall diagram to scale,
+drawn by the same geometry code as the wall; the wall itself follows the
+sliders live. Missing: the No-signal column
+([0014](0014-detect-no-signal-against-references.md)), Remote keyboard and
+Art-Net panes, and "still on the wall until you switch" (in the prototype a
+disabled input on screen goes to no-signal immediately). The `innerHTML`
+concern does not exist in egui.
diff --git a/docs/adr/0036-layout-geometry.md b/docs/adr/0036-layout-geometry.md
new file mode 100644
index 0000000..b65c3b4
--- /dev/null
+++ b/docs/adr/0036-layout-geometry.md
@@ -0,0 +1,44 @@
+# 0036. Layout geometry: contain-fit, a logo gap between the halves, optional side borders, dual by default
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2025-12-30 (24da509 gap and borders); 2026-01-16 (contain, PR #4; bottom logo removed, e6d918b); 2026-10-03 (freeze geometry, PR #332) |
+| **Area** | UI |
+| **Evidence** | `styles.css:144, 195, 415-490`; `renderer.js` `setCenterGap` :2163, `setBorderWidth` :2175, init :4970-4981; `src/main/index.js:128` |
+| **egui verdict** | Keep |
+| **egui status** | Done |
+
+## Context
+
+- Single view was briefly `object-fit: cover`; it was reverted the same day
+  to `contain`, "ensures the entire video source is displayed without
+  cropping".
+- A bottom logo for single view existed for two weeks; since 2026-01-16 its
+  markup is always hidden (dead).
+- Why the centre gap exists is not recorded; plausibly the seam between two
+  halves of the wall.
+
+## Decision
+
+- Always show the whole source, letterboxed, never stretched. Black-bar
+  cropping sits on top of this ([0015](0015-crop-black-bars-by-snapping-to-shapes.md)).
+- **Dual:** a black centre column `centerGap` px wide (default 60, slider
+  20-200) with the Schuberg Philis logo contained in 90% x 80% of it.
+- **Side borders:** black bars `borderWidth` px (default 0, slider 0-200)
+  outside the video area, in both views.
+- **Single:** no divider, no logo.
+- Freeze, the pickers' gap column and the layout diagram must use the same
+  gap -- #332 is what happens when they drift (a solid black freeze).
+- **Default view:** the renderer meant `layoutMode: null` to mean "detect
+  from the screen" (aspect >= 3 gives dual), but main merges its own default
+  `'dual'` over it, so a fresh install is always dual and the detection
+  never runs. README and USER_GUIDE describe the detection as live.
+
+## Porting to egui
+
+**Keep.** Prototype: done -- `dual_rects`, `wall_rect` and `logo_rect` are
+pure functions with tests, used by the wall, the HUD and the Settings
+diagram alike, so they cannot drift. Contain-fit in `paint_wall`.
+`layoutMode: null` reads as dual, matching what Electron actually does;
+decide whether real screen detection is wanted before adding it.
diff --git a/docs/adr/0037-transitions-are-interruptible-dips.md b/docs/adr/0037-transitions-are-interruptible-dips.md
new file mode 100644
index 0000000..30ee2f3
--- /dev/null
+++ b/docs/adr/0037-transitions-are-interruptible-dips.md
@@ -0,0 +1,44 @@
+# 0037. Transitions: interruptible, a dip to black rather than a crossfade, instant under reduced motion
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-19 (#247, PR #257) |
+| **Area** | UI |
+| **Evidence** | `renderer.js` `LAYOUT_ANIM_MS` :2072, `layoutAnimMs` :2081, `:2064-2069, 2934-2962`; `styles.css:133, 180-189` |
+| **egui verdict** | Keep, and reconsider the crossfade |
+| **egui status** | Not started |
+
+## Context
+
+At 6000x1200 an animation touches 7.2 Mpx per frame; #62 had shown
+compositing is not the bottleneck. A true crossfade between inputs needs a
+second `<video>` decoding the outgoing stream, doubling the decode.
+
+## Decision
+
+- **Dual <-> single:** 320 ms `flex-grow` + opacity collapse of the sibling
+  (not `scaleX`, which distorts the picture).
+- **Input switch:** 130 ms dip to black, hold while the stream is acquired,
+  then snap in. Only the picker path fades; the number-key path does not
+  (rationale not recorded).
+- **Interruptible:** a token per side, so the newest switch wins ("pressing 2
+  then 3 quickly must leave input 3 visible"); a second layout change
+  cancels a pending hide.
+- **Reduced motion:** both instant (`prefers-reduced-motion`).
+- Freeze stays instant.
+
+## Consequences
+
+320 ms and 130 ms are "my choices, not measured optima", and the animations
+were never watched on the wall (PR #257). A comment still says the switch
+"fades back in over 180 ms"; it snaps.
+
+## Porting to egui
+
+**Keep** interruptibility, freeze-is-instant and a reduced-motion setting
+(egui has no OS query for it; make it a setting). **Reconsider the
+crossfade:** with one session per device both pictures are already textures,
+so a crossfade costs a second textured quad, not a second decode. The
+display-none/reflow tricks and `!important` against inline styles are DOM
+artefacts. Prototype: switches are instant.
diff --git a/docs/adr/0038-cursor-and-transient-overlays.md b/docs/adr/0038-cursor-and-transient-overlays.md
new file mode 100644
index 0000000..07e7040
--- /dev/null
+++ b/docs/adr/0038-cursor-and-transient-overlays.md
@@ -0,0 +1,27 @@
+# 0038. Hide the cursor; confirm switches with a toast only when nothing else names the input
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2025-12-30 (cursor, 3b5bd3d); 2026-10-03 (cursor kept over controls, toast rules, PR #334) |
+| **Area** | UI |
+| **Evidence** | `styles.css` `body { cursor: none }`; `renderer.js` `showCursor` :3880, `showInputName` :2250, freeze badge :538 |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Decision
+
+- **Cursor:** hidden; shown for 3 s after movement; never hidden while the
+  controls or Settings are open, or over the legend.
+- **Input-name toast:** 2 s, 80 px from the bottom, 24 px text, one restarted
+  timer (not one per call); suppressed while the pickers are open, since
+  they already name what is on each half.
+- **Freeze badge:** red FROZEN, then a green LIVE for 1 s on unfreeze.
+- Sizes are chosen for reading at a distance.
+
+## Porting to egui
+
+**Keep.** Prototype: toast (2.5 s, suppressed while the pickers are open) and
+FROZEN badge are done. Missing: hiding the cursor
+(`ctx.set_cursor_icon(CursorIcon::None)` after 3 s idle, except over
+controls) and the LIVE flash.
diff --git a/docs/adr/0039-visual-language.md b/docs/adr/0039-visual-language.md
new file mode 100644
index 0000000..4d3aa0e
--- /dev/null
+++ b/docs/adr/0039-visual-language.md
@@ -0,0 +1,35 @@
+# 0039. Visual language: SBP colours, system fonts only, sized for a lit room at a distance
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-03 (PR #334; font decision recorded the same day); chip floor 2026-08-19 (PR #260) |
+| **Area** | UI |
+| **Evidence** | `styles.css:5-35, 599`; project memory "No brand font in the public repo" |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+The design handoff used TT Interphases, which is licensed to Schuberg Philis
+for internal use ("do not redistribute outside SBP"). This repo and its
+installers are public. A `local()` "use it if installed" stack was offered
+and declined in favour of plain system fonts.
+
+## Decision
+
+- Colour tokens: `--sbp-blue #1E80ED`, turquoise, signal green and orange;
+  container radius 16/16/16/2 px ("a guess"), pills, 200 ms fades.
+- **System fonts only. Never ship TT Interphases** in any form.
+- 12 px minimum text; 44 px minimum hit targets.
+- Icons are placeholders until the design file's are exported.
+
+## Porting to egui
+
+**Keep.** egui embeds fonts in the binary by default -- easy to get wrong
+here. Use egui's bundled fonts (Ubuntu-Light and Hack, both redistributable),
+which the prototype does, or a system font loaded at runtime; never embed
+TT Interphases. The prototype forces egui's dark theme (a light system theme
+put white panels over the wall). Re-derive the 12 px floor and 44 px targets
+for egui points at the wall's `pixels_per_point`, and map the colour tokens
+into an egui `Style`.
diff --git a/docs/adr/0040-remote-keyboard.md b/docs/adr/0040-remote-keyboard.md
new file mode 100644
index 0000000..dd97858
--- /dev/null
+++ b/docs/adr/0040-remote-keyboard.md
@@ -0,0 +1,44 @@
+# 0040. Forward the presenter's clicker to a networked keyboard
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-01-26 (#26, f1f2dd7; PgUp/PgDn 3d8f6fb, 24473b7); through main 2026-10-03 (PR #334) |
+| **Area** | UI |
+| **Evidence** | `remote_keyboard/source.ino`; `settings-status.js` `remoteKeyUrl` :25-34, `remoteKeyboardStatus`; `src/main/index.js:506-535`; #32 |
+| **egui verdict** | Keep |
+| **egui status** | Not started |
+
+## Context
+
+Presenters bring a clicker. Its presses arrive at the wall PC, but the
+slides are on the presenter's laptop. An ESP32-S3 plugged into the laptop
+acts as a USB keyboard and listens on the network, so no software runs on
+the presenter's machine.
+
+## Decision
+
+- **Firmware contract:** mDNS hostname (`space_keyboard`), HTTP on port 80.
+  `GET /left` and `GET /right` require an `X-API-Key` header and tap
+  PageUp / PageDown. `GET /` serves an unauthenticated page.
+- **App:** PageUp/Left and PageDown/Right, when enabled, become
+  `GET http://<host>[.local]/<left|right>` with the key. A bare hostname gets
+  `.local` **before** the scheme is added (fixed in #334). 2 s timeout, no
+  retry.
+- Requests go through the main process because a `file://` renderer `fetch`
+  with `X-API-Key` needs a CORS preflight the device does not answer.
+- The status line reports the last press, kept in memory only. The key field
+  is masked with Show/Hide. A presenter debug overlay keeps 8 lines (#32).
+
+## Consequences
+
+The API key is plain text in `settings.json` and in the firmware source; the
+transport is plain HTTP on the LAN. The Settings copy says "arrow key
+presses", but PgUp/PgDn are the primary keys.
+
+## Porting to egui
+
+**Keep** the firmware contract, the `.local` rule, timeouts, the status line
+and the shortcut rows. CORS and the main-process hop disappear. **Verify
+mDNS:** Chromium resolves `.local` on Windows itself; a Rust HTTP client uses
+the OS resolver, which may not. Not started.
diff --git a/docs/adr/0041-settings-json.md b/docs/adr/0041-settings-json.md
new file mode 100644
index 0000000..e31337e
--- /dev/null
+++ b/docs/adr/0041-settings-json.md
@@ -0,0 +1,61 @@
+# 0041. Settings are one JSON file in the app's data folder; network features default off; test mode never writes
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2025-12-30; mkdir fix 2026-01-13 (62eb8fb); mock guard 2026-08-19 (PR #259); example rewritten (#53, PR #129) |
+| **Area** | Platform |
+| **Evidence** | `src/main/index.js:87-88, 124-215`; `renderer.js:289-405` (`saveSettings` allowlist, `getDefaultSettings`); `settings.example.json`; README |
+| **egui verdict** | Keep, and fix |
+| **egui status** | Done |
+
+## Context
+
+Operators read and hand-edit `settings.json` on the wall. Inputs are keyed
+by capture device id, because index order is not stable across reboots.
+
+## Decision
+
+- `<userData>/settings.json` -- `%APPDATA%\Input Viewer\` on Windows (see
+  [open questions](open-questions.md) on the folder name).
+- Main merges defaults shallowly over the file; on any read or parse error
+  it logs and returns defaults. Writes are a plain `writeFileSync`.
+- The renderer saves an explicit **allowlist** of keys, debounced 300 ms. "A
+  key omitted from it is silently reset to its default on the next load."
+- **Network features default off:** `weatherEnabled: false` (the only
+  third-party call), `artnetEnabled: false` with no URL.
+- **`--mock` never writes** -- one mock run would otherwise persist
+  `mock-input-N` and could leave the wall starting on an input that will
+  never exist again.
+- No schema version, no migration code.
+
+## Consequences
+
+- **Not atomic.** A power cut mid-write leaves malformed JSON, which loads as
+  defaults with only a console error; the next save then overwrites the
+  file, and the wall's names and assignments are gone.
+- **Two default sets** (main and renderer) that differ: `layoutMode` `'dual'`
+  vs `null`, and main lacks `centerGap`, `borderWidth`, volumes and the
+  remote-keyboard keys while the renderer lacks `cropLetterbox` and
+  `aspectHint`.
+- Hand edits made while the app runs are overwritten (README says so).
+- The remote-keyboard API key is stored in plain text.
+
+## Porting to egui
+
+**Keep** the file, the key names, the defaults-off rule and never-write in
+test mode. **Fix** the rest. Prototype (`settings.rs`), done:
+
+- same camelCase keys; unknown keys kept in a flattened map and written back,
+  so Art-Net, remote-keyboard and volume settings survive a round trip;
+- one default set, in one place;
+- atomic write (temp file + rename); a file that does not parse is moved to
+  `settings.json.corrupt-<time>`, never overwritten;
+- imports the Electron file once on first launch: layout and unknown keys
+  carry over; **input names, enabled flags and the default input do not**,
+  because Electron keys them by Chromium's salted deviceId hash and stores
+  no label to match on;
+- inputs keyed by AVFoundation `uniqueID` / Windows device path;
+- mock **and** review runs neither read nor write.
+
+Still open: a schema version field.
diff --git a/docs/adr/0042-test-mode-flags.md b/docs/adr/0042-test-mode-flags.md
new file mode 100644
index 0000000..967fdda
--- /dev/null
+++ b/docs/adr/0042-test-mode-flags.md
@@ -0,0 +1,47 @@
+# 0042. Test-mode flags reach every state without hardware, and say so loudly
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-19 (#248, PR #259, da78a2c) |
+| **Area** | Platform |
+| **Evidence** | `test-flags.js`; `mock-capture.js`; `renderer.js:620-651, 655-678, 799-830, 1680-1686, 1299-1305, 4694-4703`; `src/main/index.js:14-41, 575-579` |
+| **egui verdict** | Keep |
+| **egui status** | Done |
+
+## Context
+
+Reaching the no-signal board and the screensavers meant unplugging a capture
+card. And "a flag that silently does nothing means someone at the wall is
+looking at a production-mode screen believing it is in test mode."
+
+## Decision
+
+| Flag | Effect |
+|---|---|
+| `--mock[=N]` | N synthetic inputs (1-8, default 4). No hardware, no camera prompt. |
+| `--no-signal` | Every input pinned to no-signal: the board from launch. |
+| `--screensaver-delay=MS` | Replaces the 5-minute wait; 0 starts a saver at once. |
+
+- Orthogonal on purpose: `--no-signal` alone is the fast path to the board;
+  with `--mock` there are named inputs to switch between while dark.
+- **Mock inputs are real streams** (`canvas.captureStream(15)`, 1280x720,
+  colour bars and a sweep), so detection cannot tell them from a card;
+  distinct `groupId` each ([0009](0009-pair-audio-with-its-video-card.md)).
+- **`--mock` never writes settings** ([0041](0041-settings-json.md)).
+- **`--no-signal` is enforced only in `hideNoSignal()`**
+  ([0019](0019-one-no-signal-state-machine.md)), and detection and health
+  are not started at all, rather than run and discarded.
+- Unknown flags that look like ours are logged as errors, never fatal. Main
+  forwards candidates with a deliberately looser filter than the parser's
+  list (`^--(mock|no.?signal|screensaver)`), so a typo like `--nosignal`
+  reaches the parser and is reported.
+
+## Porting to egui
+
+**Keep.** Prototype: done in `flags.rs` (tested), with the same names and
+semantics; unrecognised arguments are logged; mock frames go through the
+same capture path as a camera; the single seam is `side_no_signal()`. The
+main/renderer forwarding split disappears. The prototype adds three
+dev-only flags -- `--screensaver=NAME`, `--test-pattern[=WxH@FPS]` and
+`--hud` -- documented in its README.
diff --git a/docs/adr/0043-keep-privileged-work-in-one-place.md b/docs/adr/0043-keep-privileged-work-in-one-place.md
new file mode 100644
index 0000000..1bb110b
--- /dev/null
+++ b/docs/adr/0043-keep-privileged-work-in-one-place.md
@@ -0,0 +1,45 @@
+# 0043. Keep privileged work in one small, auditable place
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-05 (hardening, PR #129, #55); 2026-10-03 (origin parsing, PR #333) |
+| **Area** | Platform |
+| **Evidence** | `src/main/index.js:228-290`; `src/preload/index.js:6-55`; `index.html:6` (CSP); `SECURITY.md`; `test/settings-parsing.test.js:38-50` |
+| **egui verdict** | Drop the mechanism; keep the principle |
+| **egui status** | N/A |
+
+## Context
+
+#55 found that "no remote content" was "passing by accident": nothing
+enforced it. A prefix check on `http://localhost:5174` also let through
+`:51740` (#333). Main is CommonJS and requires `electron` at load, so it is
+effectively untestable; logic was moved into pure renderer modules.
+
+## Decision
+
+- The renderer is an untrusted, sandboxed page: `sandbox`,
+  `contextIsolation`, no `nodeIntegration`, security flags set explicitly so a
+  future Electron default cannot weaken them.
+- No navigation (parsed-origin check); `window.open` denied, http(s) handed
+  to the system browser; only `media`, `audioCapture` and `videoCapture`
+  permissions granted.
+- A small named IPC surface (`window.electronAPI`): window, settings,
+  diagnostics, reports, volume, and the two outbound-HTTP proxies. Handlers
+  never throw across the boundary; they return `{ok, error}`. Main stays a
+  "dumb pipe"; policy lives in testable modules.
+
+## Consequences
+
+Two dead channels remain (`get-settings-path`, `diag-log-reset`). The CSP
+still allows `connect-src http://* https://*` and `unsafe-eval`, so the
+sandbox, not the CSP, is the boundary.
+
+## Porting to egui
+
+**Drop** the mechanism: a native app has no web content to sandbox, no IPC
+and no CORS. **Keep the principle:** policy in pure, tested modules; the few
+operations that write files or change state on the LAN (settings, logs,
+Art-Net, remote keyboard) in one thin platform layer; external links opened
+in the system browser. The prototype follows this split (`settings.rs`,
+`health.rs`, `render_stats.rs` and `settings_status.rs` are pure and tested).
diff --git a/docs/adr/0044-a-bounded-log-file-is-the-operator-contract.md b/docs/adr/0044-a-bounded-log-file-is-the-operator-contract.md
new file mode 100644
index 0000000..d65cddc
--- /dev/null
+++ b/docs/adr/0044-a-bounded-log-file-is-the-operator-contract.md
@@ -0,0 +1,89 @@
+# 0044. A bounded daily log file is the operators' evidence
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-01 (PR #311, a9d3dbd); reports 2026-08-21 (PR #268, #271); diag log 2026-08-09 (#163) |
+| **Area** | Platform |
+| **Evidence** | `src/main/file-log.js`; `src/main/index.js:95-122, 292-306, 372-440, 581-680`; `test/file-log.test.js`; `renderer.js:1313` (`__health`); labs-videowall-config `startup/README.md` |
+| **egui verdict** | Keep |
+| **egui status** | Done |
+
+## Context
+
+On 2026-10-01 a card came up black at 12:12:27 and someone restarted the app
+at 12:22:35; there was no record of what the renderer had seen. The wall's
+operators now read `[Health]` lines from the log to diagnose black inputs.
+
+## Decision
+
+- Everything either process prints goes to
+  `<userData>/logs/input-viewer-YYYY-MM-DD.log`: **7 days** kept (pruned by
+  the date in the file name), **20 MB/day**, **600 lines/min** (with a
+  "dropped N" line), lines cut at 2000 chars, local-time days.
+- **Synchronous appends** -- "a crash or a hard power-off is exactly when
+  the last lines matter". A failed write disables the log rather than throw.
+- Startup banner: version, OS, arch, runtime version, **OS uptime** ("how
+  long after the machine came up did the app open the cards"), pid, log
+  directory. Process deaths are logged.
+- Log flat strings: objects arrive as `[object Object]`. Keep lines ASCII
+  for Windows tools.
+- Per-side health transitions and a 10-minute summary; agreed stream
+  formats; crop changes with the measured ratio.
+- Files that run for months are bounded by content: `gpu-report.txt`
+  (overwritten per launch, <= 200 lines), `fps-report.txt` (overwritten every
+  ~60 s), the detection diagnostic (capped at 2 MiB, newest half kept).
+- `__health()` in DevTools prints the current state.
+
+## Consequences
+
+The rate limit is shared, so a busy renderer can crowd out main's lines.
+The diagnostic log is labelled "temporary" and has lived since 2026-08.
+Whether DevTools, and so `__health()`, is reachable in a packaged build is
+not documented.
+
+## Porting to egui
+
+**Keep** the path, file naming, bounds and line formats -- they are an
+interface with the people reading them.
+
+**Done** (`input_viewer_egui/src/filelog.rs`): a port of `file-log.js` with
+its tests ported case for case.
+
+- **Where:** `<config>/Input Viewer (egui)/logs/input-viewer-YYYY-MM-DD.log`,
+  next to `settings.json`. Local-time days.
+- **Same bounds:** 7 days by file-name date, 20 MB/day with one "cap
+  reached" line, 600 lines/min with a "dropped N" line, 2000 characters per
+  line.
+- **Same behaviour:** synchronous appends; a log that cannot be written
+  disables itself instead of failing.
+- **Every line goes to stderr and the file.** Levels match Electron's
+  `console.log`/`warn`/`error`, and the tags match where an equivalent exists
+  (`[Health]`, `[AutoUpdater]`, `[TestFlags]`, `[Settings]`).
+- **`[Health]` lines in `describeHealth()`'s exact format, one per half
+  showing the device:**
+  `[Health] right (Mock Input 2): ok -> dark 14.4fps luma=10+/-0 1280x720 reopens=0`.
+  Also written: the reopen line, the "opened" line, the 10-minute summary,
+  and `monitoring every 2000ms` (or `Not started: --no-signal ...`).
+- **Startup banner** with OS uptime. A panic hook puts the panic message in
+  the file.
+- **GPU line** in place of `gpu-report.txt`: `[App] GPU: <vendor> /
+  <renderer> / OpenGL <version>`. That answers the question the report
+  existed for: is the wall rendering in software?
+
+Differences:
+
+- The source tag is `[app]` (one process) rather than `[main]` or
+  `[renderer]`.
+- The reopen line's id drops the `camera-` prefix before taking eight
+  characters, since `camera-0` would say nothing.
+
+Not ported:
+
+- `fps-report.txt` -- `--hud` and its `[Render]` lines cover it.
+- The detection diagnostic -- there is no reference detection yet
+  ([0014](0014-detect-no-signal-against-references.md)).
+- `__health()` -- there are no DevTools; a key or CLI dump would replace it.
+
+Mock and review runs log too, as Electron's always does. Only settings are
+protected from test mode.
diff --git a/docs/adr/0045-release-by-hand-bump-from-commits.md b/docs/adr/0045-release-by-hand-bump-from-commits.md
new file mode 100644
index 0000000..64ec749
--- /dev/null
+++ b/docs/adr/0045-release-by-hand-bump-from-commits.md
@@ -0,0 +1,46 @@
+# 0045. Release by hand; derive the version bump from Conventional Commits, with an explicit override
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-04-17 (82baf03, #38, manual release); 2026-08-25 (#290, bump input) |
+| **Area** | Delivery |
+| **Evidence** | `.github/workflows/release.yml:3-26, 53-91`; `.github/workflows/ci.yml:3-7`; `.claude/CLAUDE.md`, `.claude/DEVELOPMENT.md`; #250 |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+Releasing on every merge produced **13 patch releases on 2026-01-16 alone**
+(v2.1.0 to v2.1.13). Auto-merge with a PAT was tried and reverted. Commit
+analysis reads only subjects, so a `BREAKING CHANGE:` footer is never seen,
+and `force_release` could rescue a `none` but never raise the level: shipping
+3.0.0 would have meant writing a false `!:` (#290).
+
+## Decision
+
+- CI runs on PRs to `main` and pushes to `main`, nothing else. A stacked PR
+  gets no checks until retargeted.
+- Releasing is `gh workflow run release.yml` only; nothing triggers on a tag.
+- Bump: `!:` or `BREAKING CHANGE` -> major, `feat` -> minor,
+  `fix|perf|refactor|build|ci` -> patch, anything else -> none. A `bump`
+  input (patch/minor/major) skips analysis.
+- Branches `type/short-description`; no commitlint -- the release regex is
+  the only consumer.
+
+## Consequences
+
+- **Dependabot's `chore(deps*)` commits never bump.** Electron -- Chromium's
+  security fixes -- is a devDependency, so an Electron-only change computes
+  `none`; v3.4.1 must have been dispatched with an explicit `patch`.
+- `force_release` with no bump builds and then never publishes (the publish
+  job needs the bump job) -- likely a latent bug.
+
+## Porting to egui
+
+**Keep.** Prototype (`release-egui.yml`): manual dispatch; auto bump from
+commits that touch `input_viewer_egui/` since the last `egui-v*` tag; an
+explicit `bump` input; a no-bump run fails loudly rather than building and
+discarding. With fewer runtime security updates in a native binary the
+Dependabot gap matters less, but `chore(deps)` on a Cargo dependency with a
+security fix still needs a manual patch release.
diff --git a/docs/adr/0046-version-and-tagging.md b/docs/adr/0046-version-and-tagging.md
new file mode 100644
index 0000000..019edfc
--- /dev/null
+++ b/docs/adr/0046-version-and-tagging.md
@@ -0,0 +1,52 @@
+# 0046. VERSION is the source of truth; bump through a PR, tag the merged commit
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-03 (#84, protected main); 2026-08-11 (#197, lock file); 2026-01-23 (#19, build with the new version) |
+| **Area** | Delivery |
+| **Evidence** | `release.yml:44-51, 170-248, 253-347`; `VERSION`; `CHANGELOG.md` |
+| **egui verdict** | Adapt |
+| **egui status** | Partial |
+
+## Context
+
+- After branch protection, v2.6.2's release failed with `GH006 Protected
+  branch update failed`; nothing shipped between 2026-06-08 and 2026-08-03,
+  including a security fix (#69).
+- The bump staged VERSION and `package.json` but not the lock file, which sat
+  at 2.9.0 while the others reached 2.13.0 for four releases; `npm ci`
+  tolerates the mismatch, so nothing failed.
+- Why there is a separate VERSION file is not recorded; it predates
+  Electron (the Python v1).
+
+## Decision
+
+- Builds run in parallel on the pre-bump commit with the new version written
+  in on the runner.
+- Then: push `chore/bump-vX` with VERSION, `package.json`, `package-lock.json`;
+  open a PR and squash-merge it at once; refetch `main`; **refuse to tag**
+  unless `main:VERSION` is the new version; push an annotated `vX.Y.Z`.
+- Publish only if the bump succeeded -- otherwise the release action would
+  create the tag itself on an un-bumped `main`.
+- A hand-written Keep-a-Changelog, updated after the fact; the release page
+  uses GitHub's generated notes.
+
+## Consequences
+
+The bump PR merges only because `main` requires no reviews and no status
+checks; adding either would break releasing. The changelog lags (it stopped
+at 2.13.0 and missed 2.14-2.19 once).
+
+## Porting to egui
+
+**Adapt.** The prototype makes the **tag** the source of truth: `Cargo.toml`
+stays `0.0.0` in git and the release workflow writes the version into
+`Cargo.toml` and `Cargo.lock` at build time (both, for the lock-file reason
+above). There is no bump commit, so no protected-branch dance. Tags are
+`egui-v*` so they never become the Electron workflow's baseline -- which
+needed `git describe --match 'v[0-9]*'` in `release.yml`.
+
+Decide whether the egui app should rejoin VERSION when it replaces Electron.
+A rewrite traditionally starts a new major and a new CHANGELOG section, as
+Python -> Electron did.
diff --git a/docs/adr/0047-gate-releases-on-tests.md b/docs/adr/0047-gate-releases-on-tests.md
new file mode 100644
index 0000000..3015077
--- /dev/null
+++ b/docs/adr/0047-gate-releases-on-tests.md
@@ -0,0 +1,50 @@
+# 0047. Gate every PR and release on lint, tests and build, and show the results inline
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-08-04 (#108, #109); 2026-07-22 (59c169b, vitest --no-save) |
+| **Area** | Delivery |
+| **Evidence** | `ci.yml:13-61`; `release.yml:123-165`; `scripts/test-summary.mjs`; `vitest.config.mjs`; `eslint.config.mjs`; `test/helpers/renderer-dom.js`; `renderer.js:5110` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+Before #108 the release ran no tests, so a regression could be tagged while
+CI on `main` was red. A jsdom worker that failed to boot once reported "26
+passed" while whole suites were silently skipped.
+
+## Decision
+
+- The same job in both workflows: `npm ci`, tests with three reporters
+  (console, `github-actions` for inline annotations on the diff, JUnit), a job
+  summary rendered from JUnit (`if: always()`, never decides the run), lint,
+  build. Unhandled errors fail the run.
+- **Tests:** pure-logic suites run in node by default; renderer suites opt in
+  to jsdom per file. `renderer.js` boots only without
+  `__INPUT_VIEWER_NO_AUTOSTART__`, and the test DOM fixture derives its
+  element ids from the renderer's source, so it cannot drift.
+- **Lint for correctness, not style:** `js.configs.recommended` plus
+  `no-eval`, `no-new-func`, `eqeqeq` (null ignored); three environments
+  (main/preload CJS+Node, renderer ESM+browser, scripts/tests ESM+Node). No
+  formatting rules, to avoid churning ~5,700 lines.
+- **Toolchain pinned once:** Node 24 in both workflows, changed together.
+- vitest is installed `--no-save`, not a devDependency. The stated reason
+  (keep the lock in sync for `npm ci`) does not hold; the real one is not
+  recorded. A bare `npm ci && npm test` therefore fails by design.
+
+## Consequences
+
+CI never packages, so packaging breaks surface only at release (#86).
+
+## Porting to egui
+
+**Keep.** Prototype: an `egui` job in `ci.yml` runs `cargo test --locked` and
+a release build on macOS; `release-egui.yml` runs the tests before each
+platform's build and builds the installers on every PR that touches the app
+-- which closes the "packaging only breaks at release" gap. Missing:
+`cargo clippy -D warnings` as the lint gate (the prototype is clippy-clean
+but CI does not enforce it), a pinned `rust-toolchain.toml` used by every
+workflow, and a JUnit summary (`cargo nextest`). `rustfmt` is a fresh choice:
+the "don't reformat" constraint does not apply to new code.
diff --git a/docs/adr/0048-package-and-update-from-the-public-repo.md b/docs/adr/0048-package-and-update-from-the-public-repo.md
new file mode 100644
index 0000000..05d3435
--- /dev/null
+++ b/docs/adr/0048-package-and-update-from-the-public-repo.md
@@ -0,0 +1,68 @@
+# 0048. Package per platform and auto-update from the public source repo, asking first
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2025-12-30 (b639ad1, prompt-first); 2026-04-17 (7aa05e8, feed moved to the source repo); 2026-06-08 (9aebf8f, zip for updates); 2026-08-04 (#86, artifactName) |
+| **Area** | Delivery |
+| **Evidence** | `input_viewer_electron/package.json` `build`, `publish`; `src/main/index.js:58-80, 313-325, 797-889`; `release.yml` publish job; #86, #105, #249 |
+| **egui verdict** | Keep; Decide on the unattended prompt |
+| **egui status** | Partial |
+
+## Context
+
+- A separate `input-viewer-releases` repo existed so updates could come from
+  a public repo while the source was private (inferred). Its metadata was
+  never uploaded, so updates were broken; it was dropped once the source was
+  public.
+- **#86:** `productName` "Input Viewer" has a space. electron-builder named
+  files `Input Viewer-...`, GitHub's upload turned that into
+  `Input.Viewer-...`, and `latest-mac.yml` said `Input-Viewer-...`. **Every
+  macOS update 404'd for three releases.** The guard #86 proposed -- check
+  every `url`/`path` in the metadata exists -- **was never added** (the
+  publish job uploads the yml files unchecked).
+
+## Decision
+
+- **macOS:** universal DMG + ZIP (the ZIP is what the updater applies), with
+  an explicit `artifactName`.
+- **Windows:** x64 NSIS, `oneClick: false`, `perMachine: false`, install
+  directory changeable, **`deleteAppDataOnUninstall: false`** (settings
+  survive a reinstall), explicit `artifactName`.
+- **Updates:** electron-updater from GitHub Releases on
+  `LAB271/labs-input-viewer`, never in dev. One check, 3 s after the window
+  is ready. "Download / Later", then "Restart now / Later"; installs on quit
+  if postponed. Download progress shows as a toast.
+
+## Consequences
+
+- **On an unattended wall**, the prompt -- or the error dialog, which says
+  "Failed to download update" even when only the check failed, e.g. offline
+  at boot -- sits over 6000x1200 until someone clicks it.
+- macOS clients on 2.6.1-2.6.2 were stranded by #86.
+- How the wall actually receives updates is documented nowhere.
+
+## Porting to egui
+
+**Keep** the public-repo feed and ask-first flow; **Adapt** the tooling.
+Prototype (`release-egui.yml`, `update.rs`): Velopack -- a per-user
+`Setup.exe` (no admin) and a universal macOS `.pkg`, delta updates, the same
+two prompts as an in-app dialog, install on quit. It shares the Releases page
+with Electron safely: tags `egui-v*`, **never marked latest** (Electron's
+updater reads `/releases/latest`), and a custom update source that finds the
+newest `egui-v*` release itself, because Velopack's GitHub source only reads
+the ten newest releases. Both platforms upload into one release, and a step
+fails the run if they ever produce the same file name -- the class of bug
+#86 was.
+
+**Decide:** an unattended wall needs a non-modal update path -- check
+silently, show a small "update ready" note, install on the next quit or a
+nightly restart, and never show a modal for a failed check. And decide the
+install location the wall's startup script will launch
+([0006](0006-app-and-wall-setup-live-in-separate-repos.md)).
+
+**Verified in CI** (#346): both installers build, and every file carries its
+platform in the name (`InputViewerEgui-windows-Setup.exe`,
+`InputViewerEgui-0.1.0-pr.346-macos-full.nupkg`, `releases.windows.json`...),
+so the two platforms share one release without colliding. **Not yet
+tested:** publishing, installing, and an update from one release to the next.
diff --git a/docs/adr/0049-builds-are-unsigned.md b/docs/adr/0049-builds-are-unsigned.md
new file mode 100644
index 0000000..6248e98
--- /dev/null
+++ b/docs/adr/0049-builds-are-unsigned.md
@@ -0,0 +1,38 @@
+# 0049. Builds are unsigned
+
+| | |
+|---|---|
+| **Status** | Accepted (by default) |
+| **Date** | not recorded; #56 open and on hold |
+| **Area** | Delivery |
+| **Evidence** | `release.yml:196-199` (`CSC_IDENTITY_AUTO_DISCOVERY: false`); `build/entitlements.mac.plist`; `SECURITY.md`; #56, #86 |
+| **egui verdict** | Decide |
+| **egui status** | Same as Electron (ad-hoc on macOS) |
+
+## Context
+
+No Apple Developer ID or Authenticode certificate is configured. The rationale
+is not recorded; presumably there is no certificate. `hardenedRuntime` and
+entitlements are configured anyway, to little effect while unsigned.
+
+## Decision
+
+Ship unsigned. electron-updater verifies only the SHA-512 that sits in the
+same feed, so trust in an update is write access to the GitHub repo.
+
+## Consequences
+
+- Gatekeeper and SmartScreen warnings on install.
+- macOS auto-update (Squirrel.Mac validates the signature) has **never been
+  confirmed end to end**: #86's checkbox "confirm an installed macOS client
+  actually updates" is unchecked.
+- The wall is Windows, so the practical cost lands on macOS users.
+
+## Porting to egui
+
+**Decide**, consciously this time. The prototype signs the macOS app ad hoc
+(`codesign --sign -`) because Apple silicon will not run an unsigned arm64
+binary, and leaves the Windows installer unsigned. Velopack can sign and
+notarise if certificates exist. The JIT and library-validation entitlements
+are V8's and are not needed; the camera usage string is
+([0051](0051-request-capture-permission-up-front.md)).
diff --git a/docs/adr/0050-supply-chain-and-licence.md b/docs/adr/0050-supply-chain-and-licence.md
new file mode 100644
index 0000000..0818f9a
--- /dev/null
+++ b/docs/adr/0050-supply-chain-and-licence.md
@@ -0,0 +1,40 @@
+# 0050. Supply chain and licence: SHA-pinned actions, delayed Dependabot, public registries, Apache-2.0 with SPDX headers
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-04-16 (75c56d7, #34, SHA pins); 2026-07-22 (604c8be Apache-2.0, 45346aa SPDX); 2026-07-30 (b819078 Dependabot, SECURITY.md, NOTICE removed) |
+| **Area** | Delivery |
+| **Evidence** | `.github/dependabot.yml`; `.github/workflows/*`; `LICENSE`; `SECURITY.md`; `CODE_OF_CONDUCT.md`; `~/Developer/CLAUDE.md` (org rules) |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Decision
+
+- Every GitHub Action pinned to a full commit SHA (org rule).
+- Dependabot for npm and GitHub Actions, weekly, with a 7-day cooldown --
+  "a public repo publishes its dependency tree". Dependabot security updates,
+  secret scanning and push protection on.
+- Packages from public registries only; there has never been a JFrog
+  registry in this repo.
+- Relicensed MIT -> Apache-2.0. Every source file carries
+  `SPDX-License-Identifier: Apache-2.0` and
+  `SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271`.
+- **NOTICE deliberately removed:** Apache-2.0 section 4(d) would oblige every
+  fork to carry a NOTICE that adds nothing.
+- SECURITY.md reports to abuse@schubergphilis.com and states the code is
+  AI-written and unaudited.
+
+## Consequences
+
+- Trailing version comments on pinned SHAs go stale (`actions/checkout@... #
+  v4` is actually v7.0.1).
+- The removed NOTICE conflicts with the org's OSS release check, which
+  expects one.
+
+## Porting to egui
+
+**Keep.** Prototype: actions SHA-pinned (including `actions/setup-dotnet`);
+SPDX headers on every `.rs` file; `license = "Apache-2.0"` in `Cargo.toml`;
+crates from crates.io. Missing: the `cargo` ecosystem in `dependabot.yml`,
+and `cargo-deny` or `cargo-audit` in CI.
diff --git a/docs/adr/0051-request-capture-permission-up-front.md b/docs/adr/0051-request-capture-permission-up-front.md
new file mode 100644
index 0000000..19343a3
--- /dev/null
+++ b/docs/adr/0051-request-capture-permission-up-front.md
@@ -0,0 +1,36 @@
+# 0051. Ask for camera access before opening any capture
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2025-12-30 (3b5bd3d) |
+| **Area** | Platform |
+| **Evidence** | `src/main/index.js:328-351`; `build/entitlements.mac.plist`; `renderer.js:865` |
+| **egui verdict** | Keep |
+| **egui status** | Partial |
+
+## Context
+
+On macOS, capture needs a TCC grant; on Windows, only the Settings privacy
+toggles for desktop apps.
+
+## Decision
+
+On macOS, await `askForMediaAccess('camera')` before creating the window, so
+the first capture does not race the permission prompt. Microphone access is
+not asked up front, although audio is captured. A denied grant is ignored:
+the window opens anyway. Rationale beyond the race is not recorded.
+
+## Consequences
+
+The microphone prompt appears later, at the first audio capture.
+
+## Porting to egui
+
+**Keep**, and ask for both. Prototype: `nokhwa_initialize` requests camera
+access before enumerating, and the bundled `Info.plist` carries
+`NSCameraUsageDescription` -- without it macOS kills a bundled app on its
+first camera access. Add `NSMicrophoneUsageDescription` and the microphone
+request with audio ([0009](0009-pair-audio-with-its-video-card.md)). Note
+that macOS attributes the grant to the launching app: run from a terminal
+that can show the prompt, or from the installed bundle.
diff --git a/docs/adr/0052-run-background-work-in-app-logic.md b/docs/adr/0052-run-background-work-in-app-logic.md
new file mode 100644
index 0000000..ee4f67d
--- /dev/null
+++ b/docs/adr/0052-run-background-work-in-app-logic.md
@@ -0,0 +1,42 @@
+# 0052. Run everything that must not stop in `App::logic`, not in `ui`
+
+| | |
+|---|---|
+| **Status** | Accepted |
+| **Date** | 2026-10-12 |
+| **Area** | Platform |
+| **Evidence** | `input_viewer_egui/src/app.rs` `impl eframe::App`; eframe `App::logic` docs |
+| **egui verdict** | Keep (egui-only decision) |
+| **egui status** | Done |
+
+## Context
+
+eframe calls `App::ui` only while the window is visible. While it is hidden
+or fully covered it runs no egui pass at all and calls `App::logic` instead
+(whenever a repaint is requested).
+
+The prototype first did its health sampling, reopening, device polling and
+screensaver timing inside `ui`. Testing `--mock-fault` with the window behind
+other windows, the app logged one health line at 2 s and then nothing: the
+main thread was idle in the macOS event loop, `ui` was never called, and a
+stalled input was never reopened. On the wall, any window over the app -- an
+update prompt, the Elgato utility, a notification -- would have paused card
+recovery the same way.
+
+## Decision
+
+- `logic`: device polling, stream sync (open, release, reopen), health
+  sampling, screensaver timing, settings saves. It requests its own wake-up
+  every 500 ms, because with every input stalled or failed no frames arrive
+  to request one, and the reopen timers would never fire.
+- `ui`: input handling, texture uploads, painting, dialogs.
+
+## Consequences
+
+Anything added later that must keep running unattended -- the log file's
+day roll-over, the remote keyboard, Art-Net, the weather poll -- belongs in
+`logic` or on its own thread, never in `ui`.
+
+## Porting to egui
+
+N/A: this ADR exists only because of egui.
diff --git a/docs/adr/README.md b/docs/adr/README.md
new file mode 100644
index 0000000..c959ad3
--- /dev/null
+++ b/docs/adr/README.md
@@ -0,0 +1,134 @@
+# Architecture Decision Records
+
+Input Viewer's design decisions, reconstructed from the Electron app's code,
+issues and PRs in 2026-10, so it can be ported to Rust and egui
+([0002](0002-port-to-rust-and-egui.md)) one conscious decision at a time.
+How these are written and changed: [0001](0001-record-architecture-decisions.md);
+the format: [0000-template.md](0000-template.md).
+
+Each ADR ends with **Porting to egui**:
+
+- **Verdict** -- *Keep*: port the behaviour as is. *Adapt*: same goal,
+  different mechanism. *Drop*: an Electron or browser artefact. *Decide*: a
+  product question to answer first.
+- **egui status** -- where the prototype in
+  [`input_viewer_egui/`](../../input_viewer_egui/README.md) stands: *Done*,
+  *Partial*, *Not started*, *N/A*.
+
+Defects, contradictions and doc drift found on the way are in
+[open-questions.md](open-questions.md), including eleven product decisions
+(D1-D11) worth settling before the port reaches them.
+
+## Status board
+
+### Product
+
+| ADR | Decision | Status | egui verdict | egui status |
+|---|---|---|---|---|
+| [0001](0001-record-architecture-decisions.md) | Record architecture decisions, and port by them | Accepted | Keep | N/A |
+| [0002](0002-port-to-rust-and-egui.md) | Port Input Viewer to Rust and egui | Proposed | Decide | Prototype |
+| [0003](0003-model-the-wall-as-two-halves.md) | Model the wall as two halves, never N panels | Accepted | Keep | Done |
+| [0004](0004-one-fullscreen-window-wall-composition-is-external.md) | One borderless fullscreen window; the wall's composition is someone else's job | Accepted | Keep | Partial |
+| [0005](0005-no-single-instance-sleep-inhibit-or-relaunch.md) | Single instance, display sleep and crash relaunch are not the app's job (by omission) | Open | Decide | Not started |
+| [0006](0006-app-and-wall-setup-live-in-separate-repos.md) | The app and the wall's setup live in separate repos; the startup script owns launch order | Accepted | Keep | Partial |
+
+### Capture
+
+| ADR | Decision | Status | egui verdict | egui status |
+|---|---|---|---|---|
+| [0007](0007-capture-at-native-resolution.md) | Capture at the card's native resolution, and log what was negotiated | Accepted | Adapt | Partial |
+| [0008](0008-one-capture-session-per-device.md) | One capture session per device, shared by both halves | Accepted (Electron shape: one track per side) | Adapt | Done |
+| [0009](0009-pair-audio-with-its-video-card.md) | Pair audio with its video card; missing audio never blocks video | Accepted | Adapt | Not started |
+| [0010](0010-volume-belongs-to-a-side.md) | Volume belongs to a side; the OS volume is shown and set directly | Accepted | Adapt | Not started |
+| [0011](0011-choose-startup-inputs-by-precedence.md) | Choose each half's input by a fixed precedence, and keep it across hot-plug | Accepted | Keep | Partial |
+
+### Signal
+
+| ADR | Decision | Status | egui verdict | egui status |
+|---|---|---|---|---|
+| [0012](0012-judge-health-by-counting-frames.md) | Judge capture health by counting frames, never by measuring motion | Accepted | Keep | Done |
+| [0013](0013-reopen-by-releasing-the-device-with-two-backoffs.md) | Reopen a sick device by releasing it fully, on separate backoffs for faults and for dark | Accepted | Keep | Done |
+| [0014](0014-detect-no-signal-against-references.md) | Detect no-signal by comparing against operator-captured reference screenshots | Accepted -- but dormant on the wall | Decide | Not started |
+| [0015](0015-crop-black-bars-by-snapping-to-shapes.md) | Crop the card's black bars by snapping to known shapes | Accepted | Keep, and reconsider the source | Not started |
+| [0016](0016-laptop-resolution-hint-off-by-default.md) | Keep the "set your laptop to 3840x768" hint off by default | Accepted (premise weakened since 2026-10-02) | Keep | Not started |
+| [0017](0017-freeze-shows-the-live-picture.md) | Freeze shows exactly the picture that was live | Accepted | Adapt | Done |
+| [0018](0018-composite-on-the-gpu.md) | Composite video on the GPU, with good downscaling | Accepted (Electron: CSS `<video>`; WebGPU path evaluated and not adopted) | Drop (decided by the platform) | Done |
+| [0019](0019-one-no-signal-state-machine.md) | One no-signal state machine per side, with a downtime clock | Accepted | Keep | Partial |
+
+### Screensavers
+
+| ADR | Decision | Status | egui verdict | egui status |
+|---|---|---|---|---|
+| [0020](0020-split-flap-board-is-the-no-signal-display.md) | The split-flap board is the no-signal display, not a screensaver | Accepted | Keep | Partial |
+| [0021](0021-screensaver-registry-contract.md) | Screensavers are modules behind one synchronous contract, with a safe fallback | Accepted | Keep | Partial |
+| [0022](0022-seed-every-activation.md) | Seed every activation from the clock, log the seed, and perturb within curated ranges | Accepted | Adapt | Partial |
+| [0023](0023-start-after-5-min-rotate-every-10.md) | Start a screensaver after 5 minutes dark, rotate every 10, never repeat the last | Accepted -- dismissal is Open | Keep; Decide on dismissal | Partial |
+| [0024](0024-scale-by-area-and-room.md) | Scale savers by area and by room light, not by axis | Accepted | Keep | Not started |
+| [0025](0025-hdr-post-chain-owns-tonemapping.md) | An HDR post chain owns tonemapping; savers emit linear HDR; supersample in the shader | Accepted | Keep | Partial |
+| [0026](0026-share-glsl-and-work-in-world-space.md) | Share GLSL through one library, and work in world space divided by the short axis | Accepted | Keep | Partial |
+| [0027](0027-network-access-outside-savers.md) | Keep network access outside the savers; weather is opt-in and coarsened | Accepted | Keep | Not started |
+| [0028](0028-verify-shaders-and-measure-on-a-real-gpu.md) | Verify shaders with a direct harness and structure baselines; measure speed only on a real GPU | Accepted | Adapt | Not started |
+| [0029](0029-text-through-a-baked-glyph-atlas.md) | Draw text in savers through a baked glyph atlas | Accepted | Adapt | Not started |
+| [0030](0030-art-net-reactive-lighting.md) | Drive the room's lights from the screensaver: sparse readback, 1 Hz, only when enabled | Accepted | Keep | Not started |
+
+### UI
+
+| ADR | Decision | Status | egui verdict | egui status |
+|---|---|---|---|---|
+| [0031](0031-what-a-picker-tap-sets.md) | What a picker tap sets depends on view and Multi-view; key chips only where the key does the same | Accepted | Keep | Done |
+| [0032](0032-input-thumbnails-are-snapshots.md) | Input thumbnails are snapshots, swept one stream at a time | Accepted | Keep | Partial |
+| [0033](0033-controls-laid-over-the-wall.md) | Controls are laid over the wall from the top edge, and close themselves | Accepted | Keep | Partial |
+| [0034](0034-one-shortcut-list.md) | One shortcut list drives the keys, the legend and the docs | Accepted | Keep | Partial |
+| [0035](0035-settings-is-a-side-nav-modal.md) | Settings is a side-nav modal that autosaves and reports its own status | Accepted | Keep | Partial |
+| [0036](0036-layout-geometry.md) | Layout geometry: contain-fit, a logo gap between the halves, optional side borders, dual by default | Accepted | Keep | Done |
+| [0037](0037-transitions-are-interruptible-dips.md) | Transitions: interruptible, a dip to black rather than a crossfade, instant under reduced motion | Accepted | Keep, and reconsider the crossfade | Not started |
+| [0038](0038-cursor-and-transient-overlays.md) | Hide the cursor; confirm switches with a toast only when nothing else names the input | Accepted | Keep | Partial |
+| [0039](0039-visual-language.md) | Visual language: SBP colours, system fonts only, sized for a lit room at a distance | Accepted | Keep | Partial |
+| [0040](0040-remote-keyboard.md) | Forward the presenter's clicker to a networked keyboard | Accepted | Keep | Not started |
+
+### Platform
+
+| ADR | Decision | Status | egui verdict | egui status |
+|---|---|---|---|---|
+| [0041](0041-settings-json.md) | Settings are one JSON file in the app's data folder; network features default off; test mode never writes | Accepted | Keep, and fix | Done |
+| [0042](0042-test-mode-flags.md) | Test-mode flags reach every state without hardware, and say so loudly | Accepted | Keep | Done |
+| [0043](0043-keep-privileged-work-in-one-place.md) | Keep privileged work in one small, auditable place | Accepted | Drop the mechanism; keep the principle | N/A |
+| [0044](0044-a-bounded-log-file-is-the-operator-contract.md) | A bounded daily log file is the operators' evidence | Accepted | Keep | Done |
+| [0051](0051-request-capture-permission-up-front.md) | Ask for camera access before opening any capture | Accepted | Keep | Partial |
+| [0052](0052-run-background-work-in-app-logic.md) | Run everything that must not stop in `App::logic`, not in `ui` | Accepted | Keep (egui-only decision) | Done |
+
+### Delivery
+
+| ADR | Decision | Status | egui verdict | egui status |
+|---|---|---|---|---|
+| [0045](0045-release-by-hand-bump-from-commits.md) | Release by hand; derive the version bump from Conventional Commits, with an explicit override | Accepted | Keep | Partial |
+| [0046](0046-version-and-tagging.md) | VERSION is the source of truth; bump through a PR, tag the merged commit | Accepted | Adapt | Partial |
+| [0047](0047-gate-releases-on-tests.md) | Gate every PR and release on lint, tests and build, and show the results inline | Accepted | Keep | Partial |
+| [0048](0048-package-and-update-from-the-public-repo.md) | Package per platform and auto-update from the public source repo, asking first | Accepted | Keep; Decide on the unattended prompt | Partial |
+| [0049](0049-builds-are-unsigned.md) | Builds are unsigned | Accepted (by default) | Decide | Same as Electron (ad-hoc on macOS) |
+| [0050](0050-supply-chain-and-licence.md) | Supply chain and licence: SHA-pinned actions, delayed Dependabot, public registries, Apache-2.0 with SPDX headers | Accepted | Keep | Partial |
+
+## Suggested port order
+
+Driven by what keeps the wall working, not by size.
+
+1. **Gate: the wall itself.** Run `--test-pattern --hud` and real capture on
+   the wall's Windows host with both Elgato cards
+   ([0002](0002-port-to-rust-and-egui.md)). Everything below assumes it passes.
+2. **Capture robustness:** ~~health thresholds and reopen schedules~~
+   (done, [0012](0012-judge-health-by-counting-frames.md),
+   [0013](0013-reopen-by-releasing-the-device-with-two-backoffs.md)); native format choice ([0007](0007-capture-at-native-resolution.md)),
+   hot-plug events ([0011](0011-choose-startup-inputs-by-precedence.md)); ~~the
+   log file~~ (done, [0044](0044-a-bounded-log-file-is-the-operator-contract.md)).
+   This is what actually recovers the wall today.
+3. **Picture:** black-bar cropping ([0015](0015-crop-black-bars-by-snapping-to-shapes.md)),
+   and its driver-query alternative (#340).
+4. **Sound:** audio pairing and per-side volume
+   ([0009](0009-pair-audio-with-its-video-card.md), [0010](0010-volume-belongs-to-a-side.md)).
+5. **Deployment:** install location and startup script, unattended updates,
+   single instance (D3-D5).
+6. **Operator UI gaps:** cursor, transitions, remote keyboard, remaining
+   Settings panes.
+7. **Screensavers:** the five other pure-fragment savers first, then the
+   orchestrated ones; Art-Net and weather alongside.
+8. **Reference detection** -- only if D1 says it is still wanted.
diff --git a/docs/adr/open-questions.md b/docs/adr/open-questions.md
new file mode 100644
index 0000000..bbdfea1
--- /dev/null
+++ b/docs/adr/open-questions.md
@@ -0,0 +1,77 @@
+# Open questions, defects and drift
+
+Found while reconstructing the ADRs (2026-10-12, against `main` at 787375b,
+v3.4.1). None of these is a decision; each needs an owner. Line numbers are
+from that commit.
+
+## Decisions to make before porting
+
+| # | Question | ADR |
+|---|---|---|
+| D1 | Is reference-based no-signal detection still required? **The wall runs with no references**, and when they were removed is not recorded. | [0014](0014-detect-no-signal-against-references.md) |
+| D2 | How is the screensaver dismissed? USER_GUIDE says any mouse movement, key or touch; the code accepts only a mouse shake, `V`, or signal returning. | [0023](0023-start-after-5-min-rotate-every-10.md) |
+| D3 | An update prompt or error dialog can sit modal over an unattended wall. What should an unattended update look like? | [0048](0048-package-and-update-from-the-public-repo.md) |
+| D4 | Where does the wall install the app? `startup.ps1` launches `C:\Program Files\Input Viewer\Input Viewer.exe`, NSIS is `perMachine: false` (default `%LocalAppData%\Programs`), Velopack installs per user. | [0006](0006-app-and-wall-setup-live-in-separate-repos.md) |
+| D5 | Single-instance lock, display-sleep inhibitor, crash relaunch: app, startup script, or neither? | [0005](0005-no-single-instance-sleep-inhibit-or-relaunch.md) |
+| D6 | Sign the builds? | [0049](0049-builds-are-unsigned.md) |
+| D7 | Should the egui app's screensaver seeds reproduce Electron's (port mulberry32 + FNV-1a)? | [0022](0022-seed-every-activation.md) |
+| D8 | Picker size on the wall: 128x72 tiles fill only the top-left of each ~3000 px half. | [0033](0033-controls-laid-over-the-wall.md) |
+| D9 | `layoutMode: null` -- real screen-based detection, or drop the idea and default to dual (what actually happens)? | [0036](0036-layout-geometry.md) |
+| D10 | Number keys silently override per-half choices in dual + Multi-view. Keep, or a per-side key scheme? | [0031](0031-what-a-picker-tap-sets.md) |
+| D11 | Should screensavers get an app-state parameter? Weather (module singleton) and Split Flap (`setMessages`) each worked around its absence differently. | [0021](0021-screensaver-registry-contract.md) |
+
+## Defects in the Electron app
+
+Filed as issues on 2026-10-12. E16 was already tracked in #340.
+
+| # | Defect | Where | Issue |
+|---|---|---|---|
+| E1 | The low-resolution retry requests audio with the **video** device id -- the bug #151 fixed on the main path. | `renderer.js:927-929` | #347 |
+| E2 | The reference probe saves nothing: the full scan runs on every cycle anyway, for a diagnostic trace, even with no sink attached. | `detection-simple.js:436-442` (#163, 332fcc3) | #348 |
+| E3 | `checkNoSignal()` passes the reference *list* to `compareFrames` and would always return false. Unused. | `detection-simple.js:241` | #349 |
+| E4 | `force_release` without a bump builds artifacts and never publishes them. | `release.yml` (publish needs version-bump) | #350 |
+| E5 | `chore(deps*)` commits never bump, so Electron/Chromium security updates never release without a manual `bump`. | `release.yml:53-91` | #351 |
+| E6 | `settings.json` writes are not atomic; a corrupt file loads as defaults and is overwritten by the next save. | `src/main/index.js` `saveSettings` | #352 |
+| E7 | Main and renderer keep different default settings (`layoutMode`, `centerGap`, `borderWidth`, volumes, remote keys, `cropLetterbox`, `aspectHint`). | `index.js:124-150`, `renderer.js:366-405` | #353 |
+| E8 | The update error dialog says "Failed to download update" for a failed **check** too. | `index.js:850-860` | #354 |
+| E9 | #86's proposed guard -- check every `url`/`path` in `latest*.yml` exists -- was never added. | `release.yml` publish job | #355 |
+| E10 | Dead IPC: `get-settings-path` (caller removed in #334), `diag-log-reset` (never called). | `src/preload/index.js` | #356 |
+| E11 | Dead markup: `#bottom-logo` (always hidden since 2026-01-16), `.input-label`, the `renderDropdownVolumeControls` shim. | `index.html:36`, `styles.css` | #357 |
+| E12 | The same device on both halves opens two audio tracks; the audio may play twice. | `renderer.js` `startVideoStream` | #358 |
+| E13 | The WebCodecs read copies the whole frame (~33 MB at 4K) every 1.6 s, contradicting #61's "copies only the region". Unmeasured on the wall. | `frame-source.js` | #359 |
+| E14 | shadercheck is not run in CI; a shader regression merges unless someone runs it. | `ci.yml`, `release.yml` | #360 |
+| E15 | macOS auto-update has never been confirmed end to end on the unsigned build. | #86 checklist | #361 |
+| E16 | A 2026-10-05 over-crop of a mirrored MacBook on the wall is undiagnosed. | #316, #340 | #340 |
+
+## Documentation drift
+
+| Says | Actually | Where |
+|---|---|---|
+| Electron 43.x | 44.4.5 | `.claude/CLAUDE.md`, `index.js:113` |
+| health thumbnail 32x18 | 384x216 since #314 | CLAUDE.md, `stream-health.js:64` |
+| presenter "behind HDBaseT" | 15 m HDMI since 2026-10-02 | CLAUDE.md |
+| 12 savers, 30 baselines, "6 of the 12" | 29 savers, 29 baselines | CLAUDE.md, `shader-check.mjs:78`, `gl-base.js:206`, `post-fx.js:8` |
+| input fades back in over 180 ms | snaps | `renderer.js:2066` |
+| in-app compositor is rAF-driven | rVFC | #62 comment |
+| `W` cycles weather states | `A` (W is wall mode) | `weather-states.js:7` |
+| shortcuts have three consumers incl. the Settings table | the table was removed in #334 | `shortcuts.js` header |
+| the legend slides | it fades since #334 | CLAUDE.md |
+| `observeFrames` reads a 32x16 downscale every frame | 8x4 tiles at 1 Hz (#275) | `gl-base.js:652-664` |
+| structure baselines: "GENERATED, do not hand-edit" | CLAUDE.md says hand-edit a single line, and practice follows it | `structure-baselines.js` header |
+| layout is detected from the screen aspect | always dual (main's default wins) | README, USER_GUIDE, `settings.example.json` |
+| "Settings shows the exact path" | it no longer does | `settings.example.json` |
+| remote keyboard forwards "arrow key presses" | PgUp/PgDn primarily | Settings copy |
+| screensaver ends on any mouse/key/touch | shake, `V` or signal only | USER_GUIDE |
+| log folder `%APPDATA%\input-viewer\logs` | probably `%APPDATA%\Input Viewer\logs` (`productName`) -- check on the wall | labs-videowall-config |
+| branch types | CLAUDE.md omits `test/`, DEVELOPMENT.md has it | `.claude/` |
+
+## Not recorded anywhere
+
+- Why the capture request says 4096 wide rather than 3840.
+- Why OpenCV.js was dropped for simple frame comparison (the 11 MB spike is
+  still in `spikes/`).
+- Why the DVD logo is the fallback beyond being first; why 10 minutes for
+  rotation.
+- Why there is a separate VERSION file; why vitest is not a devDependency.
+- When and why required status checks disappeared from `main`'s protection.
+- How the wall actually receives updates.
diff --git a/input_viewer_egui/.gitignore b/input_viewer_egui/.gitignore
new file mode 100644
index 0000000..ea8c4bf
--- /dev/null
+++ b/input_viewer_egui/.gitignore
@@ -0,0 +1 @@
+/target
diff --git a/input_viewer_egui/Cargo.lock b/input_viewer_egui/Cargo.lock
new file mode 100644
index 0000000..db874d8
--- /dev/null
+++ b/input_viewer_egui/Cargo.lock
@@ -0,0 +1,5231 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "accesskit"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3b7f7f85a7e5f68090000ed7622545829afd484d210358702ae4cb97dd0c320"
+dependencies = [
+ "enumn",
+ "serde",
+ "uuid",
+]
+
+[[package]]
+name = "accesskit_atspi_common"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e8c61bee90b42a772d39d06a740207dc71a4e780004ace1db8d99fb1baaa954"
+dependencies = [
+ "accesskit",
+ "accesskit_consumer 0.36.0",
+ "atspi-common",
+ "phf",
+ "serde",
+ "zvariant",
+]
+
+[[package]]
+name = "accesskit_consumer"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53cf47daed85312e763fbf85ceca136e0d7abc68e0a7e12abe11f48172bc3b10"
+dependencies = [
+ "accesskit",
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "accesskit_consumer"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25e0d7e25d06f4dc21d1774d67146e9e80d6789216cbd4d1e88185b0095dba60"
+dependencies = [
+ "accesskit",
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "accesskit_consumer"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d10a236f96f87d70732e44520046785431ef01d5bcd6b041317bfadd2f88245"
+dependencies = [
+ "accesskit",
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "accesskit_macos"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce02dc63b43f0c9296af9ac946312a2dc8814427d7a64d2d600971dac55b6076"
+dependencies = [
+ "accesskit",
+ "accesskit_consumer 0.38.0",
+ "hashbrown 0.16.1",
+ "objc2 0.5.3",
+ "objc2-app-kit 0.2.2",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "accesskit_unix"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b016ca8db0ea0ea2ceff29a9d6240391492d960716aa471967c00e8cc8cb197c"
+dependencies = [
+ "accesskit",
+ "accesskit_atspi_common",
+ "async-channel",
+ "async-executor",
+ "async-task",
+ "atspi",
+ "futures-lite",
+ "futures-util",
+ "serde",
+ "zbus",
+]
+
+[[package]]
+name = "accesskit_windows"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eff7009f1a532e917d66970a1e80c965140c6cfbbabbdde3d64e5431e6c78e21"
+dependencies = [
+ "accesskit",
+ "accesskit_consumer 0.35.0",
+ "hashbrown 0.16.1",
+ "static_assertions",
+ "windows",
+ "windows-core",
+]
+
+[[package]]
+name = "accesskit_winit"
+version = "0.32.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fe9a94394896352cc4660ca2288bd4ef883d83238853c038b44070c8f134313"
+dependencies = [
+ "accesskit",
+ "accesskit_macos",
+ "accesskit_unix",
+ "accesskit_windows",
+ "raw-window-handle",
+ "winit",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if 1.0.5",
+ "getrandom 0.3.4",
+ "once_cell",
+ "serde",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android-activity"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f2a1bb052857d5dd49572219344a7332b31b76405648eabac5bc68978251bcd"
+dependencies = [
+ "android-properties",
+ "bitflags 2.13.2",
+ "cc",
+ "jni",
+ "libc",
+ "log",
+ "ndk",
+ "ndk-context",
+ "ndk-sys",
+ "num_enum",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "android-properties"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7eb209b1518d6bb87b283c20095f5228ecda460da70b44f0802523dea6da04"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "arboard"
+version = "3.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+dependencies = [
+ "clipboard-win",
+ "image",
+ "log",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation 0.3.2",
+ "parking_lot",
+ "percent-encoding",
+ "windows-sys 0.60.2",
+ "x11rb",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "as-raw-xcb-connection"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b"
+
+[[package]]
+name = "async-broadcast"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-executor"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
+dependencies = [
+ "async-task",
+ "concurrent-queue",
+ "fastrand",
+ "futures-lite",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "async-io"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
+dependencies = [
+ "autocfg",
+ "cfg-if 1.0.5",
+ "concurrent-queue",
+ "futures-io",
+ "futures-lite",
+ "parking",
+ "polling",
+ "rustix 1.1.5",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-process"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
+dependencies = [
+ "async-channel",
+ "async-io",
+ "async-lock",
+ "async-signal",
+ "async-task",
+ "blocking",
+ "cfg-if 1.0.5",
+ "event-listener",
+ "futures-lite",
+ "rustix 1.1.5",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f8abc12baad266b1c8cec146854c195b5864b4221d4b2ca7296a7ae82d9e451"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "async-signal"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
+dependencies = [
+ "async-io",
+ "async-lock",
+ "atomic-waker",
+ "cfg-if 1.0.5",
+ "futures-core",
+ "futures-io",
+ "rustix 1.1.5",
+ "signal-hook-registry",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "atspi"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c77886257be21c9cd89a4ae7e64860c6f0eefca799bb79127913052bd0eefb3d"
+dependencies = [
+ "atspi-common",
+ "atspi-proxies",
+]
+
+[[package]]
+name = "atspi-common"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20c5617155740c98003016429ad13fe43ce7a77b007479350a9f8bf95a29f63d"
+dependencies = [
+ "enumflags2",
+ "serde",
+ "static_assertions",
+ "zbus",
+ "zbus-lockstep",
+ "zbus-lockstep-macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "atspi-proxies"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2230e48787ed3eb4088996eab66a32ca20c0b67bbd4fd6cdfe79f04f1f04c9fc"
+dependencies = [
+ "atspi-common",
+ "serde",
+ "zbus",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "bindgen"
+version = "0.65.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfdf7b466f9a4903edc73f95d6d2bcd5baf8ae620638762244d3f60143643cc5"
+dependencies = [
+ "bitflags 1.3.2",
+ "cexpr",
+ "clang-sys",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "peeking_take_while",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash 1.1.0",
+ "shlex 1.3.0",
+ "syn 2.0.119",
+ "which",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2f926cc3060f09db9ebc5b52823d85268d24bb917e472c0c4bea35780a7d"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a"
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "block2"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c132eebf10f5cad5289222520a4a058514204aed6d791f1cf4fe8088b82d15f"
+dependencies = [
+ "objc2 0.5.3",
+]
+
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2 0.6.5",
+]
+
+[[package]]
+name = "blocking"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a70e4329df6cb94385eed412ec92375c3cdd8a6e502493d1229b6414e4036dfa"
+dependencies = [
+ "async-channel",
+ "async-task",
+ "futures-io",
+ "futures-lite",
+ "piper",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+dependencies = [
+ "bytemuck_derive",
+]
+
+[[package]]
+name = "bytemuck_derive"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a1f896587b6f2c069c73d2f0913e2d590c3990285cd2f0b6aa02b786b4c679c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "byteorder-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "calloop"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b99da2f8558ca23c71f4fd15dc57c906239752dd27ff3c00a1d56b685b7cbfec"
+dependencies = [
+ "bitflags 2.13.2",
+ "log",
+ "polling",
+ "rustix 0.38.44",
+ "slab",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "calloop"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43b32313e937c8721c9d17ee9bf60699a6402b4b7c2cb6ac1bee0ffcaa4b4e5e"
+dependencies = [
+ "bitflags 2.13.2",
+ "polling",
+ "rustix 1.1.5",
+ "tracing",
+]
+
+[[package]]
+name = "calloop-wayland-source"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95a66a987056935f7efce4ab5668920b5d0dac4a7c99991a67395f13702ddd20"
+dependencies = [
+ "calloop 0.13.0",
+ "rustix 0.38.44",
+ "wayland-backend",
+ "wayland-client",
+]
+
+[[package]]
+name = "calloop-wayland-source"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "138efcf0940a02ebf0cc8d1eff41a1682a46b431630f4c52450d6265876021fa"
+dependencies = [
+ "calloop 0.14.5",
+ "rustix 1.1.5",
+ "wayland-backend",
+ "wayland-client",
+]
+
+[[package]]
+name = "cc"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6651c9ed80effdc7db0ff72512157f901af5e3549e341e24b1dd4887d836d838"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex 2.0.1",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "cgl"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ced0551234e87afee12411d535648dd89d2e7f34c78b753395567aff3d447ff"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if 1.0.5",
+ "cpufeatures",
+ "rand_core",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "windows-link",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clipboard-win"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
+dependencies = [
+ "error-code",
+]
+
+[[package]]
+name = "cocoa"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c49e86fc36d5704151f5996b7b3795385f50ce09e3be0f47a0cfde869681cf8"
+dependencies = [
+ "bitflags 1.3.2",
+ "block",
+ "core-foundation 0.7.0",
+ "core-graphics 0.19.2",
+ "foreign-types 0.3.2",
+ "libc",
+ "objc",
+]
+
+[[package]]
+name = "cocoa-foundation"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81411967c50ee9a1fc11365f8c585f863a22a9697c89239c452292c40ba79b0d"
+dependencies = [
+ "bitflags 2.13.2",
+ "block",
+ "core-foundation 0.10.1",
+ "core-graphics-types 0.2.0",
+ "objc",
+]
+
+[[package]]
+name = "codespan-reporting"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af491d569909a7e4dee0ad7db7f5341fef5c614d5b8ec8cf765732aba3cff681"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "color"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ec7c5eb7a16992b1904d76c517d170ab353b0e0b3d5a0c81a8a0cd1037893cf"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "combine"
+version = "4.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "cookie"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "cookie_store"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b2c103cf610ec6cae3da84a766285b42fd16aad564758459e6ecf128c75206"
+dependencies = [
+ "cookie",
+ "document-features",
+ "idna",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "url",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57d24c7a13c43e870e37c1556b74555437870a04514f7685f5b354e090567171"
+dependencies = [
+ "core-foundation-sys 0.7.0",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys 0.8.7",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys 0.8.7",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3a71ab494c0b5b860bdc8407ae08978052417070c2ced38573a9157ad75b8ac"
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core-graphics"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3889374e6ea6ab25dba90bb5d96202f61108058361f6dc72e8b03e6f8bbe923"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation 0.7.0",
+ "foreign-types 0.3.2",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation 0.9.4",
+ "core-graphics-types 0.1.3",
+ "foreign-types 0.5.0",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation 0.9.4",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation 0.10.1",
+ "libc",
+]
+
+[[package]]
+name = "core-media-sys"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "273bf3fc5bf51fd06a7766a84788c1540b6527130a0bce39e00567d6ab9f31f1"
+dependencies = [
+ "cfg-if 0.1.10",
+ "core-foundation-sys 0.7.0",
+ "libc",
+]
+
+[[package]]
+name = "core-video-sys"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34ecad23610ad9757664d644e369246edde1803fcb43ed72876565098a5d3828"
+dependencies = [
+ "cfg-if 0.1.10",
+ "core-foundation-sys 0.7.0",
+ "core-graphics 0.19.2",
+ "libc",
+ "metal",
+ "objc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+dependencies = [
+ "cfg-if 1.0.5",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "cursor-icon"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
+[[package]]
+name = "derivative"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+]
+
+[[package]]
+name = "dirs"
+version = "7.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "dispatch"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd0c93bb4b0c6d9b77f4435b0ae98c24d17f1c45b2ff844c6151a07256ca923b"
+
+[[package]]
+name = "dispatch2"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2 0.6.5",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "dlib"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab8ecd87370524b461f8557c119c405552c396ed91fc0a8eec68679eab26f94a"
+dependencies = [
+ "libloading",
+]
+
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "downcast-rs"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
+
+[[package]]
+name = "dpi"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "ecolor"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0656a7530b9e2841ee7a5f983965bdd9840c32f4012f759cfd44b912cced6b34"
+dependencies = [
+ "bytemuck",
+ "emath",
+ "serde",
+]
+
+[[package]]
+name = "eframe"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55ad41fac6e3149abb4866e93df37dbd33baa95db525c3368c944584e95a5dc2"
+dependencies = [
+ "ahash",
+ "bytemuck",
+ "document-features",
+ "egui",
+ "egui-wgpu",
+ "egui-winit",
+ "egui_glow",
+ "glow",
+ "glutin",
+ "glutin-winit",
+ "image",
+ "js-sys",
+ "log",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
+ "parking_lot",
+ "percent-encoding",
+ "profiling",
+ "raw-window-handle",
+ "ron",
+ "serde",
+ "static_assertions",
+ "wasm-bindgen",
+ "web-sys",
+ "web-time",
+ "windows-sys 0.61.2",
+ "winit",
+]
+
+[[package]]
+name = "egui"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc938cc27cd911415e1e4d151bc56ff9df063d8db081374e87aeb805ea74b2ba"
+dependencies = [
+ "accesskit",
+ "ahash",
+ "bitflags 2.13.2",
+ "emath",
+ "epaint",
+ "itertools",
+ "log",
+ "nohash-hasher",
+ "profiling",
+ "ron",
+ "serde",
+ "smallvec",
+ "unicode-segmentation",
+ "web-sys",
+]
+
+[[package]]
+name = "egui-wgpu"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
+dependencies = [
+ "ahash",
+ "bytemuck",
+ "document-features",
+ "egui",
+ "epaint",
+ "log",
+ "profiling",
+ "thiserror 2.0.21",
+ "type-map",
+ "web-time",
+ "wgpu",
+ "winit",
+]
+
+[[package]]
+name = "egui-winit"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98466000559d66ba4db786a30448b01483946add4188e7f10f522a27b4fb89cc"
+dependencies = [
+ "accesskit_winit",
+ "arboard",
+ "bytemuck",
+ "egui",
+ "log",
+ "objc2 0.6.5",
+ "objc2-foundation 0.3.2",
+ "objc2-ui-kit 0.3.2",
+ "profiling",
+ "raw-window-handle",
+ "serde",
+ "smithay-clipboard",
+ "web-time",
+ "winit",
+]
+
+[[package]]
+name = "egui_glow"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "606ed4167daf341e5753d703285c4c1d562324b2c07aa8f405cd7d066fe58f3b"
+dependencies = [
+ "bytemuck",
+ "egui",
+ "glow",
+ "log",
+ "profiling",
+ "winit",
+]
+
+[[package]]
+name = "either"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
+
+[[package]]
+name = "emath"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52c8d4141cf0f60fb2f7aefaf352d3ffa5171ef0ab09731c64391801e95e48f1"
+dependencies = [
+ "bytemuck",
+ "serde",
+]
+
+[[package]]
+name = "endi"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
+
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "enumn"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f9ed6b3789237c8a0c1c505af1c7eb2c560df6186f01b098c3a1064ea532f38"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "epaint"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0ec0308dc23130fc1a7d4623a8534c2ed069c6dc84e258ee4f3de99615aa1a3"
+dependencies = [
+ "ahash",
+ "bytemuck",
+ "ecolor",
+ "emath",
+ "epaint_default_fonts",
+ "font-types",
+ "harfrust",
+ "log",
+ "nohash-hasher",
+ "parking_lot",
+ "profiling",
+ "self_cell",
+ "serde",
+ "skrifa",
+ "smallvec",
+ "unicode-general-category",
+ "unicode-segmentation",
+ "vello_cpu",
+]
+
+[[package]]
+name = "epaint_default_fonts"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773fa9c96dd0dbef887e39d0ed6177f141cce4d68e6041df77570aa3702dfa13"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "error-code"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5343afd4a8365a643ac588dab4cf234a190c7f6c88c9f6dd6ffe00837661b7"
+
+[[package]]
+name = "euclid"
+version = "0.22.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1a05365e3b1c6d1650318537c7460c6923f1abdd272ad6842baa2b509957a06"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
+dependencies = [
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "fax"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caf1079563223d5d59d83c85886a56e586cfd5c1a26292e971a0fa266531ac5a"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "fearless_simd"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide 0.9.1",
+ "zlib-rs",
+]
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "nanorand",
+ "spin",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "font-types"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c92d9081c7ab3bd83ef1eecdfad090f3d966e3ce74106779664114cfe1a6274"
+dependencies = [
+ "bytemuck",
+ "serde",
+]
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared 0.1.1",
+]
+
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared 0.3.1",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-lite"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-macro",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "gethostname"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
+dependencies = [
+ "rustix 1.1.5",
+ "windows-link",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if 1.0.5",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if 1.0.5",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if 1.0.5",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core",
+]
+
+[[package]]
+name = "gl_generator"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a95dfc23a2b4a9a2f5ab41d194f8bfda3cabec42af4e39f08c339eb2a0c124d"
+dependencies = [
+ "khronos_api",
+ "log",
+ "xml-rs",
+]
+
+[[package]]
+name = "glifo"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed4a1bb24121291d27230c1b1b44e07d6a9b28cefdb32fe1581dfb84e14f940a"
+dependencies = [
+ "bytemuck",
+ "foldhash",
+ "hashbrown 0.17.1",
+ "log",
+ "peniko",
+ "skrifa",
+ "smallvec",
+ "vello_common",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
+[[package]]
+name = "glow"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29038e1c483364cc6bb3cf78feee1816002e127c331a1eec55a4d202b9e1adb5"
+dependencies = [
+ "js-sys",
+ "slotmap",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "glutin"
+version = "0.32.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12124de845cacfebedff80e877bb37b5b75c34c5a4c89e47e1cdd67fb6041325"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg_aliases",
+ "cgl",
+ "dispatch2",
+ "glutin_egl_sys",
+ "glutin_glx_sys",
+ "glutin_wgl_sys",
+ "libloading",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "once_cell",
+ "raw-window-handle",
+ "wayland-sys",
+ "windows-sys 0.52.0",
+ "x11-dl",
+]
+
+[[package]]
+name = "glutin-winit"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85edca7075f8fc728f28cb8fbb111a96c3b89e930574369e3e9c27eb75d3788f"
+dependencies = [
+ "cfg_aliases",
+ "glutin",
+ "raw-window-handle",
+ "winit",
+]
+
+[[package]]
+name = "glutin_egl_sys"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4680ba6195f424febdc3ba46e7a42a0e58743f2edb115297b86d7f8ecc02d2"
+dependencies = [
+ "gl_generator",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "glutin_glx_sys"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7bb2938045a88b612499fbcba375a77198e01306f52272e692f8c1f3751185"
+dependencies = [
+ "gl_generator",
+ "x11-dl",
+]
+
+[[package]]
+name = "glutin_wgl_sys"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c4ee00b289aba7a9e5306d57c2d05499b2e5dc427f84ac708bd2c090212cf3e"
+dependencies = [
+ "gl_generator",
+]
+
+[[package]]
+name = "guillotiere"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b17e70c989c36bad147b27a58d148c0741c51448aa5653436547323e524d0ab"
+dependencies = [
+ "euclid",
+]
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if 1.0.5",
+ "crunchy",
+ "num-traits",
+ "zerocopy",
+]
+
+[[package]]
+name = "harfrust"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c03d949a14aa089bbb282f7dd76a498a7f684428e4257202efc119ec010376f9"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytemuck",
+ "read-fonts",
+ "smallvec",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys 0.8.7",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "image"
+version = "0.25.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
+dependencies = [
+ "bytemuck",
+ "byteorder-lite",
+ "moxcms",
+ "num-traits",
+ "png",
+ "tiff",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "input_viewer_egui"
+version = "0.0.0"
+dependencies = [
+ "bytemuck",
+ "bytes",
+ "chrono",
+ "dirs",
+ "eframe",
+ "image",
+ "nokhwa",
+ "serde",
+ "serde_json",
+ "sysinfo",
+ "ureq",
+ "velopack",
+]
+
+[[package]]
+name = "itertools"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if 1.0.5",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.21",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+dependencies = [
+ "cfg-if 1.0.5",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "khronos_api"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
+
+[[package]]
+name = "kurbo"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b60dfc32f652b926df6192e55525b16d186c69d47876c3ead4da5cc9f8450e2"
+dependencies = [
+ "arrayvec",
+ "euclid",
+ "polycool",
+ "smallvec",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if 1.0.5",
+ "windows-link",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
+dependencies = [
+ "bitflags 2.13.2",
+ "libc",
+ "plain",
+ "redox_syscall 0.9.4",
+]
+
+[[package]]
+name = "linebender_resource_handle"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4a5ff6bcca6c4867b1c4fd4ef63e4db7436ef363e0ad7531d1558856bae64f4"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "malloc_buf"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memmap2"
+version = "0.9.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "metal"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e198a0ee42bdbe9ef2c09d0b9426f3b2b47d90d93a4a9b0395c4cea605e92dc0"
+dependencies = [
+ "bitflags 1.3.2",
+ "block",
+ "cocoa",
+ "core-graphics 0.19.2",
+ "foreign-types 0.3.2",
+ "log",
+ "objc",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "moxcms"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
+dependencies = [
+ "num-traits",
+ "pxfm",
+]
+
+[[package]]
+name = "mozjpeg"
+version = "0.10.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7891b80aaa86097d38d276eb98b3805d6280708c4e0a1e6f6aed9380c51fec9"
+dependencies = [
+ "arrayvec",
+ "bytemuck",
+ "libc",
+ "mozjpeg-sys",
+ "rgb",
+]
+
+[[package]]
+name = "mozjpeg-sys"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f0dc668bf9bf888c88e2fb1ab16a406d2c380f1d082b20d51dd540ab2aa70c1"
+dependencies = [
+ "cc",
+ "dunce",
+ "libc",
+ "nasm-rs",
+]
+
+[[package]]
+name = "naga"
+version = "30.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a616d2fb8c89516ac2723a581f69d6c18576046bed761bd6b305e5618e6ae130"
+dependencies = [
+ "arrayvec",
+ "bit-set",
+ "bitflags 2.13.2",
+ "cfg-if 1.0.5",
+ "cfg_aliases",
+ "codespan-reporting",
+ "half",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "libm",
+ "log",
+ "naga-types",
+ "num-traits",
+ "once_cell",
+ "rustc-hash 1.1.0",
+ "thiserror 2.0.21",
+ "unicode-ident",
+]
+
+[[package]]
+name = "naga-types"
+version = "30.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "590afbf58a6f4f62873cd5cff4468061844bafa1cdf399cc954537c22d768d49"
+dependencies = [
+ "hashbrown 0.17.1",
+ "indexmap",
+ "rustc-hash 1.1.0",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "nanorand"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a51313c5820b0b02bd422f4b44776fbf47961755c74ce64afc73bfad10226c3"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "nasm-rs"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "706bf8a5e8c8ddb99128c3291d31bd21f4bcde17f0f4c20ec678d85c74faa149"
+dependencies = [
+ "jobserver",
+ "log",
+]
+
+[[package]]
+name = "ndk"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+dependencies = [
+ "bitflags 2.13.2",
+ "jni-sys 0.3.1",
+ "log",
+ "ndk-sys",
+ "num_enum",
+ "raw-window-handle",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
+[[package]]
+name = "ndk-sys"
+version = "0.6.0+11769913"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
+dependencies = [
+ "jni-sys 0.3.1",
+]
+
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
+[[package]]
+name = "nokhwa"
+version = "0.10.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d63f10b450319a0ace7aa8e0e25477d1fdb345313a97e220e886175539a1dbb"
+dependencies = [
+ "flume",
+ "image",
+ "nokhwa-bindings-linux",
+ "nokhwa-bindings-macos",
+ "nokhwa-bindings-windows",
+ "nokhwa-core",
+ "parking_lot",
+ "paste",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "nokhwa-bindings-linux"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb67e22201a53322291740ca064b20eaaade7222ef0349f312d9b37b004e1984"
+dependencies = [
+ "libc",
+ "nokhwa-core",
+ "v4l",
+]
+
+[[package]]
+name = "nokhwa-bindings-macos"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f70d3908ea68324e44a6b3a0f885aa59e433fb1f6678839d09e0df7d226fb42d"
+dependencies = [
+ "block",
+ "cocoa-foundation",
+ "core-foundation 0.10.1",
+ "core-media-sys",
+ "core-video-sys",
+ "flume",
+ "nokhwa-core",
+ "objc",
+ "once_cell",
+]
+
+[[package]]
+name = "nokhwa-bindings-windows"
+version = "0.4.6"
+dependencies = [
+ "nokhwa-core",
+ "once_cell",
+ "windows",
+]
+
+[[package]]
+name = "nokhwa-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1cba20bebd3bd9ae22f9273ade5bbe49da3e047c8512b53fbaf8b4b9c80d496"
+dependencies = [
+ "bytes",
+ "image",
+ "mozjpeg",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "normpath"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b11ce00d2594068e8a27c9146fdc5cf9f3ac38eb42c7cd34d05fea618873ac9f"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ntapi"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "objc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
+dependencies = [
+ "malloc_buf",
+ "objc_exception",
+]
+
+[[package]]
+name = "objc-sys"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb91bdd390c7ce1a8607f35f3ca7151b65afc0ff5ff3b34fa350f7d7c7e4310"
+
+[[package]]
+name = "objc2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19d5490aaf8f1d7cf7688dfa9b0ce07900e168852c45cd2c03f534dfd27cfd0b"
+dependencies = [
+ "objc-sys",
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
+dependencies = [
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4e89ad9e3d7d297152b17d39ed92cd50ca8063a89a9fa569046d41568891eff"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "libc",
+ "objc2 0.5.3",
+ "objc2-core-data",
+ "objc2-core-image",
+ "objc2-foundation 0.2.2",
+ "objc2-quartz-core",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation 0.3.2",
+]
+
+[[package]]
+name = "objc2-cloud-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74dd3b56391c7a0596a295029734d3c1c5e7e510a4cb30245f8221ccea96b009"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-contacts"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5ff520e9c33812fd374d8deecef01d4a840e7b41862d849513de77e44aa4889"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-core-data"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "617fbf49e071c178c0b24c080767db52958f716d9eabdf0890523aeae54773ef"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.13.2",
+ "dispatch2",
+ "objc2 0.6.5",
+]
+
+[[package]]
+name = "objc2-core-graphics"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
+dependencies = [
+ "bitflags 2.13.2",
+ "dispatch2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-io-surface",
+]
+
+[[package]]
+name = "objc2-core-image"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55260963a527c99f1819c4f8e3b47fe04f9650694ef348ffd2227e8196d34c80"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-foundation 0.2.2",
+ "objc2-metal",
+]
+
+[[package]]
+name = "objc2-core-location"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "000cfee34e683244f284252ee206a27953279d370e309649dc3ee317b37e5781"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-contacts",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "objc2-foundation"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ee638a5da3799329310ad4cfa62fbf045d5f56e3ef5ba4149e7452dcf89d5a8"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "dispatch",
+ "libc",
+ "objc2 0.5.3",
+]
+
+[[package]]
+name = "objc2-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.6.2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
+dependencies = [
+ "libc",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-surface"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-link-presentation"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1a1ae721c5e35be65f01a03b6d2ac13a54cb4fa70d8a5da293d7b0020261398"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-app-kit 0.2.2",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-metal"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd0cba1276f6023976a406a14ffa85e1fdd19df6b0f737b063b95f6c8c7aadd6"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-quartz-core"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e42bee7bff906b14b167da2bac5efe6b6a07e6f7c0a21a7308d40c960242dc7a"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-foundation 0.2.2",
+ "objc2-metal",
+]
+
+[[package]]
+name = "objc2-symbols"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a684efe3dec1b305badae1a28f6555f6ddd3bb2c2267896782858d5a78404dc"
+dependencies = [
+ "objc2 0.5.3",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-ui-kit"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8bb46798b20cd6b91cbd113524c490f1686f4c4e8f49502431415f3512e2b6f"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-cloud-kit",
+ "objc2-core-data",
+ "objc2-core-image",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+ "objc2-link-presentation",
+ "objc2-quartz-core",
+ "objc2-symbols",
+ "objc2-uniform-type-identifiers",
+ "objc2-user-notifications",
+]
+
+[[package]]
+name = "objc2-ui-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+]
+
+[[package]]
+name = "objc2-uniform-type-identifiers"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44fa5f9748dbfe1ca6c0b79ad20725a11eca7c2218bceb4b005cb1be26273bfe"
+dependencies = [
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc2-user-notifications"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76cfcbf642358e8689af64cee815d139339f3ed8ad05103ed5eaf73db8d84cb3"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "objc2 0.5.3",
+ "objc2-core-location",
+ "objc2-foundation 0.2.2",
+]
+
+[[package]]
+name = "objc_exception"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad970fb455818ad6cba4c122ad012fae53ae8b4795f86378bce65e4f6bab2ca4"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "orbclient"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5df339f526ea9a60e371768d50efc2f2508c7203290731565d1f7a6f71d21747"
+dependencies = [
+ "libc",
+ "libredox",
+]
+
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if 1.0.5",
+ "libc",
+ "redox_syscall 0.5.18",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "peeking_take_while"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+
+[[package]]
+name = "peniko"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "839c8299360d2e998bdb106dc0a6cd71dcc5f4df51df1b620361bf50e283cca6"
+dependencies = [
+ "bytemuck",
+ "color",
+ "kurbo",
+ "linebender_resource_handle",
+ "smallvec",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "piper"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
+dependencies = [
+ "atomic-waker",
+ "fastrand",
+ "futures-io",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags 2.13.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide 0.8.9",
+]
+
+[[package]]
+name = "polling"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if 1.0.5",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix 1.1.5",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "polycool"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50596ddc09eb5ad5f75cacd40209568e66df71baf86e1499a0e99c4cff12a5a6"
+dependencies = [
+ "arrayvec",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "profiling"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
+
+[[package]]
+name = "pxfm"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d55d956fa96f5ec02be2e13af0e20391a5aa83d6a074e3ad368959d0fab299ea"
+
+[[package]]
+name = "quick-error"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+
+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "raw-window-handle"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
+
+[[package]]
+name = "read-fonts"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "046a7d674daf459825b32f5062056d6882db0d2f5a479fbd76ccfc870ac18709"
+dependencies = [
+ "bytemuck",
+ "font-types",
+ "once_cell",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "737970939a87c6fa31e7acad13307bccbb017a073b695b6089a2c484f929e20e"
+dependencies = [
+ "bitflags 2.13.2",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60dc65c0ff1a7ae1294b0c67b9f14baf70b644404010370171787bfac1038fc0"
+dependencies = [
+ "libredox",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "renderdoc-sys"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832"
+
+[[package]]
+name = "rgb"
+version = "0.8.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b34b781b31e5d73e9fbc8689c70551fd1ade9a19e3e28cfec8580a79290cc4"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if 1.0.5",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "ron"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81116b9531d61eabc41aeb228e4b6b2435bcca3233b98cf3b3077d4e6e9debb3"
+dependencies = [
+ "bitflags 2.13.2",
+ "once_cell",
+ "serde",
+ "serde_derive",
+ "typeid",
+ "unicode-ident",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.13.2",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags 2.13.2",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.12.1",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "self_cell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if 1.0.5",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if 1.0.5",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "siphasher"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"
+
+[[package]]
+name = "skrifa"
+version = "0.44.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819ab7d62b1d3e72d9d9dea5650bac30424f9111364bb94928dbf5ecad1baa68"
+dependencies = [
+ "bytemuck",
+ "read-fonts",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "slotmap"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "smithay-client-toolkit"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3457dea1f0eb631b4034d61d4d8c32074caa6cd1ab2d59f2327bd8461e2c0016"
+dependencies = [
+ "bitflags 2.13.2",
+ "calloop 0.13.0",
+ "calloop-wayland-source 0.3.0",
+ "cursor-icon",
+ "libc",
+ "log",
+ "memmap2",
+ "rustix 0.38.44",
+ "thiserror 1.0.69",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-csd-frame",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+ "wayland-scanner",
+ "xkeysym",
+]
+
+[[package]]
+name = "smithay-client-toolkit"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0512da38f5e2b31201a93524adb8d3136276fa4fe4aafab4e1f727a82b534cc0"
+dependencies = [
+ "bitflags 2.13.2",
+ "calloop 0.14.5",
+ "calloop-wayland-source 0.4.1",
+ "cursor-icon",
+ "libc",
+ "log",
+ "memmap2",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-csd-frame",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-experimental",
+ "wayland-protocols-misc",
+ "wayland-protocols-wlr",
+ "wayland-scanner",
+ "xkeysym",
+]
+
+[[package]]
+name = "smithay-clipboard"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71704c03f739f7745053bde45fa203a46c58d25bc5c4efba1d9a60e9dba81226"
+dependencies = [
+ "libc",
+ "smithay-client-toolkit 0.20.0",
+ "wayland-backend",
+]
+
+[[package]]
+name = "smol_str"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01016da373cd8f7ef12624f796309f5c31ba8d646dd08856c02cd741d823c622"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "sysinfo"
+version = "0.39.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2071df9448915b71c4fe6d25deaf1c22f12bd234f01540b77312bb8e41361e6"
+dependencies = [
+ "libc",
+ "memchr",
+ "ntapi",
+ "objc2-core-foundation",
+ "objc2-io-kit",
+ "windows",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.3.4",
+ "once_cell",
+ "rustix 1.1.5",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+dependencies = [
+ "thiserror-impl 2.0.21",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "tiff"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63feaf3343d35b6ca4d50483f94843803b0f51634937cc2ec519fc32232bc52"
+dependencies = [
+ "fax",
+ "flate2",
+ "half",
+ "quick-error",
+ "weezl",
+ "zune-jpeg",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.53.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
+dependencies = [
+ "pin-project-lite",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.17+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "type-map"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb30dbbd9036155e74adad6812e9898d03ec374946234fbcebd5dfc7b9187b90"
+dependencies = [
+ "rustc-hash 2.1.3",
+]
+
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "uds_windows"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
+dependencies = [
+ "memoffset",
+ "tempfile",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "unicode-general-category"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc"
+dependencies = [
+ "base64",
+ "cookie_store",
+ "flate2",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cc1186384beb7dd8eedea376413fd654937285ea6c9cfbb928dc3043ea4b606"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "rand",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "v4l"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8fbfea44a46799d62c55323f3c55d06df722fbe577851d848d328a1041c3403"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+ "v4l2-sys-mit",
+]
+
+[[package]]
+name = "v4l2-sys-mit"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6779878362b9bacadc7893eac76abe69612e8837ef746573c4a5239daf11990b"
+dependencies = [
+ "bindgen",
+]
+
+[[package]]
+name = "vello_common"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
+dependencies = [
+ "bytemuck",
+ "fearless_simd",
+ "guillotiere",
+ "log",
+ "peniko",
+ "smallvec",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "vello_cpu"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac7349e1f55f6b801c7c277958df4ea53e7f20f21e8014910ad888b2ecda93ea"
+dependencies = [
+ "bytemuck",
+ "glifo",
+ "hashbrown 0.17.1",
+ "vello_common",
+]
+
+[[package]]
+name = "velopack"
+version = "1.2.161"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4295172ffaad78f9adbab35f7ffefa97e4ceefee9d2c38bda37fdce4d6c66e5a"
+dependencies = [
+ "anyhow",
+ "bitflags 2.13.2",
+ "derivative",
+ "glob",
+ "lazy_static",
+ "libc",
+ "log",
+ "normpath",
+ "rand",
+ "regex",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha1",
+ "sha2",
+ "thiserror 2.0.21",
+ "ureq",
+ "url",
+ "uuid",
+ "wait-timeout",
+ "waitpid-any",
+ "windows",
+ "xml",
+ "zip",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wait-timeout"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "waitpid-any"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18aa3ce681e189f125c4c1e1388c03285e2fd434ef52c7203084012ac29c5e4a"
+dependencies = [
+ "rustix 1.1.5",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+dependencies = [
+ "cfg-if 1.0.5",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
+dependencies = [
+ "js-sys",
+ "tokio",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wayland-backend"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38a91b4eaddff87b1cd1074985e3713da4af2c49742d1b356b2c01670a67a078"
+dependencies = [
+ "cc",
+ "downcast-rs",
+ "rustix 1.1.5",
+ "scoped-tls",
+ "smallvec",
+ "wayland-sys",
+]
+
+[[package]]
+name = "wayland-client"
+version = "0.31.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c36a0f861ad76d0901f2800b46321410d9f73f2ea88aac0650d86c32688073"
+dependencies = [
+ "bitflags 2.13.2",
+ "rustix 1.1.5",
+ "wayland-backend",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-csd-frame"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e"
+dependencies = [
+ "bitflags 2.13.2",
+ "cursor-icon",
+ "wayland-backend",
+]
+
+[[package]]
+name = "wayland-cursor"
+version = "0.31.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a52d18780be9b1314328a3de5f930b73d2200112e3849ca6cb11822793fb34d"
+dependencies = [
+ "rustix 1.1.5",
+ "wayland-client",
+ "xcursor",
+]
+
+[[package]]
+name = "wayland-protocols"
+version = "0.32.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d0c813de3daa2ed6520af85a3bd49b0e722a3078506899aa9686fea58dc4b6"
+dependencies = [
+ "bitflags 2.13.2",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-experimental"
+version = "20250721.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40a1f863128dcaaec790d7b4b396cc9b9a7a079e878e18c47e6c2d2c5a8dcbb1"
+dependencies = [
+ "bitflags 2.13.2",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-misc"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9567599ef23e09b8dad6e429e5738d4509dfc46b3b21f32841a304d16b29c8"
+dependencies = [
+ "bitflags 2.13.2",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-plasma"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b6d8cf1eb2c1c31ed1f5643c88a6e53538129d4af80030c8cabd1f9fa884d91"
+dependencies = [
+ "bitflags 2.13.2",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-wlr"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb04e52f7836d7c7976c78ca0250d61e33873c34156a2a1fc9474828ec268234"
+dependencies = [
+ "bitflags 2.13.2",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-scanner"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
+dependencies = [
+ "proc-macro2",
+ "quick-xml",
+ "quote",
+]
+
+[[package]]
+name = "wayland-sys"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8eab23fefc9e41f8e841df4a9c707e8a8c4ed26e944ef69297184de2785e3be"
+dependencies = [
+ "dlib",
+ "log",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "weezl"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
+
+[[package]]
+name = "wgpu"
+version = "30.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527ccdf43dd5b2e8676eed9984ce00e2bbb0a1b85b70c1969dcb6cd2eb55ab9e"
+dependencies = [
+ "arrayvec",
+ "bitflags 2.13.2",
+ "bytemuck",
+ "cfg-if 1.0.5",
+ "cfg_aliases",
+ "document-features",
+ "hashbrown 0.17.1",
+ "js-sys",
+ "log",
+ "portable-atomic",
+ "profiling",
+ "raw-window-handle",
+ "smallvec",
+ "static_assertions",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "wgpu-core",
+ "wgpu-hal",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-core"
+version = "30.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c018fce9b6270aa203c2fdd56f3cce996713534bd757e4ea58c8560b121f14"
+dependencies = [
+ "arrayvec",
+ "bit-set",
+ "bit-vec",
+ "bitflags 2.13.2",
+ "bytemuck",
+ "cfg_aliases",
+ "document-features",
+ "hashbrown 0.17.1",
+ "indexmap",
+ "log",
+ "naga",
+ "naga-types",
+ "once_cell",
+ "parking_lot",
+ "portable-atomic",
+ "profiling",
+ "raw-window-handle",
+ "rustc-hash 1.1.0",
+ "smallvec",
+ "thiserror 2.0.21",
+ "wgpu-core-deps-windows-linux-android",
+ "wgpu-hal",
+ "wgpu-naga-bridge",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-core-deps-windows-linux-android"
+version = "30.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7586165fd5f6d881cb9ce4bb71f40d6caab2c0f1837e3fc1d9788a197fb6004f"
+dependencies = [
+ "wgpu-hal",
+]
+
+[[package]]
+name = "wgpu-hal"
+version = "30.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6b7fb58561a792bc237628ba0792e332de418fefe145f13b5ed8201e6d52f58"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if 1.0.5",
+ "cfg_aliases",
+ "hashbrown 0.17.1",
+ "libloading",
+ "log",
+ "naga",
+ "naga-types",
+ "portable-atomic",
+ "portable-atomic-util",
+ "raw-window-handle",
+ "renderdoc-sys",
+ "static_assertions",
+ "thiserror 2.0.21",
+ "wgpu-naga-bridge",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-naga-bridge"
+version = "30.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f62e73117bb7a62bfd9c5a5841438a823f6566c6442a808ee269d2d055c081"
+dependencies = [
+ "naga",
+ "wgpu-types",
+]
+
+[[package]]
+name = "wgpu-types"
+version = "30.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99dad6f1fbdbbdb4c278a6508b059d44688f5cebddf78d005a46a31340269286"
+dependencies = [
+ "bitflags 2.13.2",
+ "bytemuck",
+ "js-sys",
+ "log",
+ "naga-types",
+ "raw-window-handle",
+ "static_assertions",
+ "web-sys",
+]
+
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix 0.38.44",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "winit"
+version = "0.30.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
+dependencies = [
+ "ahash",
+ "android-activity",
+ "atomic-waker",
+ "bitflags 2.13.2",
+ "block2 0.5.1",
+ "bytemuck",
+ "calloop 0.13.0",
+ "cfg_aliases",
+ "concurrent-queue",
+ "core-foundation 0.9.4",
+ "core-graphics 0.23.2",
+ "cursor-icon",
+ "dpi",
+ "js-sys",
+ "libc",
+ "memmap2",
+ "ndk",
+ "objc2 0.5.3",
+ "objc2-app-kit 0.2.2",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit 0.2.2",
+ "orbclient",
+ "percent-encoding",
+ "pin-project",
+ "raw-window-handle",
+ "redox_syscall 0.4.1",
+ "rustix 0.38.44",
+ "smithay-client-toolkit 0.19.2",
+ "smol_str",
+ "tracing",
+ "unicode-segmentation",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-plasma",
+ "web-sys",
+ "web-time",
+ "windows-sys 0.52.0",
+ "x11-dl",
+ "x11rb",
+ "xkbcommon-dl",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "x11-dl"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+dependencies = [
+ "libc",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "x11rb"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9993aa5be5a26815fe2c3eacfc1fde061fc1a1f094bf1ad2a18bf9c495dd7414"
+dependencies = [
+ "as-raw-xcb-connection",
+ "gethostname",
+ "libc",
+ "libloading",
+ "once_cell",
+ "rustix 1.1.5",
+ "x11rb-protocol",
+]
+
+[[package]]
+name = "x11rb-protocol"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
+
+[[package]]
+name = "xcursor"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "163b33ed8786455e2fa5d72f554057ce3f3182425434f756cd39c99839d88e23"
+
+[[package]]
+name = "xkbcommon-dl"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d039de8032a9a8856a6be89cea3e5d12fdd82306ab7c94d74e6deab2460651c5"
+dependencies = [
+ "bitflags 2.13.2",
+ "dlib",
+ "log",
+ "once_cell",
+ "xkeysym",
+]
+
+[[package]]
+name = "xkeysym"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
+
+[[package]]
+name = "xml"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f45bb2c13fec6a6cb4c0f76a7e94839e110a14ec803ec2940777a94c347bc52"
+
+[[package]]
+name = "xml-rs"
+version = "0.8.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+ "synstructure",
+]
+
+[[package]]
+name = "zbus"
+version = "5.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5db4be7c075cb421e4b7ee645541604239bd243ba7c357511f4ff3a74b555907"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-io",
+ "async-lock",
+ "async-process",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "blocking",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-lite",
+ "hex",
+ "libc",
+ "ordered-stream",
+ "rustix 1.1.5",
+ "serde",
+ "serde_repr",
+ "tracing",
+ "uds_windows",
+ "uuid",
+ "windows-sys 0.61.2",
+ "winnow",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus-lockstep"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6998de05217a084b7578728a9443d04ea4cd80f2a0839b8d78770b76ccd45863"
+dependencies = [
+ "zbus_xml",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus-lockstep-macros"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10da05367f3a7b7553c8cdf8fa91aee6b64afebe32b51c95177957efc47ca3a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "zbus-lockstep",
+ "zbus_xml",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "5.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2990635d09ade6df1868f72f8cac69a876a90981e8bd3c40b1be413f8dc88f40"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+ "zbus_names",
+ "zvariant",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "4.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8bf88b4a3ff53e883001e0e0115b297a9d53c31b9c1edd2bfdd853e3428624e"
+dependencies = [
+ "serde",
+ "winnow",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_xml"
+version = "5.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1586c021a01ca0a9216dcd874e546382e156a5cbab5fab6cb5f10087e22682a"
+dependencies = [
+ "serde",
+ "winnow",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zcheapstr"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1afec51604565183aeb5c54c20aeab286120d4e4460f7f76e3e8bb8c0d99473"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86502bf56ac7c77571a32e2647bb2a15894565e981fb2a48d7bde2d91c965a9d"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5457206954b06561e2608c7e19cf58b1926586d999c246eebe4502f7e2039d1a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+]
+
+[[package]]
+name = "zip"
+version = "8.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "typed-path",
+ "zopfli",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
+[[package]]
+name = "zune-core"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56377fd46368984a170bc5aac5567e52ca5da874caa60bea39fcbca78fb658b"
+
+[[package]]
+name = "zune-jpeg"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
+dependencies = [
+ "zune-core",
+]
+
+[[package]]
+name = "zvariant"
+version = "5.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1d34c27cc6cdd1f458427519dd6b8612f7b7e3f7b9a0b2355d041dda9869147"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "winnow",
+ "zcheapstr",
+ "zvariant_derive",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "5.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "864155e69b4352db0c7f374917bf45d1e0c8d17659c8b3dbf9795f3673f8c497"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.8",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad0294361a320b694a328460dc73add56c306150f5cb6bfafc44446120008a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn 3.0.8",
+ "winnow",
+]
diff --git a/input_viewer_egui/Cargo.toml b/input_viewer_egui/Cargo.toml
new file mode 100644
index 0000000..cc53017
--- /dev/null
+++ b/input_viewer_egui/Cargo.toml
@@ -0,0 +1,47 @@
+[package]
+name = "input_viewer_egui"
+# Set from the egui-v* tag by .github/workflows/release-egui.yml at build
+# time; the tag, not this line, is the source of truth for releases.
+version = "0.0.0"
+edition = "2024"
+license = "Apache-2.0"
+description = "Prototype of Input Viewer on egui/eframe"
+publish = false
+
+[[bin]]
+name = "input-viewer"
+path = "src/main.rs"
+
+[dependencies]
+bytemuck = { version = "1", features = ["extern_crate_alloc"] }
+bytes = "1"
+chrono = { version = "0.4.45", default-features = false, features = ["clock"] }
+dirs = "7"
+# glow rather than the default wgpu: the screensavers are the Electron app's
+# GLSL, and glow runs it unchanged apart from the #version line.
+eframe = { version = "0.36", default-features = false, features = ["accesskit", "default_fonts", "glow", "persistence", "wayland", "x11"] }
+image = { version = "0.25", default-features = false, features = ["png"] }
+nokhwa = { version = "0.10", features = ["input-native", "output-threaded"], optional = true }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sysinfo = { version = "0.39", default-features = false, features = ["system"] }
+ureq = { version = "3", default-features = false, features = ["rustls", "json"] }
+velopack = { version = "1", features = ["public-utils"] }
+
+[features]
+default = ["camera"]
+# Real capture devices through nokhwa (AVFoundation / Media Foundation / V4L2).
+# Build with --no-default-features for a mock-only binary.
+camera = ["dep:nokhwa"]
+
+[profile.dev]
+# Frame conversion and detection loop over every pixel; unoptimised they are
+# slow enough to drop frames on a 4K capture card.
+opt-level = 2
+
+# nokhwa's Media Foundation bindings, patched: they threw away fractional
+# frame rates (59.94 = 60000/1001) and could set a format at a low step of the
+# driver's frame-rate ladder, so the wall's Elgato cards delivered ~13 fps
+# where Chromium gets 59.94. See vendor/nokhwa-bindings-windows/PATCHED.md.
+[patch.crates-io]
+nokhwa-bindings-windows = { path = "vendor/nokhwa-bindings-windows" }
diff --git a/input_viewer_egui/README.md b/input_viewer_egui/README.md
new file mode 100644
index 0000000..428a86e
--- /dev/null
+++ b/input_viewer_egui/README.md
@@ -0,0 +1,159 @@
+# Input Viewer — egui prototype
+
+A Rust/[egui](https://github.com/emilk/egui) prototype of Input Viewer, next to
+the Electron app in `../input_viewer_electron`. One native binary (~16 MB release on macOS), no
+Chromium.
+
+```sh
+cargo run --release -- --mock                 # 4 synthetic inputs, no hardware
+cargo run --release -- --mock=2 --no-signal   # split-flap board
+cargo run --release -- --no-signal --screensaver-delay=0
+cargo run --release -- --mock=1 --no-signal --screensaver-delay=0 --screensaver=plasma
+cargo run --release                           # real capture devices (nokhwa)
+cargo run --release -- --test-pattern --hud    # two 4K60 inputs, frame-rate overlay
+cargo run --release -- --mock-fault=stall      # input 2 stalls; watch [health] reopen it (also dark, fail)
+cargo test
+cargo run --release --example camera_probe   # can each camera deliver a frame?
+```
+
+The test-mode flags behave as in the Electron app (#248), and `--mock` never
+writes settings.
+
+## What is ported
+
+| Feature | Electron source | Here |
+|---|---|---|
+| Dual / single view, Multi-view, per-half pickers (`pickerPlan`) | `renderer.js` | `app.rs` |
+| Pickers over the top edge, closes 48px below or after 30s idle | dropdown 2b | `app.rs` |
+| Shortcut table as single source, legend on the bottom edge | `shortcuts.js` | `shortcuts.rs` |
+| Mock inputs as real frames through the capture path | `mock-capture.js` | `capture.rs` |
+| Capture health and reopen backoff, ported with its tests | `stream-health.js` | `health.rs` |
+| Daily log file, same bounds and `[Health]` line format, ported with its tests | `file-log.js` | `filelog.rs` |
+| Split-flap board, screensaver after delay, 10-min rotation, seeded + logged | `split-flap.js`, `registry.js` | `screensaver.rs` |
+| Plasma saver + bloom / ACES / dither chain, same GLSL | `plasma.js`, `post-fx.js` | `plasma.rs`, `shaders/` |
+| Freeze, fullscreen, Esc does one thing per press | `renderer.js` | `app.rs` |
+| Settings dialog: Inputs and Layout panes | `index.html`, `settings-status.js` | `app/settings_ui.rs`, `settings_status.rs` |
+| `settings.json`, same keys, Electron's imported once | `settings.json` | `settings.rs` |
+| Logo column between the halves, side borders | `#center-divider`, `.edge-border` | `app.rs` |
+
+## Not ported
+
+Reference-screenshot no-signal detection, black-bar cropping, audio/volume,
+the remote keyboard and Art-Net (features and their Settings panes), weather,
+WebGPU compositing — and Plasma plus 3 painter-drawn screensavers instead
+of ~30 WebGL ones. Picker tiles show the last frame seen on screen, not a fresh
+snapshot sweep (#242).
+
+## Headless screenshots
+
+`screencapture` needs Screen Recording permission; this reads egui's own
+framebuffer instead:
+
+```sh
+INPUT_VIEWER_SCREENSHOT=out.png INPUT_VIEWER_OPEN=dropdown cargo run -- --mock
+```
+
+## Screensavers on the GPU
+
+eframe runs on its **glow** (OpenGL) backend rather than the default wgpu, so
+the Electron savers' GLSL runs unchanged apart from the `#version` line. The
+shaders in `shaders/` are generated, not hand-copied:
+
+```sh
+node input_viewer_egui/shaders/extract.mjs
+```
+
+Porting another shader saver means adding it to `extract.mjs` and a variant in
+`screensaver.rs`. The post-FX chain in `plasma.rs` is already generic.
+
+## Cameras on macOS
+
+Camera permission belongs to the app that launched the process. Run from
+Terminal or iTerm to get the prompt; launched from another app that cannot
+show one, access is silently denied. **OBS Virtual Camera does not work**:
+it only offers BGRA, which nokhwa's AVFoundation backend rejects.
+
+## Releases and auto-update
+
+Built and published by [`release-egui.yml`](../.github/workflows/release-egui.yml)
+with [Velopack](https://velopack.io), the counterpart of electron-builder +
+electron-updater:
+
+| | Electron | egui |
+|---|---|---|
+| Windows installer | NSIS `Setup.exe`, per user | Velopack `Setup.exe`, per user, no admin |
+| macOS | universal DMG | universal `.pkg` (unsigned, ad-hoc signed binary) |
+| Updates | full download | delta packages against the previous release |
+| Update UX | check 3s after start, Download / Later, Restart now / Later, install on quit | same, as an egui dialog |
+| Tags | `v*`, marked latest | `egui-v*`, **never** marked latest |
+
+```sh
+gh workflow run release-egui.yml                 # dry run: installers as artifacts
+gh workflow run release-egui.yml -f publish=true # tag + GitHub release (main only)
+```
+
+Versions come from Conventional Commits touching `input_viewer_egui/` since
+the last `egui-v*` tag (or pick `-f bump=minor`). There is no bump commit:
+the tag is the source of truth, and `Cargo.toml` stays at `0.0.0` in git.
+
+Sharing the repo with the Electron app is the delicate part:
+
+- **Never "latest".** electron-updater resolves `/releases/latest`; an egui
+  release there would leave every Electron install unable to find its
+  `latest.yml`. The workflow publishes with `make_latest: false`.
+- **Not Velopack's `GithubSource`.** It looks at only the ten most recent
+  releases, which a burst of Electron releases would push the egui ones out of.
+  `update.rs` finds the newest `egui-v*` release itself and reads its feed.
+- **`release.yml` ignores `egui-v*` tags** (`git describe --match 'v[0-9]*'`),
+  otherwise an egui release would reset the Electron commit analysis.
+
+Updates only run in an installed copy; `cargo run` logs
+`[updater] disabled` and carries on, like Electron's `isDev`.
+
+## Settings
+
+`<config>/Input Viewer (egui)/settings.json`, next to the Electron app's
+`<config>/Input Viewer/settings.json` and in the same format. On first launch
+the Electron file is imported once:
+
+- **Carries over:** `centerGap`, `borderWidth`, `layoutMode`, `multiView`, and
+  every key this app does not use yet (Art-Net, remote keyboard, volumes),
+  written back unchanged.
+- **Does not:** input names, enabled flags and the default input. Electron
+  keys `inputs` by Chromium's `deviceId`, a salted hash nothing outside
+  Chromium can reproduce, and stores no label to match on.
+
+Inputs here are keyed by AVFoundation's `uniqueID` (macOS) or the device path
+(Windows), so a name stays with its card across restarts and replugging.
+
+Every change is caught in one place, by comparing settings at the end of each
+frame, and written 300ms after it settles, atomically. `--mock` and review runs
+neither read nor write the file. A file that does not parse is moved aside to
+`settings.json.corrupt-<time>` rather than overwritten.
+
+## Render test: `--test-pattern --hud`
+
+`--test-pattern[=WxH@FPS]` (default `3840x2160@60`, also `4k30`, `1080p60`)
+gives the mock inputs a motion test pattern, and implies two of them: the
+wall's two 4K60 cards. `--hud` overlays, per half, the source and shown frame
+rates, frames skipped, and the delay from capture to upload, and logs a
+`[render]` line every 5s.
+
+What each part of the pattern shows is listed in `src/testpattern.rs`: lamp
+row and frame-number strip for drops, a red/cyan sweep for tearing and
+blending, corner marks for cropping, 1px line pairs for scaling, ramps for
+banding.
+
+Measured on an M3 Pro, two 3840x2160@60 inputs, window at ~2.2x downscale:
+
+| | shown | skipped/s | capture→upload | UI |
+|---|---|---|---|---|
+| bilinear | 60.0 fps | 0 | ~7 ms | ~103 fps |
+| trilinear mipmaps (shipped) | 60.0 fps | 0 | ~7 ms | ~95 fps |
+
+Bilinear turned the 1px line pairs into moiré; mipmaps render them as the
+flat grey they should be. 14-17 frames are skipped in the first second while
+textures are first allocated; none after.
+
+Frames reach egui already converted, on the capture thread, as a shared
+`Arc<ColorImage>` -- no per-pixel pass on the UI thread.
diff --git a/input_viewer_egui/assets/logo.png b/input_viewer_egui/assets/logo.png
new file mode 100755
index 0000000..3a61cef
Binary files /dev/null and b/input_viewer_egui/assets/logo.png differ
diff --git a/input_viewer_egui/examples/camera_probe.rs b/input_viewer_egui/examples/camera_probe.rs
new file mode 100644
index 0000000..937cb18
--- /dev/null
+++ b/input_viewer_egui/examples/camera_probe.rs
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! List capture devices and try to pull one frame from each.
+//!
+//! `cargo run --example camera_probe`
+//!
+//! Run it from your own terminal: macOS attributes camera permission to the
+//! app that launched the process, and only a terminal app can show the prompt.
+
+use std::sync::mpsc;
+use std::time::Duration;
+
+use nokhwa::pixel_format::RgbAFormat;
+use nokhwa::utils::{ApiBackend, RequestedFormat, RequestedFormatType};
+
+fn main() {
+    let (tx, rx) = mpsc::channel();
+    nokhwa::nokhwa_initialize(move |granted| {
+        let _ = tx.send(granted);
+    });
+    let granted = rx.recv_timeout(Duration::from_secs(60)).unwrap_or(false);
+    println!("camera access granted: {granted}");
+
+    for info in nokhwa::query(ApiBackend::Auto).unwrap_or_default() {
+        print!("{} [{}]: ", info.human_name(), info.index());
+        let fmt = RequestedFormat::new::<RgbAFormat>(RequestedFormatType::AbsoluteHighestResolution);
+        let result = nokhwa::Camera::new(info.index().clone(), fmt).and_then(|mut cam| {
+            cam.open_stream()?;
+            let frame = cam.frame()?;
+            let img = frame.decode_image::<RgbAFormat>()?;
+            let _ = cam.stop_stream();
+            Ok((cam.camera_format(), img.width(), img.height()))
+        });
+        match result {
+            Ok((f, w, h)) => println!("OK {f} -> {w}x{h}"),
+            Err(e) => println!("FAILED {e}"),
+        }
+    }
+}
diff --git a/input_viewer_egui/packaging/macos/Info.plist b/input_viewer_egui/packaging/macos/Info.plist
new file mode 100644
index 0000000..7780f91
--- /dev/null
+++ b/input_viewer_egui/packaging/macos/Info.plist
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Filled in by .github/workflows/release-egui.yml: @VERSION@ is the release version. -->
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key>
+  <string>Input Viewer (egui)</string>
+  <key>CFBundleDisplayName</key>
+  <string>Input Viewer (egui)</string>
+  <!-- Distinct from the Electron app's com.lab271.input-viewer, so the two can
+       be installed side by side and keep separate camera permissions. -->
+  <key>CFBundleIdentifier</key>
+  <string>com.lab271.input-viewer-egui</string>
+  <key>CFBundleExecutable</key>
+  <string>input-viewer</string>
+  <key>CFBundleIconFile</key>
+  <string>icon</string>
+  <key>CFBundlePackageType</key>
+  <string>APPL</string>
+  <key>CFBundleShortVersionString</key>
+  <string>@VERSION@</string>
+  <key>CFBundleVersion</key>
+  <string>@VERSION@</string>
+  <key>LSMinimumSystemVersion</key>
+  <string>11.0</string>
+  <key>NSHighResolutionCapable</key>
+  <true/>
+  <!-- Without this the process is killed on first camera access in a bundle. -->
+  <key>NSCameraUsageDescription</key>
+  <string>Input Viewer shows your video capture devices.</string>
+</dict>
+</plist>
diff --git a/input_viewer_egui/packaging/set-version.sh b/input_viewer_egui/packaging/set-version.sh
new file mode 100755
index 0000000..2891980
--- /dev/null
+++ b/input_viewer_egui/packaging/set-version.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+#
+# Write a release version into Cargo.toml and Cargo.lock, for the release
+# workflow. Run from input_viewer_egui/.
+#
+#   packaging/set-version.sh 0.2.0
+#
+# Both files, because Cargo.lock records the crate's own version too and
+# `--locked` refuses to build when they disagree.
+#
+# Line endings: on Windows runners the checkout is CRLF, and a pattern
+# anchored on a bare \n silently matches nothing. Every pattern here allows
+# an optional \r, and the result is checked rather than assumed.
+set -euo pipefail
+
+v="${1:?usage: set-version.sh VERSION}"
+export V="$v"
+
+# Only the first line-leading `version =` is the package's own: dependency
+# versions are inline tables, never at the start of a line.
+perl -pi -e 'if (!$done && s/^version = "[^"]*"(\r?)$/version = "$ENV{V}"$1/) { $done = 1 }' Cargo.toml
+perl -0pi -e 's/(name = "input_viewer_egui"\r?\nversion = )"[^"]*"/$1"$ENV{V}"/' Cargo.lock
+
+# Check the crate's own entries, not any matching line: some dependency is
+# bound to be at 1.0.0.
+fail() {
+  echo "::error::set-version.sh: $1 does not carry version $v after rewriting" >&2
+  exit 1
+}
+perl -ne '$found //= $1 if /^version = "(.*)"\r?$/; END { exit(!(defined $found && $found eq $ENV{V})) }' Cargo.toml || fail Cargo.toml
+perl -0ne 'exit(!/name = "input_viewer_egui"\r?\nversion = "\Q$ENV{V}\E"/)' Cargo.lock || fail Cargo.lock
+echo "version set to $v in Cargo.toml and Cargo.lock"
diff --git a/input_viewer_egui/shaders/extract.mjs b/input_viewer_egui/shaders/extract.mjs
new file mode 100644
index 0000000..a275b7b
--- /dev/null
+++ b/input_viewer_egui/shaders/extract.mjs
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+// Regenerates plasma.frag and the post-FX passes from the Electron app's sources, so the two cannot
+// drift by hand-copying:  node input_viewer_egui/shaders/extract.mjs
+import { readFileSync, writeFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const savers = join(here, '../../input_viewer_electron/src/renderer/screensavers')
+const { GLSL } = await import(join(savers, 'glsl-lib.js'))
+
+const src = readFileSync(join(savers, 'plasma.js'), 'utf8')
+const body = src.match(/const SHADER = \/\* glsl \*\/ `([\s\S]*?)`\n/)[1]
+const glsl = body.replace(/\$\{GLSL\.(\w+)\}/g, (_, k) => {
+  if (!(k in GLSL)) throw new Error(`GLSL.${k} not found`)
+  return GLSL[k]
+})
+writeFileSync(join(here, 'plasma.frag'),
+  '// GENERATED from input_viewer_electron/.../plasma.js by extract.mjs -- do not edit.\n' + glsl)
+console.log(`plasma.frag: ${glsl.split('\n').length} lines`)
+
+// The post-FX passes are module-private constants, so they are pulled out of
+// the source text rather than imported.
+const post = readFileSync(join(savers, 'post-fx.js'), 'utf8')
+for (const name of ['BRIGHT_PASS', 'DOWNSAMPLE', 'UPSAMPLE', 'COMPOSITE']) {
+  const m = post.match(new RegExp(`const ${name} = \`([\\s\\S]*?)\``))
+  if (!m) throw new Error(`${name} not found in post-fx.js`)
+  // GLSL ES 3.00 -> desktop GLSL 3.30, which is what egui's glow backend gets.
+  const glsl = m[1].replace('#version 300 es\nprecision highp float;', '#version 330 core')
+  const file = `post-${name.toLowerCase().replace('_pass', '')}.frag`
+  writeFileSync(join(here, file),
+    `// GENERATED from post-fx.js ${name} by extract.mjs -- do not edit.\n` + glsl + '\n')
+  console.log(file)
+}
diff --git a/input_viewer_egui/shaders/plasma.frag b/input_viewer_egui/shaders/plasma.frag
new file mode 100644
index 0000000..48c76ae
--- /dev/null
+++ b/input_viewer_egui/shaders/plasma.frag
@@ -0,0 +1,398 @@
+// GENERATED from input_viewer_electron/.../plasma.js by extract.mjs -- do not edit.
+
+// Fragment shaders: pixel coordinate -> world space. Needs iResolution.
+vec2 worldFromFrag(vec2 fragCoord, vec2 resolution) {
+  return (fragCoord - 0.5 * resolution) / resolution.y;
+}
+
+// Vertex shaders: world space -> clip space. Needs the aspect ratio (w/h).
+// Dividing x by aspect is what undoes the viewport stretch.
+vec4 clipFromWorld(vec2 world, float aspect) {
+  return vec4(world.x * 2.0 / aspect, world.y * 2.0, 0.0, 1.0);
+}
+
+// Half-extent of the visible world region, for placing and wrapping things.
+// y is always 0.5; x grows with the aspect ratio.
+vec2 worldExtent(float aspect) {
+  return vec2(0.5 * aspect, 0.5);
+}
+
+// Shortest separation between two points on a torus of the given half-extent.
+//
+// A plain (b - a) is wrong once a simulation wraps: two points either side of
+// the seam are physically adjacent but numerically maximally distant. In boids
+// that made neighbours across the edge read as far away, so the flock visibly
+// tore at screen edges rather than flowing through them.
+vec2 torusDelta(vec2 a, vec2 b, vec2 halfExtent) {
+  vec2 d = b - a;
+  vec2 span = 2.0 * halfExtent;
+  return d - span * floor(d / span + 0.5);
+}
+
+// Wrap a position back into [-halfExtent, halfExtent] on both axes.
+vec2 torusWrap(vec2 p, vec2 halfExtent) {
+  vec2 span = 2.0 * halfExtent;
+  return p - span * floor((p + halfExtent) / span);
+}
+
+
+vec3 cosinePalette(float t, vec3 phase) {
+  return 0.5 + 0.5 * cos(6.28318530718 * (t + phase));
+}
+
+vec3 oklabToLinear(vec3 lab) {
+  float l_ = lab.x + 0.3963377774 * lab.y + 0.2158037573 * lab.z;
+  float m_ = lab.x - 0.1055613458 * lab.y - 0.0638541728 * lab.z;
+  float s_ = lab.x - 0.0894841775 * lab.y - 1.2914855480 * lab.z;
+  vec3 lms = vec3(l_ * l_ * l_, m_ * m_ * m_, s_ * s_ * s_);
+  return vec3(
+    +4.0767416621 * lms.x - 3.3077115913 * lms.y + 0.2309699292 * lms.z,
+    -1.2684380046 * lms.x + 2.6097574011 * lms.y - 0.3413193965 * lms.z,
+    -0.0041960863 * lms.x - 0.7034186147 * lms.y + 1.7076147010 * lms.z);
+}
+
+// Perceptually even ramp: L in [0,1], hue in turns, chroma ~[0,0.4].
+vec3 oklabRamp(float t, float lightness, float chroma, float hueTurns) {
+  float h = 6.28318530718 * (hueTurns + t);
+  return max(oklabToLinear(vec3(lightness, chroma * cos(h), chroma * sin(h))), 0.0);
+}
+
+// Drop-in replacement for the cosine palette, in OKLab.
+//
+// Constant lightness and chroma, hue sweeping -- the textbook perceptually
+// uniform ramp. Holding both fixed is the whole point: varying them is what
+// gives the cosine palette its muddy troughs and blown highlights.
+//
+// L=0.75, C=0.12 were chosen by measurement, not taste. Sampling 24 hues and
+// converting back to OKLab:
+//
+//   cosine palette      chroma varies 2.3x across the ramp
+//   L=0.70 C=0.13       1.08x, but 3/24 hues fall outside sRGB
+//   L=0.72 C=0.15       1.20x, 7/24 out of gamut
+//   L=0.75 C=0.12       1.00x, 0/24 out of gamut   <- this one
+//
+// Out-of-gamut hues clip, which reintroduces exactly the flat patches the
+// change is meant to remove, so staying inside sRGB matters more than squeezing
+// out extra saturation.
+//
+// The phase vector keeps the cosine version's meaning: .x rotates the hue
+// wheel, and the spread between components nudges chroma, so per-activation
+// palette variation still varies the palette.
+vec3 palettePerceptual(float t, vec3 phase) {
+  float chroma = 0.12 * (0.85 + 0.3 * fract(phase.y - phase.z));
+  return oklabRamp(phase.x + t, 0.75, chroma, 0.0);
+}
+
+
+vec3 mod289(vec3 x) { return x - floor(x * (1.0 / 289.0)) * 289.0; }
+vec2 mod289(vec2 x) { return x - floor(x * (1.0 / 289.0)) * 289.0; }
+vec3 permute289(vec3 x) { return mod289(((x * 34.0) + 1.0) * x); }
+
+float snoise(vec2 v) {
+  const vec4 C = vec4(0.211324865405187, 0.366025403784439,
+                     -0.577350269189626, 0.024390243902439);
+  vec2 i  = floor(v + dot(v, C.yy));
+  vec2 x0 = v - i + dot(i, C.xx);
+  vec2 i1 = (x0.x > x0.y) ? vec2(1.0, 0.0) : vec2(0.0, 1.0);
+  vec4 x12 = x0.xyxy + C.xxzz;
+  x12.xy -= i1;
+  i = mod289(i);
+  vec3 p = permute289(permute289(i.y + vec3(0.0, i1.y, 1.0)) + i.x + vec3(0.0, i1.x, 1.0));
+  vec3 m = max(0.5 - vec3(dot(x0, x0), dot(x12.xy, x12.xy), dot(x12.zw, x12.zw)), 0.0);
+  m = m * m; m = m * m;
+  vec3 x = 2.0 * fract(p * C.www) - 1.0;
+  vec3 h = abs(x) - 0.5;
+  vec3 ox = floor(x + 0.5);
+  vec3 a0 = x - ox;
+  m *= 1.79284291400159 - 0.85373472095314 * (a0 * a0 + h * h);
+  vec3 g;
+  g.x  = a0.x  * x0.x  + h.x  * x0.y;
+  g.yz = a0.yz * x12.xz + h.yz * x12.yw;
+  return 130.0 * dot(m, g);
+}
+
+
+vec4 mod289(vec4 x) { return x - floor(x * (1.0 / 289.0)) * 289.0; }
+vec4 permute289(vec4 x) { return mod289(((x * 34.0) + 1.0) * x); }
+vec4 taylorInvSqrt(vec4 r) { return 1.79284291400159 - 0.85373472095314 * r; }
+
+vec4 snoised(vec3 v) {
+  const vec2 C = vec2(1.0 / 6.0, 1.0 / 3.0);
+  const vec4 D = vec4(0.0, 0.5, 1.0, 2.0);
+
+  // Skew into the simplex lattice and find the first corner.
+  vec3 i  = floor(v + dot(v, C.yyy));
+  vec3 x0 = v - i + dot(i, C.xxx);
+
+  // Rank the components to pick which of the six tetrahedra we are in.
+  vec3 gt = step(x0.yzx, x0.xyz);
+  vec3 l  = 1.0 - gt;
+  vec3 i1 = min(gt.xyz, l.zxy);
+  vec3 i2 = max(gt.xyz, l.zxy);
+
+  vec3 x1 = x0 - i1 + C.xxx;
+  vec3 x2 = x0 - i2 + C.yyy;
+  vec3 x3 = x0 - D.yyy;
+
+  i = mod289(i);
+  vec4 p = permute289(permute289(permute289(
+             i.z + vec4(0.0, i1.z, i2.z, 1.0))
+           + i.y + vec4(0.0, i1.y, i2.y, 1.0))
+           + i.x + vec4(0.0, i1.x, i2.x, 1.0));
+
+  // Gradients: 7x7x6 points over a cube, mapped onto an octahedron.
+  float n_ = 0.142857142857; // 1/7
+  vec3  ns = n_ * D.wyz - D.xzx;
+
+  vec4 j = p - 49.0 * floor(p * ns.z * ns.z);
+
+  vec4 xf = floor(j * ns.z);
+  vec4 yf = floor(j - 7.0 * xf);
+
+  vec4 gx = xf * ns.x + ns.yyyy;
+  vec4 gy = yf * ns.x + ns.yyyy;
+  vec4 gh = 1.0 - abs(gx) - abs(gy);
+
+  vec4 b0 = vec4(gx.xy, gy.xy);
+  vec4 b1 = vec4(gx.zw, gy.zw);
+
+  vec4 s0 = floor(b0) * 2.0 + 1.0;
+  vec4 s1 = floor(b1) * 2.0 + 1.0;
+  vec4 sh = -step(gh, vec4(0.0));
+
+  vec4 a0 = b0.xzyw + s0.xzyw * sh.xxyy;
+  vec4 a1 = b1.xzyw + s1.xzyw * sh.zzww;
+
+  vec3 g0 = vec3(a0.xy, gh.x);
+  vec3 g1 = vec3(a0.zw, gh.y);
+  vec3 g2 = vec3(a1.xy, gh.z);
+  vec3 g3 = vec3(a1.zw, gh.w);
+
+  vec4 norm = taylorInvSqrt(vec4(dot(g0, g0), dot(g1, g1), dot(g2, g2), dot(g3, g3)));
+  g0 *= norm.x; g1 *= norm.y; g2 *= norm.z; g3 *= norm.w;
+
+  // Radial falloff per corner. w is kept unsquared here (Ashima squares in
+  // place) because the derivative needs both w^3 and w^4.
+  vec4 w  = max(0.6 - vec4(dot(x0, x0), dot(x1, x1), dot(x2, x2), dot(x3, x3)), 0.0);
+  vec4 w2 = w * w;
+  vec4 w4 = w2 * w2;
+  vec4 gd = vec4(dot(g0, x0), dot(g1, x1), dot(g2, x2), dot(g3, x3));
+
+  vec4 c = w2 * w * gd;
+  vec3 grad = -8.0 * (c.x * x0 + c.y * x1 + c.z * x2 + c.w * x3)
+            + w4.x * g0 + w4.y * g1 + w4.z * g2 + w4.w * g3;
+
+  return 42.0 * vec4(dot(w4, gd), grad);
+}
+
+// Value only, for the places that do not need the gradient.
+float snoise(vec3 v) { return snoised(v).x; }
+
+
+// Quilez's decorrelating rotation and its inverse (orthonormal, so transpose).
+const mat3 FBMD3_ROT = mat3( 0.00,  0.80,  0.60,
+                            -0.80,  0.36, -0.48,
+                            -0.60, -0.48,  0.64);
+const mat3 FBMD3_ROT_INV = mat3( 0.00, -0.80, -0.60,
+                                 0.80,  0.36, -0.48,
+                                 0.60, -0.48,  0.64);
+
+vec4 fbmd3(vec3 p, int octaves, float gain, float erosion) {
+  // 1.97 rather than 2.0: an exact octave doubling repeats the lattice
+  // alignment at every level, and the near-miss is free.
+  const float LACUNARITY = 1.97;
+  float amp = 0.5, sum = 0.0, norm = 0.0;
+  vec3 grad = vec3(0.0);
+  mat3 m = mat3(1.0);
+  for (int i = 0; i < octaves; i++) {
+    vec4 n = snoised(p);
+    sum  += amp * n.x / (1.0 + erosion * dot(grad, grad));
+    grad += amp * m * n.yzw;
+    norm += amp;
+    amp  *= gain;
+    p = LACUNARITY * FBMD3_ROT * p;
+    m = LACUNARITY * FBMD3_ROT_INV * m;
+  }
+  float inv = 1.0 / max(norm, 1e-5);
+  return vec4(sum * inv, grad * inv);
+}
+
+
+const float TAU = 6.28318530718;
+
+// The analytic gradient of an fbmd3 octave is not a small number: simplex noise
+// is normalised so its *value* lands in [-1,1], which leaves the derivative
+// running around 5-10 per unit of input. Measured here (rendering
+// length(n.yzw) directly) it sits near 8 for the octave counts below. Dividing
+// by that lets every warp amplitude and bump strength further down be written
+// as "how far, in cells" rather than as an opaque small constant, which is the
+// difference between tuning and guessing.
+const float GRAD_NORM = 1.0 / 8.0;
+
+// Rotations applied to each warp level's flow vector.
+//
+// Rotating a gradient by 90 degrees in the xy plane turns it into a
+// divergence-free flow: instead of pushing the domain downhill (which piles
+// material up and flattens the result) it shears the domain sideways, which is
+// what produces the marbled, filament-rich look. The two levels use different
+// angles so the second warp does not simply reinforce the first.
+mat3 flowRotation(float turns) {
+  float a = TAU * turns;
+  float c = cos(a), s = sin(a);
+  // Rotation about z, with a slight tilt into z so the warp also displaces the
+  // time axis -- neighbouring regions then evolve slightly out of step, which
+  // stops the whole field pulsing as one.
+  return mat3( c,  s, 0.0,
+              -s,  c, 0.0,
+              0.0, 0.12, 0.99);
+}
+
+// Base hues, in turns around the OKLab hue wheel. Curated rather than random:
+// the interesting failure of a free hue is that it lands somewhere the sRGB
+// gamut is narrow at this lightness, and the ramp flattens exactly where it
+// should be most saturated. These four were checked against the L/C used below.
+float baseHue(float s) {
+  if (s < 0.25) return 0.62;  // deep blue -> cyan
+  if (s < 0.50) return 0.08;  // amber -> magma
+  if (s < 0.75) return 0.42;  // jade -> teal
+  return 0.86;                // violet -> rose
+}
+
+void mainImage(out vec4 fragColor, in vec2 fragCoord) {
+  // World space: divide by the SHORT axis, so the pattern is not stretched 5:1
+  // on the wall (issue #114) and a wider canvas shows more plasma rather than a
+  // magnified version of the same plasma. y spans [-0.5, 0.5].
+  vec2 uv = worldFromFrag(fragCoord, iResolution.xy);
+
+  // Base feature scale, in cells per screen height. Deliberately close to one:
+  // in a domain-warped fBm the apparent complexity comes from the warp, not
+  // from the base frequency, so the base stays large and soft. At 6000x1200
+  // this is ~900px per base cell, and the wall shows about seven of them
+  // across. The old version was effectively at 30+ cells per height with no
+  // large-scale variation at all, which is precisely why it turned to mud.
+  float scale = 1.05 + iSeed.z * 0.30;
+
+  // Field offset. Also decorrelates the three fbm levels from each other.
+  vec3 offset = vec3(iSeed.x, iSeed.y, iSeed.w) * 71.0;
+
+  // Time on the third axis. 0.05 cells/second against a cell of 1.0 means the
+  // surface renews itself over roughly twenty seconds -- slow enough to be calm
+  // on a ten-minute rotation slot, fast enough that it is visibly alive.
+  float t = iTime;
+  vec3 p = vec3(uv * scale, t * 0.05) + offset;
+
+  // ---- Multi-level domain warp -------------------------------------------
+  // The warp vector at each level is the *derivative* of a low-octave fbm, so a
+  // coherent flow direction costs one fbm rather than the two or three separate
+  // noise fields the usual (Quilez) formulation evaluates. Few octaves and a
+  // low gain on purpose: a warp field with fine detail in it displaces
+  // neighbouring pixels in unrelated directions, which shreds the level below
+  // into grain instead of stretching it into filaments.
+  //
+  // Displacement is comparable to the cell size at level 1 and a third of it at
+  // level 2. That is the regime where fBm stops looking like clouds and starts
+  // looking marbled -- much less and it is just fBm, much more and the domain
+  // folds onto itself into pinched knots.
+  vec4 n1 = fbmd3(p, 3, 0.42, 0.0);
+  vec3 p1 = p + 0.90 * GRAD_NORM * (flowRotation(0.25) * n1.yzw);
+
+  // Level 2 runs on the already-warped domain at a slightly higher frequency
+  // and a different rotation, so it shears rather than reinforcing level 1.
+  vec4 n2 = fbmd3(p1 * 1.6 + vec3(19.3, 7.1, t * 0.018), 3, 0.42, 0.0);
+  vec3 p2 = p1 + 0.32 * GRAD_NORM * (flowRotation(-0.17) * n2.yzw);
+
+  // Level 3: the surface itself. Gain 0.40 rather than 0.5 because the gradient
+  // is about to be used for lighting -- see the note on fbmd3. Erosion damps
+  // octaves where the accumulated slope is already steep, concentrating fine
+  // detail into the flanks of the large forms instead of spreading it evenly;
+  // 0.35 is moderate, higher flattens the ridges into plateaus.
+  vec4 n3 = fbmd3(p2 + vec3(4.7, 11.9, 0.0), 4, 0.40, 0.35);
+  float h = n3.x;
+  vec2 grad = n3.yz;
+
+  // ---- Lighting -----------------------------------------------------------
+  // Shade the fBm as a heightfield. This is the cheapest depth available: the
+  // gradient is already computed, and the difference between a colour-mapped
+  // plasma and a lit one is the difference between a pattern and a surface.
+  //
+  // 0.55 cells of rise per cell of run at a typical slope, which is a fairly
+  // dramatic relief -- around 30 degrees. Tuned by eye at 6000x1200: higher
+  // looks embossed and metallic, lower goes flat.
+  vec3 nrm = normalize(vec3(-grad * (0.55 * GRAD_NORM), 1.0));
+
+  // Key light from the upper left, the default for reading relief as raised
+  // rather than sunken.
+  vec3 lightDir = normalize(vec3(-0.5, 0.62, 0.6));
+  float diff = clamp(dot(nrm, lightDir), 0.0, 1.0);
+
+  // Half-vector specular against a head-on viewer. Narrow and strong: it is
+  // what puts a highlight on the crest of each ridge and reads as wet or
+  // molten rather than matte.
+  vec3 halfV = normalize(lightDir + vec3(0.0, 0.0, 1.0));
+  float spec = pow(clamp(dot(nrm, halfV), 0.0, 1.0), 34.0);
+
+  // Cheap ambient occlusion: valleys of the heightfield are self-shadowed.
+  float ao = clamp(0.45 + 0.75 * (h + 0.35), 0.25, 1.0);
+
+  // ---- Colour -------------------------------------------------------------
+  // Hue varies only at very low frequency (0.4 cells per screen height against
+  // the surface's ~4) and over a narrow span. Both bounds are the point: a hue
+  // that varies as fast as the detail averages to grey, and a hue that sweeps
+  // the whole wheel gives a rainbow rather than a palette. +/-0.07 turns is
+  // about 25 degrees each way, an analogous scheme.
+  //
+  // The drift term is 0.0018 turns/second: one lap of the hue wheel per nine
+  // minutes, against a ten-minute rotation slot. Fast enough that a long look
+  // is not a still image, slow enough that no single glance sees it move.
+  float hueField = snoise(vec3(uv * 0.4, t * 0.017) + offset.zxy);
+  float hue = baseHue(iSeed.y) + 0.07 * hueField + 0.0018 * t;
+
+  // Lightness carries the structure. Range 0.05..~1.0 in OKLab L, so there are
+  // genuine blacks and genuine highlights rather than the old flat 0.75.
+  float lit = 0.05 + 0.74 * diff * ao;
+  float crest = smoothstep(0.10, 0.68, h);
+  float L = clamp(lit + 0.26 * crest, 0.0, 1.0);
+
+  // Chroma falls off at both ends: near black there is no chroma to see, and
+  // hot crests desaturating toward white is what makes them read as *bright*
+  // rather than merely as a lighter version of the same colour.
+  float chroma = 0.125 * smoothstep(0.0, 0.20, L) * (1.0 - 0.45 * smoothstep(0.72, 1.0, L));
+  float a = TAU * hue;
+  vec3 col = max(oklabToLinear(vec3(L, chroma * cos(a), chroma * sin(a))), 0.0);
+
+  // ---- Composition --------------------------------------------------------
+  // A very low-frequency energy field, drifting slower than everything else.
+  // Without it a 5:1 canvas is uniformly busy from end to end and the eye has
+  // nowhere to rest; with it, whole stretches of the wall fall to a deep quiet
+  // base and the bright regions read as events. This is the single change that
+  // most affects how the saver looks at wall aspect.
+  float energy = snoise(vec3(uv * 0.20, t * 0.012) + offset.yzx * 0.7);
+  // Biased dark: the midpoint sits at +0.2 rather than 0, so rather more than
+  // half of the field falls into the quiet base. An unbiased mask leaves the
+  // wall evenly busy, which is the failure this exists to fix.
+  float mask = smoothstep(-0.25, 0.75, energy);
+  // The floor is 0.20 rather than something near zero. A quiet region should be
+  // *dim plasma*, not an absence of image: a black patch on a lit-room videowall
+  // reads as a dead panel, it disappears entirely under the ambient washout, and
+  // it leaves shadercheck's structure probe with nothing to measure if its
+  // 512px sample happens to land there.
+  col *= 0.20 + 1.25 * mask;
+
+  // Specular and crest glow are added *after* the mask so the brightest ridges
+  // in an active region genuinely exceed 1.0 and the bloom in the post chain
+  // has something real to find. Feeding pre-tonemapped colour into the chain is
+  // issue #140; these are HDR values.
+  // Same reasoning as the mask floor: the quiet regions keep a fraction of the
+  // highlights, so they still glint rather than going inert.
+  float activity = 0.18 + 0.82 * mask;
+  float heat = activity * pow(crest, 3.0);
+  col += col * 2.2 * heat;
+  col += vec3(1.0, 0.92, 0.82) * spec * (0.22 + 1.4 * heat) * activity;
+
+  // Deep ambient floor, tinted the complement of the base hue so the quiet
+  // regions are a colour rather than an absence of one.
+  float ca = TAU * (baseHue(iSeed.y) + 0.5);
+  col += max(oklabToLinear(vec3(0.16, 0.05 * cos(ca), 0.05 * sin(ca))), 0.0) * 0.9;
+
+  fragColor = vec4(col, 1.0);
+}
diff --git a/input_viewer_egui/shaders/post-bright.frag b/input_viewer_egui/shaders/post-bright.frag
new file mode 100644
index 0000000..3ff85a4
--- /dev/null
+++ b/input_viewer_egui/shaders/post-bright.frag
@@ -0,0 +1,18 @@
+// GENERATED from post-fx.js BRIGHT_PASS by extract.mjs -- do not edit.
+#version 330 core
+uniform sampler2D uSrc;
+uniform vec2 uTexel;
+uniform float uThreshold;
+uniform float uKnee;
+out vec4 outColor;
+
+// Soft-knee bright pass. A hard threshold produces a visible ring where pixels
+// cross it; the knee blends across a band instead.
+void main() {
+  vec3 c = texture(uSrc, gl_FragCoord.xy * uTexel).rgb;
+  float lum = max(max(c.r, c.g), c.b);
+  float soft = clamp(lum - uThreshold + uKnee, 0.0, 2.0 * uKnee);
+  soft = soft * soft / (4.0 * uKnee + 1e-5);
+  float contribution = max(soft, lum - uThreshold) / max(lum, 1e-5);
+  outColor = vec4(c * contribution, 1.0);
+}
diff --git a/input_viewer_egui/shaders/post-composite.frag b/input_viewer_egui/shaders/post-composite.frag
new file mode 100644
index 0000000..43ef165
--- /dev/null
+++ b/input_viewer_egui/shaders/post-composite.frag
@@ -0,0 +1,53 @@
+// GENERATED from post-fx.js COMPOSITE by extract.mjs -- do not edit.
+#version 330 core
+uniform sampler2D uScene;
+uniform sampler2D uBloom;
+uniform vec2 uTexel;
+uniform float uBloomIntensity;
+uniform float uExposure;
+uniform int uTonemap;      // 0 = none, 1 = Reinhard-Jodie, 2 = ACES
+uniform int uDither;
+out vec4 outColor;
+
+// ACES filmic, Narkowicz's fitted curve. Rolls highlights off smoothly instead
+// of clipping, which is what preserves structure in a dense bright core.
+vec3 tonemapACES(vec3 x) {
+  const float a = 2.51, b = 0.03, c = 2.43, d = 0.59, e = 0.14;
+  return clamp((x * (a * x + b)) / (x * (c * x + d) + e), 0.0, 1.0);
+}
+
+// Cheaper alternative that keeps saturation better than plain Reinhard.
+vec3 tonemapReinhardJodie(vec3 x) {
+  float l = dot(x, vec3(0.2126, 0.7152, 0.0722));
+  vec3 tv = x / (1.0 + x);
+  return mix(x / (1.0 + l), tv, tv);
+}
+
+// Interleaved gradient noise: a cheap, well-distributed dither. Breaking the
+// final 8-bit quantisation matters most on wide smooth gradients -- a bloom
+// falloff across 6000px of projector is a textbook banding case.
+float ignNoise(vec2 p) {
+  return fract(52.9829189 * fract(dot(p, vec2(0.06711056, 0.00583715))));
+}
+
+void main() {
+  vec2 uv = gl_FragCoord.xy * uTexel;
+  vec3 color = texture(uScene, uv).rgb;
+  color += texture(uBloom, uv).rgb * uBloomIntensity;
+  color *= uExposure;
+
+  if (uTonemap == 2) color = tonemapACES(color);
+  else if (uTonemap == 1) color = tonemapReinhardJodie(color);
+  else color = clamp(color, 0.0, 1.0);
+
+  // Linear -> sRGB. Without this, linear values are displayed as though they
+  // were already encoded, which reads darker and over-saturated.
+  color = pow(max(color, 0.0), vec3(1.0 / 2.2));
+
+  if (uDither == 1) {
+    // +/- half a code value, so it dithers the quantisation step itself.
+    color += (ignNoise(gl_FragCoord.xy) - 0.5) / 255.0;
+  }
+
+  outColor = vec4(color, 1.0);
+}
diff --git a/input_viewer_egui/shaders/post-downsample.frag b/input_viewer_egui/shaders/post-downsample.frag
new file mode 100644
index 0000000..93389b8
--- /dev/null
+++ b/input_viewer_egui/shaders/post-downsample.frag
@@ -0,0 +1,14 @@
+// GENERATED from post-fx.js DOWNSAMPLE by extract.mjs -- do not edit.
+#version 330 core
+uniform sampler2D uSrc;
+uniform vec2 uTexel;
+out vec4 outColor;
+void main() {
+  vec2 uv = gl_FragCoord.xy * uTexel * 2.0;
+  vec3 sum = texture(uSrc, uv).rgb * 4.0;
+  sum += texture(uSrc, uv - uTexel).rgb;
+  sum += texture(uSrc, uv + uTexel).rgb;
+  sum += texture(uSrc, uv + vec2(uTexel.x, -uTexel.y)).rgb;
+  sum += texture(uSrc, uv - vec2(uTexel.x, -uTexel.y)).rgb;
+  outColor = vec4(sum / 8.0, 1.0);
+}
diff --git a/input_viewer_egui/shaders/post-upsample.frag b/input_viewer_egui/shaders/post-upsample.frag
new file mode 100644
index 0000000..926b90a
--- /dev/null
+++ b/input_viewer_egui/shaders/post-upsample.frag
@@ -0,0 +1,20 @@
+// GENERATED from post-fx.js UPSAMPLE by extract.mjs -- do not edit.
+#version 330 core
+uniform sampler2D uSrc;
+uniform vec2 uTexel;
+uniform float uRadius;
+out vec4 outColor;
+void main() {
+  vec2 uv = gl_FragCoord.xy * uTexel * 0.5;
+  vec2 d = uTexel * uRadius;
+  vec3 sum = texture(uSrc, uv + vec2(-d.x, 0.0)).rgb * 2.0;
+  sum += texture(uSrc, uv + vec2(d.x, 0.0)).rgb * 2.0;
+  sum += texture(uSrc, uv + vec2(0.0, -d.y)).rgb * 2.0;
+  sum += texture(uSrc, uv + vec2(0.0, d.y)).rgb * 2.0;
+  sum += texture(uSrc, uv).rgb * 4.0;
+  sum += texture(uSrc, uv + vec2(-d.x, -d.y)).rgb;
+  sum += texture(uSrc, uv + vec2(d.x, -d.y)).rgb;
+  sum += texture(uSrc, uv + vec2(-d.x, d.y)).rgb;
+  sum += texture(uSrc, uv + vec2(d.x, d.y)).rgb;
+  outColor = vec4(sum / 16.0, 1.0);
+}
diff --git a/input_viewer_egui/src/app.rs b/input_viewer_egui/src/app.rs
new file mode 100644
index 0000000..5a81c05
--- /dev/null
+++ b/input_viewer_egui/src/app.rs
@@ -0,0 +1,1276 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! The wall: one or two halves, the pickers laid over the top edge, the legend
+//! on the bottom edge, and the no-signal board / screensaver.
+
+use std::collections::HashMap;
+use std::sync::mpsc;
+use std::time::{Duration, Instant};
+
+use eframe::egui::{
+    self, Align2, Color32, CornerRadius, FontId, Key, Rect, Sense, Stroke, StrokeKind, TextureHandle,
+    TextureOptions, Vec2, pos2, vec2,
+};
+use crate::capture::{self, Device, Stream};
+use crate::gpu_video;
+use crate::flags::Flags;
+use crate::health::{self, Sample, Status, StreamHealth, limits as health_limits};
+use crate::render_stats::RenderStats;
+use crate::review::Review;
+use crate::screensaver::{self, Rng, Screensaver};
+use crate::settings::{Layout, Settings, Store};
+use crate::shortcuts::{self, Action};
+use crate::update::{self, Updater};
+
+mod settings_ui;
+use settings_ui::Pane;
+use crate::filelog::{log_error, log_info, log_warn};
+
+const DROPDOWN_IDLE: Duration = Duration::from_secs(30);
+const EDGE_PX: f32 = 6.0;
+const CLOSE_MARGIN: f32 = 48.0;
+const TOAST_FOR: Duration = Duration::from_millis(2500);
+const TILE: Vec2 = vec2(128.0, 72.0);
+const DEVICE_POLL: Duration = Duration::from_secs(10);
+/// Video is almost always drawn smaller than it arrives (a 3840x2160 card on a
+/// ~2133x1200 half of the wall is 1.8x down), and plain bilinear filtering
+/// samples only 2x2 texels: past 2x it skips source pixels, and 1px detail --
+/// slide text, table rules -- turns to moiré and shimmers. Trilinear
+/// mipmapping averages instead. Measured with `--test-pattern --hud`: it
+/// fixes the moiré and keeps two 4K60 inputs at 60 fps with no skipped frames.
+const VIDEO_TEXTURE: TextureOptions = TextureOptions::LINEAR.with_mipmap_mode(Some(egui::TextureFilter::Linear));
+
+/// Thumbnail the health check judges flatness on: the size Electron's crop
+/// detection shares with it (#314), so a port of cropping can reuse it.
+const HEALTH_THUMB: (usize, usize) = (384, 216);
+/// A `[Health]` line per side every 10 minutes, as renderer.js writes.
+const HEALTH_SUMMARY_MS: f64 = 10.0 * 60.0 * 1000.0;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Side {
+    Left,
+    Right,
+    Both,
+}
+
+/// Which input each half starts on, by Electron's rules (`getVideoDevices` and
+/// `openInitialStreams`):
+///
+/// 1. keep what a half already shows if that device is still there (hot-plug);
+/// 2. else the saved left/right device;
+/// 3. else the first enabled device on the left, the second on the right
+///    (or the first again if there is only one);
+/// 4. at startup only, `defaultInputId` overrides both halves if it is
+///    present and enabled;
+/// 5. with Multi-view off the right half always copies the left.
+fn choose_sides(devices: &[Device], s: &Settings, current: &[Option<String>; 2], startup: bool) -> [Option<String>; 2] {
+    let present = |id: &Option<String>| id.as_ref().filter(|id| devices.iter().any(|d| &d.id == *id)).cloned();
+    let mut enabled = devices.iter().filter(|d| s.is_enabled(&d.id)).map(|d| d.id.clone());
+    let first = enabled.next().or_else(|| devices.first().map(|d| d.id.clone()));
+    let second = enabled.next().or_else(|| first.clone());
+
+    let mut left = present(&current[0]).or_else(|| present(&s.left_device_id)).or_else(|| first.clone());
+    let mut right = present(&current[1]).or_else(|| present(&s.right_device_id)).or(second);
+    if startup
+        && let Some(default) = present(&s.default_input_id).filter(|id| s.is_enabled(id))
+    {
+        left = Some(default.clone());
+        right = Some(default);
+    }
+    if !s.multi_view {
+        right = left.clone();
+    }
+    [left, right]
+}
+
+/// Dual view: left half, logo divider, right half. The halves share what the
+/// gap leaves, like the flex layout around `#center-divider`.
+fn dual_rects(rect: Rect, gap: f32) -> (Rect, Rect, Rect) {
+    let gap = gap.clamp(0.0, rect.width());
+    let half = (rect.width() - gap) / 2.0;
+    let left = Rect::from_min_size(rect.min, vec2(half, rect.height()));
+    let divider = Rect::from_min_size(pos2(left.right(), rect.top()), vec2(gap, rect.height()));
+    let right = Rect::from_min_max(pos2(divider.right(), rect.top()), rect.max);
+    (left, divider, right)
+}
+
+/// The content area once `borderWidth` is taken off each side edge.
+fn wall_rect(rect: Rect, border: f32) -> Rect {
+    let b = border.clamp(0.0, rect.width() / 2.0);
+    Rect::from_min_max(rect.min + vec2(b, 0.0), rect.max - vec2(b, 0.0))
+}
+
+/// `.divider-logo`: contained within 90% of the column's width and 80% of its
+/// height, centred.
+fn logo_rect(divider: Rect, logo: Vec2) -> Rect {
+    let scale = (divider.width() * 0.9 / logo.x).min(divider.height() * 0.8 / logo.y);
+    Rect::from_center_size(divider.center(), logo * scale)
+}
+
+fn load_logo(ctx: &egui::Context) -> Option<TextureHandle> {
+    let img = image::load_from_memory(include_bytes!("../assets/logo.png")).ok()?.to_rgba8();
+    let size = [img.width() as usize, img.height() as usize];
+    let image = egui::ColorImage::from_rgba_unmultiplied(size, img.as_raw());
+    Some(ctx.load_texture("logo", image, TextureOptions::LINEAR))
+}
+
+/// `pickerPlan()` from the Electron app: which pickers the dropdown shows and
+/// whether their tiles carry number-key chips.
+///
+/// Per-half pickers carry no chip on purpose: `1`-`4` set both halves, and a
+/// chip beside a control that sets one half would document the wrong thing.
+fn picker_plan(layout: Layout, multi_view: bool) -> (Vec<(&'static str, Side)>, bool) {
+    match (layout, multi_view) {
+        (Layout::Dual, true) => (vec![("Left half", Side::Left), ("Right half", Side::Right)], false),
+        (Layout::Dual, false) => (vec![("Both halves", Side::Both)], true),
+        (Layout::Single, true) => (vec![("Whole wall", Side::Left)], true),
+        (Layout::Single, false) => (vec![("Whole wall", Side::Both)], true),
+    }
+}
+
+/// The picture a slot draws: an egui texture for RGBA frames, or a GPU
+/// texture that `gpu_video` converts YUY2 frames into.
+#[derive(Clone)]
+enum VideoTexture {
+    Egui(TextureHandle),
+    Gpu { id: egui::TextureId, size: Vec2 },
+}
+
+impl VideoTexture {
+    fn id(&self) -> egui::TextureId {
+        match self {
+            VideoTexture::Egui(t) => t.id(),
+            VideoTexture::Gpu { id, .. } => *id,
+        }
+    }
+    fn size_vec2(&self) -> Vec2 {
+        match self {
+            VideoTexture::Egui(t) => t.size_vec2(),
+            VideoTexture::Gpu { size, .. } => *size,
+        }
+    }
+}
+
+/// GPU conversion state: compiled once, on the first YUY2 frame.
+enum Gpu {
+    NotYet,
+    Ready(gpu_video::Converter),
+    /// Could not set up; YUY2 is converted on the CPU instead (slowly).
+    Failed,
+}
+
+/// One open capture device, shared by every half that shows it (ADR 0008).
+struct Slot {
+    /// None between closing the device for a reopen and opening it again.
+    stream: Option<Stream>,
+    /// When to open again after a reopen's release gap (app clock, ms).
+    reopen_at: Option<f64>,
+    texture: Option<VideoTexture>,
+    shown_seq: u64,
+    /// Outlives the stream across reopens, so the backoff backs off.
+    health: StreamHealth,
+    next_sample: f64,
+    stats: RenderStats,
+    /// The status last written to the log, as Electron's healthLastStatus.
+    last_logged: Option<Status>,
+    /// The "opened" line for this stream has been written.
+    announced: bool,
+}
+
+impl Slot {
+    fn open(device: &Device, ctx: &egui::Context, now: f64) -> Self {
+        let mut slot = Self {
+            stream: None,
+            reopen_at: None,
+            texture: None,
+            shown_seq: 0,
+            health: StreamHealth::new(),
+            next_sample: 0.0,
+            stats: RenderStats::new(),
+            last_logged: None,
+            announced: false,
+        };
+        slot.attach(device, ctx, now);
+        slot
+    }
+
+    fn attach(&mut self, device: &Device, ctx: &egui::Context, now: f64) {
+        self.stream = Some(Stream::open(device, ctx.clone()));
+        self.reopen_at = None;
+        self.shown_seq = 0;
+        self.stats = RenderStats::new();
+        self.health.opened(now);
+        self.next_sample = now + health_limits::SAMPLE_MS;
+        self.announced = false;
+    }
+}
+
+pub struct InputViewer {
+    flags: Flags,
+    settings: Settings,
+    store: Store,
+    /// None while closed; which pane while open.
+    settings_pane: Option<Pane>,
+    devices: Vec<Device>,
+    /// The first device list has been applied (defaultInputId is startup-only).
+    started: bool,
+    device_rx: Option<mpsc::Receiver<Vec<Device>>>,
+    next_device_poll: Instant,
+    /// Device id shown on [left, right].
+    sides: [Option<String>; 2],
+    slots: HashMap<String, Slot>,
+    /// Last frame seen per device, for the picker tiles. A snapshot, not a
+    /// live preview, so opening the dropdown opens no extra streams.
+    stills: HashMap<String, VideoTexture>,
+    gpu: Gpu,
+    /// Per device, kept across reopens so egui registrations are not leaked.
+    gpu_textures: HashMap<String, gpu_video::GpuTexture>,
+    frozen: bool,
+    dropdown_open: bool,
+    dropdown_bottom: f32,
+    legend_open: bool,
+    legend_top: f32,
+    last_activity: Instant,
+    toast: Option<(String, Instant)>,
+    board_since: [Option<Instant>; 2],
+    wall_dark_since: Option<Instant>,
+    saver: Option<Screensaver>,
+    saver_on_demand: bool,
+    saver_started: Instant,
+    last_saver: Option<usize>,
+    rng: Rng,
+    last_frame: Instant,
+    review: Option<Review>,
+    updater: Option<Updater>,
+    logo: Option<TextureHandle>,
+    /// --hud: repaints per second, and when the count started.
+    ui_fps: f32,
+    ui_frames: (u32, Instant),
+    report_count: u64,
+    /// Origin of the millisecond clock the health policy runs on.
+    epoch: Instant,
+    /// When the last 10-minute `[Health]` summary was written (ms).
+    last_health_summary: f64,
+}
+
+impl InputViewer {
+    pub fn new(cc: &eframe::CreationContext<'_>, flags: Flags) -> Self {
+        // Always dark: this runs on a video wall, and following a light system
+        // theme would put white panels over the picture.
+        cc.egui_ctx.set_theme(egui::Theme::Dark);
+        let review = Review::from_env();
+        // Mock and review runs neither read nor write settings.json: they are
+        // for looking at the UI, and must not be able to change the wall's
+        // configuration.
+        let (settings, store) = Store::open(flags.mock.is_none() && review.is_none());
+        let mut app = Self {
+            settings,
+            store,
+            settings_pane: None,
+            devices: Vec::new(),
+            started: false,
+            device_rx: None,
+            next_device_poll: Instant::now() + DEVICE_POLL,
+            sides: [None, None],
+            slots: HashMap::new(),
+            stills: HashMap::new(),
+            gpu: Gpu::NotYet,
+            gpu_textures: HashMap::new(),
+            frozen: false,
+            dropdown_open: false,
+            dropdown_bottom: 0.0,
+            legend_open: false,
+            legend_top: f32::MAX,
+            last_activity: Instant::now(),
+            toast: None,
+            board_since: [None, None],
+            wall_dark_since: None,
+            saver: None,
+            saver_on_demand: false,
+            saver_started: Instant::now(),
+            last_saver: None,
+            rng: Rng::new(Rng::clock_seed()),
+            last_frame: Instant::now(),
+            review,
+            // Never in mock or review runs: those are for looking at the UI.
+            updater: None,
+            logo: load_logo(&cc.egui_ctx),
+            ui_fps: 0.0,
+            ui_frames: (0, Instant::now()),
+            report_count: 0,
+            epoch: Instant::now(),
+            last_health_summary: 0.0,
+            flags,
+        };
+        if app.flags.mock.is_none() && app.review.is_none() {
+            app.updater = Updater::start(cc.egui_ctx.clone());
+        }
+        // Electron wrote gpu-report.txt to answer one recurring question --
+        // is the wall rendering in software? (#268, #271) -- this line answers
+        // it from the log.
+        if let Some(gl) = &cc.gl {
+            use eframe::glow::HasContext as _;
+            let (vendor, renderer, version) = unsafe {
+                (
+                    gl.get_parameter_string(eframe::glow::VENDOR),
+                    gl.get_parameter_string(eframe::glow::RENDERER),
+                    gl.get_parameter_string(eframe::glow::VERSION),
+                )
+            };
+            log_info!("[App] GPU: {vendor} / {renderer} / OpenGL {version}");
+        }
+        if app.flags.no_signal {
+            log_info!("[Health] Not started: --no-signal pins the state");
+        } else {
+            log_info!("[Health] monitoring every {}ms", health_limits::SAMPLE_MS);
+        }
+        if let Some(n) = app.flags.mock {
+            app.set_devices(capture::mock_devices(n, app.flags.test_pattern, app.flags.mock_fault));
+        } else {
+            let (tx, rx) = mpsc::channel();
+            let ctx = cc.egui_ctx.clone();
+            app.device_rx = Some(rx);
+            capture::camera_initialize(move |granted| {
+                if !granted {
+                    log_warn!("[Video] camera access not granted");
+                }
+                let _ = tx.send(capture::camera_devices());
+                ctx.request_repaint();
+            });
+        }
+        app
+    }
+
+    // ---------------------------------------------------------------- devices
+
+    fn set_devices(&mut self, devices: Vec<Device>) {
+        if devices == self.devices {
+            return;
+        }
+        log_info!("[Devices] {}", devices.iter().map(|d| d.label.as_str()).collect::<Vec<_>>().join(", "));
+        self.devices = devices;
+        self.sides = choose_sides(&self.devices, &self.settings, &self.sides, !self.started);
+        self.started |= !self.devices.is_empty();
+    }
+
+    fn poll_devices(&mut self, ctx: &egui::Context) {
+        if let Some(rx) = &self.device_rx
+            && let Ok(list) = rx.try_recv()
+        {
+            self.set_devices(list);
+        }
+        // Hot-plug: re-enumerate off the UI thread now and then.
+        if self.flags.mock.is_none() && Instant::now() >= self.next_device_poll {
+            self.next_device_poll = Instant::now() + DEVICE_POLL;
+            let (tx, rx) = mpsc::channel();
+            self.device_rx = Some(rx);
+            let ctx = ctx.clone();
+            std::thread::spawn(move || {
+                let _ = tx.send(capture::camera_devices());
+                ctx.request_repaint();
+            });
+        }
+    }
+
+    /// The operator's name for an input, else the device's own label.
+    fn label_of(&self, id: Option<&String>) -> String {
+        let Some(device) = id.and_then(|id| self.devices.iter().find(|d| &d.id == id)) else {
+            return "No input".into();
+        };
+        self.settings.name_of(&device.id).unwrap_or(&device.label).to_owned()
+    }
+
+    /// What the pickers offer and what 1-4 count through.
+    fn enabled_devices(&self) -> Vec<Device> {
+        self.devices.iter().filter(|d| self.settings.is_enabled(&d.id)).cloned().collect()
+    }
+
+    // -------------------------------------------------------------- selection
+
+    fn visible_sides(&self) -> &'static [usize] {
+        match self.settings.layout() {
+            Layout::Dual => &[0, 1],
+            Layout::Single => &[0],
+        }
+    }
+
+    fn select(&mut self, id: String, side: Side) {
+        let side = if self.settings.multi_view { side } else { Side::Both };
+        match side {
+            Side::Left => self.sides[0] = Some(id.clone()),
+            Side::Right => self.sides[1] = Some(id.clone()),
+            Side::Both => self.sides = [Some(id.clone()), Some(id.clone())],
+        }
+        if !self.dropdown_open {
+            self.toast = Some((self.label_of(Some(&id)), Instant::now()));
+        }
+    }
+
+    fn set_multi_view(&mut self, on: bool) {
+        self.settings.multi_view = on;
+        if !on {
+            self.sides[1] = self.sides[0].clone();
+        }
+    }
+
+    fn now_ms(&self) -> f64 {
+        self.epoch.elapsed().as_secs_f64() * 1000.0
+    }
+
+    /// Open a stream for each input on screen and release the rest. A device
+    /// closed for a reopen is opened again here once its release gap is over.
+    fn sync_streams(&mut self, ctx: &egui::Context) {
+        // A disabled input is never opened; its half shows no signal.
+        let wanted: Vec<String> = self.visible_sides().iter()
+            .filter_map(|&i| self.sides[i].clone())
+            .filter(|id| self.settings.is_enabled(id))
+            .collect();
+        self.slots.retain(|id, _| wanted.contains(id));
+        let now = self.now_ms();
+        for id in wanted {
+            let Some(device) = self.devices.iter().find(|d| d.id == id).cloned() else { continue };
+            match self.slots.get_mut(&id) {
+                None => {
+                    self.slots.insert(id, Slot::open(&device, ctx, now));
+                }
+                Some(slot) if slot.stream.is_none() && slot.reopen_at.is_some_and(|t| now >= t) => {
+                    slot.attach(&device, ctx, now);
+                }
+                Some(_) => {}
+            }
+        }
+    }
+
+    fn update_frames(&mut self, ctx: &egui::Context, eframe_frame: &mut eframe::Frame) {
+        let now = Instant::now();
+        let forced = self.flags.no_signal;
+        for (id, slot) in &mut self.slots {
+            let Some(stream) = &slot.stream else { continue };
+            let frame = stream.latest();
+            let fresh = frame.as_ref().filter(|f| f.seq != slot.shown_seq);
+            // While frozen, keep sampling health but stop updating the picture.
+            if let Some(f) = fresh.filter(|_| !self.frozen && !forced) {
+                let image = match &f.pixels {
+                    // The Arc is handed over as is: no copy, no conversion here.
+                    capture::Pixels::Rgba(image) => Some(image.clone()),
+                    capture::Pixels::Yuyv(bytes) => {
+                        let gl = eframe_frame.gl().cloned();
+                        if let (Gpu::NotYet, Some(gl)) = (&self.gpu, &gl) {
+                            self.gpu = match unsafe { gpu_video::Converter::new(gl) } {
+                                Ok(c) => {
+                                    log_info!("[Video] YUY2 frames are converted on the GPU");
+                                    Gpu::Ready(c)
+                                }
+                                Err(e) => {
+                                    log_error!("[Video] GPU conversion unavailable, converting YUY2 on the CPU: {e}");
+                                    Gpu::Failed
+                                }
+                            };
+                        }
+                        match (&self.gpu, gl) {
+                            (Gpu::Ready(conv), Some(gl)) => {
+                                let tex = match self.gpu_textures.entry(id.clone()) {
+                                    std::collections::hash_map::Entry::Occupied(e) => Some(e.into_mut()),
+                                    std::collections::hash_map::Entry::Vacant(v) => match unsafe { gpu_video::GpuTexture::new(&gl, eframe_frame) } {
+                                        Ok(t) => Some(v.insert(t)),
+                                        Err(e) => {
+                                            log_error!("[Video] {id}: could not create its GPU texture: {e}");
+                                            None
+                                        }
+                                    },
+                                };
+                                if let Some(tex) = tex {
+                                    unsafe { tex.update(&gl, conv, bytes, f.width(), f.height()) };
+                                    slot.texture = Some(VideoTexture::Gpu {
+                                        id: tex.id,
+                                        size: vec2(tex.size[0] as f32, tex.size[1] as f32),
+                                    });
+                                }
+                                None
+                            }
+                            // The slow path, so a machine without the GPU path
+                            // still shows a picture.
+                            _ => {
+                                let rgba = crate::yuv::yuyv_to_rgba(bytes, f.width(), f.height());
+                                Some(std::sync::Arc::new(egui::ColorImage::from_rgba_premultiplied([f.width(), f.height()], &rgba)))
+                            }
+                        }
+                    }
+                };
+                if let Some(image) = image {
+                    match &mut slot.texture {
+                        Some(VideoTexture::Egui(t)) => t.set(image, VIDEO_TEXTURE),
+                        _ => slot.texture = Some(VideoTexture::Egui(ctx.load_texture(id.clone(), image, VIDEO_TEXTURE))),
+                    }
+                }
+                if let Some(t) = &slot.texture {
+                    self.stills.insert(id.clone(), t.clone());
+                }
+                slot.stats.shown(now, f.seq, slot.shown_seq, f.captured_at);
+            }
+            if let Some(report) = slot.stats.tick(now) {
+                self.report_count += 1;
+                // Every 5s in the log, so a run can be judged without
+                // watching it.
+                if self.flags.hud && self.report_count.is_multiple_of(5) {
+                    let size = frame.as_ref().map_or((0, 0), |f| (f.width(), f.height()));
+                    log_info!("[Render] {id} {}x{}: {} · ui {:.0} fps · {} skipped in total",
+                        size.0, size.1, report.line(), self.ui_fps, slot.stats.total_skipped);
+                }
+            }
+            if let Some(f) = fresh {
+                slot.shown_seq = f.seq;
+            }
+        }
+    }
+
+    /// Which halves show each device, and its name, for log lines that read
+    /// per side as Electron's do: `[Health] left (Presenter): ...`.
+    fn sides_by_device(&self) -> HashMap<String, (Vec<&'static str>, String)> {
+        let mut map: HashMap<String, (Vec<&'static str>, String)> = HashMap::new();
+        for &i in self.visible_sides() {
+            if let Some(id) = &self.sides[i] {
+                let label = self.label_of(Some(id));
+                map.entry(id.clone()).or_insert_with(|| (Vec::new(), label)).0.push(["left", "right"][i]);
+            }
+        }
+        map
+    }
+
+    /// Health: every 2 s per device, never under --no-signal (it is not
+    /// started there in Electron either, rather than run and ignored).
+    fn sample_health(&mut self) {
+        if self.flags.no_signal {
+            return;
+        }
+        let now_ms = self.now_ms();
+        let who = self.sides_by_device();
+        let summary = now_ms - self.last_health_summary >= HEALTH_SUMMARY_MS;
+        if summary {
+            self.last_health_summary = now_ms;
+        }
+        for (id, slot) in &mut self.slots {
+            let Some((sides, label)) = who.get(id) else { continue };
+            let Some(stream) = &slot.stream else { continue };
+            let frame = stream.latest();
+            if !slot.announced
+                && let Some(f) = &frame
+            {
+                slot.announced = true;
+                for side in sides {
+                    log_info!("[Health] {side} opened \"{label}\" {}x{} id={}", f.width(), f.height(), short_id(id));
+                }
+            }
+            // A failure is acted on at once, as Electron does on a rejected
+            // open or an ended track; everything else waits for the sample.
+            let new_failure = stream.error().is_some() && !slot.health.status().is_fault();
+            if now_ms < slot.next_sample && !new_failure {
+                continue;
+            }
+            slot.next_sample = now_ms + health_limits::SAMPLE_MS;
+            check_health(id, slot, frame.as_deref(), now_ms, sides, label, summary);
+        }
+    }
+
+    /// Does this half show the NO SIGNAL board?
+    ///
+    /// As in Electron: forced, no input, a missing or disabled device, or a
+    /// device that cannot be opened. **Not** a dark, stalled or frameless
+    /// stream -- those are reopened by the health policy and stay black
+    /// meanwhile; only reference detection (ADR 0014, not ported) turns a
+    /// live-but-dark card into the board.
+    fn side_no_signal(&self, i: usize) -> bool {
+        if self.flags.no_signal {
+            return true;
+        }
+        let Some(id) = self.sides[i].as_ref() else { return true };
+        if !self.devices.iter().any(|d| &d.id == id) || !self.settings.is_enabled(id) {
+            return true;
+        }
+        self.slots.get(id).is_some_and(|slot| slot.health.status() == Status::OpenFailed)
+    }
+
+    // ------------------------------------------------------------ screensaver
+
+    fn start_saver(&mut self, index: Option<usize>) {
+        // --screensaver pins the first pick only; rotation stays random.
+        let pinned = self.flags.screensaver.take().and_then(|want| {
+            let i = screensaver::NAMES.iter().position(|n| crate::flags::normalise(n) == want);
+            if i.is_none() {
+                log_warn!("[TestFlags] no screensaver called {want:?}");
+            }
+            i
+        });
+        let index = index.or(pinned).unwrap_or_else(|| self.rng.index_except(screensaver::NAMES.len(), self.last_saver));
+        self.last_saver = Some(index);
+        self.saver = Some(Screensaver::new(index, Rng::clock_seed()));
+        self.saver_started = Instant::now();
+    }
+
+    fn step_saver(&mut self, delta: isize) {
+        let n = screensaver::NAMES.len() as isize;
+        let cur = self.saver.as_ref().map_or(0, |s| s.index as isize);
+        if self.saver.is_none() {
+            self.saver_on_demand = true;
+        }
+        self.start_saver(Some(((cur + delta).rem_euclid(n)) as usize));
+    }
+
+    fn update_saver(&mut self, now: Instant) {
+        let all_dark = self.visible_sides().iter().all(|&i| self.side_no_signal(i));
+        if !all_dark {
+            self.wall_dark_since = None;
+            if !self.saver_on_demand {
+                self.saver = None;
+            }
+        } else {
+            let since = *self.wall_dark_since.get_or_insert(now);
+            if self.saver.is_none() && now.duration_since(since) >= self.flags.screensaver_delay {
+                self.start_saver(None);
+            }
+        }
+        if self.saver.is_some() && now.duration_since(self.saver_started) >= screensaver::ROTATE_EVERY {
+            self.start_saver(None);
+        }
+    }
+
+    // ------------------------------------------------------------------- keys
+
+    fn handle_keys(&mut self, ctx: &egui::Context) {
+        let pressed: Vec<Key> = ctx.input(|i| {
+            i.events
+                .iter()
+                .filter_map(|e| match e {
+                    egui::Event::Key { key, pressed: true, repeat: false, modifiers, .. }
+                        if !modifiers.command && !modifiers.ctrl && !modifiers.alt => Some(*key),
+                    _ => None,
+                })
+                .collect()
+        });
+        if !pressed.is_empty() {
+            self.last_activity = Instant::now();
+        }
+        // Typing an input's name must not switch inputs or quit (Electron's
+        // shortcuts ignore every form control for the same reason), and with
+        // Settings open nothing behind the dialog should react at all. Esc
+        // still gets through, to close it.
+        let quiet = self.settings_pane.is_some() || ctx.egui_wants_keyboard_input();
+        for key in pressed {
+            let Some(action) = shortcuts::action_for(key) else { continue };
+            if quiet && action != Action::Escape {
+                continue;
+            }
+            self.run(action, ctx);
+        }
+    }
+
+    fn run(&mut self, action: Action, ctx: &egui::Context) {
+        match action {
+            Action::SelectInput(i) => {
+                if let Some(d) = self.enabled_devices().get(i) {
+                    self.select(d.id.clone(), Side::Both);
+                }
+            }
+            Action::LayoutDual => self.settings.layout_mode = Some(Layout::Dual),
+            Action::LayoutSingle => self.settings.layout_mode = Some(Layout::Single),
+            Action::Freeze => self.frozen = !self.frozen,
+            Action::ScreensaverToggle => {
+                if self.saver.is_some() {
+                    self.saver = None;
+                    self.saver_on_demand = false;
+                } else {
+                    self.saver_on_demand = true;
+                    self.start_saver(None);
+                }
+            }
+            Action::ScreensaverNext => self.step_saver(1),
+            Action::ScreensaverPrev => self.step_saver(-1),
+            Action::Fullscreen => {
+                let fs = ctx.input(|i| i.viewport().fullscreen.unwrap_or(false));
+                ctx.send_viewport_cmd(egui::ViewportCommand::Fullscreen(!fs));
+            }
+            // One thing per press: close panels if any are open, and stop.
+            Action::Escape => {
+                if self.settings_pane.is_some() {
+                    self.settings_pane = None;
+                } else if self.dropdown_open || self.legend_open {
+                    self.dropdown_open = false;
+                    self.legend_open = false;
+                } else {
+                    self.frozen = false;
+                    if self.saver_on_demand {
+                        self.saver_on_demand = false;
+                        self.saver = None;
+                    }
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Fullscreen(false));
+                }
+            }
+            Action::Quit => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
+        }
+    }
+
+    // --------------------------------------------------------------- painting
+
+    fn paint_wall(&mut self, ui: &mut egui::Ui, rect: Rect, now: Instant, dt: f32) {
+        let painter = ui.painter_at(rect);
+        painter.rect_filled(rect, 0.0, Color32::BLACK);
+        // borderWidth: black bars over both side edges, inset from the content.
+        let rect = wall_rect(rect, self.settings.border_width);
+
+        if let Some(saver) = &mut self.saver {
+            let t = now.duration_since(self.saver_started).as_secs_f32();
+            saver.paint(&painter, rect, t, dt);
+            if t < 4.0 {
+                badge(&painter, rect.left_bottom() + vec2(16.0, -16.0), Align2::LEFT_BOTTOM,
+                    &format!("{}  ·  seed {}", saver.name(), saver.seed));
+            }
+            return;
+        }
+
+        let halves: Vec<(usize, Rect)> = match self.settings.layout() {
+            Layout::Single => vec![(0, rect)],
+            Layout::Dual => {
+                let (l, divider, r) = dual_rects(rect, self.settings.center_gap);
+                if let Some(logo) = &self.logo {
+                    let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+                    painter.image(logo.id(), logo_rect(divider, logo.size_vec2()), uv, Color32::WHITE);
+                }
+                vec![(0, l), (1, r)]
+            }
+        };
+        for (i, half) in halves {
+            if self.side_no_signal(i) {
+                let since = *self.board_since[i].get_or_insert(now);
+                let label = self.label_of(self.sides[i].as_ref());
+                screensaver::paint_split_flap(&painter.with_clip_rect(half), half,
+                    &["NO SIGNAL", &label], now.duration_since(since).as_secs_f32());
+                continue;
+            }
+            self.board_since[i] = None;
+            let Some(tex) = self.sides[i].as_ref().and_then(|id| self.slots.get(id)).and_then(|s| s.texture.as_ref())
+            else {
+                continue;
+            };
+            // object-fit: contain.
+            let size = tex.size_vec2();
+            let scale = (half.width() / size.x).min(half.height() / size.y);
+            let fit = Rect::from_center_size(half.center(), size * scale);
+            painter.image(tex.id(), fit, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+        }
+
+        if self.frozen {
+            badge(&painter, rect.right_top() + vec2(-16.0, 16.0), Align2::RIGHT_TOP, "FROZEN");
+        }
+        if self.flags.hud {
+            self.paint_hud(&painter, rect);
+        }
+    }
+
+    /// `--hud`: one line per visible half, over its top-left corner.
+    fn paint_hud(&self, painter: &egui::Painter, rect: Rect) {
+        let halves: Vec<(usize, Rect)> = match self.settings.layout() {
+            Layout::Single => vec![(0, rect)],
+            Layout::Dual => {
+                let (l, _, r) = dual_rects(rect, self.settings.center_gap);
+                vec![(0, l), (1, r)]
+            }
+        };
+        for (i, half) in halves {
+            let Some(slot) = self.sides[i].as_ref().and_then(|id| self.slots.get(id)) else { continue };
+            let size = slot.stream.as_ref().and_then(Stream::latest).map_or((0, 0), |f| (f.width(), f.height()));
+            let stats = slot.stats.last.map_or_else(|| "measuring…".to_owned(), |r| r.line());
+            let text = format!("{}x{} · {stats} · ui {:.0} fps", size.0, size.1, self.ui_fps);
+            hud_line(painter, half.left_top() + vec2(12.0, 12.0), &text);
+        }
+    }
+
+    fn paint_toast(&mut self, ctx: &egui::Context, rect: Rect, now: Instant) {
+        let Some((text, at)) = &self.toast else { return };
+        if now.duration_since(*at) > TOAST_FOR || self.dropdown_open {
+            self.toast = None;
+            return;
+        }
+        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("toast")));
+        badge(&painter, rect.center_bottom() - vec2(0.0, 80.0), Align2::CENTER_BOTTOM, text);
+    }
+
+    fn dropdown(&mut self, ctx: &egui::Context, rect: Rect) {
+        let (pickers, chips) = picker_plan(self.settings.layout(), self.settings.multi_view);
+        let mut clicked: Option<(String, Side)> = None;
+        let mut open_settings = false;
+        let enabled = self.enabled_devices();
+        let mut layout = self.settings.layout();
+        let mut multi = self.settings.multi_view;
+
+        let resp = egui::Area::new(egui::Id::new("wall-pickers"))
+            .fixed_pos(rect.left_top())
+            .order(egui::Order::Foreground)
+            .show(ctx, |ui| {
+                ui.set_width(rect.width());
+                panel_frame().show(ui, |ui| {
+                    ui.set_width(rect.width() - 32.0);
+                    ui.vertical_centered(|ui| {
+                        ui.horizontal(|ui| {
+                            ui.selectable_value(&mut layout, Layout::Dual, "Dual  D");
+                            ui.selectable_value(&mut layout, Layout::Single, "Single  S");
+                            ui.separator();
+                            ui.checkbox(&mut multi, "Multi-view");
+                            if self.flags.mock.is_some() {
+                                ui.separator();
+                                ui.weak(format!("mock mode: {} inputs", self.devices.len()));
+                            }
+                            if self.flags.no_signal {
+                                ui.weak("· --no-signal");
+                            }
+                            ui.separator();
+                            open_settings = ui.button("Settings").clicked();
+                        });
+                    });
+                    ui.add_space(8.0);
+                    ui.columns(pickers.len(), |cols| {
+                        for (col, (title, side)) in cols.iter_mut().zip(&pickers) {
+                            let current = match side {
+                                Side::Right => self.sides[1].as_ref(),
+                                _ => self.sides[0].as_ref(),
+                            };
+                            col.label(egui::RichText::new(*title).small().weak());
+                            col.label(egui::RichText::new(self.label_of(current)).strong());
+                            egui::ScrollArea::horizontal().id_salt(title).show(col, |ui| {
+                                ui.horizontal(|ui| {
+                                    for (idx, d) in enabled.iter().enumerate() {
+                                        let selected = current == Some(&d.id);
+                                        let chip = chips.then(|| shortcuts::input_key_for(idx)).flatten();
+                                        let label = self.label_of(Some(&d.id));
+                                        if tile(ui, &label, self.stills.get(&d.id), selected, chip).clicked() {
+                                            clicked = Some((d.id.clone(), *side));
+                                        }
+                                    }
+                                    if self.devices.is_empty() {
+                                        ui.weak("No capture devices found");
+                                    } else if enabled.is_empty() {
+                                        ui.weak("Every input is disabled. Enable one in Settings.");
+                                    }
+                                });
+                            });
+                        }
+                    });
+                });
+            });
+        self.dropdown_bottom = resp.response.rect.bottom();
+        self.settings.layout_mode = Some(layout);
+        if open_settings {
+            self.settings_pane = Some(Pane::Inputs);
+            self.dropdown_open = false;
+        }
+        if multi != self.settings.multi_view {
+            self.set_multi_view(multi);
+        }
+        if let Some((id, side)) = clicked {
+            self.select(id, side);
+        }
+    }
+
+    /// The two electron-updater dialogs, as an egui window.
+    fn update_dialog(&mut self, ctx: &egui::Context) {
+        let Some(updater) = &self.updater else { return };
+        let status = updater.status();
+        let (title, body) = match &status {
+            update::Status::Idle => return,
+            update::Status::Available(v) => ("Update available", format!("A new version ({v}) is available.\nWould you like to download it now?")),
+            update::Status::Downloading(p) => ("Downloading update", format!("{p}%")),
+            update::Status::Ready(v) => ("Update ready", format!("Version {v} has been downloaded.\nThe application will restart to install it.")),
+            update::Status::Failed(e) => ("Update error", format!("Failed to update:\n{e}")),
+        };
+        egui::Window::new(title)
+            .collapsible(false)
+            .resizable(false)
+            .anchor(Align2::CENTER_CENTER, Vec2::ZERO)
+            .order(egui::Order::Tooltip)
+            .show(ctx, |ui| {
+                ui.label(body);
+                ui.add_space(8.0);
+                ui.horizontal(|ui| match &status {
+                    update::Status::Available(_) => {
+                        if ui.button("Download").clicked() {
+                            updater.download();
+                        }
+                        if ui.button("Later").clicked() {
+                            updater.dismiss();
+                        }
+                    }
+                    update::Status::Downloading(p) => {
+                        ui.add(egui::ProgressBar::new(*p as f32 / 100.0).desired_width(240.0));
+                    }
+                    update::Status::Ready(_) => {
+                        if ui.button("Restart now").clicked() {
+                            updater.restart_now();
+                        }
+                        // Installs on the next quit instead.
+                        if ui.button("Later").clicked() {
+                            updater.dismiss();
+                        }
+                    }
+                    _ => {
+                        if ui.button("OK").clicked() {
+                            updater.dismiss();
+                        }
+                    }
+                });
+            });
+    }
+
+    fn legend(&mut self, ctx: &egui::Context, rect: Rect) {
+        let resp = egui::Area::new(egui::Id::new("legend"))
+            .anchor(Align2::CENTER_BOTTOM, vec2(0.0, -8.0))
+            .order(egui::Order::Foreground)
+            .show(ctx, |ui| {
+                panel_frame().show(ui, |ui| {
+                    ui.set_max_width((rect.width() - 48.0).min(900.0));
+                    egui::Grid::new("legend-grid").num_columns(4).spacing([16.0, 6.0]).show(ui, |ui| {
+                        for (i, s) in shortcuts::SHORTCUTS.iter().enumerate() {
+                            ui.label(egui::RichText::new(s.chips).monospace().strong());
+                            ui.label(s.label);
+                            if i % 2 == 1 {
+                                ui.end_row();
+                            }
+                        }
+                    });
+                });
+            });
+        self.legend_top = resp.response.rect.top();
+    }
+}
+
+/// Electron logs `deviceId.slice(0, 8)`. Camera ids here are
+/// `camera-<unique id>`, whose first eight characters say nothing, so the
+/// prefix goes first.
+fn short_id(id: &str) -> String {
+    id.strip_prefix("camera-").map_or_else(|| id.to_owned(), |rest| rest.chars().take(8).collect())
+}
+
+/// `describeHealth()` from renderer.js, character for character:
+/// `ok 60fps luma=80+/-64.1 1920x1080 reopens=0`. `+/-` rather than the
+/// plus-minus sign, because the log is read with Windows tools that print it
+/// as two garbage characters.
+fn describe_health(info: &health::Info, frame: Option<&capture::Frame>) -> String {
+    let (luma, std) = info.luma.map_or(("-".to_owned(), "-".to_owned()), |l| {
+        (format!("{}", l.mean.round()), format!("{}", (l.std * 10.0).round() / 10.0))
+    });
+    let size = frame.map_or_else(|| "-".to_owned(), |f| format!("{}x{}", f.width(), f.height()));
+    let error = info.error.as_deref().map(|e| format!(" error={e}")).unwrap_or_default();
+    format!("{} {}fps luma={luma}+/-{std} {size} reopens={}{error}", info.status.name(), info.fps, info.attempts)
+}
+
+/// One health sample for a device: feed the policy, log it per side, and
+/// close the device for a reopen when the policy says so.
+fn check_health(
+    id: &str,
+    slot: &mut Slot,
+    frame: Option<&capture::Frame>,
+    now: f64,
+    sides: &[&str],
+    label: &str,
+    summary: bool,
+) {
+    let Some(stream) = &slot.stream else { return };
+    match stream.error() {
+        // Failed before a single frame: it never opened.
+        Some(e) if frame.is_none() => {
+            if slot.health.status() != Status::OpenFailed {
+                slot.health.open_failed(now, &e);
+            }
+        }
+        Some(_) => {
+            slot.health.sample(Sample { frames: frame.map(|f| f.seq), ended: true, stats: None }, now);
+        }
+        None => {
+            let stats = frame.map(|f| {
+                let (tw, th) = HEALTH_THUMB;
+                health::luma_stats(&f.health_thumbnail(tw, th))
+            });
+            slot.health.sample(Sample { frames: Some(frame.map_or(0, |f| f.seq)), ended: false, stats }, now);
+        }
+    }
+    let info = slot.health.info();
+    let described = describe_health(&info, frame);
+    if slot.last_logged != Some(info.status) {
+        let from = slot.last_logged.map_or("start", Status::name);
+        for side in sides {
+            if matches!(info.status, Status::Ok | Status::Opening | Status::Idle) {
+                log_info!("[Health] {side} ({label}): {from} -> {described}");
+            } else {
+                log_warn!("[Health] {side} ({label}): {from} -> {described}");
+            }
+        }
+        slot.last_logged = Some(info.status);
+    } else if summary && info.status != Status::Idle {
+        for side in sides {
+            log_info!("[Health] {side} ({label}): {described}");
+        }
+    }
+    let decision = slot.health.decide(now);
+    if decision.reopen {
+        slot.health.reopening(now);
+        let reason = decision.reason.map_or("?", Status::name);
+        log_warn!(
+            "[Health] reopening {} ({label}) for {}: {} {reason}, attempt {}",
+            short_id(id), sides.join("+"), sides.first().copied().unwrap_or("?"), slot.health.info().attempts
+        );
+        // Dropping the stream closes the device; it is opened again after
+        // the release gap, "so the driver sees the device closed rather than
+        // a handover".
+        slot.stream = None;
+        slot.texture = None;
+        slot.reopen_at = Some(now + health_limits::REOPEN_RELEASE_MS);
+    }
+}
+
+fn panel_frame() -> egui::Frame {
+    egui::Frame::NONE
+        .fill(Color32::from_rgba_unmultiplied(16, 16, 20, 235))
+        .corner_radius(CornerRadius::same(12))
+        .inner_margin(16)
+        .outer_margin(8)
+}
+
+fn hud_line(painter: &egui::Painter, at: egui::Pos2, text: &str) {
+    let galley = painter.layout_no_wrap(text.to_owned(), FontId::monospace(14.0), Color32::from_rgb(120, 255, 140));
+    let r = Rect::from_min_size(at, galley.size()).expand2(vec2(8.0, 4.0));
+    painter.rect_filled(r, 4.0, Color32::from_black_alpha(200));
+    painter.galley(at, galley, Color32::WHITE);
+}
+
+fn badge(painter: &egui::Painter, at: egui::Pos2, align: Align2, text: &str) {
+    let galley = painter.layout_no_wrap(text.to_owned(), FontId::proportional(22.0), Color32::WHITE);
+    let r = align.anchor_size(at, galley.size()).expand2(vec2(16.0, 8.0));
+    painter.rect_filled(r, 8.0, Color32::from_black_alpha(190));
+    painter.galley(r.min + vec2(16.0, 8.0), galley, Color32::WHITE);
+}
+
+/// One input tile: a fixed 128x72 still with the name under it, never the
+/// strip width (a first pass at `width: 100%` in the Electron app measured
+/// 292x164).
+fn tile(ui: &mut egui::Ui, label: &str, still: Option<&VideoTexture>, selected: bool, chip: Option<&str>) -> egui::Response {
+    let (rect, resp) = ui.allocate_exact_size(vec2(TILE.x, TILE.y + 22.0), Sense::click());
+    let img = Rect::from_min_size(rect.min, TILE);
+    let p = ui.painter();
+    match still {
+        Some(t) => {
+            p.image(t.id(), img, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+        }
+        None => {
+            p.rect_filled(img, 6.0, Color32::from_gray(30));
+            p.text(img.center(), Align2::CENTER_CENTER, "no preview", FontId::proportional(12.0), Color32::from_gray(110));
+        }
+    }
+    let stroke = if selected {
+        Stroke::new(3.0, Color32::from_rgb(90, 160, 255))
+    } else if resp.hovered() {
+        Stroke::new(2.0, Color32::from_gray(160))
+    } else {
+        Stroke::new(1.0, Color32::from_gray(60))
+    };
+    p.rect_stroke(img, 6.0, stroke, StrokeKind::Inside);
+    let name_pos = pos2(img.left(), img.bottom() + 4.0);
+    let name = p.layout(label.to_owned(), FontId::proportional(12.0), Color32::from_gray(220), TILE.x - 20.0);
+    p.galley(name_pos, name, Color32::from_gray(220));
+    if let Some(k) = chip {
+        let c = Rect::from_min_size(pos2(img.right() - 18.0, img.bottom() + 3.0), vec2(18.0, 16.0));
+        p.rect_filled(c, 4.0, Color32::from_gray(70));
+        p.text(c.center(), Align2::CENTER_CENTER, k, FontId::monospace(12.0), Color32::WHITE);
+    }
+    resp.on_hover_cursor(egui::CursorIcon::PointingHand)
+}
+
+impl eframe::App for InputViewer {
+    /// Everything that must keep running when nobody can see the window.
+    ///
+    /// eframe skips `ui()` entirely while the window is hidden or covered, and
+    /// calls only this. Health, reopening and device polling lived in `ui()`
+    /// at first, and a covered window simply stopped recovering its cards --
+    /// found by `--mock-fault` with the window behind others. On the wall any
+    /// window over the app (an update prompt, say) would have done the same.
+    fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        self.poll_devices(ctx);
+        self.sync_streams(ctx);
+        self.sample_health();
+        self.update_saver(Instant::now());
+        self.store.tick(&self.settings);
+        // Wake up on our own: with every input stalled or failed no frames
+        // arrive to request a repaint, and the reopen timers would never fire.
+        ctx.request_repaint_after(Duration::from_millis(500));
+    }
+
+    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
+        let ctx = ui.ctx().clone();
+        let now = Instant::now();
+        // Every change to settings, from any control or key, is caught by
+        // comparing against this at the end of the frame -- one place, like
+        // Electron's saveSettings(), so no call site can forget to save.
+        let before = self.settings.clone();
+        self.ui_frames.0 += 1;
+        let since = now.duration_since(self.ui_frames.1);
+        if since >= Duration::from_secs(1) {
+            self.ui_fps = self.ui_frames.0 as f32 / since.as_secs_f32();
+            self.ui_frames = (0, now);
+        }
+        let dt = now.duration_since(self.last_frame).as_secs_f32().min(0.1);
+        self.last_frame = now;
+
+        self.handle_keys(&ctx);
+        self.update_frames(&ctx, frame);
+
+        let rect = ui.max_rect();
+        self.paint_wall(ui, rect, now, dt);
+
+        // Hover-to-reveal on the top and bottom edges; a tap there toggles.
+        let (pointer, moved, tapped) = ctx.input(|i| (i.pointer.hover_pos(), i.pointer.is_moving(), i.pointer.primary_clicked()));
+        if moved || tapped {
+            self.last_activity = now;
+        }
+        if let Some(p) = pointer.filter(|_| self.settings_pane.is_none()) {
+            if p.y <= rect.top() + EDGE_PX {
+                self.dropdown_open = true;
+            } else if self.dropdown_open && p.y > self.dropdown_bottom + CLOSE_MARGIN {
+                self.dropdown_open = false;
+            }
+            if p.y >= rect.bottom() - EDGE_PX {
+                self.legend_open = true;
+            } else if self.legend_open && p.y < self.legend_top - CLOSE_MARGIN {
+                self.legend_open = false;
+            }
+        }
+        if let Some(open) = self.review.as_ref().and_then(|r| r.open.clone()) {
+            self.dropdown_open = open == "dropdown";
+            self.legend_open = open == "legend";
+            if let Some(pane) = open.strip_prefix("settings") {
+                self.settings_pane.get_or_insert(if pane == ":layout" { Pane::Layout } else { Pane::Inputs });
+            }
+            self.last_activity = now;
+        }
+        if self.dropdown_open && now.duration_since(self.last_activity) > DROPDOWN_IDLE {
+            self.dropdown_open = false;
+        }
+        if self.dropdown_open {
+            self.dropdown(&ctx, rect);
+        }
+        if self.legend_open {
+            self.legend(&ctx, rect);
+        }
+        self.paint_toast(&ctx, rect, now);
+        self.settings_dialog(&ctx, rect);
+        self.update_dialog(&ctx);
+
+        // The halves' current inputs are part of settings (leftDeviceId /
+        // rightDeviceId). Not overwritten with None before a side has an
+        // input: that is how Electron once forgot the wall's input on restart.
+        for (i, saved) in [&mut self.settings.left_device_id, &mut self.settings.right_device_id].into_iter().enumerate() {
+            if self.sides[i].is_some() {
+                saved.clone_from(&self.sides[i]);
+            }
+        }
+        if self.settings != before {
+            self.store.mark_dirty();
+        }
+        self.store.tick(&self.settings);
+        if let Some(review) = &mut self.review {
+            review.tick(&ctx);
+        }
+
+        // Animate the board and savers; capture threads request repaints for
+        // new frames themselves.
+        if self.saver.is_some() || self.board_since.iter().any(Option::is_some) || self.toast.is_some() {
+            ctx.request_repaint();
+        } else {
+            ctx.request_repaint_after(Duration::from_millis(500));
+        }
+    }
+
+    fn on_exit(&mut self, _gl: Option<&eframe::glow::Context>) {
+        self.store.flush(&self.settings);
+        if let Some(u) = &self.updater {
+            u.on_exit();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn devs(ids: &[&str]) -> Vec<Device> {
+        ids.iter().map(|id| Device { id: (*id).into(), label: id.to_uppercase(), index: None, test_pattern: None, mock_fault: None }).collect()
+    }
+
+    fn ids(sides: [Option<String>; 2]) -> [Option<&'static str>; 2] {
+        sides.map(|s| s.map(|s| &*s.leak()))
+    }
+
+    #[test]
+    fn first_launch_takes_the_first_two_enabled_inputs() {
+        let mut s = Settings::default();
+        s.input_mut("a").enabled = false;
+        let d = devs(&["a", "b", "c"]);
+        assert_eq!(ids(choose_sides(&d, &s, &[None, None], true)), [Some("b"), Some("c")]);
+    }
+
+    #[test]
+    fn saved_sides_beat_the_defaults_and_vanished_ones_are_ignored() {
+        let s = Settings { left_device_id: Some("c".into()), right_device_id: Some("gone".into()), ..Default::default() };
+        assert_eq!(ids(choose_sides(&devs(&["a", "b", "c"]), &s, &[None, None], true)), [Some("c"), Some("b")]);
+    }
+
+    #[test]
+    fn default_input_wins_at_startup_only_and_only_if_enabled() {
+        let mut s = Settings { default_input_id: Some("b".into()), left_device_id: Some("a".into()), ..Default::default() };
+        let d = devs(&["a", "b"]);
+        assert_eq!(ids(choose_sides(&d, &s, &[None, None], true)), [Some("b"), Some("b")]);
+        // A hot-plug later keeps what is on screen.
+        let on_screen = [Some("a".to_string()), Some("a".to_string())];
+        assert_eq!(ids(choose_sides(&d, &s, &on_screen, false)), [Some("a"), Some("a")]);
+        s.input_mut("b").enabled = false;
+        assert_eq!(ids(choose_sides(&d, &s, &[None, None], true))[0], Some("a"));
+    }
+
+    #[test]
+    fn without_multi_view_the_right_half_copies_the_left() {
+        let s = Settings { multi_view: false, ..Default::default() };
+        assert_eq!(ids(choose_sides(&devs(&["a", "b"]), &s, &[None, None], true)), [Some("a"), Some("a")]);
+    }
+
+    #[test]
+    fn side_borders_inset_the_content_and_never_cross() {
+        let wall = Rect::from_min_size(pos2(0.0, 0.0), vec2(6000.0, 1200.0));
+        let inner = wall_rect(wall, 100.0);
+        assert_eq!((inner.left(), inner.right()), (100.0, 5900.0));
+        assert_eq!(wall_rect(wall, 9999.0).width(), 0.0);
+    }
+
+    #[test]
+    fn dual_halves_split_what_the_gap_leaves() {
+        let wall = Rect::from_min_size(pos2(0.0, 0.0), vec2(6000.0, 1200.0));
+        let (l, d, r) = dual_rects(wall, 60.0);
+        assert_eq!((l.width(), d.width(), r.width()), (2970.0, 60.0, 2970.0));
+        assert_eq!((l.right(), r.left()), (d.left(), d.right()));
+        assert_eq!(dual_rects(wall, 9000.0).1.width(), 6000.0);
+    }
+
+    #[test]
+    fn logo_fits_the_divider_column() {
+        let d = Rect::from_min_size(pos2(2970.0, 0.0), vec2(60.0, 1200.0));
+        let r = logo_rect(d, vec2(1014.0, 275.0));
+        assert!((r.width() - 54.0).abs() < 0.01, "90% of the column: {r:?}");
+        assert_eq!(r.center(), d.center());
+    }
+
+    #[test]
+    fn picker_plan_matches_the_electron_table() {
+        let sides = |l, m| picker_plan(l, m).0.into_iter().map(|(_, s)| s).collect::<Vec<_>>();
+        assert_eq!(sides(Layout::Dual, true), [Side::Left, Side::Right]);
+        assert_eq!(sides(Layout::Dual, false), [Side::Both]);
+        assert_eq!(sides(Layout::Single, true), [Side::Left]);
+        assert_eq!(sides(Layout::Single, false), [Side::Both]);
+        assert!(!picker_plan(Layout::Dual, true).1, "per-half pickers carry no key chips");
+        assert!(picker_plan(Layout::Single, true).1);
+    }
+}
diff --git a/input_viewer_egui/src/app/settings_ui.rs b/input_viewer_egui/src/app/settings_ui.rs
new file mode 100644
index 0000000..6f3b7e6
--- /dev/null
+++ b/input_viewer_egui/src/app/settings_ui.rs
@@ -0,0 +1,304 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! The Settings dialog: a side-nav modal, like the Electron one, with the two
+//! panes whose features exist here -- Inputs and Layout. Remote keyboard and
+//! Art-Net come with those features; a pane for something that does nothing
+//! would suggest it works.
+//!
+//! Everything edits `self.settings` in place. Saving is not done here: the
+//! frame loop notices the change and writes it, debounced.
+
+use super::*;
+use crate::settings::{BORDER_WIDTH_RANGE, CENTER_GAP_RANGE};
+use crate::settings_status::{self as status, InputState, Tone};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Pane {
+    Inputs,
+    Layout,
+}
+
+const STILL: Vec2 = vec2(96.0, 54.0);
+const NAV_WIDTH: f32 = 180.0;
+const BODY_HEIGHT: f32 = 440.0;
+const NAME_WIDTH: f32 = 280.0;
+
+fn tone_color(tone: Tone) -> Color32 {
+    match tone {
+        Tone::Ok => Color32::from_rgb(80, 200, 120),
+        Tone::Warn => Color32::from_rgb(245, 180, 60),
+        Tone::Off => Color32::from_gray(110),
+    }
+}
+
+/// A status dot, sized to sit on a text line.
+fn dot(ui: &mut egui::Ui, tone: Tone) {
+    let (r, _) = ui.allocate_exact_size(vec2(10.0, 10.0), Sense::hover());
+    ui.painter().circle_filled(r.center(), 4.0, tone_color(tone));
+}
+
+impl InputViewer {
+    fn input_state(&self, id: &str) -> InputState {
+        let on_screen = self.visible_sides().iter().any(|&i| self.sides[i].as_deref() == Some(id));
+        if !on_screen {
+            return InputState::NotOnScreen;
+        }
+        let Some(slot) = self.slots.get(id) else { return InputState::Opening };
+        let Some(stream) = &slot.stream else { return InputState::Reopening };
+        match slot.health.status() {
+            Status::Ok => match stream.latest() {
+                Some(f) => InputState::Live { width: f.width(), height: f.height() },
+                None => InputState::Opening,
+            },
+            Status::Idle | Status::Opening => InputState::Opening,
+            Status::Dark => InputState::Dark,
+            Status::NoFrames => InputState::Failed("No frames since it opened".into()),
+            Status::Stalled => InputState::Failed("Frames stopped".into()),
+            Status::Ended => InputState::Failed("The stream ended".into()),
+            Status::OpenFailed => InputState::Failed(format!("Could not open: {}", slot.health.info().error.unwrap_or_default())),
+        }
+    }
+
+    pub(super) fn settings_dialog(&mut self, ctx: &egui::Context, wall: Rect) {
+        let Some(mut pane) = self.settings_pane else { return };
+        let states: Vec<(bool, InputState)> = self
+            .devices
+            .iter()
+            .map(|d| (self.settings.is_enabled(&d.id), self.input_state(&d.id)))
+            .collect();
+        let mut close = false;
+
+        let modal = egui::Modal::new(egui::Id::new("settings")).show(ctx, |ui| {
+            ui.set_width(820.0_f32.min(wall.width() - 64.0));
+            ui.horizontal(|ui| {
+                ui.heading("Settings");
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    close = ui.button("Close").clicked();
+                });
+            });
+            ui.separator();
+            // Fixed height: inside a modal there is no parent to fill, so
+            // anything asking for "all the height" -- a vertical separator,
+            // say -- takes the whole window instead.
+            // Fits a laptop-sized window as well as the wall: header and
+            // footer take about 110pt between them.
+            let body_height = BODY_HEIGHT.min(wall.height() - 140.0).max(200.0);
+            let body = vec2(ui.available_width(), body_height);
+            ui.allocate_ui_with_layout(body, egui::Layout::left_to_right(egui::Align::Min), |ui| {
+                ui.allocate_ui_with_layout(vec2(NAV_WIDTH, body_height), egui::Layout::top_down(egui::Align::Min), |ui| {
+                    ui.set_width(NAV_WIDTH);
+                    let (inputs_text, inputs_tone) = status::inputs_nav(&states);
+                    nav_item(ui, &mut pane, Pane::Inputs, "Inputs", &inputs_text, inputs_tone);
+                    let layout_text = match self.settings.layout() {
+                        Layout::Dual => "Dual",
+                        Layout::Single => "Single",
+                    };
+                    nav_item(ui, &mut pane, Pane::Layout, "Layout", layout_text, Tone::Off);
+                    ui.add_space(16.0);
+                    ui.label(egui::RichText::new("Remote keyboard and Art-Net are not in this prototype yet.").small().weak());
+                });
+                let (line, _) = ui.allocate_exact_size(vec2(17.0, body_height), Sense::hover());
+                ui.painter().vline(line.center().x, line.y_range(), ui.visuals().widgets.noninteractive.bg_stroke);
+                let width = ui.available_width();
+                ui.allocate_ui_with_layout(vec2(width, body_height), egui::Layout::top_down(egui::Align::Min), |ui| {
+                    ui.set_width(width);
+                    match pane {
+                        Pane::Inputs => self.inputs_pane(ui, &states),
+                        Pane::Layout => self.layout_pane(ui, wall),
+                    }
+                });
+            });
+            ui.separator();
+            let saved = match self.store.path() {
+                Some(p) => format!("Changes save automatically to {}", p.display()),
+                None => "Test mode: changes apply now but are not saved.".into(),
+            };
+            ui.label(egui::RichText::new(saved).small().weak());
+        });
+
+        self.settings_pane = if close || modal.should_close() { None } else { Some(pane) };
+    }
+
+    fn inputs_pane(&mut self, ui: &mut egui::Ui, states: &[(bool, InputState)]) {
+        ui.label(egui::RichText::new("Inputs").strong());
+        ui.label(egui::RichText::new(
+            "Name an input to show that name instead of the device's. Disabled inputs are \
+             left out of the pickers and the number keys.").small().weak());
+        ui.add_space(6.0);
+
+        if self.devices.is_empty() {
+            ui.weak("No capture devices found.");
+            return;
+        }
+
+        // Start-up input: "last used" is Electron's null defaultInputId.
+        ui.horizontal(|ui| {
+            ui.label("At start-up show");
+            let mut last_used = self.settings.default_input_id.is_none();
+            if ui.radio_value(&mut last_used, true, "the inputs last on screen").clicked() {
+                self.settings.default_input_id = None;
+            }
+            ui.weak("or the one marked below");
+        });
+        ui.add_space(4.0);
+
+        let devices = self.devices.clone();
+        let mut enabled_index = 0;
+        egui::ScrollArea::vertical().max_height(ui.available_height()).show(ui, |ui| {
+            egui::Grid::new("settings-inputs").num_columns(5).spacing([12.0, 10.0]).show(ui, |ui| {
+                ui.weak("Key");
+                ui.weak("");
+                ui.weak("Name");
+                ui.weak("Enabled");
+                ui.weak("Start-up");
+                ui.end_row();
+
+                for (d, (enabled, state)) in devices.iter().zip(states) {
+                    let key = status::input_key_label(enabled.then_some(enabled_index));
+                    if *enabled {
+                        enabled_index += 1;
+                    }
+                    ui.label(egui::RichText::new(key).monospace().strong());
+
+                    let (r, _) = ui.allocate_exact_size(STILL, Sense::hover());
+                    match self.stills.get(&d.id) {
+                        Some(t) => {
+                            ui.painter().image(t.id(), r, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
+                        }
+                        None => {
+                            ui.painter().rect_filled(r, 4.0, Color32::from_gray(30));
+                        }
+                    }
+
+                    ui.vertical(|ui| {
+                        // A grid column shrinks to its content's minimum,
+                        // which for a text field is a few characters.
+                        ui.set_min_width(NAME_WIDTH);
+                        let mut name = self.settings.inputs.get(&d.id).and_then(|i| i.name.clone()).unwrap_or_default();
+                        let edit = ui.add(egui::TextEdit::singleline(&mut name).hint_text(&d.label).desired_width(NAME_WIDTH));
+                        if edit.changed() {
+                            self.settings.input_mut(&d.id).name = (!name.is_empty()).then_some(name);
+                        }
+                        // Trimmed when the field is left, as Electron's change
+                        // event does -- not per keystroke, which would eat the
+                        // space while typing a two-word name.
+                        if edit.lost_focus()
+                            && let Some(n) = self.settings.input_mut(&d.id).name.as_mut()
+                        {
+                            *n = n.trim().to_owned();
+                            if n.is_empty() {
+                                self.settings.input_mut(&d.id).name = None;
+                            }
+                        }
+                        let (tone, line) = status::input_status(*enabled, state);
+                        ui.horizontal(|ui| {
+                            dot(ui, tone);
+                            let what = if self.settings.name_of(&d.id).is_some() {
+                                format!("{} · {line}", d.label)
+                            } else {
+                                line
+                            };
+                            ui.label(egui::RichText::new(what).small().weak());
+                        });
+                    });
+
+                    let mut on = *enabled;
+                    if ui.checkbox(&mut on, "").changed() {
+                        self.settings.input_mut(&d.id).enabled = on;
+                    }
+
+                    let is_default = self.settings.default_input_id.as_deref() == Some(d.id.as_str());
+                    if ui.add_enabled(*enabled, egui::RadioButton::new(is_default, "")).clicked() {
+                        self.settings.default_input_id = Some(d.id.clone());
+                    }
+                    ui.end_row();
+                }
+            });
+        });
+    }
+
+    fn layout_pane(&mut self, ui: &mut egui::Ui, wall: Rect) {
+        ui.label(egui::RichText::new("Layout").strong());
+        ui.add_space(6.0);
+
+        egui::Grid::new("settings-layout").num_columns(2).spacing([16.0, 10.0]).show(ui, |ui| {
+            ui.label("View");
+            ui.horizontal(|ui| {
+                let mut layout = self.settings.layout();
+                ui.selectable_value(&mut layout, Layout::Dual, "Dual");
+                ui.selectable_value(&mut layout, Layout::Single, "Single");
+                self.settings.layout_mode = Some(layout);
+            });
+            ui.end_row();
+
+            ui.label("Multi-view");
+            let mut multi = self.settings.multi_view;
+            if ui.checkbox(&mut multi, "Each half can show a different input").changed() {
+                self.set_multi_view(multi);
+            }
+            ui.end_row();
+
+            ui.label("Centre gap");
+            ui.add(egui::Slider::new(&mut self.settings.center_gap, CENTER_GAP_RANGE).step_by(1.0).suffix(" px"));
+            ui.end_row();
+
+            ui.label("Side borders");
+            ui.add(egui::Slider::new(&mut self.settings.border_width, BORDER_WIDTH_RANGE).step_by(1.0).suffix(" px"));
+            ui.end_row();
+        });
+
+        ui.add_space(12.0);
+        ui.label(egui::RichText::new("The wall behind this dialog follows as you drag; the diagram is the whole wall to scale.").small().weak());
+        ui.add_space(4.0);
+        self.layout_diagram(ui, wall);
+    }
+
+    /// The wall to scale, built from the same geometry the wall is painted
+    /// with, so the two cannot disagree.
+    fn layout_diagram(&self, ui: &mut egui::Ui, wall: Rect) {
+        let width = ui.available_width().min(560.0);
+        let size = vec2(width, width * wall.height() / wall.width().max(1.0));
+        let (area, _) = ui.allocate_exact_size(size, Sense::hover());
+        let s = area.width() / wall.width().max(1.0);
+        let map = |r: Rect| Rect::from_min_max(area.min + (r.min - wall.min) * s, area.min + (r.max - wall.min) * s);
+        let p = ui.painter();
+
+        p.rect_filled(area, 2.0, Color32::BLACK);
+        let inner = wall_rect(wall, self.settings.border_width);
+        let halves: Vec<(usize, Rect)> = match self.settings.layout() {
+            Layout::Single => vec![(0, inner)],
+            Layout::Dual => {
+                let (l, divider, r) = dual_rects(inner, self.settings.center_gap);
+                if let Some(logo) = &self.logo {
+                    let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+                    p.image(logo.id(), map(logo_rect(divider, logo.size_vec2())), uv, Color32::WHITE);
+                }
+                vec![(0, l), (1, r)]
+            }
+        };
+        for (i, half) in halves {
+            let r = map(half);
+            p.rect_filled(r, 0.0, Color32::from_rgb(34, 38, 48));
+            let text = self.label_of(self.sides[i].as_ref());
+            p.text(r.center(), Align2::CENTER_CENTER, text, FontId::proportional(12.0), Color32::from_gray(200));
+        }
+        p.rect_stroke(area, 2.0, Stroke::new(1.0, Color32::from_gray(70)), StrokeKind::Outside);
+    }
+}
+
+fn nav_item(ui: &mut egui::Ui, current: &mut Pane, pane: Pane, label: &str, state: &str, tone: Tone) {
+    let selected = *current == pane;
+    let resp = ui
+        .horizontal(|ui| {
+            let r = ui.selectable_label(selected, label);
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                ui.label(egui::RichText::new(state).small().weak());
+                dot(ui, tone);
+            });
+            r
+        })
+        .inner;
+    if resp.clicked() {
+        *current = pane;
+    }
+}
diff --git a/input_viewer_egui/src/capture.rs b/input_viewer_egui/src/capture.rs
new file mode 100644
index 0000000..a606e86
--- /dev/null
+++ b/input_viewer_egui/src/capture.rs
@@ -0,0 +1,424 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Capture devices and streams.
+//!
+//! Each open stream is a thread that writes its latest RGBA frame into a shared
+//! slot; the UI thread picks it up once per repaint. A stream is opened per
+//! *device*, not per side, so both halves showing one card share it -- the same
+//! reason the Electron app releases every side on a device before a reopen.
+//!
+//! Mock inputs (`--mock`) are generated here rather than stubbed in the UI, so
+//! detection reads them through exactly the path a capture card takes.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+use std::thread::JoinHandle;
+use std::time::{Duration, Instant};
+
+use eframe::egui;
+use crate::filelog::{log_error, log_info, log_warn};
+
+pub const MOCK_PREFIX: &str = "mock-input-";
+const MOCK_WIDTH: usize = 1280;
+const MOCK_HEIGHT: usize = 720;
+const MOCK_FPS: u64 = 15;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Device {
+    /// Stable across restarts and replugging: settings are keyed by it.
+    pub id: String,
+    pub label: String,
+    /// Where the backend opens it. Not the id: list positions shift whenever
+    /// a device is added, so a setting keyed by position would follow
+    /// whichever camera happened to be enumerated there.
+    pub index: Option<String>,
+    /// Mock inputs only: draw the motion test pattern at this size and rate
+    /// instead of colour bars (`--test-pattern`).
+    pub test_pattern: Option<PatternFormat>,
+    /// Mock inputs only: misbehave this way (`--mock-fault`).
+    pub mock_fault: Option<MockFault>,
+}
+
+/// How a mock input misbehaves, to drive the health policy without hardware.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MockFault {
+    /// Frames keep arriving, all one flat dark colour: a card with no source.
+    Dark,
+    /// Ten seconds of normal frames, then none: a hung card.
+    Stall,
+    /// The device cannot be opened.
+    Fail,
+}
+
+/// How long a `Stall` mock delivers before it stops.
+const MOCK_STALL_AFTER: Duration = Duration::from_secs(10);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct PatternFormat {
+    pub width: usize,
+    pub height: usize,
+    pub fps: u32,
+}
+
+/// A captured frame, already in egui's pixel format.
+///
+/// Converted on the capture thread, and handed to egui as an `Arc` with no
+/// copy. At 3840x2160 a per-pixel conversion on the UI thread costs several
+/// milliseconds a frame per input -- for two 4K60 cards, a large part of the
+/// frame budget spent before anything is drawn.
+pub struct Frame {
+    pub pixels: Pixels,
+    width: usize,
+    height: usize,
+    pub seq: u64,
+    pub captured_at: Instant,
+}
+
+/// What a frame carries.
+pub enum Pixels {
+    /// Ready for egui, as an `Arc` it can take without a copy.
+    Rgba(Arc<egui::ColorImage>),
+    /// The card's own packed 4:2:2 bytes, `Y0 U Y1 V` per pixel pair,
+    /// converted to RGB on the GPU (`gpu_video.rs`). On the wall's cards this
+    /// is the only 4K format, and converting it on one CPU core took ~49 ms a
+    /// frame.
+    Yuyv(bytes::Bytes),
+}
+
+impl Frame {
+    pub fn new(width: usize, height: usize, pixels: Vec<egui::Color32>, seq: u64) -> Self {
+        let image = Arc::new(egui::ColorImage::new([width, height], pixels));
+        Self { pixels: Pixels::Rgba(image), width, height, seq, captured_at: Instant::now() }
+    }
+    pub fn new_yuyv(width: usize, height: usize, bytes: bytes::Bytes, seq: u64) -> Self {
+        debug_assert_eq!(bytes.len(), width * height * 2);
+        Self { pixels: Pixels::Yuyv(bytes), width, height, seq, captured_at: Instant::now() }
+    }
+    pub fn width(&self) -> usize {
+        self.width
+    }
+    pub fn height(&self) -> usize {
+        self.height
+    }
+    /// An averaged RGBA thumbnail for the health check, whatever the format.
+    pub fn health_thumbnail(&self, tw: usize, th: usize) -> Vec<u8> {
+        match &self.pixels {
+            Pixels::Rgba(image) => {
+                crate::health::thumbnail(bytemuck::cast_slice(&image.pixels), self.width, self.height, tw, th)
+            }
+            Pixels::Yuyv(bytes) => crate::yuv::luma_thumbnail(bytes, self.width, self.height, tw, th),
+        }
+    }
+}
+
+/// RGBA bytes to pixels, reusing the allocation when it can.
+pub fn pixels_from_rgba(rgba: Vec<u8>) -> Vec<egui::Color32> {
+    bytemuck::allocation::try_cast_vec(rgba).unwrap_or_else(|(_, v)| {
+        v.as_chunks::<4>().0.iter().map(|p| egui::Color32::from_rgba_premultiplied(p[0], p[1], p[2], p[3])).collect()
+    })
+}
+
+#[derive(Default)]
+struct Shared {
+    latest: Mutex<Option<Arc<Frame>>>,
+    error: Mutex<Option<String>>,
+}
+
+pub struct Stream {
+    shared: Arc<Shared>,
+    stop: Arc<AtomicBool>,
+    handle: Option<JoinHandle<()>>,
+}
+
+impl Stream {
+    pub fn open(device: &Device, ctx: egui::Context) -> Self {
+        let shared = Arc::new(Shared::default());
+        let stop = Arc::new(AtomicBool::new(false));
+        let (s, st, d) = (shared.clone(), stop.clone(), device.clone());
+        let handle = std::thread::Builder::new()
+            .name(format!("capture {}", device.id))
+            .spawn(move || {
+                let result = if let Some(n) = d.id.strip_prefix(MOCK_PREFIX) {
+                    let n = n.parse().unwrap_or(1);
+                    match d.test_pattern {
+                        Some(f) => {
+                            run_test_pattern(n, f, &s, &st, &ctx);
+                            Ok(())
+                        }
+                        None => run_mock(n, d.mock_fault, &s, &st, &ctx),
+                    }
+                } else {
+                    run_camera(&d, &s, &st, &ctx)
+                };
+                if let Err(e) = result {
+                    log_error!("[Video] {}: {e}", d.label);
+                    *s.error.lock().unwrap() = Some(e);
+                    ctx.request_repaint();
+                }
+            })
+            .expect("spawn capture thread");
+        Self { shared, stop, handle: Some(handle) }
+    }
+
+    pub fn latest(&self) -> Option<Arc<Frame>> {
+        self.shared.latest.lock().unwrap().clone()
+    }
+
+    pub fn error(&self) -> Option<String> {
+        self.shared.error.lock().unwrap().clone()
+    }
+}
+
+impl Drop for Stream {
+    fn drop(&mut self) {
+        self.stop.store(true, Ordering::Relaxed);
+        // Joined off-thread: a camera blocked in frame() can take a frame
+        // interval to notice, and the UI must not stall on an input switch.
+        if let Some(h) = self.handle.take() {
+            std::thread::spawn(move || {
+                let _ = h.join();
+            });
+        }
+    }
+}
+
+fn publish(shared: &Shared, frame: Frame, ctx: &egui::Context) {
+    *shared.latest.lock().unwrap() = Some(Arc::new(frame));
+    ctx.request_repaint();
+}
+
+// ---------------------------------------------------------------------------
+// Mock inputs
+// ---------------------------------------------------------------------------
+
+/// `fault`, if any, applies to the last input only, so the others stay
+/// healthy to compare against.
+pub fn mock_devices(count: usize, test_pattern: Option<PatternFormat>, fault: Option<MockFault>) -> Vec<Device> {
+    (1..=count)
+        .map(|i| Device {
+            id: format!("{MOCK_PREFIX}{i}"),
+            label: match test_pattern {
+                Some(f) => format!("Test {i} {}x{}@{}", f.width, f.height, f.fps),
+                None => format!("Mock Input {i}"),
+            },
+            index: None,
+            test_pattern,
+            mock_fault: fault.filter(|_| i == count),
+        })
+        .collect()
+}
+
+const BARS: [[u8; 3]; 7] = [
+    [0xc0, 0xc0, 0xc0], [0xc0, 0xc0, 0x00], [0x00, 0xc0, 0xc0], [0x00, 0xc0, 0x00],
+    [0xc0, 0x00, 0xc0], [0xc0, 0x00, 0x00], [0x00, 0x00, 0xc0],
+];
+
+/// Colour bars plus a sweeping bar, so consecutive frames differ and detection
+/// reads the input as live. Each input's bars are rotated by its number, so a
+/// glance tells them apart without rasterising a label.
+pub fn draw_mock_frame(n: usize, phase: f32, w: usize, h: usize) -> Vec<u8> {
+    let mut px = vec![0u8; w * h * 4];
+    let bar_h = h * 2 / 3;
+    let sweep_w = (w as f32 * 0.012).max(2.0);
+    let sweep_x = phase * (w as f32 + sweep_w) - sweep_w;
+    for y in 0..h {
+        for x in 0..w {
+            let mut c = if y < bar_h {
+                BARS[(x * BARS.len() / w + n - 1) % BARS.len()]
+            } else {
+                [0x10, 0x10, 0x14]
+            };
+            if (x as f32) >= sweep_x && (x as f32) < sweep_x + sweep_w {
+                for ch in &mut c {
+                    *ch = (*ch as f32 * 0.45 + 255.0 * 0.55) as u8;
+                }
+            }
+            let i = (y * w + x) * 4;
+            px[i..i + 4].copy_from_slice(&[c[0], c[1], c[2], 255]);
+        }
+    }
+    px
+}
+
+fn run_mock(n: usize, fault: Option<MockFault>, shared: &Shared, stop: &AtomicBool, ctx: &egui::Context) -> Result<(), String> {
+    if fault == Some(MockFault::Fail) {
+        return Err("could not open (--mock-fault=fail)".into());
+    }
+    let period = Duration::from_millis(1000 / MOCK_FPS);
+    let start = Instant::now();
+    let mut seq = 0;
+    while !stop.load(Ordering::Relaxed) {
+        let stalled = fault == Some(MockFault::Stall) && start.elapsed() >= MOCK_STALL_AFTER;
+        if !stalled {
+            let pixels = if fault == Some(MockFault::Dark) {
+                // The near-black a card shows with nothing plugged in.
+                vec![egui::Color32::from_rgb(10, 10, 12); MOCK_WIDTH * MOCK_HEIGHT]
+            } else {
+                let phase = (start.elapsed().as_secs_f32() / 4.0).fract();
+                pixels_from_rgba(draw_mock_frame(n, phase, MOCK_WIDTH, MOCK_HEIGHT))
+            };
+            seq += 1;
+            publish(shared, Frame::new(MOCK_WIDTH, MOCK_HEIGHT, pixels, seq), ctx);
+        }
+        std::thread::sleep(period);
+    }
+    Ok(())
+}
+
+/// `--test-pattern`: frames on an absolute schedule, so the rate is exactly
+/// `fps` on average rather than drifting by the time each frame takes to draw.
+/// A frame that cannot be drawn in time is skipped, not queued, the way a
+/// capture card drops rather than buffers -- and logged, because then the
+/// *source* is the bottleneck and the renderer's numbers mean nothing.
+fn run_test_pattern(n: usize, f: PatternFormat, shared: &Shared, stop: &AtomicBool, ctx: &egui::Context) {
+    let pattern = crate::testpattern::Pattern::new(f.width, f.height, f.fps, n);
+    let period = Duration::from_secs_f64(1.0 / f.fps.max(1) as f64);
+    let start = Instant::now();
+    let mut late = 0u64;
+    let mut frame = 0u64;
+    while !stop.load(Ordering::Relaxed) {
+        // YUY2, as the wall's cards deliver at 4K, so the test exercises the
+        // same GPU conversion path a real input takes.
+        let pixels = pattern.frame(frame);
+        let yuyv = crate::yuv::rgba_to_yuyv(bytemuck::cast_slice(&pixels), f.width, f.height);
+        // seq starts at 1 like every other source; the pattern counts from 0.
+        publish(shared, Frame::new_yuyv(f.width, f.height, bytes::Bytes::from(yuyv), frame + 1), ctx);
+        let next = frame + 1;
+        let due = start + period.mul_f64(next as f64);
+        let now = Instant::now();
+        if now < due {
+            std::thread::sleep(due - now);
+            frame = next;
+        } else {
+            // Behind: jump to the frame that is due now.
+            let behind = ((now - start).as_secs_f64() / period.as_secs_f64()) as u64;
+            late += behind.saturating_sub(next);
+            frame = behind.max(next);
+            if late > 0 && late.is_power_of_two() {
+                log_warn!("[TestPattern] input {n}: source fell behind, {late} frames skipped so far");
+            }
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Real capture devices
+// ---------------------------------------------------------------------------
+
+#[cfg(feature = "camera")]
+mod camera {
+    use super::*;
+    use nokhwa::pixel_format::RgbAFormat;
+    use nokhwa::utils::{ApiBackend, CameraIndex, FrameFormat, RequestedFormat, RequestedFormatType};
+
+    const PREFIX: &str = "camera-";
+
+    /// Ask for camera permission. macOS needs this before `query` returns
+    /// anything; elsewhere it completes immediately.
+    pub fn initialize(on_done: impl Fn(bool) + Send + Sync + 'static) {
+        nokhwa::nokhwa_initialize(on_done);
+    }
+
+    pub fn devices() -> Vec<Device> {
+        match nokhwa::query(ApiBackend::Auto) {
+            Ok(list) => list
+                .into_iter()
+                .map(|info| {
+                    // misc() is AVFoundation's uniqueID on macOS and the
+                    // device's symbolic link on Windows: both survive a
+                    // restart and a replug into the same port.
+                    let stable = info.misc();
+                    let key = if stable.trim().is_empty() { info.index().as_string() } else { stable };
+                    Device {
+                        id: format!("{PREFIX}{key}"),
+                        label: info.human_name(),
+                        index: Some(info.index().as_string()),
+                        test_pattern: None,
+                        mock_fault: None,
+                    }
+                })
+                .collect(),
+            Err(e) => {
+                log_error!("[Devices] device query failed: {e}");
+                Vec::new()
+            }
+        }
+    }
+
+    pub fn run(d: &Device, shared: &Shared, stop: &AtomicBool, ctx: &egui::Context) -> Result<(), String> {
+        let raw = d.index.as_deref().ok_or("not a camera")?;
+        let index = match raw.parse::<u32>() {
+            Ok(i) => CameraIndex::Index(i),
+            Err(_) => CameraIndex::String(raw.to_owned()),
+        };
+        let format = RequestedFormat::new::<RgbAFormat>(RequestedFormatType::AbsoluteHighestResolution);
+        let mut cam = nokhwa::Camera::new(index, format).map_err(|e| e.to_string())?;
+        cam.open_stream().map_err(|e| e.to_string())?;
+        // The negotiated format, pixel format and rate included: the wall's
+        // ~13 fps came down to which native format nokhwa had picked, and
+        // only "3840x2160" was logged.
+        let f = cam.camera_format();
+        log_info!("[Video] {} stream: {}x{} {:?} @ {}fps", d.label, f.resolution().width_x,
+            f.resolution().height_y, f.format(), f.frame_rate());
+        let mut seq = 0;
+        // Where a frame's time goes, once per 120 frames: waiting for the
+        // card, or converting to RGBA on this one thread.
+        let (mut read_time, mut convert_time, mut n) = (Duration::ZERO, Duration::ZERO, 0u32);
+        let mut window = Instant::now();
+        while !stop.load(Ordering::Relaxed) {
+            let t0 = Instant::now();
+            let buf = cam.frame().map_err(|e| e.to_string())?;
+            let t1 = Instant::now();
+            seq += 1;
+            let res = buf.resolution();
+            let (w, h) = (res.width_x as usize, res.height_y as usize);
+            // YUY2 goes to the GPU as it arrived; anything else is converted
+            // here, as before.
+            let frame = if buf.source_frame_format() == FrameFormat::YUYV && w % 2 == 0 && buf.buffer().len() == w * h * 2 {
+                Frame::new_yuyv(w, h, buf.buffer_bytes(), seq)
+            } else {
+                let img = buf.decode_image::<RgbAFormat>().map_err(|e| e.to_string())?;
+                Frame::new(img.width() as usize, img.height() as usize, pixels_from_rgba(img.into_raw()), seq)
+            };
+            let t2 = Instant::now();
+            publish(shared, frame, ctx);
+            read_time += t1 - t0;
+            convert_time += t2 - t1;
+            n += 1;
+            if n == 120 {
+                let secs = window.elapsed().as_secs_f64();
+                log_info!("[Video] {}: {:.1} fps delivered; per frame {:.1} ms waiting for the card, {:.1} ms converting",
+                    d.label, f64::from(n) / secs,
+                    read_time.as_secs_f64() * 1000.0 / f64::from(n),
+                    convert_time.as_secs_f64() * 1000.0 / f64::from(n));
+                (read_time, convert_time, n) = (Duration::ZERO, Duration::ZERO, 0);
+                window = Instant::now();
+            }
+        }
+        let _ = cam.stop_stream();
+        Ok(())
+    }
+}
+
+#[cfg(feature = "camera")]
+pub use camera::{devices as camera_devices, initialize as camera_initialize};
+
+#[cfg(feature = "camera")]
+fn run_camera(d: &Device, s: &Shared, st: &AtomicBool, ctx: &egui::Context) -> Result<(), String> {
+    camera::run(d, s, st, ctx)
+}
+
+#[cfg(not(feature = "camera"))]
+pub fn camera_initialize(on_done: impl Fn(bool) + Send + Sync + 'static) {
+    on_done(false);
+}
+
+#[cfg(not(feature = "camera"))]
+pub fn camera_devices() -> Vec<Device> {
+    Vec::new()
+}
+
+#[cfg(not(feature = "camera"))]
+fn run_camera(_: &Device, _: &Shared, _: &AtomicBool, _: &egui::Context) -> Result<(), String> {
+    Err("built without the `camera` feature".into())
+}
diff --git a/input_viewer_egui/src/filelog.rs b/input_viewer_egui/src/filelog.rs
new file mode 100644
index 0000000..69afb65
--- /dev/null
+++ b/input_viewer_egui/src/filelog.rs
@@ -0,0 +1,379 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Persistent app log: one file per day, kept for a week. A port of
+//! `src/main/file-log.js` (ADR 0044), with its tests.
+//!
+//! The wall came up with a dark capture card, someone restarted the app ten
+//! minutes later, and there was no way to tell afterwards what it had seen.
+//! This is the record, and the operators read it: the file names, the line
+//! format and the `[Health]` lines are an interface, not an implementation
+//! detail.
+//!
+//! Bounded three ways, because the wall runs for months:
+//! - files older than `retention_days` are deleted (on start and at each day
+//!   change), by the date in the name, not the mtime;
+//! - a day's file stops growing at `max_bytes_per_day`, with one line saying so;
+//! - more than `max_lines_per_minute` lines in a minute are dropped and
+//!   counted, so a log loop cannot fill the disk before the cap matters.
+//!
+//! Worst case on disk is 7 x 20 MB. Appends are synchronous on purpose: a
+//! crash or a hard power-off is exactly when the last lines matter. A log that
+//! cannot be written disables itself rather than ever take the app down.
+
+use std::fs::{self, OpenOptions};
+use std::io::Write as _;
+use std::path::{Path, PathBuf};
+use std::sync::{Mutex, OnceLock};
+
+use chrono::{Datelike, Duration, Local, NaiveDate, NaiveDateTime, Timelike};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Level {
+    Info,
+    Warn,
+    Error,
+}
+
+impl Level {
+    fn label(self) -> &'static str {
+        match self {
+            Level::Info => "INFO",
+            Level::Warn => "WARN",
+            Level::Error => "ERROR",
+        }
+    }
+}
+
+pub struct Limits {
+    pub retention_days: i64,
+    pub max_bytes_per_day: u64,
+    pub max_lines_per_minute: u32,
+    pub max_line_length: usize,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self { retention_days: 7, max_bytes_per_day: 20 * 1024 * 1024, max_lines_per_minute: 600, max_line_length: 2000 }
+    }
+}
+
+/// Local-date stamp, so a file is one wall-clock day where the wall is.
+pub fn day_stamp(d: NaiveDate) -> String {
+    format!("{:04}-{:02}-{:02}", d.year(), d.month(), d.day())
+}
+
+fn time_stamp(t: NaiveDateTime) -> String {
+    format!("{:02}:{:02}:{:02}.{:03}", t.hour(), t.minute(), t.second(), t.and_utc().timestamp_subsec_millis())
+}
+
+/// The day in a log file's name, or None for anything else in the folder.
+fn file_day(name: &str) -> Option<NaiveDate> {
+    let stamp = name.strip_prefix("input-viewer-")?.strip_suffix(".log")?;
+    NaiveDate::parse_from_str(stamp, "%Y-%m-%d").ok()
+}
+
+pub struct FileLog {
+    dir: PathBuf,
+    limits: Limits,
+    day: Option<NaiveDate>,
+    file: PathBuf,
+    bytes: u64,
+    capped: bool,
+    minute: Option<i64>,
+    lines_this_minute: u32,
+    dropped: u32,
+    broken: bool,
+}
+
+impl FileLog {
+    pub fn new(dir: impl Into<PathBuf>, limits: Limits) -> Self {
+        Self {
+            dir: dir.into(),
+            limits,
+            day: None,
+            file: PathBuf::new(),
+            bytes: 0,
+            capped: false,
+            minute: None,
+            lines_this_minute: 0,
+            dropped: 0,
+            broken: false,
+        }
+    }
+
+    pub fn dir(&self) -> &Path {
+        &self.dir
+    }
+
+    /// Delete files past retention. Returns the names removed.
+    pub fn prune(&self, today: NaiveDate) -> Vec<String> {
+        let Ok(entries) = fs::read_dir(&self.dir) else { return Vec::new() };
+        // Compare calendar days, not mtimes: a file touched late is still that day.
+        let cutoff = today - Duration::days(self.limits.retention_days - 1);
+        let mut removed = Vec::new();
+        for entry in entries.flatten() {
+            let name = entry.file_name().to_string_lossy().into_owned();
+            if file_day(&name).is_some_and(|d| d < cutoff) && fs::remove_file(entry.path()).is_ok() {
+                // In use or gone: try again tomorrow.
+                removed.push(name);
+            }
+        }
+        removed
+    }
+
+    fn roll_if_needed(&mut self, now: NaiveDateTime) {
+        let today = now.date();
+        if self.day == Some(today) {
+            return;
+        }
+        self.day = Some(today);
+        self.file = self.dir.join(format!("input-viewer-{}.log", day_stamp(today)));
+        self.capped = false;
+        self.bytes = fs::create_dir_all(&self.dir)
+            .ok()
+            .and_then(|()| fs::metadata(&self.file).ok())
+            .map_or(0, |m| m.len());
+        self.prune(today);
+    }
+
+    fn append(&mut self, text: &str) {
+        if self.broken {
+            return;
+        }
+        let ok = OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(&self.file)
+            .and_then(|mut f| f.write_all(text.as_bytes()));
+        match ok {
+            Ok(()) => self.bytes += text.len() as u64,
+            // Stop trying rather than fail on every line.
+            Err(_) => self.broken = true,
+        }
+    }
+
+    /// Today's file.
+    #[cfg(test)]
+    pub fn path(&mut self, now: NaiveDateTime) -> PathBuf {
+        self.roll_if_needed(now);
+        self.file.clone()
+    }
+
+    pub fn write(&mut self, level: Level, source: &str, message: &str, now: NaiveDateTime) {
+        self.roll_if_needed(now);
+
+        let minute = now.and_utc().timestamp().div_euclid(60);
+        if self.minute != Some(minute) {
+            if self.dropped > 0 && !self.capped {
+                let line = format!(
+                    "{} WARN  [log] dropped {} line(s) over {}/min in the previous minute\n",
+                    time_stamp(now), self.dropped, self.limits.max_lines_per_minute
+                );
+                self.append(&line);
+            }
+            self.minute = Some(minute);
+            self.lines_this_minute = 0;
+            self.dropped = 0;
+        }
+        if self.lines_this_minute >= self.limits.max_lines_per_minute {
+            self.dropped += 1;
+            return;
+        }
+        self.lines_this_minute += 1;
+
+        if self.capped {
+            return;
+        }
+        if self.bytes >= self.limits.max_bytes_per_day {
+            self.capped = true;
+            let line = format!(
+                "{} WARN  [log] {} byte daily cap reached; nothing more is written until tomorrow\n",
+                time_stamp(now), self.limits.max_bytes_per_day
+            );
+            self.append(&line);
+            return;
+        }
+
+        let mut text: String = message.chars().take(self.limits.max_line_length).collect();
+        if message.chars().count() > self.limits.max_line_length {
+            text.push_str("...(truncated)");
+        }
+        // One record per line, so a multi-line message does not interleave.
+        let text = text.replace("\r\n", "\n").replace('\n', "\n    ");
+        let line = format!("{} {:<5} [{source}] {text}\n", time_stamp(now), level.label());
+        self.append(&line);
+    }
+}
+
+// ---------------------------------------------------------------------------
+// The app's one log: stderr and the file, from any thread.
+// ---------------------------------------------------------------------------
+
+static LOG: OnceLock<Mutex<FileLog>> = OnceLock::new();
+
+/// Start writing to `<dir>/input-viewer-YYYY-MM-DD.log`. Lines logged before
+/// this go to stderr only.
+pub fn init(dir: PathBuf) {
+    let _ = LOG.set(Mutex::new(FileLog::new(dir, Limits::default())));
+}
+
+pub fn dir() -> Option<PathBuf> {
+    LOG.get().map(|l| l.lock().unwrap_or_else(|e| e.into_inner()).dir().to_owned())
+}
+
+pub fn line(level: Level, message: &str) {
+    eprintln!("{message}");
+    if let Some(log) = LOG.get() {
+        // A panic while holding the lock poisons it; logging must still work,
+        // the panic hook in particular.
+        let mut log = log.lock().unwrap_or_else(|e| e.into_inner());
+        log.write(level, "app", message, Local::now().naive_local());
+    }
+}
+
+/// `info!`/`warn!`/`error!` for this crate, named so they cannot be confused
+/// with the `log` crate's.
+macro_rules! log_info {
+    ($($arg:tt)*) => { $crate::filelog::line($crate::filelog::Level::Info, &format!($($arg)*)) };
+}
+macro_rules! log_warn {
+    ($($arg:tt)*) => { $crate::filelog::line($crate::filelog::Level::Warn, &format!($($arg)*)) };
+}
+macro_rules! log_error {
+    ($($arg:tt)*) => { $crate::filelog::line($crate::filelog::Level::Error, &format!($($arg)*)) };
+}
+pub(crate) use {log_error, log_info, log_warn};
+
+#[cfg(test)]
+mod tests {
+    //! Ported from test/file-log.test.js, case for case.
+    use super::*;
+
+    fn at(s: &str) -> NaiveDateTime {
+        NaiveDateTime::parse_from_str(s, "%Y-%m-%dT%H:%M:%S").unwrap()
+    }
+
+    fn scratch(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("iv-log-{name}-{}", std::process::id()));
+        let _ = fs::remove_dir_all(&dir);
+        fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    fn listing(dir: &Path) -> Vec<String> {
+        let mut v: Vec<String> = fs::read_dir(dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+        v.sort();
+        v
+    }
+
+    fn limits() -> Limits {
+        Limits::default()
+    }
+
+    #[test]
+    fn one_timestamped_line_per_record_in_a_file_named_for_the_day() {
+        let dir = scratch("line");
+        let mut log = FileLog::new(&dir, limits());
+        let now = at("2026-09-23T08:40:00");
+        log.write(Level::Info, "renderer", "[Health] left ok", now);
+        log.write(Level::Warn, "main", "two\nlines", now);
+        let path = log.path(now);
+        assert_eq!(path.file_name().unwrap(), "input-viewer-2026-09-23.log");
+        let text = fs::read_to_string(path).unwrap();
+        assert!(text.starts_with("08:40:00.000 INFO  [renderer] [Health] left ok\n"), "{text}");
+        assert!(text.contains("WARN  [main] two\n    lines\n"), "{text}");
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn rolls_to_a_new_file_at_midnight() {
+        let dir = scratch("roll");
+        let mut log = FileLog::new(&dir, limits());
+        log.write(Level::Info, "main", "before", at("2026-09-23T23:59:59"));
+        log.write(Level::Info, "main", "after", at("2026-09-24T00:00:01"));
+        assert_eq!(listing(&dir), ["input-viewer-2026-09-23.log", "input-viewer-2026-09-24.log"]);
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn deletes_files_older_than_a_week_and_leaves_other_files_alone() {
+        let dir = scratch("prune");
+        for d in ["2026-09-10", "2026-09-16", "2026-09-17", "2026-09-22"] {
+            fs::write(dir.join(format!("input-viewer-{d}.log")), "x").unwrap();
+        }
+        fs::write(dir.join("settings.json"), "{}").unwrap();
+        let mut log = FileLog::new(&dir, limits());
+        log.write(Level::Info, "main", "start", at("2026-09-23T09:00:00"));
+        // Seven calendar days kept: 17th..23rd.
+        assert_eq!(listing(&dir), [
+            "input-viewer-2026-09-17.log", "input-viewer-2026-09-22.log",
+            "input-viewer-2026-09-23.log", "settings.json",
+        ]);
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn prunes_again_when_the_day_changes() {
+        let dir = scratch("reprune");
+        let mut log = FileLog::new(&dir, limits());
+        log.write(Level::Info, "main", "day 0", at("2026-09-23T12:00:00"));
+        log.write(Level::Info, "main", "day 8", at("2026-10-01T00:00:01"));
+        assert_eq!(listing(&dir), ["input-viewer-2026-10-01.log"]);
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn stops_growing_at_the_daily_cap_and_says_so_once() {
+        let dir = scratch("cap");
+        let mut log = FileLog::new(&dir, Limits { max_bytes_per_day: 200, ..limits() });
+        let now = at("2026-09-23T09:00:00");
+        for i in 0..50 {
+            log.write(Level::Info, "main", &format!("line {i}"), now);
+        }
+        let text = fs::read_to_string(log.path(now)).unwrap();
+        assert!(text.len() < 400, "{}", text.len());
+        assert_eq!(text.matches("daily cap reached").count(), 1);
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn rate_limits_a_flood_and_reports_how_much_was_dropped() {
+        let dir = scratch("rate");
+        let mut log = FileLog::new(&dir, Limits { max_lines_per_minute: 5, ..limits() });
+        for i in 0..20 {
+            log.write(Level::Info, "renderer", &format!("spam {i}"), at("2026-09-23T09:00:00"));
+        }
+        log.write(Level::Info, "renderer", "next minute", at("2026-09-23T09:01:00"));
+        let text = fs::read_to_string(log.path(at("2026-09-23T09:01:00"))).unwrap();
+        assert_eq!(text.matches("spam").count(), 5);
+        assert!(text.contains("dropped 15 line(s)"));
+        assert!(text.contains("next minute"));
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn truncates_a_runaway_line() {
+        let dir = scratch("trunc");
+        let mut log = FileLog::new(&dir, Limits { max_line_length: 10, ..limits() });
+        let now = at("2026-09-23T09:00:00");
+        log.write(Level::Info, "main", &"x".repeat(100), now);
+        assert!(fs::read_to_string(log.path(now)).unwrap().contains("xxxxxxxxxx...(truncated)"));
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn never_panics_when_the_directory_cannot_be_written() {
+        let dir = scratch("blocked");
+        let blocker = dir.join("not-a-dir");
+        fs::write(&blocker, "").unwrap();
+        let mut log = FileLog::new(&blocker, limits());
+        log.write(Level::Error, "main", "still fine", at("2026-09-23T09:00:00"));
+        log.write(Level::Error, "main", "and again", at("2026-09-23T09:00:00"));
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn stamps_days_from_the_local_date() {
+        assert_eq!(day_stamp(NaiveDate::from_ymd_opt(2026, 1, 5).unwrap()), "2026-01-05");
+    }
+}
diff --git a/input_viewer_egui/src/flags.rs b/input_viewer_egui/src/flags.rs
new file mode 100644
index 0000000..ac5c364
--- /dev/null
+++ b/input_viewer_egui/src/flags.rs
@@ -0,0 +1,202 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Test-mode launch flags, the Rust side of #248.
+//!
+//! Same three flags as the Electron app, same semantics:
+//!
+//! | Flag | Effect |
+//! |---|---|
+//! | `--mock[=N]` | N synthetic inputs (1-8, default 4). No capture hardware. |
+//! | `--no-signal` | Pins every input into the no-signal state. |
+//! | `--screensaver-delay=MS` | Replaces the five-minute wait. |
+//! | `--screensaver=NAME` | Prototype only: pins the first saver picked (`plasma`, `starfield`, ...). |
+//! | `--test-pattern[=WxH@FPS]` | Prototype only: mock inputs carry a motion test pattern, 3840x2160@60 by default. Implies `--mock=2`, the wall's two cards. |
+//! | `--hud` | Prototype only: per-half frame-rate and latency overlay, and a `[render]` log line every 5s. |
+//! | `--mock-fault=dark\|stall\|fail` | Prototype only: the last mock input goes dark, stalls after 10 s, or fails to open -- to watch the health policy reopen it. |
+//!
+//! Unknown `--` arguments are collected rather than ignored, so a typo like
+//! `--nosignal` gets logged. A flag that silently does nothing means someone at
+//! the wall is looking at a production screen believing it is in test mode.
+
+use std::time::Duration;
+
+use crate::capture::{MockFault, PatternFormat};
+
+pub const DEFAULT_MOCK_COUNT: usize = 4;
+pub const MAX_MOCK_COUNT: usize = 8;
+pub const DEFAULT_SCREENSAVER_DELAY: Duration = Duration::from_secs(5 * 60);
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Flags {
+    /// `Some(n)` when `--mock` was given.
+    pub mock: Option<usize>,
+    pub no_signal: bool,
+    pub screensaver_delay: Duration,
+    /// Normalised as the preview selector does: lowercase, no spaces, `-` or `_`.
+    pub screensaver: Option<String>,
+    pub test_pattern: Option<PatternFormat>,
+    pub hud: bool,
+    pub mock_fault: Option<MockFault>,
+    pub unrecognised: Vec<String>,
+}
+
+impl Default for Flags {
+    fn default() -> Self {
+        Self {
+            mock: None,
+            no_signal: false,
+            screensaver_delay: DEFAULT_SCREENSAVER_DELAY,
+            screensaver: None,
+            test_pattern: None,
+            hud: false,
+            mock_fault: None,
+            unrecognised: Vec::new(),
+        }
+    }
+}
+
+pub fn parse<I, S>(args: I) -> Flags
+where
+    I: IntoIterator<Item = S>,
+    S: AsRef<str>,
+{
+    let mut flags = Flags::default();
+    for arg in args {
+        let arg = arg.as_ref();
+        if !arg.starts_with("--") {
+            continue;
+        }
+        let (name, value) = match arg.split_once('=') {
+            Some((n, v)) => (n, Some(v)),
+            None => (arg, None),
+        };
+        match (name, value) {
+            ("--mock", None) => flags.mock = Some(DEFAULT_MOCK_COUNT),
+            ("--mock", Some(v)) => match v.parse::<usize>() {
+                Ok(n) => flags.mock = Some(n.clamp(1, MAX_MOCK_COUNT)),
+                Err(_) => flags.unrecognised.push(arg.to_owned()),
+            },
+            ("--no-signal", None) => flags.no_signal = true,
+            ("--screensaver-delay", Some(v)) => match v.parse::<u64>() {
+                Ok(ms) => flags.screensaver_delay = Duration::from_millis(ms),
+                Err(_) => flags.unrecognised.push(arg.to_owned()),
+            },
+            ("--screensaver", Some(v)) if !v.is_empty() => flags.screensaver = Some(normalise(v)),
+            ("--test-pattern", None) => flags.test_pattern = Some(DEFAULT_PATTERN),
+            ("--test-pattern", Some(v)) => match parse_format(v) {
+                Some(f) => flags.test_pattern = Some(f),
+                None => flags.unrecognised.push(arg.to_owned()),
+            },
+            ("--hud", None) => flags.hud = true,
+            ("--mock-fault", Some(v)) => match v {
+                "dark" => flags.mock_fault = Some(MockFault::Dark),
+                "stall" => flags.mock_fault = Some(MockFault::Stall),
+                "fail" => flags.mock_fault = Some(MockFault::Fail),
+                _ => flags.unrecognised.push(arg.to_owned()),
+            },
+            _ => flags.unrecognised.push(arg.to_owned()),
+        }
+    }
+    // A test pattern needs inputs to carry it: two, like the wall. So does a
+    // fault, with a healthy input beside the broken one.
+    if (flags.test_pattern.is_some() || flags.mock_fault.is_some()) && flags.mock.is_none() {
+        flags.mock = Some(2);
+    }
+    flags
+}
+
+pub const DEFAULT_PATTERN: PatternFormat = PatternFormat { width: 3840, height: 2160, fps: 60 };
+
+/// `WxH@FPS`, `WxH` (60 fps) or the shorthands `4k60`, `4k30`, `1080p60`.
+pub fn parse_format(v: &str) -> Option<PatternFormat> {
+    let named = match v.to_ascii_lowercase().as_str() {
+        "4k60" => Some((3840, 2160, 60)),
+        "4k30" => Some((3840, 2160, 30)),
+        "1080p60" => Some((1920, 1080, 60)),
+        _ => None,
+    };
+    let (width, height, fps) = match named {
+        Some(t) => t,
+        None => {
+            let (size, fps) = v.split_once('@').unwrap_or((v, "60"));
+            let (w, h) = size.split_once('x')?;
+            (w.parse().ok()?, h.parse().ok()?, fps.parse().ok()?)
+        }
+    };
+    // 64px is the smallest the pattern lays out legibly; 8K is the largest
+    // anything here will meet.
+    ((64..=7680).contains(&width) && (64..=4320).contains(&height) && (1..=240).contains(&fps))
+        .then_some(PatternFormat { width, height, fps })
+}
+
+pub fn normalise(name: &str) -> String {
+    name.chars().filter(|c| !matches!(c, ' ' | '-' | '_')).flat_map(char::to_lowercase).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn defaults_without_flags() {
+        assert_eq!(parse(["input-viewer"]), Flags::default());
+    }
+
+    #[test]
+    fn mock_count_defaults_and_clamps() {
+        assert_eq!(parse(["--mock"]).mock, Some(4));
+        assert_eq!(parse(["--mock=2"]).mock, Some(2));
+        assert_eq!(parse(["--mock=0"]).mock, Some(1));
+        assert_eq!(parse(["--mock=99"]).mock, Some(8));
+    }
+
+    #[test]
+    fn flags_combine() {
+        let f = parse(["--mock=2", "--no-signal", "--screensaver-delay=0"]);
+        assert_eq!(f.mock, Some(2));
+        assert!(f.no_signal);
+        assert_eq!(f.screensaver_delay, Duration::ZERO);
+        assert!(f.unrecognised.is_empty());
+    }
+
+    #[test]
+    fn screensaver_name_is_normalised() {
+        assert_eq!(parse(["--screensaver=DVD-logo"]).screensaver.as_deref(), Some("dvdlogo"));
+        assert_eq!(parse(["--screensaver="]).unrecognised, ["--screensaver="]);
+    }
+
+    #[test]
+    fn test_pattern_defaults_to_two_4k60_inputs() {
+        let f = parse(["--test-pattern"]);
+        assert_eq!(f.test_pattern, Some(DEFAULT_PATTERN));
+        assert_eq!(f.mock, Some(2));
+        assert_eq!(parse(["--mock=1", "--test-pattern=1080p60"]).mock, Some(1));
+    }
+
+    #[test]
+    fn pattern_formats() {
+        let f = |w, h, fps| Some(PatternFormat { width: w, height: h, fps });
+        assert_eq!(parse_format("3840x2160@60"), f(3840, 2160, 60));
+        assert_eq!(parse_format("1920x1080"), f(1920, 1080, 60));
+        assert_eq!(parse_format("4K30"), f(3840, 2160, 30));
+        assert_eq!(parse_format("3840x2160@0"), None);
+        assert_eq!(parse_format("huge"), None);
+        assert_eq!(parse(["--test-pattern=nope"]).unrecognised, ["--test-pattern=nope"]);
+    }
+
+    #[test]
+    fn mock_fault_implies_two_mock_inputs() {
+        let f = parse(["--mock-fault=stall"]);
+        assert_eq!(f.mock_fault, Some(MockFault::Stall));
+        assert_eq!(f.mock, Some(2));
+        assert_eq!(parse(["--mock-fault=melt"]).unrecognised, ["--mock-fault=melt"]);
+    }
+
+    #[test]
+    fn typos_are_reported_not_dropped() {
+        let f = parse(["--nosignal", "--mock=lots", "--screensaver-delay"]);
+        assert_eq!(f.unrecognised, ["--nosignal", "--mock=lots", "--screensaver-delay"]);
+        assert!(!f.no_signal);
+        assert_eq!(f.mock, None);
+    }
+}
diff --git a/input_viewer_egui/src/gpu_video.rs b/input_viewer_egui/src/gpu_video.rs
new file mode 100644
index 0000000..0b83ce9
--- /dev/null
+++ b/input_viewer_egui/src/gpu_video.rs
@@ -0,0 +1,189 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! YUY2 to RGB on the GPU.
+//!
+//! The wall's Elgato cards deliver 3840x2160 only as YUY2. Converted on one
+//! CPU core that took ~49 ms a frame on the wall's Threadripper, capping
+//! capture at ~12 fps (measured 2026-10-12). Chromium never pays that: it
+//! hands the GPU the card's own bytes. So does this.
+//!
+//! Each frame: the packed bytes are uploaded as a half-width RGBA8 texture --
+//! one texel per pixel pair, `Y0 U Y1 V` -- and a fullscreen pass writes the
+//! full-size RGBA8 texture egui draws, then its mipmaps (trilinear, as for
+//! every video texture: ADR 0018). Half the bytes cross the bus compared with
+//! uploading RGBA, and the CPU does nothing per pixel.
+//!
+//! The textures are per device and registered with egui once, so a reopen or
+//! a new frame size reuses them rather than leaking registrations.
+//!
+//! Runs from `App::ui`, where eframe's GL context is current and egui has not
+//! yet painted; the state touched here is put back to what egui expects.
+
+use eframe::egui;
+use eframe::glow::{self, HasContext};
+
+const VERTEX: &str = "#version 330 core
+void main() {
+  vec2 p = vec2(float((gl_VertexID << 1) & 2), float(gl_VertexID & 2));
+  gl_Position = vec4(p * 2.0 - 1.0, 0.0, 1.0);
+}";
+
+/// BT.709 limited range. `yuv::ycbcr_to_rgb` is the same formula on the CPU,
+/// where it has unit tests.
+const FRAGMENT: &str = "#version 330 core
+uniform sampler2D uPacked;
+out vec4 outColor;
+void main() {
+  ivec2 p = ivec2(gl_FragCoord.xy);
+  vec4 t = texelFetch(uPacked, ivec2(p.x >> 1, p.y), 0);
+  float y = ((p.x & 1) == 0) ? t.r : t.b;
+  float Y = (y * 255.0 - 16.0) / 219.0;
+  float cb = (t.g * 255.0 - 128.0) / 224.0;
+  float cr = (t.a * 255.0 - 128.0) / 224.0;
+  vec3 rgb = vec3(Y + 1.5748 * cr, Y - 0.1873 * cb - 0.4681 * cr, Y + 1.8556 * cb);
+  outColor = vec4(clamp(rgb, 0.0, 1.0), 1.0);
+}";
+
+/// The conversion program, shared by every device.
+pub struct Converter {
+    program: glow::Program,
+    vao: glow::VertexArray,
+    fbo: glow::Framebuffer,
+    u_packed: Option<glow::UniformLocation>,
+}
+
+impl Converter {
+    /// # Safety
+    /// `gl` must be the current context.
+    pub unsafe fn new(gl: &glow::Context) -> Result<Self, String> {
+        unsafe {
+            let program = gl.create_program()?;
+            let mut shaders = Vec::new();
+            for (kind, src) in [(glow::VERTEX_SHADER, VERTEX), (glow::FRAGMENT_SHADER, FRAGMENT)] {
+                let sh = gl.create_shader(kind)?;
+                gl.shader_source(sh, src);
+                gl.compile_shader(sh);
+                if !gl.get_shader_compile_status(sh) {
+                    return Err(gl.get_shader_info_log(sh));
+                }
+                gl.attach_shader(program, sh);
+                shaders.push(sh);
+            }
+            gl.link_program(program);
+            if !gl.get_program_link_status(program) {
+                return Err(gl.get_program_info_log(program));
+            }
+            for sh in shaders {
+                gl.detach_shader(program, sh);
+                gl.delete_shader(sh);
+            }
+            Ok(Self {
+                u_packed: gl.get_uniform_location(program, "uPacked"),
+                program,
+                vao: gl.create_vertex_array()?,
+                fbo: gl.create_framebuffer()?,
+            })
+        }
+    }
+}
+
+/// One device's textures: the packed upload and the converted picture.
+pub struct GpuTexture {
+    packed: glow::Texture,
+    rgba: glow::Texture,
+    /// What egui paints with.
+    pub id: egui::TextureId,
+    pub size: [usize; 2],
+}
+
+impl GpuTexture {
+    /// # Safety
+    /// `gl` must be the current context.
+    pub unsafe fn new(gl: &glow::Context, frame: &mut eframe::Frame) -> Result<Self, String> {
+        unsafe {
+            let packed = gl.create_texture()?;
+            gl.bind_texture(glow::TEXTURE_2D, Some(packed));
+            // texelFetch reads exact texels; no filtering on the packed data.
+            for (p, v) in [
+                (glow::TEXTURE_MIN_FILTER, glow::NEAREST),
+                (glow::TEXTURE_MAG_FILTER, glow::NEAREST),
+                (glow::TEXTURE_WRAP_S, glow::CLAMP_TO_EDGE),
+                (glow::TEXTURE_WRAP_T, glow::CLAMP_TO_EDGE),
+            ] {
+                gl.tex_parameter_i32(glow::TEXTURE_2D, p, v as i32);
+            }
+            let rgba = gl.create_texture()?;
+            gl.bind_texture(glow::TEXTURE_2D, Some(rgba));
+            for (p, v) in [
+                (glow::TEXTURE_MIN_FILTER, glow::LINEAR_MIPMAP_LINEAR),
+                (glow::TEXTURE_MAG_FILTER, glow::LINEAR),
+                (glow::TEXTURE_WRAP_S, glow::CLAMP_TO_EDGE),
+                (glow::TEXTURE_WRAP_T, glow::CLAMP_TO_EDGE),
+            ] {
+                gl.tex_parameter_i32(glow::TEXTURE_2D, p, v as i32);
+            }
+            gl.bind_texture(glow::TEXTURE_2D, None);
+            let id = frame.register_native_glow_texture(rgba);
+            Ok(Self { packed, rgba, id, size: [0, 0] })
+        }
+    }
+
+    unsafe fn allocate(&mut self, gl: &glow::Context, w: usize, h: usize) {
+        unsafe {
+            let (w, h) = (w as i32, h as i32);
+            gl.bind_texture(glow::TEXTURE_2D, Some(self.packed));
+            gl.tex_image_2d(glow::TEXTURE_2D, 0, glow::RGBA8 as i32, w / 2, h, 0, glow::RGBA, glow::UNSIGNED_BYTE, glow::PixelUnpackData::Slice(None));
+            gl.bind_texture(glow::TEXTURE_2D, Some(self.rgba));
+            gl.tex_image_2d(glow::TEXTURE_2D, 0, glow::RGBA8 as i32, w, h, 0, glow::RGBA, glow::UNSIGNED_BYTE, glow::PixelUnpackData::Slice(None));
+            gl.bind_texture(glow::TEXTURE_2D, None);
+        }
+    }
+
+    /// Upload one YUY2 frame and convert it. Width must be even.
+    ///
+    /// # Safety
+    /// `gl` must be the current context.
+    pub unsafe fn update(&mut self, gl: &glow::Context, conv: &Converter, yuyv: &[u8], w: usize, h: usize) {
+        unsafe {
+            if self.size != [w, h] {
+                self.allocate(gl, w, h);
+                self.size = [w, h];
+            }
+            let (wi, hi) = (w as i32, h as i32);
+
+            // Upload. Rows are w*2 bytes, a multiple of 4, so the default
+            // alignment is right; reset anyway in case egui left it at 1.
+            gl.pixel_store_i32(glow::UNPACK_ALIGNMENT, 4);
+            gl.pixel_store_i32(glow::UNPACK_ROW_LENGTH, 0);
+            gl.bind_texture(glow::TEXTURE_2D, Some(self.packed));
+            gl.tex_sub_image_2d(glow::TEXTURE_2D, 0, 0, 0, wi / 2, hi, glow::RGBA, glow::UNSIGNED_BYTE, glow::PixelUnpackData::Slice(Some(&yuyv[..w * h * 2])));
+
+            // Convert into the picture egui draws. Row y of the output comes
+            // from row y of the input, so the orientation is unchanged.
+            gl.bind_framebuffer(glow::FRAMEBUFFER, Some(conv.fbo));
+            gl.framebuffer_texture_2d(glow::FRAMEBUFFER, glow::COLOR_ATTACHMENT0, glow::TEXTURE_2D, Some(self.rgba), 0);
+            gl.viewport(0, 0, wi, hi);
+            gl.disable(glow::SCISSOR_TEST);
+            gl.disable(glow::BLEND);
+            gl.disable(glow::CULL_FACE);
+            gl.disable(glow::DEPTH_TEST);
+            gl.disable(glow::FRAMEBUFFER_SRGB);
+            gl.use_program(Some(conv.program));
+            gl.active_texture(glow::TEXTURE0);
+            gl.bind_texture(glow::TEXTURE_2D, Some(self.packed));
+            gl.uniform_1_i32(conv.u_packed.as_ref(), 0);
+            gl.bind_vertex_array(Some(conv.vao));
+            gl.draw_arrays(glow::TRIANGLES, 0, 3);
+
+            // Mipmaps: video is nearly always drawn smaller than it arrives.
+            gl.bind_texture(glow::TEXTURE_2D, Some(self.rgba));
+            gl.generate_mipmap(glow::TEXTURE_2D);
+
+            // Back to what egui expects to find.
+            gl.bind_vertex_array(None);
+            gl.use_program(None);
+            gl.bind_texture(glow::TEXTURE_2D, None);
+            gl.bind_framebuffer(glow::FRAMEBUFFER, None);
+        }
+    }
+}
diff --git a/input_viewer_egui/src/health.rs b/input_viewer_egui/src/health.rs
new file mode 100644
index 0000000..180c1f8
--- /dev/null
+++ b/input_viewer_egui/src/health.rs
@@ -0,0 +1,597 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Capture-card health: is this input actually working, and should it be
+//! reopened? A port of `stream-health.js` (ADRs 0012 and 0013), constants and
+//! tests included.
+//!
+//! The wall's Elgato cards sometimes come up after boot showing black with a
+//! live source plugged in, until someone restarts the app. The driver exposes
+//! no signal-lock state, so the only evidence is what arrives on the stream.
+//! This module turns that evidence into a status and a reopen decision. It is
+//! pure -- no clock of its own, `now` is passed in as milliseconds -- so the
+//! policy is unit tested; the app owns the sampling and the reopen.
+//!
+//! | Status | Meaning |
+//! |---|---|
+//! | `Opening` | stream open, no frame yet |
+//! | `Ok` | frames arriving and the picture is not uniform |
+//! | `NoFrames` | open for `FIRST_FRAME_TIMEOUT_MS` and not a single frame |
+//! | `Stalled` | frames WERE flowing and have stopped for `STALL_MS` |
+//! | `Ended` | the stream ended (driver dropped it, device went away) |
+//! | `OpenFailed` | the device could not be opened |
+//! | `Dark` | frames arriving, but the picture is one flat colour |
+//!
+//! A frame COUNT, never motion: #159 rejected motion detection because a held
+//! slide is pixel-identical for minutes, and a card still delivers it at
+//! 60 fps. "Was flowing first" keeps a static virtual camera, which really
+//! sends a frame or two, from being called stalled.
+//!
+//! Reopening a dark feed is safe because its blank moment cannot be seen; the
+//! dark cadence is slow because "nothing plugged in all night" is the steady
+//! state.
+//!
+//! These statuses decide **reopening**. Only `OpenFailed` puts the NO SIGNAL
+//! board up (see `InputViewer::side_no_signal`): a dark or stalled card on the
+//! wall stays black while it is retried, as in Electron.
+
+pub mod limits {
+    /// Open but no frame at all after this long: the card is not delivering.
+    pub const FIRST_FRAME_TIMEOUT_MS: f64 = 8000.0;
+    /// Frames stopped for this long after flowing: stalled.
+    pub const STALL_MS: f64 = 6000.0;
+    /// A feed must deliver at least this rate once before a stop counts as a stall.
+    pub const FLOWING_MIN_FPS: f64 = 5.0;
+    /// Uniform picture for this long before it counts as dark.
+    pub const DARK_MS: f64 = 6000.0;
+    /// Healthy this long and the reopen backoff starts over.
+    pub const RECOVERED_RESET_MS: f64 = 60_000.0;
+    /// Delays before each reopen of a faulted feed; the last one repeats.
+    pub const FAULT_BACKOFF_MS: [f64; 5] = [2000.0, 5000.0, 15_000.0, 30_000.0, 60_000.0];
+    /// Delays before each reopen of a dark feed; the last one repeats.
+    pub const DARK_BACKOFF_MS: [f64; 6] = [5000.0, 15_000.0, 30_000.0, 60_000.0, 300_000.0, 600_000.0];
+    /// Standard deviation of luma (0-255) at or below which a picture is one flat colour.
+    pub const UNIFORM_STD_MAX: f64 = 3.0;
+    /// How often the app samples each stream (renderer.js samples every 2 s).
+    pub const SAMPLE_MS: f64 = 2000.0;
+    /// Gap between closing a device and reopening it, "so the driver sees the
+    /// device closed rather than a handover" (REOPEN_RELEASE_MS).
+    pub const REOPEN_RELEASE_MS: f64 = 500.0;
+}
+
+use limits::*;
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct LumaStats {
+    pub mean: f64,
+    pub std: f64,
+}
+
+/// Mean and standard deviation of luma over RGBA pixels (Rec. 601 weights;
+/// exactness is irrelevant, flatness is the question). Meant for a small
+/// downscale, not a full frame.
+pub fn luma_stats(rgba: &[u8]) -> LumaStats {
+    let n = rgba.len() / 4;
+    if n == 0 {
+        return LumaStats { mean: 0.0, std: 0.0 };
+    }
+    let (mut sum, mut sum_sq) = (0.0f64, 0.0f64);
+    for p in rgba.as_chunks::<4>().0 {
+        let y = 0.299 * p[0] as f64 + 0.587 * p[1] as f64 + 0.114 * p[2] as f64;
+        sum += y;
+        sum_sq += y * y;
+    }
+    let mean = sum / n as f64;
+    let variance = (sum_sq / n as f64 - mean * mean).max(0.0);
+    LumaStats { mean, std: variance.sqrt() }
+}
+
+/// One flat colour -- black, or a solid no-signal screen?
+pub fn is_uniform(stats: &LumaStats) -> bool {
+    stats.std <= UNIFORM_STD_MAX
+}
+
+/// Delay before reopen number `attempt` (0-based); the last step repeats.
+pub fn backoff_delay(schedule: &[f64], attempt: usize) -> f64 {
+    schedule[attempt.min(schedule.len() - 1)]
+}
+
+/// Box-averaged RGBA thumbnail of an RGBA frame.
+///
+/// Averaged, not point-sampled, as Electron's canvas downscale is: a card's
+/// "no signal" screen has a noise floor, and point samples would keep that
+/// noise and read a dead input as a picture. Each cell averages a 4x4 grid of
+/// samples, so a 4K frame costs ~1.3 M reads at 384x216, not 8.3 M.
+pub fn thumbnail(rgba: &[u8], w: usize, h: usize, tw: usize, th: usize) -> Vec<u8> {
+    let mut out = vec![0u8; tw * th * 4];
+    if w == 0 || h == 0 || rgba.len() < w * h * 4 {
+        return out;
+    }
+    const GRID: usize = 4;
+    for ty in 0..th {
+        let (y0, y1) = (ty * h / th, ((ty + 1) * h / th).max(ty * h / th + 1));
+        for tx in 0..tw {
+            let (x0, x1) = (tx * w / tw, ((tx + 1) * w / tw).max(tx * w / tw + 1));
+            let mut acc = [0u32; 3];
+            let mut n = 0u32;
+            for gy in 0..GRID {
+                let y = y0 + (y1 - y0) * (2 * gy + 1) / (2 * GRID);
+                for gx in 0..GRID {
+                    let x = x0 + (x1 - x0) * (2 * gx + 1) / (2 * GRID);
+                    let i = (y * w + x) * 4;
+                    acc[0] += rgba[i] as u32;
+                    acc[1] += rgba[i + 1] as u32;
+                    acc[2] += rgba[i + 2] as u32;
+                    n += 1;
+                }
+            }
+            let o = (ty * tw + tx) * 4;
+            out[o..o + 4].copy_from_slice(&[(acc[0] / n) as u8, (acc[1] / n) as u8, (acc[2] / n) as u8, 255]);
+        }
+    }
+    out
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Status {
+    Idle,
+    Opening,
+    Ok,
+    NoFrames,
+    Stalled,
+    Ended,
+    OpenFailed,
+    Dark,
+}
+
+impl Status {
+    pub fn is_fault(self) -> bool {
+        matches!(self, Status::NoFrames | Status::Stalled | Status::Ended | Status::OpenFailed)
+    }
+
+    /// The name stream-health.js uses, for log lines that read the same.
+    pub fn name(self) -> &'static str {
+        match self {
+            Status::Idle => "idle",
+            Status::Opening => "opening",
+            Status::Ok => "ok",
+            Status::NoFrames => "no-frames",
+            Status::Stalled => "stalled",
+            Status::Ended => "ended",
+            Status::OpenFailed => "open-failed",
+            Status::Dark => "dark",
+        }
+    }
+}
+
+/// One observation of a stream.
+#[derive(Debug, Clone, Copy)]
+pub struct Sample {
+    /// Monotonically increasing count of frames delivered, or None if unknown.
+    pub frames: Option<u64>,
+    pub ended: bool,
+    /// Luma of a small downscale, or None.
+    pub stats: Option<LumaStats>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Decision {
+    pub reopen: bool,
+    pub reason: Option<Status>,
+    pub wait_ms: f64,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Info {
+    pub status: Status,
+    pub fps: f64,
+    pub flowing: bool,
+    pub attempts: usize,
+    pub luma: Option<LumaStats>,
+    pub error: Option<String>,
+}
+
+/// Health state for one stream. Feed it events and samples; ask it what to do.
+#[derive(Debug, Clone)]
+pub struct StreamHealth {
+    status: Status,
+    opened_at: f64,
+    last_frames: Option<u64>,
+    last_frame_at: f64,
+    last_sample_at: f64,
+    first_frame_at: Option<f64>,
+    flowing: bool,
+    uniform_since: Option<f64>,
+    last_stats: Option<LumaStats>,
+    fps: f64,
+    error: Option<String>,
+    // Survive reopens, so the backoff actually backs off.
+    attempts: usize,
+    last_reopen_at: Option<f64>,
+    healthy_since: Option<f64>,
+}
+
+impl Default for StreamHealth {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl StreamHealth {
+    pub fn new() -> Self {
+        Self {
+            status: Status::Idle,
+            opened_at: 0.0,
+            last_frames: None,
+            last_frame_at: 0.0,
+            last_sample_at: 0.0,
+            first_frame_at: None,
+            flowing: false,
+            uniform_since: None,
+            last_stats: None,
+            fps: 0.0,
+            error: None,
+            attempts: 0,
+            last_reopen_at: None,
+            healthy_since: None,
+        }
+    }
+
+    fn set_status(&mut self, next: Status, now: f64) {
+        self.status = next;
+        if next == Status::Ok {
+            self.healthy_since.get_or_insert(now);
+        } else {
+            self.healthy_since = None;
+        }
+    }
+
+    pub fn status(&self) -> Status {
+        self.status
+    }
+
+    /// A stream was just attached.
+    pub fn opened(&mut self, now: f64) {
+        self.opened_at = now;
+        self.last_frames = None;
+        self.last_frame_at = now;
+        self.last_sample_at = now;
+        self.first_frame_at = None;
+        self.flowing = false;
+        self.uniform_since = None;
+        self.last_stats = None;
+        self.fps = 0.0;
+        self.error = None;
+        self.set_status(Status::Opening, now);
+    }
+
+    /// The device could not be opened.
+    pub fn open_failed(&mut self, now: f64, error: &str) {
+        self.opened_at = now;
+        self.error = Some(error.to_owned());
+        self.set_status(Status::OpenFailed, now);
+    }
+
+    /// One observation; returns the status after it.
+    pub fn sample(&mut self, s: Sample, now: f64) -> Status {
+        if matches!(self.status, Status::Idle | Status::OpenFailed) {
+            return self.status;
+        }
+        if s.ended {
+            self.set_status(Status::Ended, now);
+            return self.status;
+        }
+
+        if let Some(frames) = s.frames {
+            match self.last_frames {
+                None => {
+                    self.last_frames = Some(frames);
+                    // A counter already past 0 at first look has delivered.
+                    if frames > 0 {
+                        self.last_frame_at = now;
+                        self.first_frame_at = Some(now);
+                    }
+                }
+                Some(last) if frames > last => {
+                    let dt = now - self.last_sample_at;
+                    if dt > 0.0 {
+                        self.fps = (frames - last) as f64 * 1000.0 / dt;
+                    }
+                    if self.fps >= FLOWING_MIN_FPS {
+                        self.flowing = true;
+                    }
+                    self.first_frame_at.get_or_insert(now);
+                    self.last_frames = Some(frames);
+                    self.last_frame_at = now;
+                }
+                // Backwards: the counter restarted with a new source. A new
+                // baseline, not evidence of a stall.
+                Some(last) if frames < last => {
+                    self.last_frames = Some(frames);
+                    self.last_frame_at = now;
+                }
+                Some(_) => self.fps = 0.0,
+            }
+        }
+        self.last_sample_at = now;
+
+        if let Some(stats) = s.stats {
+            self.last_stats = Some(stats);
+            if is_uniform(&stats) {
+                self.uniform_since.get_or_insert(now);
+            } else {
+                self.uniform_since = None;
+            }
+        }
+
+        if s.frames.is_some() {
+            if self.first_frame_at.is_none() {
+                let next = if now - self.opened_at >= FIRST_FRAME_TIMEOUT_MS { Status::NoFrames } else { Status::Opening };
+                self.set_status(next, now);
+                return self.status;
+            }
+            if self.flowing && now - self.last_frame_at >= STALL_MS {
+                self.set_status(Status::Stalled, now);
+                return self.status;
+            }
+        }
+
+        if self.uniform_since.is_some_and(|t| now - t >= DARK_MS) {
+            self.set_status(Status::Dark, now);
+            return self.status;
+        }
+
+        self.set_status(Status::Ok, now);
+        if self.attempts > 0 && self.healthy_since.is_some_and(|t| now - t >= RECOVERED_RESET_MS) {
+            self.attempts = 0;
+            self.last_reopen_at = None;
+        }
+        self.status
+    }
+
+    /// Should this stream be reopened now?
+    pub fn decide(&self, now: f64) -> Decision {
+        let schedule: &[f64] = if self.status.is_fault() {
+            &FAULT_BACKOFF_MS
+        } else if self.status == Status::Dark {
+            &DARK_BACKOFF_MS
+        } else {
+            return Decision { reopen: false, reason: None, wait_ms: 0.0 };
+        };
+        // From the last reopen, or from the open for the first attempt -- so a
+        // stream that goes bad an hour in waits the first delay, not zero.
+        let since = self.last_reopen_at.unwrap_or(self.opened_at);
+        let wait_ms = (since + backoff_delay(schedule, self.attempts) - now).max(0.0);
+        Decision { reopen: wait_ms == 0.0, reason: Some(self.status), wait_ms }
+    }
+
+    /// A reopen was started.
+    pub fn reopening(&mut self, now: f64) {
+        self.attempts += 1;
+        self.last_reopen_at = Some(now);
+    }
+
+    pub fn info(&self) -> Info {
+        Info {
+            status: self.status,
+            fps: (self.fps * 10.0).round() / 10.0,
+            flowing: self.flowing,
+            attempts: self.attempts,
+            luma: self.last_stats,
+            error: self.error.clone(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    //! Ported from test/stream-health.test.js, case for case.
+    use super::*;
+
+    const BUSY: LumaStats = LumaStats { mean: 90.0, std: 40.0 };
+    const FLAT: LumaStats = LumaStats { mean: 1.0, std: 0.2 };
+
+    /// Drive a tracker at `fps` for `ms`, sampling every `step` ms.
+    fn run(h: &mut StreamHealth, from: f64, ms: f64, fps: f64, stats: LumaStats, frames: &mut f64) -> (f64, Status) {
+        let step = 2000.0;
+        let (mut t, mut status) = (from, h.status());
+        while t < from + ms {
+            t += step;
+            *frames += fps * step / 1000.0;
+            status = h.sample(Sample { frames: Some(*frames as u64), ended: false, stats: Some(stats) }, t);
+        }
+        (t, status)
+    }
+
+    fn sample(frames: Option<u64>, ended: bool, stats: Option<LumaStats>) -> Sample {
+        Sample { frames, ended, stats }
+    }
+
+    #[test]
+    fn flat_picture_is_uniform_and_a_varied_one_is_not() {
+        let flat = vec![10u8; 32 * 18 * 4];
+        assert!(is_uniform(&luma_stats(&flat)));
+        let bars: Vec<u8> = (0..32 * 18).flat_map(|i| { let v = if i % 2 == 1 { 250 } else { 5 }; [v, v, v, 255] }).collect();
+        assert!(!is_uniform(&luma_stats(&bars)));
+    }
+
+    #[test]
+    fn a_solid_colour_that_is_not_black_is_uniform_too() {
+        // An Elgato-style solid blue no-signal screen is as dead as black.
+        let blue: Vec<u8> = (0..64).flat_map(|_| [0, 0, 200, 255]).collect();
+        let s = luma_stats(&blue);
+        assert!(s.mean > 20.0);
+        assert!(is_uniform(&s));
+    }
+
+    #[test]
+    fn no_division_by_zero_on_an_empty_buffer() {
+        assert_eq!(luma_stats(&[]), LumaStats { mean: 0.0, std: 0.0 });
+    }
+
+    #[test]
+    fn backoff_repeats_the_last_step() {
+        let s = [1.0, 2.0, 3.0];
+        let got: Vec<f64> = [0, 1, 2, 3, 99].into_iter().map(|a| backoff_delay(&s, a)).collect();
+        assert_eq!(got, [1.0, 2.0, 3.0, 3.0, 3.0]);
+    }
+
+    #[test]
+    fn ok_while_a_card_delivers_a_real_picture() {
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        let (_, status) = run(&mut h, 0.0, 30_000.0, 60.0, BUSY, &mut 0.0);
+        assert_eq!(status, Status::Ok);
+        assert!(!h.decide(30_000.0).reopen);
+    }
+
+    #[test]
+    fn ok_on_a_held_slide() {
+        // The #159 trap: a still picture at 60 fps is a working card.
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        assert_eq!(run(&mut h, 0.0, 60_000.0, 60.0, BUSY, &mut 0.0).1, Status::Ok);
+    }
+
+    #[test]
+    fn no_frames_when_a_card_opens_and_never_delivers() {
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        assert_eq!(h.sample(sample(Some(0), false, None), 4000.0), Status::Opening);
+        assert_eq!(h.sample(sample(Some(0), false, None), FIRST_FRAME_TIMEOUT_MS), Status::NoFrames);
+    }
+
+    #[test]
+    fn stalled_when_frames_stop_after_flowing() {
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        let mut frames = 0.0;
+        let (t, _) = run(&mut h, 0.0, 10_000.0, 60.0, BUSY, &mut frames);
+        h.sample(sample(Some(frames as u64), false, Some(BUSY)), t + 2000.0);
+        assert_eq!(h.sample(sample(Some(frames as u64), false, Some(BUSY)), t + STALL_MS), Status::Stalled);
+    }
+
+    #[test]
+    fn a_counter_going_backwards_is_a_new_baseline() {
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        let mut frames = 0.0;
+        let (t, _) = run(&mut h, 0.0, 10_000.0, 60.0, BUSY, &mut frames);
+        frames = 0.0;
+        assert_eq!(run(&mut h, t, 10_000.0, 60.0, BUSY, &mut frames).1, Status::Ok);
+    }
+
+    #[test]
+    fn a_static_virtual_camera_is_not_stalled() {
+        // One frame, then nothing: never reached FLOWING_MIN_FPS.
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        h.sample(sample(Some(1), false, Some(BUSY)), 500.0);
+        let mut t = 2500.0;
+        while t < 60_000.0 {
+            assert_eq!(h.sample(sample(Some(1), false, Some(BUSY)), t), Status::Ok);
+            t += 2000.0;
+        }
+    }
+
+    #[test]
+    fn ended_as_soon_as_the_stream_ends() {
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        assert_eq!(h.sample(sample(Some(10), true, Some(BUSY)), 1000.0), Status::Ended);
+    }
+
+    #[test]
+    fn dark_after_a_flat_picture_persists_not_on_the_first_flat_sample() {
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        let mut frames = 0.0;
+        let (t, first) = run(&mut h, 0.0, 2000.0, 60.0, FLAT, &mut frames);
+        assert_eq!(first, Status::Ok);
+        assert_eq!(run(&mut h, t, DARK_MS, 60.0, FLAT, &mut frames).1, Status::Dark);
+    }
+
+    #[test]
+    fn works_without_a_frame_counter() {
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        assert_eq!(h.sample(sample(None, false, Some(BUSY)), 2000.0), Status::Ok);
+        h.sample(sample(None, false, Some(FLAT)), 4000.0);
+        assert_eq!(h.sample(sample(None, false, Some(FLAT)), 4000.0 + DARK_MS), Status::Dark);
+    }
+
+    #[test]
+    fn backs_off_between_reopens_of_a_faulted_feed() {
+        let mut h = StreamHealth::new();
+        h.open_failed(0.0, "NotReadableError");
+        assert_eq!(h.info().error.as_deref(), Some("NotReadableError"));
+        let mut delays = Vec::new();
+        let mut t = 0.0;
+        for _ in 0..FAULT_BACKOFF_MS.len() + 2 {
+            let d = h.decide(t);
+            assert!(!d.reopen);
+            t += d.wait_ms;
+            let now = h.decide(t);
+            assert!(now.reopen);
+            assert_eq!(now.reason, Some(Status::OpenFailed));
+            delays.push(d.wait_ms);
+            h.reopening(t);
+            h.open_failed(t, "again");
+        }
+        let last = *FAULT_BACKOFF_MS.last().unwrap();
+        let mut want = FAULT_BACKOFF_MS.to_vec();
+        want.extend([last, last]);
+        assert_eq!(delays, want);
+    }
+
+    #[test]
+    fn a_dark_feed_uses_the_slower_schedule() {
+        let mut h = StreamHealth::new();
+        h.opened(0.0);
+        let (t, _) = run(&mut h, 0.0, DARK_MS + 2000.0, 60.0, FLAT, &mut 0.0);
+        assert_eq!(h.info().status, Status::Dark);
+        let d = h.decide(t);
+        assert_eq!(d.reason, Some(Status::Dark));
+        // First wait counts from when the stream opened.
+        assert_eq!(d.wait_ms, (DARK_BACKOFF_MS[0] - t).max(0.0));
+    }
+
+    #[test]
+    fn backoff_starts_over_once_a_reopened_feed_stays_healthy() {
+        let mut h = StreamHealth::new();
+        h.open_failed(0.0, "x");
+        h.reopening(2000.0);
+        h.open_failed(2000.0, "x");
+        h.reopening(7000.0);
+        h.opened(7000.0);
+        assert_eq!(h.info().attempts, 2);
+        run(&mut h, 7000.0, RECOVERED_RESET_MS + 4000.0, 60.0, BUSY, &mut 0.0);
+        assert_eq!(h.info().attempts, 0);
+    }
+
+    #[test]
+    fn nothing_for_a_side_with_no_stream() {
+        let mut h = StreamHealth::new();
+        assert_eq!(h.sample(sample(Some(0), true, Some(FLAT)), 99_999.0), Status::Idle);
+        assert!(!h.decide(99_999.0).reopen);
+    }
+
+    // Beyond the JS suite: the thumbnail feeding `stats`.
+
+    #[test]
+    fn thumbnail_averages_so_a_noisy_dead_input_reads_flat() {
+        // A dark no-signal screen with random noise of 4..16 luma per pixel
+        // (std ~3.5): point samples would call it a picture; the 16-sample
+        // average per cell brings it to ~0.9, flat.
+        let (w, h) = (640, 360);
+        let mut rng = crate::screensaver::Rng::new(7);
+        let noisy: Vec<u8> = (0..w * h).flat_map(|_| { let v = rng.range(4.0, 16.0) as u8; [v, v, v, 255] }).collect();
+        assert!(!is_uniform(&luma_stats(&noisy)));
+        assert!(is_uniform(&luma_stats(&thumbnail(&noisy, w, h, 96, 54))));
+    }
+
+    #[test]
+    fn thumbnail_keeps_a_real_picture_varied() {
+        let bars = crate::capture::draw_mock_frame(1, 0.5, 640, 360);
+        assert!(!is_uniform(&luma_stats(&thumbnail(&bars, 640, 360, 96, 54))));
+    }
+}
diff --git a/input_viewer_egui/src/main.rs b/input_viewer_egui/src/main.rs
new file mode 100644
index 0000000..592eeb3
--- /dev/null
+++ b/input_viewer_egui/src/main.rs
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Input Viewer, egui prototype.
+
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+// First, so its macros are in scope everywhere below.
+mod filelog;
+
+mod app;
+mod capture;
+mod flags;
+mod gpu_video;
+mod health;
+mod plasma;
+mod render_stats;
+mod review;
+mod screensaver;
+mod settings;
+mod settings_status;
+mod shortcuts;
+mod testpattern;
+mod update;
+mod yuv;
+
+use crate::filelog::{log_error, log_info};
+
+/// The log file, the startup banner and the panic hook (ADR 0044).
+fn start_log() {
+    if let Some(config) = dirs::config_dir() {
+        filelog::init(config.join(settings::APP_DIR).join("logs"));
+    }
+    // OS uptime is here because the question after a bad boot is usually
+    // "how long after the machine came up did the app open the cards".
+    log_info!(
+        "[App] Input Viewer (egui) {} starting; {} {}, OS up {}s, pid {}, log {}",
+        env!("CARGO_PKG_VERSION"),
+        sysinfo::System::long_os_version().unwrap_or_else(|| std::env::consts::OS.to_owned()),
+        std::env::consts::ARCH,
+        sysinfo::System::uptime(),
+        std::process::id(),
+        filelog::dir().map_or_else(|| "(none)".to_owned(), |d| d.display().to_string()),
+    );
+    // A panic is the one exit that would otherwise leave no trace in the file.
+    let default_hook = std::panic::take_hook();
+    std::panic::set_hook(Box::new(move |info| {
+        log_error!("[App] panic: {info}");
+        default_hook(info);
+    }));
+}
+
+fn main() -> eframe::Result {
+    // Must run first: when the installer or an update launches the app with
+    // its hook arguments, this handles them and exits before any window opens.
+    velopack::VelopackApp::build().run();
+
+    start_log();
+    let flags = flags::parse(std::env::args().skip(1));
+    for arg in &flags.unrecognised {
+        log_error!("[TestFlags] unrecognised argument: {arg}");
+    }
+    if flags.mock.is_some() || flags.no_signal || flags.screensaver_delay != flags::DEFAULT_SCREENSAVER_DELAY {
+        log_info!("[TestFlags] test mode: {flags:?}");
+    }
+
+    let options = eframe::NativeOptions {
+        viewport: eframe::egui::ViewportBuilder::default()
+            .with_title("Input Viewer")
+            .with_inner_size([1500.0, 500.0])
+            .with_min_inner_size([480.0, 160.0]),
+        renderer: eframe::Renderer::Glow,
+        ..Default::default()
+    };
+    eframe::run_native(
+        "Input Viewer",
+        options,
+        Box::new(move |cc| Ok(Box::new(app::InputViewer::new(cc, flags)))),
+    )
+}
diff --git a/input_viewer_egui/src/plasma.rs b/input_viewer_egui/src/plasma.rs
new file mode 100644
index 0000000..7d2f803
--- /dev/null
+++ b/input_viewer_egui/src/plasma.rs
@@ -0,0 +1,313 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Plasma, on the GPU: the Electron app's shader, byte for byte, plus its
+//! post-FX chain (HDR scene -> bloom mips -> ACES -> dither).
+//!
+//! The GLSL in `shaders/` is generated from the Electron sources by
+//! `shaders/extract.mjs`, so a tuning change there is one regenerate away
+//! rather than a hand port. Only the header differs: desktop GLSL 3.30, which is
+//! what eframe's glow backend gets on macOS and Windows, instead of ES 3.00.
+//!
+//! This runs inside an egui paint callback. egui restores its own GL state
+//! after a callback, but it leaves the scissor test on, so every pass here
+//! disables it first -- otherwise the bloom mips get clipped to the window's
+//! clip rect and the bloom goes lopsided.
+
+use std::sync::Mutex;
+
+use eframe::glow::{self, HasContext};
+use crate::filelog::{log_error, log_info};
+
+const PLASMA: &str = include_str!("../shaders/plasma.frag");
+const BRIGHT: &str = include_str!("../shaders/post-bright.frag");
+const DOWN: &str = include_str!("../shaders/post-downsample.frag");
+const UP: &str = include_str!("../shaders/post-upsample.frag");
+const COMPOSITE: &str = include_str!("../shaders/post-composite.frag");
+
+/// Same as gl-base.js FRAGMENT_HEADER, desktop dialect.
+const FRAGMENT_HEADER: &str = "#version 330 core
+uniform vec3 iResolution;
+uniform float iTime;
+uniform int iFrame;
+uniform vec4 iSeed;
+out vec4 outColor;
+";
+
+const MAINIMAGE_FOOTER: &str = "
+void main() {
+  vec4 color = vec4(0.0);
+  mainImage(color, gl_FragCoord.xy);
+  outColor = color;
+}";
+
+/// One oversized triangle from gl_VertexID, so no vertex buffer is needed.
+const VERTEX: &str = "#version 330 core
+void main() {
+  vec2 p = vec2(float((gl_VertexID << 1) & 2), float(gl_VertexID & 2));
+  gl_Position = vec4(p * 2.0 - 1.0, 0.0, 1.0);
+}";
+
+const BLOOM_MIPS: usize = 6;
+
+/// plasma.js `postFX` settings.
+pub struct Bloom {
+    pub threshold: f32,
+    pub knee: f32,
+    pub intensity: f32,
+    pub radius: f32,
+}
+
+pub const PLASMA_BLOOM: Bloom = Bloom { threshold: 0.85, knee: 0.4, intensity: 0.5, radius: 1.0 };
+
+#[derive(Clone, Copy)]
+struct Target {
+    fbo: glow::Framebuffer,
+    tex: glow::Texture,
+    w: i32,
+    h: i32,
+}
+
+struct Gpu {
+    vao: glow::VertexArray,
+    scene_prog: glow::Program,
+    bright: glow::Program,
+    down: glow::Program,
+    up: glow::Program,
+    composite: glow::Program,
+    scene: Option<Target>,
+    mips: Vec<Target>,
+    out: Option<Target>,
+    size: (i32, i32),
+}
+
+enum State {
+    Uninit,
+    Ready(Gpu),
+    Failed,
+}
+
+/// Programs are compiled on first use and kept for the life of the GL context,
+/// so a re-activation does not pay the compile again.
+static GPU: Mutex<State> = Mutex::new(State::Uninit);
+
+/// Whether a previous attempt failed, so the caller can fall back to a painter
+/// saver the way registry.js falls back to the DVD logo.
+pub fn failed() -> bool {
+    matches!(*GPU.lock().unwrap(), State::Failed)
+}
+
+/// Render one frame into `viewport` (pixels, GL origin bottom-left) of the
+/// framebuffer egui is drawing to.
+pub fn paint(gl: &glow::Context, viewport: [i32; 4], time: f32, frame: i32, seed: [f32; 4]) {
+    let mut state = GPU.lock().unwrap();
+    if let State::Uninit = *state {
+        *state = match unsafe { Gpu::new(gl) } {
+            Ok(g) => State::Ready(g),
+            Err(e) => {
+                log_error!("[Screensaver] GPU setup failed, falling back: {e}");
+                State::Failed
+            }
+        };
+    }
+    if let State::Ready(gpu) = &mut *state {
+        unsafe { gpu.draw(gl, viewport, time, frame, seed) };
+    }
+}
+
+unsafe fn compile(gl: &glow::Context, vs: &str, fs: &str) -> Result<glow::Program, String> {
+    unsafe {
+        let prog = gl.create_program()?;
+        let mut shaders = Vec::new();
+        for (kind, src) in [(glow::VERTEX_SHADER, vs), (glow::FRAGMENT_SHADER, fs)] {
+            let sh = gl.create_shader(kind)?;
+            gl.shader_source(sh, src);
+            gl.compile_shader(sh);
+            if !gl.get_shader_compile_status(sh) {
+                return Err(gl.get_shader_info_log(sh));
+            }
+            gl.attach_shader(prog, sh);
+            shaders.push(sh);
+        }
+        gl.link_program(prog);
+        if !gl.get_program_link_status(prog) {
+            return Err(gl.get_program_info_log(prog));
+        }
+        for sh in shaders {
+            gl.detach_shader(prog, sh);
+            gl.delete_shader(sh);
+        }
+        Ok(prog)
+    }
+}
+
+unsafe fn target(gl: &glow::Context, w: i32, h: i32, hdr: bool) -> Result<Target, String> {
+    unsafe {
+        let tex = gl.create_texture()?;
+        gl.bind_texture(glow::TEXTURE_2D, Some(tex));
+        let (ifmt, ty) = if hdr { (glow::RGBA16F, glow::HALF_FLOAT) } else { (glow::RGBA8, glow::UNSIGNED_BYTE) };
+        gl.tex_image_2d(glow::TEXTURE_2D, 0, ifmt as i32, w, h, 0, glow::RGBA, ty, glow::PixelUnpackData::Slice(None));
+        for (p, v) in [
+            (glow::TEXTURE_MIN_FILTER, glow::LINEAR),
+            (glow::TEXTURE_MAG_FILTER, glow::LINEAR),
+            (glow::TEXTURE_WRAP_S, glow::CLAMP_TO_EDGE),
+            (glow::TEXTURE_WRAP_T, glow::CLAMP_TO_EDGE),
+        ] {
+            gl.tex_parameter_i32(glow::TEXTURE_2D, p, v as i32);
+        }
+        let fbo = gl.create_framebuffer()?;
+        gl.bind_framebuffer(glow::FRAMEBUFFER, Some(fbo));
+        gl.framebuffer_texture_2d(glow::FRAMEBUFFER, glow::COLOR_ATTACHMENT0, glow::TEXTURE_2D, Some(tex), 0);
+        let status = gl.check_framebuffer_status(glow::FRAMEBUFFER);
+        if status != glow::FRAMEBUFFER_COMPLETE {
+            return Err(format!("framebuffer incomplete: 0x{status:x}"));
+        }
+        Ok(Target { fbo, tex, w, h })
+    }
+}
+
+impl Gpu {
+    unsafe fn new(gl: &glow::Context) -> Result<Self, String> {
+        unsafe {
+            let scene_src = format!("{FRAGMENT_HEADER}{PLASMA}{MAINIMAGE_FOOTER}");
+            let gpu = Self {
+                vao: gl.create_vertex_array()?,
+                scene_prog: compile(gl, VERTEX, &scene_src).map_err(|e| format!("plasma: {e}"))?,
+                bright: compile(gl, VERTEX, BRIGHT).map_err(|e| format!("bright: {e}"))?,
+                down: compile(gl, VERTEX, DOWN).map_err(|e| format!("downsample: {e}"))?,
+                up: compile(gl, VERTEX, UP).map_err(|e| format!("upsample: {e}"))?,
+                composite: compile(gl, VERTEX, COMPOSITE).map_err(|e| format!("composite: {e}"))?,
+                scene: None,
+                mips: Vec::new(),
+                out: None,
+                size: (0, 0),
+            };
+            log_info!("[Screensaver] shaders compiled");
+            Ok(gpu)
+        }
+    }
+
+    unsafe fn free_targets(&mut self, gl: &glow::Context) {
+        unsafe {
+            for t in self.scene.take().into_iter().chain(self.out.take()).chain(self.mips.drain(..)) {
+                gl.delete_framebuffer(t.fbo);
+                gl.delete_texture(t.tex);
+            }
+        }
+    }
+
+    /// Match the targets to the viewport, as post-fx.js `resize()` does.
+    unsafe fn resize(&mut self, gl: &glow::Context, w: i32, h: i32) -> Result<(), String> {
+        unsafe {
+            if self.size == (w, h) && self.scene.is_some() {
+                return Ok(());
+            }
+            self.free_targets(gl);
+            self.scene = Some(target(gl, w, h, true)?);
+            // The composite lands in its own target and is then blitted into
+            // egui's framebuffer: the post-FX shaders read gl_FragCoord as if
+            // the canvas started at (0,0), which egui's viewport does not.
+            self.out = Some(target(gl, w, h, false)?);
+            let (mut mw, mut mh) = ((w >> 1).max(1), (h >> 1).max(1));
+            for _ in 0..BLOOM_MIPS {
+                self.mips.push(target(gl, mw, mh, true)?);
+                mw = (mw >> 1).max(1);
+                mh = (mh >> 1).max(1);
+            }
+            self.size = (w, h);
+            Ok(())
+        }
+    }
+
+    unsafe fn pass(&self, gl: &glow::Context, prog: glow::Program, to: Target, src: &[glow::Texture], set: impl Fn(&dyn Fn(&str) -> Option<glow::UniformLocation>)) {
+        unsafe {
+            gl.bind_framebuffer(glow::FRAMEBUFFER, Some(to.fbo));
+            gl.viewport(0, 0, to.w, to.h);
+            gl.use_program(Some(prog));
+            for (i, &t) in src.iter().enumerate() {
+                gl.active_texture(glow::TEXTURE0 + i as u32);
+                gl.bind_texture(glow::TEXTURE_2D, Some(t));
+            }
+            set(&|name| gl.get_uniform_location(prog, name));
+            gl.draw_arrays(glow::TRIANGLES, 0, 3);
+        }
+    }
+
+    unsafe fn draw(&mut self, gl: &glow::Context, vp: [i32; 4], time: f32, frame: i32, seed: [f32; 4]) {
+        unsafe {
+            let [x, y, w, h] = vp;
+            if w <= 0 || h <= 0 {
+                return;
+            }
+            if let Err(e) = self.resize(gl, w, h) {
+                log_error!("[Screensaver] {e}");
+                return;
+            }
+            let (scene, out) = (self.scene.unwrap(), self.out.unwrap());
+            let b = &PLASMA_BLOOM;
+
+            gl.disable(glow::SCISSOR_TEST);
+            gl.disable(glow::BLEND);
+            gl.disable(glow::CULL_FACE);
+            gl.disable(glow::DEPTH_TEST);
+            gl.disable(glow::FRAMEBUFFER_SRGB);
+            gl.bind_vertex_array(Some(self.vao));
+
+            // Scene, in HDR.
+            self.pass(gl, self.scene_prog, scene, &[], |u| {
+                gl.uniform_3_f32(u("iResolution").as_ref(), w as f32, h as f32, 1.0);
+                gl.uniform_1_f32(u("iTime").as_ref(), time);
+                gl.uniform_1_i32(u("iFrame").as_ref(), frame);
+                gl.uniform_4_f32(u("iSeed").as_ref(), seed[0], seed[1], seed[2], seed[3]);
+            });
+
+            // Bloom: bright pass into mip 0, down the chain, then additively
+            // back up it.
+            let m0 = self.mips[0];
+            self.pass(gl, self.bright, m0, &[scene.tex], |u| {
+                gl.uniform_1_i32(u("uSrc").as_ref(), 0);
+                gl.uniform_2_f32(u("uTexel").as_ref(), 1.0 / m0.w as f32, 1.0 / m0.h as f32);
+                gl.uniform_1_f32(u("uThreshold").as_ref(), b.threshold);
+                gl.uniform_1_f32(u("uKnee").as_ref(), b.knee.max(1e-4));
+            });
+            for i in 1..self.mips.len() {
+                let (src, dst) = (self.mips[i - 1], self.mips[i]);
+                self.pass(gl, self.down, dst, &[src.tex], |u| {
+                    gl.uniform_1_i32(u("uSrc").as_ref(), 0);
+                    gl.uniform_2_f32(u("uTexel").as_ref(), 1.0 / dst.w as f32, 1.0 / dst.h as f32);
+                });
+            }
+            gl.enable(glow::BLEND);
+            gl.blend_func(glow::ONE, glow::ONE);
+            for i in (1..self.mips.len()).rev() {
+                let (src, dst) = (self.mips[i], self.mips[i - 1]);
+                self.pass(gl, self.up, dst, &[src.tex], |u| {
+                    gl.uniform_1_i32(u("uSrc").as_ref(), 0);
+                    gl.uniform_2_f32(u("uTexel").as_ref(), 1.0 / dst.w as f32, 1.0 / dst.h as f32);
+                    gl.uniform_1_f32(u("uRadius").as_ref(), b.radius);
+                });
+            }
+            gl.disable(glow::BLEND);
+
+            // Composite: scene + bloom, exposure, ACES, gamma, dither.
+            self.pass(gl, self.composite, out, &[scene.tex, m0.tex], |u| {
+                gl.uniform_1_i32(u("uScene").as_ref(), 0);
+                gl.uniform_1_i32(u("uBloom").as_ref(), 1);
+                gl.uniform_2_f32(u("uTexel").as_ref(), 1.0 / w as f32, 1.0 / h as f32);
+                gl.uniform_1_f32(u("uBloomIntensity").as_ref(), b.intensity);
+                gl.uniform_1_f32(u("uExposure").as_ref(), 1.0);
+                gl.uniform_1_i32(u("uTonemap").as_ref(), 2);
+                gl.uniform_1_i32(u("uDither").as_ref(), 1);
+            });
+            gl.active_texture(glow::TEXTURE0);
+
+            // Into egui's framebuffer (the default one: egui_glow paints
+            // straight to the screen; see Painter::intermediate_fbo).
+            gl.bind_framebuffer(glow::READ_FRAMEBUFFER, Some(out.fbo));
+            gl.bind_framebuffer(glow::DRAW_FRAMEBUFFER, None);
+            gl.blit_framebuffer(0, 0, w, h, x, y, x + w, y + h, glow::COLOR_BUFFER_BIT, glow::NEAREST);
+            gl.bind_framebuffer(glow::FRAMEBUFFER, None);
+            gl.bind_vertex_array(None);
+            gl.use_program(None);
+        }
+    }
+}
diff --git a/input_viewer_egui/src/render_stats.rs b/input_viewer_egui/src/render_stats.rs
new file mode 100644
index 0000000..9e6c23f
--- /dev/null
+++ b/input_viewer_egui/src/render_stats.rs
@@ -0,0 +1,156 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Per-stream frame accounting for `--hud`: is every frame the source makes
+//! reaching the screen?
+//!
+//! - **source fps** -- from the sequence numbers, so it counts frames the
+//!   source made whether or not they were shown.
+//! - **shown fps** -- frames actually uploaded to a texture.
+//! - **skipped** -- source frames replaced before the UI got to them. Zero
+//!   means the renderer keeps up; anything else means frames never reached
+//!   the screen.
+//! - **delay** -- from the frame being captured to its upload. Not glass to
+//!   glass (the paint and the display's scanout come after), but it is the
+//!   part this app controls.
+
+use std::time::{Duration, Instant};
+
+pub const WINDOW: Duration = Duration::from_secs(1);
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Report {
+    pub source_fps: f32,
+    pub shown_fps: f32,
+    pub skipped: u64,
+    pub delay_ms: f32,
+}
+
+#[derive(Debug)]
+pub struct RenderStats {
+    window_start: Option<Instant>,
+    first_seq: u64,
+    last_seq: u64,
+    shown: u32,
+    skipped: u64,
+    delay: Duration,
+    delay_n: u32,
+    pub total_skipped: u64,
+    pub last: Option<Report>,
+}
+
+impl RenderStats {
+    pub fn new() -> Self {
+        Self {
+            window_start: None,
+            first_seq: 0,
+            last_seq: 0,
+            shown: 0,
+            skipped: 0,
+            delay: Duration::ZERO,
+            delay_n: 0,
+            total_skipped: 0,
+            last: None,
+        }
+    }
+
+    /// A frame was uploaded. `prev_seq` is the one shown before it (0: none).
+    pub fn shown(&mut self, now: Instant, seq: u64, prev_seq: u64, captured_at: Instant) {
+        if self.window_start.is_none() {
+            self.window_start = Some(now);
+            self.first_seq = seq;
+        }
+        if prev_seq != 0 && seq > prev_seq + 1 {
+            let gap = seq - prev_seq - 1;
+            self.skipped += gap;
+            self.total_skipped += gap;
+        }
+        self.last_seq = seq;
+        self.shown += 1;
+        self.delay += now.saturating_duration_since(captured_at);
+        self.delay_n += 1;
+    }
+
+    /// Close the window once a second; returns the new report when it does.
+    pub fn tick(&mut self, now: Instant) -> Option<Report> {
+        let start = self.window_start?;
+        let elapsed = now.saturating_duration_since(start);
+        if elapsed < WINDOW {
+            return None;
+        }
+        let secs = elapsed.as_secs_f32();
+        let report = Report {
+            source_fps: (self.last_seq - self.first_seq) as f32 / secs,
+            shown_fps: self.shown.saturating_sub(1) as f32 / secs,
+            skipped: self.skipped,
+            delay_ms: self.delay.as_secs_f32() * 1000.0 / self.delay_n.max(1) as f32,
+        };
+        // The next window starts at the last frame, so no interval is lost.
+        // That frame opens the window as a fence post for the rates; its
+        // delay was already counted in this one.
+        self.window_start = Some(now);
+        self.first_seq = self.last_seq;
+        self.shown = 1;
+        self.skipped = 0;
+        self.delay = Duration::ZERO;
+        self.delay_n = 0;
+        self.last = Some(report);
+        Some(report)
+    }
+}
+
+impl Report {
+    pub fn line(&self) -> String {
+        format!(
+            "source {:.1} fps · shown {:.1} fps · skipped {} · delay {:.1} ms",
+            self.source_fps, self.shown_fps, self.skipped, self.delay_ms
+        )
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn run(source_fps: u64, shown_every: u64, secs: u64) -> Report {
+        let t0 = Instant::now();
+        let mut s = RenderStats::new();
+        let mut prev = 0;
+        let mut last = None;
+        for seq in 1..=source_fps * secs + 1 {
+            let at = t0 + Duration::from_secs_f64((seq - 1) as f64 / source_fps as f64);
+            if (seq - 1) % shown_every == 0 {
+                s.shown(at, seq, prev, at - Duration::from_millis(2));
+                prev = seq;
+            }
+            if let Some(r) = s.tick(at) {
+                last = Some(r);
+            }
+        }
+        last.expect("a full window")
+    }
+
+    #[test]
+    fn keeping_up_shows_every_frame() {
+        let r = run(60, 1, 3);
+        assert!((r.source_fps - 60.0).abs() < 0.5, "{r:?}");
+        assert!((r.shown_fps - 60.0).abs() < 0.5, "{r:?}");
+        assert_eq!(r.skipped, 0);
+        assert!((r.delay_ms - 2.0).abs() < 0.01);
+    }
+
+    #[test]
+    fn a_renderer_at_half_rate_skips_every_other_frame() {
+        let r = run(60, 2, 3);
+        assert!((r.shown_fps - 30.0).abs() < 0.5, "{r:?}");
+        assert!((r.source_fps - 60.0).abs() < 0.5, "{r:?}");
+        assert_eq!(r.skipped, 30);
+    }
+
+    #[test]
+    fn nothing_until_a_full_window() {
+        let mut s = RenderStats::new();
+        let t0 = Instant::now();
+        s.shown(t0, 1, 0, t0);
+        assert_eq!(s.tick(t0 + Duration::from_millis(500)), None);
+    }
+}
diff --git a/input_viewer_egui/src/review.rs b/input_viewer_egui/src/review.rs
new file mode 100644
index 0000000..989eae5
--- /dev/null
+++ b/input_viewer_egui/src/review.rs
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Headless review hook: render, save a PNG of the window, quit.
+//!
+//! `screencapture` needs Screen Recording permission, which a CI runner or an
+//! agent's shell does not have. egui can read back its own framebuffer, so this
+//! captures exactly what was drawn without asking the OS.
+//!
+//! ```sh
+//! INPUT_VIEWER_SCREENSHOT=out.png INPUT_VIEWER_OPEN=dropdown input-viewer --mock
+//! ```
+//!
+//! `INPUT_VIEWER_OPEN` (`dropdown`, `legend`, `settings`, `settings:layout`) pins a panel open,
+//! since there is no pointer to hover with. `INPUT_VIEWER_SCREENSHOT_AFTER` is
+//! the delay in ms (default 2500).
+
+use std::path::PathBuf;
+use std::time::{Duration, Instant};
+
+use eframe::egui;
+use crate::filelog::{log_error, log_info};
+
+pub struct Review {
+    path: PathBuf,
+    due: Instant,
+    requested: bool,
+    pub open: Option<String>,
+}
+
+impl Review {
+    pub fn from_env() -> Option<Self> {
+        let path = std::env::var_os("INPUT_VIEWER_SCREENSHOT")?.into();
+        let after = std::env::var("INPUT_VIEWER_SCREENSHOT_AFTER").ok().and_then(|v| v.parse().ok()).unwrap_or(2500);
+        Some(Self {
+            path,
+            due: Instant::now() + Duration::from_millis(after),
+            requested: false,
+            open: std::env::var("INPUT_VIEWER_OPEN").ok(),
+        })
+    }
+
+    pub fn tick(&mut self, ctx: &egui::Context) {
+        if !self.requested && Instant::now() >= self.due {
+            self.requested = true;
+            ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(Default::default()));
+        }
+        let shot = ctx.input(|i| {
+            i.events.iter().find_map(|e| match e {
+                egui::Event::Screenshot { image, .. } => Some(image.clone()),
+                _ => None,
+            })
+        });
+        if let Some(img) = shot {
+            let [w, h] = img.size;
+            let bytes: Vec<u8> = img.pixels.iter().flat_map(|c| c.to_array()).collect();
+            match image::save_buffer(&self.path, &bytes, w as u32, h as u32, image::ExtendedColorType::Rgba8) {
+                Ok(()) => log_info!("[Review] saved {} ({w}x{h})", self.path.display()),
+                Err(e) => log_error!("[Review] could not save {}: {e}", self.path.display()),
+            }
+            ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+        }
+        ctx.request_repaint_after(Duration::from_millis(100));
+    }
+}
diff --git a/input_viewer_egui/src/screensaver.rs b/input_viewer_egui/src/screensaver.rs
new file mode 100644
index 0000000..af474e9
--- /dev/null
+++ b/input_viewer_egui/src/screensaver.rs
@@ -0,0 +1,235 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! No-signal screen: the split-flap board, then a screensaver.
+//!
+//! The Electron app has ~30 WebGL savers. These are three painter-only ones,
+//! enough to show the lifecycle: per-activation seed (logged, so a look can be
+//! reproduced), rotation every ten minutes, and never repeating the last pick.
+
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use eframe::egui::{self, Align2, Color32, FontId, Pos2, Rect, Stroke, StrokeKind, Vec2, pos2, vec2};
+use crate::filelog::log_info;
+
+pub const ROTATE_EVERY: Duration = Duration::from_secs(10 * 60);
+
+/// xorshift64*; small, seedable, good enough for visuals.
+#[derive(Clone)]
+pub struct Rng(u64);
+
+impl Rng {
+    pub fn new(seed: u64) -> Self {
+        Self(seed.max(1))
+    }
+    pub fn clock_seed() -> u64 {
+        SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_nanos() as u64).unwrap_or(1)
+    }
+    pub fn next_u64(&mut self) -> u64 {
+        self.0 ^= self.0 >> 12;
+        self.0 ^= self.0 << 25;
+        self.0 ^= self.0 >> 27;
+        self.0.wrapping_mul(0x2545_f491_4f6c_dd1d)
+    }
+    /// Uniform in [0, 1).
+    pub fn f32(&mut self) -> f32 {
+        (self.next_u64() >> 40) as f32 / (1u64 << 24) as f32
+    }
+    pub fn range(&mut self, lo: f32, hi: f32) -> f32 {
+        lo + (hi - lo) * self.f32()
+    }
+    /// An index in `0..n` that is not `avoid` (when n > 1).
+    pub fn index_except(&mut self, n: usize, avoid: Option<usize>) -> usize {
+        if n <= 1 {
+            return 0;
+        }
+        match avoid {
+            Some(a) if a < n => {
+                let i = (self.next_u64() % (n as u64 - 1)) as usize;
+                if i >= a { i + 1 } else { i }
+            }
+            _ => (self.next_u64() % n as u64) as usize,
+        }
+    }
+}
+
+pub const NAMES: &[&str] = &["Plasma", "Starfield", "DVD logo", "Lissajous"];
+
+pub struct Screensaver {
+    pub index: usize,
+    pub seed: u64,
+    state: State,
+}
+
+enum State {
+    /// GPU, see plasma.rs. `seed` is gl-base.js's iSeed: four uncorrelated
+    /// randoms fixed for the activation.
+    Plasma { seed: [f32; 4], frame: i32 },
+    Starfield { stars: Vec<(f32, f32, f32)>, speed: f32 },
+    Dvd { pos: Vec2, vel: Vec2, hue: f32 },
+    Lissajous { a: f32, b: f32, phase: f32, hue: f32 },
+}
+
+impl Screensaver {
+    pub fn new(index: usize, seed: u64) -> Self {
+        let mut rng = Rng::new(seed);
+        let state = match index % NAMES.len() {
+            0 => State::Plasma { seed: [rng.f32(), rng.f32(), rng.f32(), rng.f32()], frame: 0 },
+            1 => State::Starfield {
+                stars: (0..600)
+                    .map(|_| (rng.range(-1.0, 1.0), rng.range(-1.0, 1.0), rng.range(0.05, 1.0)))
+                    .collect(),
+                speed: rng.range(0.15, 0.4),
+            },
+            2 => State::Dvd {
+                pos: vec2(rng.f32(), rng.f32()),
+                vel: vec2(rng.range(0.08, 0.14), rng.range(0.1, 0.2)),
+                hue: rng.f32(),
+            },
+            _ => State::Lissajous {
+                a: [1.0, 2.0, 3.0, 5.0][(rng.next_u64() % 4) as usize],
+                b: [2.0, 3.0, 4.0, 7.0][(rng.next_u64() % 4) as usize],
+                phase: rng.f32() * std::f32::consts::TAU,
+                hue: rng.f32(),
+            },
+        };
+        log_info!("[Screensaver] {} seed={seed}", NAMES[index % NAMES.len()]);
+        Self { index: index % NAMES.len(), seed, state }
+    }
+
+    pub fn name(&self) -> &'static str {
+        NAMES[self.index]
+    }
+
+    pub fn paint(&mut self, painter: &egui::Painter, rect: Rect, t: f32, dt: f32) {
+        // registry.js falls back to the DVD logo when a saver cannot start;
+        // same here if the GPU path did not come up.
+        if matches!(self.state, State::Plasma { .. }) && crate::plasma::failed() {
+            let mut rng = Rng::new(self.seed);
+            self.index = 2;
+            self.state = State::Dvd { pos: vec2(rng.f32(), rng.f32()), vel: vec2(0.1, 0.15), hue: rng.f32() };
+        }
+        painter.rect_filled(rect, 0.0, Color32::BLACK);
+        let c = rect.center();
+        match &mut self.state {
+            State::Plasma { seed, frame } => {
+                let (seed, f) = (*seed, *frame);
+                *frame += 1;
+                let cb = eframe::egui_glow::CallbackFn::new(move |info, painter| {
+                    let v = info.viewport_in_pixels();
+                    crate::plasma::paint(painter.gl(), [v.left_px, v.from_bottom_px, v.width_px, v.height_px], t, f, seed);
+                });
+                painter.add(egui::PaintCallback { rect, callback: std::sync::Arc::new(cb) });
+            }
+            State::Starfield { stars, speed } => {
+                let scale = rect.width().max(rect.height()) * 0.5;
+                for s in stars.iter_mut() {
+                    s.2 -= *speed * dt;
+                    if s.2 <= 0.02 {
+                        s.2 += 1.0;
+                    }
+                    let p = pos2(c.x + s.0 / s.2 * scale * 0.5, c.y + s.1 / s.2 * scale * 0.5);
+                    if rect.contains(p) {
+                        let b = ((1.0 - s.2) * 255.0) as u8;
+                        painter.circle_filled(p, (1.0 - s.2) * 2.5 + 0.5, Color32::from_gray(b));
+                    }
+                }
+            }
+            State::Dvd { pos, vel, hue } => {
+                let size = vec2(rect.height() * 0.5, rect.height() * 0.22);
+                let room = rect.size() - size;
+                *pos += *vel * dt;
+                for (p, v) in [(&mut pos.x, &mut vel.x), (&mut pos.y, &mut vel.y)] {
+                    if *p < 0.0 || *p > 1.0 {
+                        *p = p.clamp(0.0, 1.0);
+                        *v = -*v;
+                        *hue = (*hue + 0.17).fract();
+                    }
+                }
+                let min = rect.min + vec2(pos.x * room.x, pos.y * room.y);
+                let box_ = Rect::from_min_size(min, size);
+                let col = hsv(*hue, 0.8, 1.0);
+                painter.rect_stroke(box_, 12.0, Stroke::new(4.0, col), StrokeKind::Inside);
+                painter.text(box_.center(), Align2::CENTER_CENTER, "INPUT VIEWER",
+                    FontId::proportional(size.y * 0.35), col);
+            }
+            State::Lissajous { a, b, phase, hue } => {
+                let r = vec2(rect.width() * 0.45, rect.height() * 0.42);
+                let n = 600;
+                let pts: Vec<Pos2> = (0..=n)
+                    .map(|i| {
+                        let s = i as f32 / n as f32 * std::f32::consts::TAU;
+                        pos2(c.x + r.x * (*a * s + *phase + t * 0.2).sin(), c.y + r.y * (*b * s).sin())
+                    })
+                    .collect();
+                painter.add(egui::Shape::line(pts, Stroke::new(2.0, hsv((*hue + t * 0.01).fract(), 0.6, 0.9))));
+            }
+        }
+    }
+}
+
+pub fn hsv(h: f32, s: f32, v: f32) -> Color32 {
+    egui::ecolor::Hsva::new(h, s, v, 1.0).into()
+}
+
+const FLAP_CHARS: &[u8] = b" ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-";
+
+/// The split-flap board. Each cell flips through the alphabet until it lands
+/// on its letter; `age` is seconds since the board appeared.
+pub fn paint_split_flap(painter: &egui::Painter, rect: Rect, lines: &[&str], age: f32) {
+    painter.rect_filled(rect, 0.0, Color32::from_rgb(8, 8, 10));
+    let cols = lines.iter().map(|l| l.chars().count()).max().unwrap_or(1).max(10);
+    let cell_w = (rect.width() * 0.8 / cols as f32).min(rect.height() * 0.22 / 1.4);
+    let cell = vec2(cell_w, cell_w * 1.4);
+    let gap = cell_w * 0.08;
+    let total_h = lines.len() as f32 * (cell.y + gap * 3.0);
+    let mut y = rect.center().y - total_h / 2.0;
+    for (row, line) in lines.iter().enumerate() {
+        let chars: Vec<char> = line.to_uppercase().chars().collect();
+        let row_w = cols as f32 * (cell.x + gap);
+        let x0 = rect.center().x - row_w / 2.0;
+        for col in 0..cols {
+            let target = chars.get(col).copied().unwrap_or(' ');
+            let target_i = FLAP_CHARS.iter().position(|&c| c as char == target).unwrap_or(0);
+            // Each cell settles a little after its left neighbour.
+            let flips = ((age - (col + row * 3) as f32 * 0.04) * 24.0).max(0.0) as usize;
+            let shown = if flips >= target_i { target } else { FLAP_CHARS[flips] as char };
+            let min = pos2(x0 + col as f32 * (cell.x + gap), y);
+            let r = Rect::from_min_size(min, cell);
+            painter.rect_filled(r, cell.x * 0.08, Color32::from_rgb(28, 28, 32));
+            painter.hline(r.x_range(), r.center().y, Stroke::new(1.5, Color32::from_rgb(8, 8, 10)));
+            painter.text(r.center(), Align2::CENTER_CENTER, shown, FontId::monospace(cell.y * 0.7),
+                if row == 0 { Color32::from_rgb(240, 240, 235) } else { Color32::from_rgb(245, 190, 60) });
+        }
+        y += cell.y + gap * 3.0;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn same_seed_same_sequence() {
+        let (mut a, mut b) = (Rng::new(42), Rng::new(42));
+        for _ in 0..100 {
+            assert_eq!(a.next_u64(), b.next_u64());
+        }
+    }
+
+    #[test]
+    fn floats_stay_in_unit_interval() {
+        let mut r = Rng::new(7);
+        assert!((0..10_000).map(|_| r.f32()).all(|v| (0.0..1.0).contains(&v)));
+    }
+
+    #[test]
+    fn rotation_never_repeats_the_previous_pick() {
+        let mut r = Rng::new(9);
+        for prev in 0..NAMES.len() {
+            for _ in 0..200 {
+                assert_ne!(r.index_except(NAMES.len(), Some(prev)), prev);
+            }
+        }
+        assert_eq!(r.index_except(1, Some(0)), 0);
+    }
+}
diff --git a/input_viewer_egui/src/settings.rs b/input_viewer_egui/src/settings.rs
new file mode 100644
index 0000000..fda176a
--- /dev/null
+++ b/input_viewer_egui/src/settings.rs
@@ -0,0 +1,345 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! `settings.json`, in the Electron app's format.
+//!
+//! Same keys and the same file layout as Electron's, so it can be read, edited
+//! and copied around the same way on the wall. Lives in its own folder,
+//! `<config>/Input Viewer (egui)/`, next to Electron's `<config>/Input Viewer/`,
+//! so the two apps never write the same file.
+//!
+//! On first launch the Electron file is imported. What carries over is the
+//! layout -- centerGap, borderWidth, layoutMode, multiView -- and every key this
+//! app does not use (Art-Net, remote keyboard, volumes...), kept verbatim in
+//! `extra` and written back unchanged. Input names do **not** carry over:
+//! Electron keys `inputs` by Chromium's deviceId, a salted hash nothing outside
+//! Chromium can reproduce, and stores no label to match on instead. Those
+//! entries are kept but stay inert.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value};
+use crate::filelog::{log_error, log_info, log_warn};
+
+/// Electron's `debouncedSaveSettings` delay: a slider drag writes once, after
+/// it stops.
+const SAVE_DEBOUNCE: Duration = Duration::from_millis(300);
+
+pub const APP_DIR: &str = "Input Viewer (egui)";
+pub const ELECTRON_APP_DIR: &str = "Input Viewer";
+
+/// The ranges of Electron's sliders.
+pub const CENTER_GAP_RANGE: std::ops::RangeInclusive<f32> = 20.0..=200.0;
+pub const BORDER_WIDTH_RANGE: std::ops::RangeInclusive<f32> = 0.0..=200.0;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum Layout {
+    #[default]
+    Dual,
+    Single,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", default)]
+pub struct InputSettings {
+    /// Operator's name for the input; None shows the device's own label.
+    pub name: Option<String>,
+    pub enabled: bool,
+    #[serde(flatten)]
+    pub extra: Map<String, Value>,
+}
+
+impl Default for InputSettings {
+    fn default() -> Self {
+        Self { name: None, enabled: true, extra: Map::new() }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", default)]
+pub struct Settings {
+    /// Electron also allows null ("detect from the screen"); read as dual.
+    pub layout_mode: Option<Layout>,
+    pub multi_view: bool,
+    pub center_gap: f32,
+    pub border_width: f32,
+    pub left_device_id: Option<String>,
+    pub right_device_id: Option<String>,
+    /// The input both halves start on. None: the first enabled one.
+    pub default_input_id: Option<String>,
+    pub inputs: BTreeMap<String, InputSettings>,
+    /// Everything this app does not use, preserved for the round trip.
+    #[serde(flatten)]
+    pub extra: Map<String, Value>,
+}
+
+impl Default for Settings {
+    fn default() -> Self {
+        Self {
+            layout_mode: Some(Layout::Dual),
+            multi_view: true,
+            center_gap: 60.0,
+            border_width: 0.0,
+            left_device_id: None,
+            right_device_id: None,
+            default_input_id: None,
+            inputs: BTreeMap::new(),
+            extra: Map::new(),
+        }
+    }
+}
+
+impl Settings {
+    pub fn layout(&self) -> Layout {
+        self.layout_mode.unwrap_or_default()
+    }
+
+    /// The input's entry, created with defaults on first touch, as Electron's
+    /// `state.settings.inputs[deviceId] ??= { enabled: true }`.
+    pub fn input_mut(&mut self, id: &str) -> &mut InputSettings {
+        self.inputs.entry(id.to_owned()).or_default()
+    }
+
+    pub fn is_enabled(&self, id: &str) -> bool {
+        self.inputs.get(id).is_none_or(|i| i.enabled)
+    }
+
+    /// The operator's name if set and not blank.
+    pub fn name_of(&self, id: &str) -> Option<&str> {
+        self.inputs.get(id)?.name.as_deref().map(str::trim).filter(|n| !n.is_empty())
+    }
+
+    /// Pull out-of-range values from a hand-edited file back into the sliders'
+    /// range rather than rendering a 5000px gap.
+    pub fn sanitise(&mut self) {
+        let clamp = |v: f32, r: &std::ops::RangeInclusive<f32>, d: f32| {
+            if v.is_finite() { v.clamp(*r.start(), *r.end()) } else { d }
+        };
+        self.center_gap = clamp(self.center_gap, &CENTER_GAP_RANGE, 60.0);
+        self.border_width = clamp(self.border_width, &BORDER_WIDTH_RANGE, 0.0);
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Origin {
+    Own,
+    ImportedFromElectron(PathBuf),
+    Defaults,
+    /// The file did not parse. It was moved aside, not overwritten.
+    Recovered { backup: PathBuf, error: String },
+}
+
+pub struct Store {
+    path: Option<PathBuf>,
+    dirty_since: Option<Instant>,
+}
+
+pub fn default_path() -> Option<PathBuf> {
+    Some(dirs::config_dir()?.join(APP_DIR).join("settings.json"))
+}
+
+pub fn electron_path() -> Option<PathBuf> {
+    Some(dirs::config_dir()?.join(ELECTRON_APP_DIR).join("settings.json"))
+}
+
+pub fn parse(text: &str) -> Result<Settings, serde_json::Error> {
+    let mut s: Settings = serde_json::from_str(text)?;
+    s.sanitise();
+    Ok(s)
+}
+
+/// Load from `path`, else import from `electron`, else defaults.
+pub fn load_from(path: &Path, electron: Option<&Path>) -> (Settings, Origin) {
+    match std::fs::read_to_string(path) {
+        Ok(text) => match parse(&text) {
+            Ok(s) => return (s, Origin::Own),
+            Err(e) => {
+                let backup = path.with_extension(format!(
+                    "json.corrupt-{}",
+                    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs())
+                ));
+                let _ = std::fs::rename(path, &backup);
+                return (Settings::default(), Origin::Recovered { backup, error: e.to_string() });
+            }
+        },
+        Err(e) if e.kind() != std::io::ErrorKind::NotFound => {
+            log_warn!("[Settings] cannot read {}: {e}", path.display());
+        }
+        Err(_) => {}
+    }
+    if let Some(electron) = electron
+        && let Ok(text) = std::fs::read_to_string(electron)
+        && let Ok(s) = parse(&text)
+    {
+        return (s, Origin::ImportedFromElectron(electron.to_owned()));
+    }
+    (Settings::default(), Origin::Defaults)
+}
+
+impl Store {
+    /// `enabled: false` (mock mode) loads nothing and never writes: one mock run
+    /// must not persist `mock-input-N` as the wall's real selection.
+    pub fn open(enabled: bool) -> (Settings, Self) {
+        let path = default_path().filter(|_| enabled);
+        let Some(p) = &path else {
+            return (Settings::default(), Self { path: None, dirty_since: None });
+        };
+        let (settings, origin) = load_from(p, electron_path().as_deref());
+        match &origin {
+            Origin::Own => log_info!("[Settings] loaded {}", p.display()),
+            Origin::ImportedFromElectron(from) => log_info!("[Settings] imported layout from {}", from.display()),
+            Origin::Defaults => log_info!("[Settings] none found, using defaults"),
+            Origin::Recovered { backup, error } => {
+                log_warn!("[Settings] {} did not parse ({error}); moved to {}", p.display(), backup.display())
+            }
+        }
+        let mut store = Self { path, dirty_since: None };
+        // An import is written straight away, so it happens exactly once.
+        if !matches!(origin, Origin::Own) {
+            store.write(&settings);
+        }
+        (settings, store)
+    }
+
+    /// Where settings are written; None in mock and review runs.
+    pub fn path(&self) -> Option<&Path> {
+        self.path.as_deref()
+    }
+
+    pub fn mark_dirty(&mut self) {
+        self.dirty_since = Some(Instant::now());
+    }
+
+    /// Write if a change has settled. Call every frame.
+    pub fn tick(&mut self, settings: &Settings) {
+        if self.dirty_since.is_some_and(|t| t.elapsed() >= SAVE_DEBOUNCE) {
+            self.write(settings);
+        }
+    }
+
+    pub fn flush(&mut self, settings: &Settings) {
+        if self.dirty_since.is_some() {
+            self.write(settings);
+        }
+    }
+
+    fn write(&mut self, settings: &Settings) {
+        self.dirty_since = None;
+        let Some(path) = &self.path else { return };
+        if let Err(e) = write_atomic(path, settings) {
+            log_error!("[Settings] could not save {}: {e}", path.display());
+        }
+    }
+}
+
+/// Write to a temporary file and rename over the real one, so a crash or power
+/// cut mid-write leaves the previous settings rather than half a file.
+pub fn write_atomic(path: &Path, settings: &Settings) -> std::io::Result<()> {
+    if let Some(dir) = path.parent() {
+        std::fs::create_dir_all(dir)?;
+    }
+    let tmp = path.with_extension("json.tmp");
+    std::fs::write(&tmp, serde_json::to_string_pretty(settings)? + "\n")?;
+    std::fs::rename(&tmp, path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A trimmed real Electron settings.json.
+    const ELECTRON: &str = r#"{
+      "leftDeviceId": "4f1c0e9a",
+      "rightDeviceId": "4f1c0e9a",
+      "layoutMode": "single",
+      "centerGap": 80,
+      "borderWidth": 12,
+      "defaultInputId": null,
+      "leftVolume": 0.5,
+      "inputs": { "4f1c0e9a": { "name": "Booth", "enabled": true } },
+      "multiView": false,
+      "artnetEnabled": true,
+      "artnetUrl": "http://relay.local",
+      "artnetSceneBySaver": { "plasma": "warm" }
+    }"#;
+
+    #[test]
+    fn reads_the_electron_format() {
+        let s = parse(ELECTRON).unwrap();
+        assert_eq!(s.layout(), Layout::Single);
+        assert_eq!((s.center_gap, s.border_width, s.multi_view), (80.0, 12.0, false));
+        assert_eq!(s.name_of("4f1c0e9a"), Some("Booth"));
+    }
+
+    #[test]
+    fn keys_this_app_does_not_use_survive_a_round_trip() {
+        let s = parse(ELECTRON).unwrap();
+        let back: Value = serde_json::from_str(&serde_json::to_string(&s).unwrap()).unwrap();
+        assert_eq!(back["artnetUrl"], "http://relay.local");
+        assert_eq!(back["artnetSceneBySaver"]["plasma"], "warm");
+        assert_eq!(back["leftVolume"], 0.5);
+        assert_eq!(back["layoutMode"], "single");
+        assert_eq!(back["centerGap"], 80.0);
+    }
+
+    #[test]
+    fn null_layout_and_missing_keys_get_defaults() {
+        let s = parse(r#"{ "layoutMode": null }"#).unwrap();
+        assert_eq!(s.layout(), Layout::Dual);
+        assert!(s.multi_view);
+        assert_eq!(s.center_gap, 60.0);
+        assert!(s.is_enabled("never-seen"));
+    }
+
+    #[test]
+    fn hand_edited_values_are_pulled_into_range() {
+        let s = parse(r#"{ "centerGap": 5000, "borderWidth": -3 }"#).unwrap();
+        assert_eq!((s.center_gap, s.border_width), (200.0, 0.0));
+    }
+
+    #[test]
+    fn blank_names_fall_back_to_the_device_label() {
+        let mut s = Settings::default();
+        s.input_mut("a").name = Some("   ".into());
+        assert_eq!(s.name_of("a"), None);
+    }
+
+    fn scratch(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("iv-settings-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    #[test]
+    fn imports_electron_once_then_reads_its_own() {
+        let dir = scratch("import");
+        let (own, electron) = (dir.join("egui/settings.json"), dir.join("electron/settings.json"));
+        std::fs::create_dir_all(electron.parent().unwrap()).unwrap();
+        std::fs::write(&electron, ELECTRON).unwrap();
+
+        let (s, origin) = load_from(&own, Some(&electron));
+        assert!(matches!(origin, Origin::ImportedFromElectron(_)));
+        write_atomic(&own, &s).unwrap();
+
+        let (again, origin) = load_from(&own, Some(&electron));
+        assert_eq!(origin, Origin::Own);
+        assert_eq!(again, s);
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn a_corrupt_file_is_moved_aside_not_overwritten() {
+        let dir = scratch("corrupt");
+        let own = dir.join("settings.json");
+        std::fs::write(&own, "{ not json").unwrap();
+        let (s, origin) = load_from(&own, None);
+        assert_eq!(s, Settings::default());
+        let Origin::Recovered { backup, .. } = origin else { panic!("{origin:?}") };
+        assert_eq!(std::fs::read_to_string(backup).unwrap(), "{ not json");
+        std::fs::remove_dir_all(dir).unwrap();
+    }
+}
diff --git a/input_viewer_egui/src/settings_status.rs b/input_viewer_egui/src/settings_status.rs
new file mode 100644
index 0000000..6bb1374
--- /dev/null
+++ b/input_viewer_egui/src/settings_status.rs
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! What the Settings dialog says, kept apart from how it draws it -- the
+//! counterpart of `settings-status.js`, and unit tested for the same reason.
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Tone {
+    Ok,
+    Warn,
+    Off,
+}
+
+/// Where an input stands, as far as the dialog is concerned.
+#[derive(Debug, Clone, PartialEq)]
+pub enum InputState {
+    /// Not on either half, so no stream is open and nothing is known.
+    NotOnScreen,
+    Opening,
+    Live { width: usize, height: usize },
+    /// Frames arriving, picture one flat colour: being retried slowly.
+    Dark,
+    /// Closed for a reopen, about to open again.
+    Reopening,
+    Failed(String),
+}
+
+/// The Key column: `1`-`4` follow the order of *enabled* inputs, so a disabled
+/// input has no key (`–`) and the fifth enabled one onward has none either
+/// (`·`) -- printing `5` would promise a binding that does not exist.
+pub fn input_key_label(enabled_index: Option<usize>) -> &'static str {
+    match enabled_index {
+        None => "–",
+        Some(i) => ["1", "2", "3", "4"].get(i).copied().unwrap_or("·"),
+    }
+}
+
+pub fn input_status(enabled: bool, state: &InputState) -> (Tone, String) {
+    if !enabled {
+        return (Tone::Off, "Disabled. Hidden from the pickers and the number keys.".into());
+    }
+    match state {
+        InputState::NotOnScreen => (Tone::Off, "Not on screen.".into()),
+        InputState::Opening => (Tone::Off, "Opening…".into()),
+        InputState::Live { width, height } => (Tone::Ok, format!("Live, {width}x{height}.")),
+        InputState::Dark => (Tone::Warn, "On screen, picture is one flat colour. Retrying.".into()),
+        InputState::Reopening => (Tone::Warn, "Reopening…".into()),
+        InputState::Failed(e) => (Tone::Warn, format!("{e}. Retrying.")),
+    }
+}
+
+/// The nav entry for Inputs: how many are enabled, and amber if one on screen
+/// is failing or none are enabled at all.
+pub fn inputs_nav(states: &[(bool, InputState)]) -> (String, Tone) {
+    let enabled = states.iter().filter(|(e, _)| *e).count();
+    let text = format!("{enabled} of {}", states.len());
+    let failing = states.iter().any(|(e, s)| *e && matches!(s, InputState::Failed(_) | InputState::Dark));
+    let tone = if states.is_empty() || enabled == 0 || failing { Tone::Warn } else { Tone::Ok };
+    (text, tone)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn key_labels_follow_enabled_order() {
+        let labels: Vec<_> = [None, Some(0), Some(3), Some(4)].into_iter().map(input_key_label).collect();
+        assert_eq!(labels, ["–", "1", "4", "·"]);
+    }
+
+    #[test]
+    fn disabled_wins_over_whatever_the_stream_is_doing() {
+        let (tone, line) = input_status(false, &InputState::Failed("busy".into()));
+        assert_eq!(tone, Tone::Off);
+        assert!(line.starts_with("Disabled"));
+    }
+
+    #[test]
+    fn live_reports_the_resolution() {
+        assert_eq!(input_status(true, &InputState::Live { width: 3840, height: 2160 }),
+            (Tone::Ok, "Live, 3840x2160.".into()));
+    }
+
+    #[test]
+    fn nav_warns_on_failures_and_on_nothing_enabled() {
+        assert_eq!(inputs_nav(&[(true, InputState::NotOnScreen), (false, InputState::NotOnScreen)]),
+            ("1 of 2".into(), Tone::Ok));
+        assert_eq!(inputs_nav(&[(true, InputState::Failed("x".into()))]).1, Tone::Warn);
+        assert_eq!(inputs_nav(&[(false, InputState::NotOnScreen)]).1, Tone::Warn);
+        // A failing input that is disabled is the operator's choice, not a fault.
+        assert_eq!(inputs_nav(&[(true, InputState::NotOnScreen), (false, InputState::Failed("x".into()))]).1, Tone::Ok);
+        assert_eq!(inputs_nav(&[]).1, Tone::Warn);
+    }
+}
diff --git a/input_viewer_egui/src/shortcuts.rs b/input_viewer_egui/src/shortcuts.rs
new file mode 100644
index 0000000..9a5a3a7
--- /dev/null
+++ b/input_viewer_egui/src/shortcuts.rs
@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! The keyboard shortcuts, as data -- a port of `shortcuts.js` (#258).
+//!
+//! One list feeds both the key handler and the legend, so the two cannot drift.
+//! The remote-keyboard rows are omitted: the prototype has no remote keyboard.
+
+use eframe::egui::Key;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Action {
+    SelectInput(usize),
+    LayoutDual,
+    LayoutSingle,
+    Freeze,
+    ScreensaverToggle,
+    ScreensaverNext,
+    ScreensaverPrev,
+    Fullscreen,
+    Escape,
+    Quit,
+}
+
+pub struct Shortcut {
+    /// Each key with the action it runs. Most rows bind one action; `1`-`4`
+    /// bind a different input each.
+    pub keys: &'static [(Key, Action)],
+    pub chips: &'static str,
+    pub label: &'static str,
+}
+
+use Action::*;
+
+pub const SHORTCUTS: &[Shortcut] = &[
+    Shortcut {
+        keys: &[(Key::Num1, SelectInput(0)), (Key::Num2, SelectInput(1)), (Key::Num3, SelectInput(2)), (Key::Num4, SelectInput(3))],
+        chips: "1–4",
+        label: "Select input",
+    },
+    Shortcut { keys: &[(Key::D, LayoutDual)], chips: "D", label: "Dual view" },
+    Shortcut { keys: &[(Key::S, LayoutSingle)], chips: "S", label: "Single view" },
+    Shortcut { keys: &[(Key::Space, Freeze)], chips: "Space", label: "Freeze frame" },
+    Shortcut { keys: &[(Key::V, ScreensaverToggle)], chips: "V", label: "Screensaver on demand" },
+    // '=' is the unshifted key that produces '+' on US/UK layouts.
+    Shortcut { keys: &[(Key::Plus, ScreensaverNext), (Key::Equals, ScreensaverNext)], chips: "+", label: "Next screensaver" },
+    Shortcut { keys: &[(Key::Minus, ScreensaverPrev)], chips: "-", label: "Previous screensaver" },
+    Shortcut { keys: &[(Key::F, Fullscreen), (Key::F11, Fullscreen)], chips: "F / F11", label: "Fullscreen" },
+    Shortcut { keys: &[(Key::Escape, Escape)], chips: "Esc", label: "Exit fullscreen, unfreeze, close panels" },
+    Shortcut { keys: &[(Key::Q, Quit)], chips: "Q", label: "Quit" },
+];
+
+/// The action bound to `key`, looked up in the table above.
+pub fn action_for(key: Key) -> Option<Action> {
+    SHORTCUTS.iter().flat_map(|s| s.keys).find(|(k, _)| *k == key).map(|(_, a)| *a)
+}
+
+/// The chip for the input at `index`, or None past the fourth: labelling a fifth
+/// row `5` would promise a binding that does not exist.
+pub fn input_key_for(index: usize) -> Option<&'static str> {
+    ["1", "2", "3", "4"].get(index).copied()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashSet;
+
+    #[test]
+    fn no_key_is_claimed_twice() {
+        // A duplicate would silently shadow the later entry in action_for.
+        let mut seen = HashSet::new();
+        for (k, _) in SHORTCUTS.iter().flat_map(|s| s.keys) {
+            assert!(seen.insert(*k), "{k:?} listed twice");
+        }
+    }
+
+    #[test]
+    fn every_action_is_reachable_from_a_key() {
+        let all = [LayoutDual, LayoutSingle, Freeze, ScreensaverToggle, ScreensaverNext,
+            ScreensaverPrev, Fullscreen, Escape, Quit, SelectInput(0), SelectInput(3)];
+        for a in all {
+            assert!(SHORTCUTS.iter().flat_map(|s| s.keys).any(|(_, b)| *b == a), "{a:?} has no key");
+        }
+    }
+
+    #[test]
+    fn number_chips_stop_at_four() {
+        assert_eq!(input_key_for(3), Some("4"));
+        assert_eq!(input_key_for(4), None);
+    }
+}
diff --git a/input_viewer_egui/src/testpattern.rs b/input_viewer_egui/src/testpattern.rs
new file mode 100644
index 0000000..9611f62
--- /dev/null
+++ b/input_viewer_egui/src/testpattern.rs
@@ -0,0 +1,309 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! A motion test pattern for `--test-pattern`: does a 4K60 feed render
+//! properly, and if not, how not?
+//!
+//! Each element answers one question by looking at the screen:
+//!
+//! | Element | Shows |
+//! |---|---|
+//! | Lamp row, one cell lit per frame | Dropped or repeated frames: in a photo with a long exposure every cell should be lit once per second, evenly. A gap is a drop, a brighter cell a repeat. |
+//! | Timecode `MM:SS:FF` and a 32-bit frame-number strip | Which frame is on screen, so two halves (or a screenshot) can be compared. |
+//! | Sweeping bar, red on even frames and cyan on odd | Tearing (the bar splits into two colours along a line) and blending (it goes purple-grey). Moves exactly its own width per frame, so steady motion has no gaps and no overlap -- any judder is the renderer's. |
+//! | Coloured corner marks and a 4px border | Cropping and aspect: all four corners must be visible, and unstretched. |
+//! | 1px line pairs and checkerboards | Scaling quality: a 4K frame on a smaller half is downscaled, and these turn to grey (good) or to moiré (aliasing). |
+//! | Grey and RGB ramps | Banding and gamma. |
+//!
+//! The static parts are drawn once; a frame copies them and draws only what
+//! moves, which is what keeps 3840x2160 at 60 fps within one core.
+
+use eframe::egui::Color32;
+
+const BG: Color32 = Color32::from_rgb(16, 16, 20);
+const PANEL: Color32 = Color32::from_rgb(28, 28, 34);
+const DIM: Color32 = Color32::from_rgb(40, 40, 48);
+const LIT: Color32 = Color32::WHITE;
+const EVEN: Color32 = Color32::from_rgb(255, 40, 40);
+const ODD: Color32 = Color32::from_rgb(0, 230, 230);
+
+/// Fractions of the frame, so the layout holds at any test size.
+struct Layout {
+    w: usize,
+    h: usize,
+}
+
+impl Layout {
+    fn x(&self, f: f32) -> usize {
+        ((self.w as f32 * f) as usize).min(self.w)
+    }
+    fn y(&self, f: f32) -> usize {
+        ((self.h as f32 * f) as usize).min(self.h)
+    }
+    fn lamp_row(&self) -> (usize, usize, usize, usize) {
+        (self.x(0.04), self.y(0.05), self.x(0.96), self.y(0.11))
+    }
+    fn strip(&self) -> (usize, usize, usize, usize) {
+        (self.x(0.04), self.y(0.13), self.x(0.96), self.y(0.17))
+    }
+    fn timecode(&self) -> (usize, usize, usize, usize) {
+        (self.x(0.18), self.y(0.22), self.x(0.96), self.y(0.52))
+    }
+    fn input_number(&self) -> (usize, usize, usize, usize) {
+        (self.x(0.04), self.y(0.22), self.x(0.14), self.y(0.52))
+    }
+    fn sweep(&self) -> (usize, usize) {
+        (self.y(0.57), self.y(0.73))
+    }
+}
+
+pub struct Pattern {
+    w: usize,
+    h: usize,
+    fps: u32,
+    input: usize,
+    background: Vec<Color32>,
+}
+
+fn fill(px: &mut [Color32], w: usize, x0: usize, y0: usize, x1: usize, y1: usize, c: Color32) {
+    let h = px.len() / w.max(1);
+    let (x1, y1) = (x1.min(w), y1.min(h));
+    for y in y0.min(y1)..y1 {
+        px[y * w + x0.min(x1)..y * w + x1].fill(c);
+    }
+}
+
+/// Seven-segment digits: no font rasteriser in a capture thread.
+const SEGMENTS: [u8; 10] = [0x3f, 0x06, 0x5b, 0x4f, 0x66, 0x6d, 0x7d, 0x07, 0x7f, 0x6f];
+
+#[allow(clippy::too_many_arguments)] // a drawing primitive: position, size, glyph, colours
+fn digit(px: &mut [Color32], w: usize, x: usize, y: usize, dw: usize, dh: usize, d: u8, on: Color32, off: Color32) {
+    let t = (dw / 6).max(2);
+    let half = dh / 2;
+    // a b c d e f g
+    let rects = [
+        (x + t, y, x + dw - t, y + t),
+        (x + dw - t, y + t, x + dw, y + half),
+        (x + dw - t, y + half, x + dw, y + dh - t),
+        (x + t, y + dh - t, x + dw - t, y + dh),
+        (x, y + half, x + t, y + dh - t),
+        (x, y + t, x + t, y + half),
+        (x + t, y + half - t / 2, x + dw - t, y + half + t - t / 2),
+    ];
+    for (i, (x0, y0, x1, y1)) in rects.into_iter().enumerate() {
+        let lit = SEGMENTS[d as usize % 10] & (1 << i) != 0;
+        fill(px, w, x0, y0, x1, y1, if lit { on } else { off });
+    }
+}
+
+/// Draw `text` (digits and ':') right-aligned-free, fitted to the box.
+fn seven_seg(px: &mut [Color32], w: usize, (x0, y0, x1, y1): (usize, usize, usize, usize), text: &str, on: Color32, off: Color32) {
+    let n = text.chars().count().max(1) as f32;
+    let dh = y1 - y0;
+    let dw = ((x1 - x0) as f32 / n * 0.8).min(dh as f32 * 0.55) as usize;
+    let step = ((x1 - x0) as f32 / n) as usize;
+    for (i, ch) in text.chars().enumerate() {
+        let x = x0 + i * step + (step - dw) / 2;
+        match ch {
+            ':' => {
+                let s = (dw / 6).max(2);
+                let cx = x + dw / 2 - s / 2;
+                fill(px, w, cx, y0 + dh / 3 - s / 2, cx + s, y0 + dh / 3 + s / 2, on);
+                fill(px, w, cx, y0 + 2 * dh / 3 - s / 2, cx + s, y0 + 2 * dh / 3 + s / 2, on);
+            }
+            c => digit(px, w, x, y0, dw, dh, c.to_digit(10).unwrap_or(0) as u8, on, off),
+        }
+    }
+}
+
+/// `MM:SS:FF` for frame `n` at `fps`.
+pub fn timecode(n: u64, fps: u32) -> String {
+    let fps = fps.max(1) as u64;
+    let (ff, s) = (n % fps, n / fps);
+    format!("{:02}:{:02}:{:02}", (s / 60) % 100, s % 60, ff)
+}
+
+/// Left edge of the sweeping bar on frame `n`. It advances exactly one bar
+/// width per frame and crosses the frame in two seconds.
+pub fn sweep_x(n: u64, w: usize, fps: u32) -> (usize, usize) {
+    let steps = (fps.max(1) as usize * 2).max(1);
+    let bar = (w / steps).max(1);
+    ((n as usize % steps) * bar, bar)
+}
+
+/// Which lamp is lit on frame `n`: one per frame, `fps` lamps.
+pub fn lamp(n: u64, fps: u32) -> usize {
+    (n % fps.max(1) as u64) as usize
+}
+
+impl Pattern {
+    pub fn new(w: usize, h: usize, fps: u32, input: usize) -> Self {
+        let mut p = Self { w, h, fps, input, background: vec![BG; w * h] };
+        p.draw_static();
+        p
+    }
+
+    fn draw_static(&mut self) {
+        let (w, h) = (self.w, self.h);
+        let l = Layout { w, h };
+        let px = &mut self.background;
+
+        // Resolution blocks: vertical 1px lines, horizontal 1px lines, 1px
+        // and 2px checkerboards.
+        let (by0, by1) = (l.y(0.77), l.y(0.95));
+        for (i, kind) in [0, 1, 2, 3].into_iter().enumerate() {
+            let bx0 = l.x(0.04 + i as f32 * 0.115);
+            let bx1 = l.x(0.04 + i as f32 * 0.115 + 0.1);
+            for y in by0..by1 {
+                for x in bx0..bx1 {
+                    let on = match kind {
+                        0 => x % 2 == 0,
+                        1 => y % 2 == 0,
+                        2 => (x + y) % 2 == 0,
+                        _ => (x / 2 + y / 2) % 2 == 0,
+                    };
+                    px[y * w + x] = if on { LIT } else { Color32::BLACK };
+                }
+            }
+        }
+
+        // Ramps: grey, then R, G, B, stacked.
+        let (rx0, rx1) = (l.x(0.52), l.x(0.96));
+        let rows = [(1, 1, 1), (1, 0, 0), (0, 1, 0), (0, 0, 1)];
+        let band = (by1 - by0) / rows.len();
+        for (i, (r, g, b)) in rows.into_iter().enumerate() {
+            for x in rx0..rx1 {
+                let v = ((x - rx0) * 255 / (rx1 - rx0 - 1).max(1)) as u8;
+                let c = Color32::from_rgb(v * r, v * g, v * b);
+                for y in by0 + i * band..by0 + (i + 1) * band {
+                    px[y * w + x] = c;
+                }
+            }
+        }
+
+        // Panels behind the moving parts, and the unlit lamps.
+        let (lx0, ly0, lx1, ly1) = l.lamp_row();
+        fill(px, w, lx0, ly0, lx1, ly1, PANEL);
+        let cells = self.fps.max(1) as usize;
+        let cw = (lx1 - lx0) / cells;
+        for i in 0..cells {
+            let x = lx0 + i * cw;
+            fill(px, w, x + 2, ly0 + 2, x + cw.saturating_sub(2), ly1 - 2, DIM);
+        }
+        let (sx0, sy0, sx1, sy1) = l.strip();
+        fill(px, w, sx0, sy0, sx1, sy1, PANEL);
+        seven_seg(px, w, l.input_number(), &self.input.to_string(), Color32::from_rgb(245, 190, 60), PANEL);
+
+        // Border and corner marks: TL red, TR green, BL blue, BR yellow.
+        let b = 4.min(w / 2).min(h / 2);
+        fill(px, w, 0, 0, w, b, LIT);
+        fill(px, w, 0, h - b, w, h, LIT);
+        fill(px, w, 0, 0, b, h, LIT);
+        fill(px, w, w - b, 0, w, h, LIT);
+        let m = (h / 12).max(4);
+        let t = (m / 5).max(2);
+        for (cx, cy, c) in [
+            (b, b, Color32::RED),
+            (w - b - m, b, Color32::GREEN),
+            (b, h - b - m, Color32::BLUE),
+            (w - b - m, h - b - m, Color32::YELLOW),
+        ] {
+            fill(px, w, cx, cy, cx + m, cy + m, c);
+            fill(px, w, cx + t, cy + t, cx + m - t, cy + m - t, BG);
+        }
+    }
+
+    #[cfg(test)]
+    pub fn size(&self) -> (usize, usize) {
+        (self.w, self.h)
+    }
+
+    /// Frame `n`, freshly allocated: the buffer is handed to egui, which owns
+    /// it until the GPU upload.
+    pub fn frame(&self, n: u64) -> Vec<Color32> {
+        let mut px = self.background.clone();
+        let (w, h) = (self.w, self.h);
+        let l = Layout { w, h };
+
+        let (lx0, ly0, lx1, ly1) = l.lamp_row();
+        let cw = (lx1 - lx0) / self.fps.max(1) as usize;
+        let x = lx0 + lamp(n, self.fps) * cw;
+        fill(&mut px, w, x + 2, ly0 + 2, x + cw.saturating_sub(2), ly1 - 2, LIT);
+
+        let (sx0, sy0, sx1, sy1) = l.strip();
+        let bw = (sx1 - sx0) / 32;
+        for bit in 0..32 {
+            let on = (n >> (31 - bit)) & 1 == 1;
+            let x = sx0 + bit * bw;
+            fill(&mut px, w, x + 2, sy0 + 2, x + bw - 2, sy1 - 2, if on { LIT } else { DIM });
+        }
+
+        seven_seg(&mut px, w, l.timecode(), &timecode(n, self.fps), LIT, PANEL);
+
+        let (y0, y1) = l.sweep();
+        let (bx, bar) = sweep_x(n, w, self.fps);
+        fill(&mut px, w, bx, y0, bx + bar, y1, if n.is_multiple_of(2) { EVEN } else { ODD });
+        px
+    }
+
+    /// Read the frame number back from the strip.
+    #[cfg(test)]
+    pub fn decode_frame_number(&self, px: &[Color32]) -> u64 {
+        let l = Layout { w: self.w, h: self.h };
+        let (sx0, sy0, sx1, sy1) = l.strip();
+        let bw = (sx1 - sx0) / 32;
+        let y = (sy0 + sy1) / 2;
+        (0..32).fold(0u64, |acc, bit| {
+            let c = px[y * self.w + sx0 + bit * bw + bw / 2];
+            (acc << 1) | (c == LIT) as u64
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn timecode_rolls_over_at_the_frame_rate() {
+        assert_eq!(timecode(0, 60), "00:00:00");
+        assert_eq!(timecode(59, 60), "00:00:59");
+        assert_eq!(timecode(60, 60), "00:01:00");
+        assert_eq!(timecode(60 * 61 + 7, 60), "01:01:07");
+    }
+
+    #[test]
+    fn the_sweep_moves_exactly_its_own_width_per_frame() {
+        let (x0, bar) = sweep_x(10, 3840, 60);
+        let (x1, _) = sweep_x(11, 3840, 60);
+        assert_eq!(bar, 32);
+        assert_eq!(x1 - x0, bar);
+        assert_eq!(sweep_x(120, 3840, 60).0, 0, "wraps every two seconds");
+    }
+
+    #[test]
+    fn one_lamp_per_frame() {
+        let lit: Vec<_> = (0..120).map(|n| lamp(n, 60)).collect();
+        assert_eq!(&lit[..3], &[0, 1, 2]);
+        assert_eq!(lit[60], 0);
+    }
+
+    #[test]
+    fn frame_number_round_trips_through_the_strip() {
+        let p = Pattern::new(640, 360, 60, 1);
+        for n in [0, 1, 59, 60, 12_345, u32::MAX as u64] {
+            assert_eq!(p.decode_frame_number(&p.frame(n)), n);
+        }
+    }
+
+    #[test]
+    fn consecutive_frames_differ_and_the_corners_are_marked() {
+        let p = Pattern::new(640, 360, 60, 2);
+        let (a, b) = (p.frame(0), p.frame(1));
+        assert_ne!(a, b);
+        let (w, h) = p.size();
+        let m = h / 12;
+        // Just inside the 4px border, the top-left mark is red.
+        assert_eq!(a[(4 + m / 10) * w + 4 + m / 10], Color32::RED);
+        assert_eq!(a[(h - 5 - m / 10) * w + w - 5 - m / 10], Color32::YELLOW);
+    }
+}
diff --git a/input_viewer_egui/src/update.rs b/input_viewer_egui/src/update.rs
new file mode 100644
index 0000000..c89471d
--- /dev/null
+++ b/input_viewer_egui/src/update.rs
@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! Auto-update, the egui counterpart of electron-updater.
+//!
+//! Same flow as the Electron main process: one check a few seconds after
+//! start, then "Download / Later", then "Restart now / Later". A postponed
+//! update installs on the next quit, as `autoInstallOnAppQuit` does there.
+//!
+//! Packaging and updates are Velopack. Releases share the
+//! `LAB271/labs-input-viewer` repo with the Electron app, which constrains
+//! where the feed can be found:
+//!
+//! - egui releases are tagged `egui-v*` and are **never** marked "latest".
+//!   electron-updater resolves `/releases/latest`; an egui release there would
+//!   strand every Electron install looking for a `latest.yml` it lacks.
+//! - So Velopack's own `GithubSource` is not used. It scans only the ten most
+//!   recent releases, and the Electron app has shipped three in one day -- a
+//!   busy fortnight would push the last egui release out of that window and
+//!   the updater would report nothing, silently. `EguiReleases` filters by tag
+//!   prefix instead and hands the chosen release to `HttpSource`.
+
+use std::path::Path;
+use std::sync::mpsc::{self, Receiver, Sender};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use velopack::sources::{HttpSource, UpdateSource};
+use velopack::{UpdateCheck, UpdateInfo, UpdateManager, VelopackAsset, VelopackAssetFeed};
+use crate::filelog::{log_error, log_info, log_warn};
+
+pub const REPO: &str = "LAB271/labs-input-viewer";
+pub const TAG_PREFIX: &str = "egui-v";
+const FIRST_CHECK_AFTER: Duration = Duration::from_secs(3);
+
+#[derive(serde::Deserialize)]
+struct Release {
+    tag_name: String,
+    draft: bool,
+    prerelease: bool,
+}
+
+/// The newest published egui release, from a page of `/releases`.
+/// GitHub returns them newest first.
+pub fn newest_egui_tag(releases: &[(String, bool, bool)]) -> Option<&str> {
+    releases
+        .iter()
+        .find(|(tag, draft, pre)| !draft && !pre && tag.starts_with(TAG_PREFIX))
+        .map(|(tag, _, _)| tag.as_str())
+}
+
+/// Update source that resolves the newest `egui-v*` release, then reads its
+/// Velopack feed over plain HTTP.
+#[derive(Default)]
+struct EguiReleases {
+    resolved: Mutex<Option<HttpSource>>,
+}
+
+impl EguiReleases {
+    fn resolve(&self) -> Result<HttpSource, velopack::Error> {
+        let url = format!("https://api.github.com/repos/{REPO}/releases?per_page=100");
+        let list: Vec<Release> = ureq::get(&url)
+            .header("Accept", "application/vnd.github+json")
+            .header("User-Agent", "input-viewer-egui")
+            .call()
+            .and_then(|mut r| r.body_mut().read_json())
+            .map_err(|e| velopack::Error::Other(format!("listing releases: {e}")))?;
+        let list: Vec<_> = list.into_iter().map(|r| (r.tag_name, r.draft, r.prerelease)).collect();
+        let tag = newest_egui_tag(&list)
+            .ok_or_else(|| velopack::Error::Other(format!("no {TAG_PREFIX}* release in the last 100")))?;
+        Ok(HttpSource::new(format!("https://github.com/{REPO}/releases/download/{tag}/")))
+    }
+}
+
+impl UpdateSource for EguiReleases {
+    fn get_release_feed(&self, channel: &str, app: &velopack::bundle::Manifest, staged: &str) -> Result<VelopackAssetFeed, velopack::Error> {
+        let source = self.resolve()?;
+        let feed = source.get_release_feed(channel, app, staged);
+        *self.resolved.lock().unwrap() = Some(source);
+        feed
+    }
+
+    fn download_release_entry(&self, asset: &VelopackAsset, local_file: &Path, progress: Option<Sender<i16>>) -> Result<(), velopack::Error> {
+        // The feed of release N lists N's full package and its deltas, all
+        // uploaded to release N, so the source the feed came from serves them.
+        let source = match self.resolved.lock().unwrap().clone() {
+            Some(s) => s,
+            None => self.resolve()?,
+        };
+        source.download_release_entry(asset, local_file, progress)
+    }
+}
+
+/// What the UI should show.
+#[derive(Debug, Clone, PartialEq)]
+pub enum Status {
+    Idle,
+    Available(String),
+    Downloading(i16),
+    Ready(String),
+    Failed(String),
+}
+
+enum Command {
+    Download,
+    RestartNow,
+}
+
+/// Background updater. All Velopack calls block on the network, so they run on
+/// a worker thread and report back through `status`.
+pub struct Updater {
+    status: Arc<Mutex<Status>>,
+    commands: Sender<Command>,
+    /// Set once an update is downloaded, so `on_exit` can apply it.
+    pending: Arc<Mutex<Option<(UpdateManager, VelopackAsset)>>>,
+}
+
+impl Updater {
+    /// None when the app was not installed by Velopack (`cargo run`, a copied
+    /// binary): there is nothing to update in place, as with `isDev` in Electron.
+    pub fn start(ctx: eframe::egui::Context) -> Option<Self> {
+        let manager = match UpdateManager::new(EguiReleases::default(), None, None) {
+            Ok(m) => m,
+            Err(e) => {
+                log_info!("[AutoUpdater] disabled: {e}");
+                return None;
+            }
+        };
+        log_info!("[AutoUpdater] installed version {}", manager.get_current_version_as_string());
+        let status = Arc::new(Mutex::new(Status::Idle));
+        let pending = Arc::new(Mutex::new(None));
+        let (tx, rx) = mpsc::channel();
+        let (s, p) = (status.clone(), pending.clone());
+        std::thread::Builder::new()
+            .name("updater".into())
+            .spawn(move || run(manager, rx, s, p, ctx))
+            .ok()?;
+        Some(Self { status, commands: tx, pending })
+    }
+
+    pub fn status(&self) -> Status {
+        self.status.lock().unwrap().clone()
+    }
+
+    pub fn dismiss(&self) {
+        let mut s = self.status.lock().unwrap();
+        // "Later" on a downloaded update keeps it pending for on_exit.
+        if !matches!(*s, Status::Downloading(_)) {
+            *s = Status::Idle;
+        }
+    }
+
+    pub fn download(&self) {
+        let _ = self.commands.send(Command::Download);
+    }
+
+    pub fn restart_now(&self) {
+        let _ = self.commands.send(Command::RestartNow);
+    }
+
+    /// Install a postponed update as the app quits.
+    pub fn on_exit(&self) {
+        if let Some((manager, asset)) = self.pending.lock().unwrap().take() {
+            log_info!("[AutoUpdater] installing {} on quit", asset.Version);
+            if let Err(e) = manager.wait_exit_then_apply_updates(&asset, true, false, Vec::<String>::new()) {
+                log_error!("[AutoUpdater] could not schedule install: {e}");
+            }
+        }
+    }
+}
+
+fn run(
+    manager: UpdateManager,
+    rx: Receiver<Command>,
+    status: Arc<Mutex<Status>>,
+    pending: Arc<Mutex<Option<(UpdateManager, VelopackAsset)>>>,
+    ctx: eframe::egui::Context,
+) {
+    let set = |s: Status| {
+        *status.lock().unwrap() = s;
+        ctx.request_repaint();
+    };
+    std::thread::sleep(FIRST_CHECK_AFTER);
+    log_info!("[AutoUpdater] checking for update...");
+    let info: Box<UpdateInfo> = match manager.check_for_updates() {
+        Ok(UpdateCheck::UpdateAvailable(info)) => info,
+        Ok(_) => {
+            log_info!("[AutoUpdater] up to date");
+            return;
+        }
+        Err(e) => {
+            // Logged, not shown: an offline wall should not greet the room
+            // with an error dialog every launch.
+            log_warn!("[AutoUpdater] check failed: {e}");
+            return;
+        }
+    };
+    let version = info.TargetFullRelease.Version.clone();
+    log_info!("[AutoUpdater] update available: {version}");
+    set(Status::Available(version.clone()));
+
+    while let Ok(cmd) = rx.recv() {
+        match cmd {
+            Command::Download => {
+                let (ptx, prx) = mpsc::channel::<i16>();
+                let progress_status = status.clone();
+                let progress_ctx = ctx.clone();
+                std::thread::spawn(move || {
+                    for pct in prx {
+                        *progress_status.lock().unwrap() = Status::Downloading(pct);
+                        progress_ctx.request_repaint();
+                    }
+                });
+                set(Status::Downloading(0));
+                match manager.download_updates(&info, Some(ptx)) {
+                    Ok(()) => {
+                        log_info!("[AutoUpdater] downloaded {version}");
+                        *pending.lock().unwrap() = Some((manager.clone(), info.TargetFullRelease.clone()));
+                        set(Status::Ready(version.clone()));
+                    }
+                    Err(e) => {
+                        log_error!("[AutoUpdater] download failed: {e}");
+                        set(Status::Failed(e.to_string()));
+                    }
+                }
+            }
+            Command::RestartNow => {
+                pending.lock().unwrap().take();
+                if let Err(e) = manager.apply_updates_and_restart(&info.TargetFullRelease) {
+                    log_error!("[AutoUpdater] restart failed: {e}");
+                    set(Status::Failed(e.to_string()));
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn r(tag: &str, draft: bool, pre: bool) -> (String, bool, bool) {
+        (tag.to_owned(), draft, pre)
+    }
+
+    #[test]
+    fn skips_electron_drafts_and_prereleases() {
+        let list = [
+            r("v3.5.0", false, false),
+            r("egui-v0.3.0", true, false),
+            r("egui-v0.2.1", false, true),
+            r("v3.4.1", false, false),
+            r("egui-v0.2.0", false, false),
+            r("egui-v0.1.0", false, false),
+        ];
+        assert_eq!(newest_egui_tag(&list), Some("egui-v0.2.0"));
+    }
+
+    #[test]
+    fn none_when_only_electron_releases() {
+        assert_eq!(newest_egui_tag(&[r("v3.4.1", false, false)]), None);
+    }
+}
diff --git a/input_viewer_egui/src/yuv.rs b/input_viewer_egui/src/yuv.rs
new file mode 100644
index 0000000..b16192c
--- /dev/null
+++ b/input_viewer_egui/src/yuv.rs
@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2025-2026 Schuberg Philis / Lab271
+//! YUY2 (packed 4:2:2) colour maths, BT.709 limited range.
+//!
+//! The wall's Elgato cards offer 3840x2160 only as YUY2. Converting that to
+//! RGBA on one CPU core took ~49 ms a frame on the wall and capped capture at
+//! ~12 fps, so the conversion moved to the GPU (`gpu_video.rs`). What stays on
+//! the CPU is here:
+//!
+//! - `yuyv_to_rgba`, the shader's formula in Rust, so the colour maths has
+//!   unit tests;
+//! - `rgba_to_yuyv`, so the `--test-pattern` source can emit what the cards
+//!   emit and exercise the same path -- split across cores, since a 4K frame
+//!   at 60 fps on one core would be the bottleneck being measured;
+//! - `luma_thumbnail`, so the health check reads brightness straight from the
+//!   Y bytes, without converting the frame.
+//!
+//! BT.709 because HD and UHD HDMI video is 709. nokhwa's CPU path used BT.601
+//! coefficients; the difference is a slight shift in greens and reds.
+//!
+//! Layout: every 4 bytes are `Y0 U Y1 V` for two horizontally adjacent pixels.
+
+/// Kr = 0.2126, Kb = 0.0722; limited range: Y 16..235, Cb/Cr 16..240.
+pub fn ycbcr_to_rgb(y: u8, cb: u8, cr: u8) -> [u8; 3] {
+    let y = (f32::from(y) - 16.0) / 219.0;
+    let cb = (f32::from(cb) - 128.0) / 224.0;
+    let cr = (f32::from(cr) - 128.0) / 224.0;
+    let r = y + 1.5748 * cr;
+    let g = y - 0.1873 * cb - 0.4681 * cr;
+    let b = y + 1.8556 * cb;
+    [r, g, b].map(|c| (c.clamp(0.0, 1.0) * 255.0).round() as u8)
+}
+
+pub fn rgb_to_ycbcr(r: u8, g: u8, b: u8) -> [u8; 3] {
+    let (r, g, b) = (f32::from(r) / 255.0, f32::from(g) / 255.0, f32::from(b) / 255.0);
+    let y = 0.2126 * r + 0.7152 * g + 0.0722 * b;
+    let cb = (b - y) / 1.8556;
+    let cr = (r - y) / 1.5748;
+    [
+        (16.0 + 219.0 * y).round().clamp(0.0, 255.0) as u8,
+        (128.0 + 224.0 * cb).round().clamp(0.0, 255.0) as u8,
+        (128.0 + 224.0 * cr).round().clamp(0.0, 255.0) as u8,
+    ]
+}
+
+/// What the GPU shader computes, on the CPU. Width must be even.
+pub fn yuyv_to_rgba(yuyv: &[u8], w: usize, h: usize) -> Vec<u8> {
+    let mut out = vec![0u8; w * h * 4];
+    for (i, q) in yuyv[..w * h * 2].as_chunks::<4>().0.iter().enumerate() {
+        let [y0, u, y1, v] = [q[0], q[1], q[2], q[3]];
+        let [r0, g0, b0] = ycbcr_to_rgb(y0, u, v);
+        let [r1, g1, b1] = ycbcr_to_rgb(y1, u, v);
+        out[i * 8..i * 8 + 8].copy_from_slice(&[r0, g0, b0, 255, r1, g1, b1, 255]);
+    }
+    out
+}
+
+/// RGBA to YUY2, chroma averaged over each pixel pair, rows split across
+/// threads. Width must be even.
+pub fn rgba_to_yuyv(rgba: &[u8], w: usize, h: usize) -> Vec<u8> {
+    let mut out = vec![0u8; w * h * 2];
+    let threads = std::thread::available_parallelism().map_or(4, |n| n.get()).min(16);
+    let rows_per = h.div_ceil(threads).max(1);
+    std::thread::scope(|scope| {
+        for (chunk_index, out_rows) in out.chunks_mut(rows_per * w * 2).enumerate() {
+            let src = &rgba[chunk_index * rows_per * w * 4..];
+            scope.spawn(move || {
+                for (i, q) in out_rows.as_chunks_mut::<4>().0.iter_mut().enumerate() {
+                    let p = &src[i * 8..i * 8 + 8];
+                    let [y0, u0, v0] = rgb_to_ycbcr(p[0], p[1], p[2]);
+                    let [y1, u1, v1] = rgb_to_ycbcr(p[4], p[5], p[6]);
+                    let u = (u16::from(u0) + u16::from(u1)).div_ceil(2) as u8;
+                    let v = (u16::from(v0) + u16::from(v1)).div_ceil(2) as u8;
+                    q.copy_from_slice(&[y0, u, y1, v]);
+                }
+            });
+        }
+    });
+    out
+}
+
+/// A grey RGBA thumbnail from the Y bytes alone, in full range (0..255) so
+/// the health check's thresholds mean the same as for an RGBA frame.
+/// Box-averaged like `health::thumbnail`, 4x4 samples per cell.
+pub fn luma_thumbnail(yuyv: &[u8], w: usize, h: usize, tw: usize, th: usize) -> Vec<u8> {
+    let mut out = vec![0u8; tw * th * 4];
+    if w < 2 || h == 0 || yuyv.len() < w * h * 2 {
+        return out;
+    }
+    const GRID: usize = 4;
+    for ty in 0..th {
+        let (y0, y1) = (ty * h / th, ((ty + 1) * h / th).max(ty * h / th + 1));
+        for tx in 0..tw {
+            let (x0, x1) = (tx * w / tw, ((tx + 1) * w / tw).max(tx * w / tw + 1));
+            let mut acc = 0u32;
+            for gy in 0..GRID {
+                let y = y0 + (y1 - y0) * (2 * gy + 1) / (2 * GRID);
+                for gx in 0..GRID {
+                    let x = x0 + (x1 - x0) * (2 * gx + 1) / (2 * GRID);
+                    // Y sits at byte 0 of each pixel's pair-half: 2 bytes a pixel.
+                    acc += u32::from(yuyv[(y * w + x) * 2]);
+                }
+            }
+            let mean = acc as f32 / (GRID * GRID) as f32;
+            let full = ((mean - 16.0) * 255.0 / 219.0).round().clamp(0.0, 255.0) as u8;
+            let o = (ty * tw + tx) * 4;
+            out[o..o + 4].copy_from_slice(&[full, full, full, 255]);
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn reference_colours_round_trip() {
+        for rgb in [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [192, 192, 0], [16, 16, 20]] {
+            let [y, cb, cr] = rgb_to_ycbcr(rgb[0], rgb[1], rgb[2]);
+            let back = ycbcr_to_rgb(y, cb, cr);
+            for c in 0..3 {
+                assert!((i16::from(back[c]) - i16::from(rgb[c])).abs() <= 2, "{rgb:?} -> {back:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn limited_range_black_and_white() {
+        assert_eq!(rgb_to_ycbcr(0, 0, 0), [16, 128, 128]);
+        assert_eq!(rgb_to_ycbcr(255, 255, 255), [235, 128, 128]);
+        assert_eq!(ycbcr_to_rgb(16, 128, 128), [0, 0, 0]);
+        assert_eq!(ycbcr_to_rgb(235, 128, 128), [255, 255, 255]);
+    }
+
+    #[test]
+    fn a_frame_round_trips_through_yuyv() {
+        let (w, h) = (64, 36);
+        let rgba = crate::capture::draw_mock_frame(1, 0.3, w, h);
+        let back = yuyv_to_rgba(&rgba_to_yuyv(&rgba, w, h), w, h);
+        // Colour is shared per pixel pair, so a pair straddling a bar edge
+        // blends -- as on the real cards; that is 4:2:2. Every pair whose two
+        // source pixels agree must come back within rounding.
+        for (src, out) in rgba.chunks_exact(8).zip(back.chunks_exact(8)) {
+            if src[..4] == src[4..] {
+                let worst = src.iter().zip(out).map(|(a, b)| (i16::from(*a) - i16::from(*b)).abs()).max().unwrap();
+                assert!(worst <= 2, "uniform pair {src:?} came back as {out:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn parallel_conversion_matches_single_rows() {
+        // Rows split across threads must join seamlessly: compare a frame
+        // whose height does not divide evenly.
+        let (w, h) = (32, 37);
+        let rgba = crate::capture::draw_mock_frame(2, 0.6, w, h);
+        let yuyv = rgba_to_yuyv(&rgba, w, h);
+        for y in [0, 18, 36] {
+            let row = &rgba[y * w * 4..(y + 1) * w * 4];
+            assert_eq!(&rgba_to_yuyv(row, w, 1)[..], &yuyv[y * w * 2..(y + 1) * w * 2], "row {y}");
+        }
+    }
+
+    #[test]
+    fn luma_thumbnail_reads_full_range() {
+        let (w, h) = (64, 36);
+        let black: Vec<u8> = (0..w * h / 2).flat_map(|_| [16, 128, 16, 128]).collect();
+        let white: Vec<u8> = (0..w * h / 2).flat_map(|_| [235, 128, 235, 128]).collect();
+        assert_eq!(luma_thumbnail(&black, w, h, 8, 4)[0], 0);
+        assert_eq!(luma_thumbnail(&white, w, h, 8, 4)[0], 255);
+    }
+}
diff --git a/input_viewer_egui/vendor/nokhwa-bindings-windows/.gitignore b/input_viewer_egui/vendor/nokhwa-bindings-windows/.gitignore
new file mode 100644
index 0000000..4470988
--- /dev/null
+++ b/input_viewer_egui/vendor/nokhwa-bindings-windows/.gitignore
@@ -0,0 +1,2 @@
+target/
+Cargo.lock
\ No newline at end of file
diff --git a/input_viewer_egui/vendor/nokhwa-bindings-windows/Cargo.toml b/input_viewer_egui/vendor/nokhwa-bindings-windows/Cargo.toml
new file mode 100644
index 0000000..3820a31
--- /dev/null
+++ b/input_viewer_egui/vendor/nokhwa-bindings-windows/Cargo.toml
@@ -0,0 +1,60 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2021"
+name = "nokhwa-bindings-windows"
+version = "0.4.6"
+authors = ["l1npengtul"]
+build = false
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "The Windows Media Foundation bindings crate for `nokhwa`"
+readme = "README.md"
+keywords = [
+    "media-foundation",
+    "windows",
+    "capture",
+    "webcam",
+]
+license = "Apache-2.0"
+repository = "https://github.com/l1npengtul/nokhwa"
+
+[package.metadata.docs.rs]
+features = ["docs-only"]
+
+[features]
+docs-only = []
+
+[lib]
+name = "nokhwa_bindings_windows"
+path = "src/lib.rs"
+
+[dependencies.nokhwa-core]
+version = "0.1"
+
+[dependencies.once_cell]
+version = "1"
+
+[target.'cfg(target_os="windows")'.dependencies.windows]
+version = "0.62"
+features = [
+    "Win32_Media_MediaFoundation",
+    "Win32_System_Com",
+    "Win32_Foundation",
+    "Win32_Media_DirectShow",
+    "Win32_Media",
+    "Win32",
+    "Win32_Media_KernelStreaming",
+]
diff --git a/input_viewer_egui/vendor/nokhwa-bindings-windows/PATCHED.md b/input_viewer_egui/vendor/nokhwa-bindings-windows/PATCHED.md
new file mode 100644
index 0000000..2700bcf
--- /dev/null
+++ b/input_viewer_egui/vendor/nokhwa-bindings-windows/PATCHED.md
@@ -0,0 +1,26 @@
+# nokhwa-bindings-windows 0.4.6, patched for Input Viewer
+
+Vendored from crates.io (Apache-2.0, as upstream) and wired in through
+`[patch.crates-io]` in `input_viewer_egui/Cargo.toml`. Every change is marked
+`PATCHED (Input Viewer)` in `src/lib.rs`.
+
+Found on the wall (2026-10-12): both Elgato 4K60 Pro MK.2 cards delivered
+~13 fps to the egui prototype while Chromium, on the same cards in the same
+state, negotiated 3840x2160 @ 59.94 and measured 60 fps.
+
+1. **Fractional rates were discarded.** Rates are read as
+   `numerator << 32 | denominator`, and any denominator other than 1 zeroed the
+   rate. 59.94 is 60000/1001, so the cards' real top rate never reached the
+   format list. Now rounded to whole fps (`ratio_fps`).
+2. **`set_format` could pick a low rate.** A native media type matched when its
+   range max, own rate or range min equalled the request, and was then set as
+   is -- with its own `MF_MT_FRAME_RATE`, which on these cards can be any step
+   of a ladder down to 1 fps. A type whose own rate matches now wins; a type
+   that only covers the rate in its range is a fallback, with `MF_MT_FRAME_RATE`
+   set explicitly (to the range max's exact ratio when that rounds to the
+   request, so 60000/1001 stays 60000/1001).
+3. **The current rate read as the denominator.** `format_refreshed` did
+   `fps as u32` on the packed value, keeping the low 32 bits: 60000/1001 read
+   as 1001.
+
+Worth offering upstream (l1npengtul/nokhwa) once confirmed on the hardware.
diff --git a/input_viewer_egui/vendor/nokhwa-bindings-windows/README.md b/input_viewer_egui/vendor/nokhwa-bindings-windows/README.md
new file mode 100644
index 0000000..d5c4137
--- /dev/null
+++ b/input_viewer_egui/vendor/nokhwa-bindings-windows/README.md
@@ -0,0 +1,6 @@
+# nokhwa-bindings-windows
+This crate is the MediaFoundation bindings for the `nokhwa` crate.
+
+It is not meant for general consumption. If you are looking for a Windows camera capture crate, consider using `nokhwa` with feature `input-native`.
+
+No support or API stability will be given. Subject to change at any time.
diff --git a/input_viewer_egui/vendor/nokhwa-bindings-windows/src/lib.rs b/input_viewer_egui/vendor/nokhwa-bindings-windows/src/lib.rs
new file mode 100644
index 0000000..b9df88d
--- /dev/null
+++ b/input_viewer_egui/vendor/nokhwa-bindings-windows/src/lib.rs
@@ -0,0 +1,1379 @@
+/*
+ * Copyright 2022 l1npengtul <l1npengtul@protonmail.com> / The Nokhwa Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#![deny(clippy::pedantic)]
+#![warn(clippy::all)]
+#![allow(clippy::missing_errors_doc)]
+#![allow(clippy::cast_possible_truncation)]
+#![allow(clippy::too_many_lines)]
+
+//! # nokhwa-bindings-windows
+//! This crate is the `MediaFoundation` bindings for the `nokhwa` crate.
+//!
+//! It is not meant for general consumption. If you are looking for a Windows camera capture crate, consider using `nokhwa` with feature `input-msmf`.
+//!
+//! No support or API stability will be given. Subject to change at any time.
+
+#[cfg(all(windows, not(feature = "docs-only")))]
+pub mod wmf {
+    use nokhwa_core::error::NokhwaError;
+    use nokhwa_core::types::{
+        ApiBackend, CameraControl, CameraFormat, CameraIndex, CameraInfo, ControlValueDescription,
+        ControlValueSetter, FrameFormat, KnownCameraControl, KnownCameraControlFlag, Resolution,
+    };
+    use once_cell::sync::Lazy;
+    use std::ffi::c_void;
+    use std::{
+        borrow::Cow,
+        cell::Cell,
+        mem::MaybeUninit,
+        slice::from_raw_parts,
+        sync::{
+            atomic::{AtomicBool, AtomicUsize, Ordering},
+            Arc,
+        },
+        time::Duration,
+    };
+    use windows::Win32::Media::DirectShow::{CameraControl_Flags_Auto, CameraControl_Flags_Manual};
+    use windows::Win32::Media::MediaFoundation::{
+        MFCreateSample, MF_SOURCE_READER_FIRST_VIDEO_STREAM,
+    };
+    use windows::{
+        core::{Interface, GUID, PWSTR},
+        Win32::{
+            Media::{
+                DirectShow::{
+                    CameraControl_Exposure, CameraControl_Focus, CameraControl_Iris,
+                    CameraControl_Pan, CameraControl_Tilt, CameraControl_Zoom, IAMCameraControl,
+                    IAMVideoProcAmp, VideoProcAmp_BacklightCompensation, VideoProcAmp_Brightness,
+                    VideoProcAmp_ColorEnable, VideoProcAmp_Contrast, VideoProcAmp_Gain,
+                    VideoProcAmp_Gamma, VideoProcAmp_Hue, VideoProcAmp_Saturation,
+                    VideoProcAmp_Sharpness, VideoProcAmp_WhiteBalance,
+                },
+                KernelStreaming::GUID_NULL,
+                MediaFoundation::{
+                    IMFActivate, IMFAttributes, IMFMediaSource, IMFMediaType, IMFSample,
+                    IMFSourceReader,
+                    MFCreateAttributes, MFCreateSourceReaderFromMediaSource, MFEnumDeviceSources,
+                    MFShutdown, MFStartup, MFSTARTUP_NOSOCKET, MF_API_VERSION,
+                    MF_DEVSOURCE_ATTRIBUTE_FRIENDLY_NAME, MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE,
+                    MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_GUID,
+                    MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_SYMBOLIC_LINK, MF_MT_FRAME_RATE,
+                    MF_MT_FRAME_RATE_RANGE_MAX, MF_MT_FRAME_RATE_RANGE_MIN, MF_MT_FRAME_SIZE,
+                    MF_MT_SUBTYPE, MF_READWRITE_DISABLE_CONVERTERS,
+                },
+            },
+            System::Com::{CoInitializeEx, CoUninitialize, COINIT},
+        },
+    };
+
+    static INITIALIZED: Lazy<Arc<AtomicBool>> = Lazy::new(|| Arc::new(AtomicBool::new(false)));
+    static CAMERA_REFCNT: Lazy<Arc<AtomicUsize>> = Lazy::new(|| Arc::new(AtomicUsize::new(0)));
+
+    // See: https://stackoverflow.com/questions/80160/what-does-coinit-speed-over-memory-do
+    const CO_INIT_APARTMENT_THREADED: COINIT = COINIT(0x2);
+    const CO_INIT_DISABLE_OLE1DDE: COINIT = COINIT(0x4);
+
+    // See: https://gix.github.io/media-types/#major-types
+    const MF_VIDEO_FORMAT_YUY2: GUID = GUID::from_values(
+        0x3259_5559,
+        0x0000,
+        0x0010,
+        [0x80, 0x00, 0x00, 0xAA, 0x00, 0x38, 0x9B, 0x71],
+    );
+    const MF_VIDEO_FORMAT_MJPEG: GUID = GUID::from_values(
+        0x4750_4A4D,
+        0x0000,
+        0x0010,
+        [0x80, 0x00, 0x00, 0xAA, 0x00, 0x38, 0x9B, 0x71],
+    );
+    const MF_VIDEO_FORMAT_GRAY: GUID = GUID::from_values(
+        0x3030_3859,
+        0x0000,
+        0x0010,
+        [0x80, 0x00, 0x00, 0xAA, 0x00, 0x38, 0x9B, 0x71],
+    );
+    const MF_VIDEO_FORMAT_NV12: GUID = GUID::from_values(
+        0x3231_564E,
+        0x0000,
+        0x0010,
+        [0x80, 0x00, 0x00, 0xAA, 0x00, 0x38, 0x9B, 0x71],
+    );
+    const MF_VIDEO_FORMAT_RGB24: GUID = GUID::from_values(
+        0x0000_0014,
+        0x0000,
+        0x0010,
+        [0x80, 0x00, 0x00, 0xAA, 0x00, 0x38, 0x9B, 0x71],
+    );
+
+    const MEDIA_FOUNDATION_FIRST_VIDEO_STREAM: u32 = 0xFFFF_FFFC;
+    const MF_SOURCE_READER_MEDIASOURCE: u32 = 0xFFFF_FFFF;
+
+    // const CAM_CTRL_AUTO: i32 = 0x0001;
+    // const CAM_CTRL_MANUAL: i32 = 0x0002;
+
+    // macro_rules! define_controls {
+    //     ( $( ($key:expr => ($property:ident, $min:ident, $max:ident, $step:ident, $default:ident, $flag:ident)) )* ) => {
+    //         $(
+    //         $key => {
+    //             if let Err(why) = unsafe {
+    //                     video_proc_amp.GetRange(
+    //                         $property.0,
+    //                         &mut $min,
+    //                         &mut $max,
+    //                         &mut $step,
+    //                         &mut $default,
+    //                         &mut $flag,
+    //                     )
+    //                 } {
+    //                     return Err(NokhwaError::GetPropertyError {
+    //                         property: stringify!($key).to_string(),
+    //                         error: why.to_string()
+    //                     });
+    //                 }
+    //         }
+    //         )*
+    //     };
+    //     ( $( ($key:expr : ($property:ident, $value:ident, $flag:ident)) )* ) => {
+    //         $(
+    //         $key => {
+    //             if let Err(why) = unsafe {
+    //                 video_proc_amp.Get($property.0, &mut $value, &mut $flag)
+    //                 } {
+    //                     return Err(NokhwaError::GetPropertyError {
+    //                         property: stringify!($key).to_string(),
+    //                         error: why.to_string()
+    //                     });
+    //                 }
+    //         }
+    //         )*
+    //     };
+    // }
+
+    /// PATCHED (Input Viewer): an MF frame rate is `numerator << 32 | denominator`.
+    /// Rounded to whole fps, so 60000/1001 is 60 rather than discarded.
+    fn ratio_fps(packed: u64) -> u32 {
+        let numerator = packed >> 32;
+        let denominator = packed & 0xFFFF_FFFF;
+        if denominator == 0 {
+            return 0;
+        }
+        ((numerator + denominator / 2) / denominator) as u32
+    }
+
+    /// The whole-fps rates a native media type offers: its range max, its own
+    /// rate and its range min, without zeros or duplicates.
+    fn frame_rates_of(media_type: &IMFMediaType) -> Vec<u32> {
+        let mut rates = Vec::with_capacity(3);
+        for key in [&MF_MT_FRAME_RATE_RANGE_MAX, &MF_MT_FRAME_RATE, &MF_MT_FRAME_RATE_RANGE_MIN] {
+            if let Ok(packed) = unsafe { media_type.GetUINT64(key) } {
+                let fps = ratio_fps(packed);
+                if fps != 0 && !rates.contains(&fps) {
+                    rates.push(fps);
+                }
+            }
+        }
+        rates
+    }
+
+    fn guid_to_frameformat(guid: GUID) -> Option<FrameFormat> {
+        match guid {
+            MF_VIDEO_FORMAT_NV12 => Some(FrameFormat::NV12),
+            MF_VIDEO_FORMAT_RGB24 => Some(FrameFormat::RAWBGR),
+            MF_VIDEO_FORMAT_GRAY => Some(FrameFormat::GRAY),
+            MF_VIDEO_FORMAT_YUY2 => Some(FrameFormat::YUYV),
+            MF_VIDEO_FORMAT_MJPEG => Some(FrameFormat::MJPEG),
+            _ => None,
+        }
+    }
+
+    pub fn initialize_mf() -> Result<(), NokhwaError> {
+        if !(INITIALIZED.load(Ordering::SeqCst)) {
+            if let Err(why) = unsafe {
+                CoInitializeEx(None, CO_INIT_APARTMENT_THREADED | CO_INIT_DISABLE_OLE1DDE).ok()
+            } {
+                return Err(NokhwaError::InitializeError {
+                    backend: ApiBackend::MediaFoundation,
+                    error: why.to_string(),
+                });
+            }
+
+            if let Err(why) = unsafe { MFStartup(MF_API_VERSION, MFSTARTUP_NOSOCKET) } {
+                unsafe {
+                    CoUninitialize();
+                }
+                return Err(NokhwaError::InitializeError {
+                    backend: ApiBackend::MediaFoundation,
+                    error: why.to_string(),
+                });
+            }
+            INITIALIZED.store(true, Ordering::SeqCst);
+        }
+        Ok(())
+    }
+
+    pub fn de_initialize_mf() -> Result<(), NokhwaError> {
+        if INITIALIZED.load(Ordering::SeqCst) {
+            unsafe {
+                if let Err(why) = MFShutdown() {
+                    return Err(NokhwaError::ShutdownError {
+                        backend: ApiBackend::MediaFoundation,
+                        error: why.to_string(),
+                    });
+                }
+                CoUninitialize();
+                INITIALIZED.store(false, Ordering::SeqCst);
+            }
+        }
+        Ok(())
+    }
+
+    fn query_activate_pointers() -> Result<Vec<IMFActivate>, NokhwaError> {
+        initialize_mf()?;
+
+        let mut attributes: Option<IMFAttributes> = None;
+        if let Err(why) = unsafe { MFCreateAttributes(&mut attributes, 1) } {
+            return Err(NokhwaError::GetPropertyError {
+                property: "IMFAttributes".to_string(),
+                error: why.to_string(),
+            });
+        }
+
+        let attributes = match attributes {
+            Some(attr) => {
+                if let Err(why) = unsafe {
+                    attr.SetGUID(
+                        &MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE,
+                        &MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_GUID,
+                    )
+                } {
+                    return Err(NokhwaError::SetPropertyError {
+                        property: "GUID MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE".to_string(),
+                        value: "MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_GUID".to_string(),
+                        error: why.to_string(),
+                    });
+                }
+                attr
+            }
+            None => {
+                return Err(NokhwaError::SetPropertyError {
+                    property: "GUID MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE".to_string(),
+                    value: "MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_GUID".to_string(),
+                    error: "Call to IMFAttributes::SetGUID failed - IMFAttributes is None"
+                        .to_string(),
+                });
+            }
+        };
+
+        let mut count: u32 = 0;
+        let mut unused_mf_activate: MaybeUninit<*mut Option<IMFActivate>> = MaybeUninit::uninit();
+
+        if let Err(why) =
+            unsafe { MFEnumDeviceSources(&attributes, unused_mf_activate.as_mut_ptr(), &mut count) }
+        {
+            return Err(NokhwaError::StructureError {
+                structure: "MFEnumDeviceSources".to_string(),
+                error: why.to_string(),
+            });
+        }
+
+        let mut device_list = vec![];
+        if count == 0 {
+            return Ok(device_list);
+        }
+
+        unsafe { from_raw_parts(unused_mf_activate.assume_init(), count as usize) }
+            .iter()
+            .for_each(|pointer| {
+                if let Some(imf_activate) = pointer {
+                    device_list.push(imf_activate.clone());
+                }
+            });
+
+        Ok(device_list)
+    }
+
+    fn activate_to_descriptors(
+        index: CameraIndex,
+        imf_activate: &IMFActivate,
+    ) -> Result<CameraInfo, NokhwaError> {
+        let mut pwstr_name = PWSTR(&mut 0_u16);
+        let mut len_pwstrname = 0;
+        let mut pwstr_symlink = PWSTR(&mut 0_u16);
+        let mut len_pwstrsymlink = 0;
+
+        if let Err(why) = unsafe {
+            imf_activate.GetAllocatedString(
+                &MF_DEVSOURCE_ATTRIBUTE_FRIENDLY_NAME,
+                &mut pwstr_name,
+                &mut len_pwstrname,
+            )
+        } {
+            return Err(NokhwaError::GetPropertyError {
+                property: "MF_DEVSOURCE_ATTRIBUTE_FRIENDLY_NAME".to_string(),
+                error: why.to_string(),
+            });
+        }
+
+        if let Err(why) = unsafe {
+            imf_activate.GetAllocatedString(
+                &MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_SYMBOLIC_LINK,
+                &mut pwstr_symlink,
+                &mut len_pwstrsymlink,
+            )
+        } {
+            return Err(NokhwaError::GetPropertyError {
+                property: "MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_SYMBOLIC_LINK".to_string(),
+                error: why.to_string(),
+            });
+        }
+
+        if pwstr_name.is_null() {
+            return Err(NokhwaError::GetPropertyError {
+                property: "MF_DEVSOURCE_ATTRIBUTE_FRIENDLY_NAME".to_string(),
+                error: "Call to IMFActivate::GetAllocatedString failed - PWSTR is null".to_string(),
+            });
+        }
+        if pwstr_symlink.is_null() {
+            return Err(NokhwaError::GetPropertyError {
+                property: "MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_SYMBOLIC_LINK".to_string(),
+                error: "Call to IMFActivate::GetAllocatedString failed - PWSTR is null".to_string(),
+            });
+        }
+
+        let name = unsafe {
+            pwstr_name
+                .to_string()
+                .map_err(|x| NokhwaError::StructureError {
+                    structure: "PWSTR/String - Name".to_string(),
+                    error: x.to_string(),
+                })?
+        };
+        let symlink = unsafe {
+            pwstr_symlink
+                .to_string()
+                .map_err(|x| NokhwaError::StructureError {
+                    structure: "PWSTR/String - Symlink".to_string(),
+                    error: x.to_string(),
+                })?
+        };
+
+        Ok(CameraInfo::new(
+            &name,
+            "MediaFoundation Camera",
+            &symlink,
+            index,
+        ))
+    }
+
+    pub fn query_media_foundation_descriptors() -> Result<Vec<CameraInfo>, NokhwaError> {
+        let mut device_list = vec![];
+
+        for (index, activate_ptr) in query_activate_pointers()?.into_iter().enumerate() {
+            device_list.push(activate_to_descriptors(
+                CameraIndex::Index(index as u32),
+                &activate_ptr,
+            )?);
+        }
+        Ok(device_list)
+    }
+
+    #[derive(Copy, Clone, Debug, PartialOrd, PartialEq, Eq)]
+    enum MFControlId {
+        ProcAmpBoolean(i32),
+        ProcAmpRange(i32),
+        CCValue(i32),
+        CCRange(i32),
+    }
+
+    #[allow(clippy::cast_sign_loss)]
+    fn kcc_to_i32(kcc: KnownCameraControl) -> Option<MFControlId> {
+        let control_id = match kcc {
+            KnownCameraControl::Brightness => MFControlId::ProcAmpRange(VideoProcAmp_Brightness.0),
+            KnownCameraControl::Contrast => MFControlId::ProcAmpRange(VideoProcAmp_Contrast.0),
+            KnownCameraControl::Hue => MFControlId::ProcAmpRange(VideoProcAmp_Hue.0),
+            KnownCameraControl::Saturation => MFControlId::ProcAmpRange(VideoProcAmp_Saturation.0),
+            KnownCameraControl::Sharpness => MFControlId::ProcAmpRange(VideoProcAmp_Sharpness.0),
+            KnownCameraControl::Gamma => MFControlId::ProcAmpRange(VideoProcAmp_Gamma.0),
+            KnownCameraControl::WhiteBalance => {
+                MFControlId::ProcAmpRange(VideoProcAmp_WhiteBalance.0)
+            }
+            KnownCameraControl::BacklightComp => {
+                MFControlId::ProcAmpBoolean(VideoProcAmp_BacklightCompensation.0)
+            }
+            KnownCameraControl::Gain => MFControlId::ProcAmpRange(VideoProcAmp_Gain.0),
+            KnownCameraControl::Pan => MFControlId::CCRange(CameraControl_Pan.0),
+            KnownCameraControl::Tilt => MFControlId::CCRange(CameraControl_Tilt.0),
+            KnownCameraControl::Zoom => MFControlId::CCRange(CameraControl_Zoom.0),
+            KnownCameraControl::Exposure => MFControlId::CCValue(CameraControl_Exposure.0),
+            KnownCameraControl::Iris => MFControlId::CCValue(CameraControl_Iris.0),
+            KnownCameraControl::Focus => MFControlId::CCValue(CameraControl_Focus.0),
+            KnownCameraControl::Other(o) => {
+                if o == VideoProcAmp_ColorEnable.0 as u128 {
+                    MFControlId::ProcAmpRange(o as i32)
+                } else {
+                    return None;
+                }
+            }
+        };
+
+        Some(control_id)
+    }
+
+    pub struct MediaFoundationDevice {
+        is_open: Cell<bool>,
+        device_specifier: CameraInfo,
+        device_format: CameraFormat,
+        source_reader: IMFSourceReader,
+        /// Wallclock instant captured when the stream was started.
+        /// MF sample timestamps are relative to stream start, so
+        /// `stream_epoch + sample_time` gives us an absolute wallclock.
+        stream_epoch: Option<Duration>,
+    }
+
+    impl MediaFoundationDevice {
+        pub fn new(index: CameraIndex) -> Result<Self, NokhwaError> {
+            initialize_mf()?;
+            match index {
+                CameraIndex::Index(i) => {
+                    let (media_source, device_descriptor) =
+                        match query_activate_pointers()?.into_iter().nth(i as usize) {
+                            Some(activate) => {
+                                match unsafe { activate.ActivateObject::<IMFMediaSource>() } {
+                                    Ok(media_source) => {
+                                        (media_source, activate_to_descriptors(index, &activate)?)
+                                    }
+                                    Err(why) => {
+                                        return Err(NokhwaError::OpenDeviceError(
+                                            index.to_string(),
+                                            why.to_string(),
+                                        ))
+                                    }
+                                }
+                            }
+                            None => {
+                                return Err(NokhwaError::OpenDeviceError(
+                                    index.to_string(),
+                                    "No device".to_string(),
+                                ))
+                            }
+                        };
+
+                    let source_reader_attr = {
+                        let attr = match {
+                            let mut attr: Option<IMFAttributes> = None;
+
+                            if let Err(why) = unsafe { MFCreateAttributes(&mut attr, 3) } {
+                                return Err(NokhwaError::StructureError {
+                                    structure: "MFCreateAttributes".to_string(),
+                                    error: why.to_string(),
+                                });
+                            }
+                            attr
+                        } {
+                            Some(imf_attr) => imf_attr,
+                            None => {
+                                return Err(NokhwaError::StructureError {
+                                    structure: "MFCreateAttributes".to_string(),
+                                    error: "Attributee Alloc Failure".to_string(),
+                                });
+                            }
+                        };
+
+                        if let Err(why) = unsafe {
+                            attr.SetUINT32(&MF_READWRITE_DISABLE_CONVERTERS, u32::from(true))
+                        } {
+                            return Err(NokhwaError::SetPropertyError {
+                                property: "MF_READWRITE_DISABLE_CONVERTERS".to_string(),
+                                value: u32::from(true).to_string(),
+                                error: why.to_string(),
+                            });
+                        }
+
+                        attr
+                    };
+
+                    let source_reader = match unsafe {
+                        MFCreateSourceReaderFromMediaSource(&media_source, &source_reader_attr)
+                    } {
+                        Ok(sr) => sr,
+                        Err(why) => {
+                            return Err(NokhwaError::StructureError {
+                                structure: "MFCreateSourceReaderFromMediaSource".to_string(),
+                                error: why.to_string(),
+                            })
+                        }
+                    };
+
+                    // increment refcnt
+                    CAMERA_REFCNT.store(CAMERA_REFCNT.load(Ordering::SeqCst) + 1, Ordering::SeqCst);
+
+                    Ok(MediaFoundationDevice {
+                        is_open: Cell::new(false),
+                        device_specifier: device_descriptor,
+                        device_format: CameraFormat::default(),
+                        source_reader,
+                        stream_epoch: None,
+                    })
+                }
+                CameraIndex::String(s) => {
+                    let devicelist = query_media_foundation_descriptors()?;
+                    let mut id_eq = None;
+
+                    for mfdev in devicelist {
+                        if mfdev.misc() == s {
+                            id_eq = Some(mfdev.index().as_index()?);
+                            break;
+                        }
+                    }
+
+                    match id_eq {
+                        Some(index) => Self::new(CameraIndex::Index(index)),
+                        None => Err(NokhwaError::OpenDeviceError(s, "Not Found".to_string())),
+                    }
+                }
+            }
+        }
+        //
+        // pub fn with_string(unique_id: &[u16]) -> Result<Self, NokhwaError> {
+        //     let devicelist = query_media_foundation_descriptors()?;
+        //     let mut id_eq = None;
+        //
+        //     for mfdev in devicelist {
+        //         if (mfdev.symlink() as &[u16]) == unique_id {
+        //             id_eq = Some(mfdev.index().as_index()?);
+        //             break;
+        //         }
+        //     }
+        //
+        //     match id_eq {
+        //         Some(index) => Self::new(index),
+        //         None => {
+        //             return Err(BindingError::DeviceOpenFailError(
+        //                 std::str::from_utf8(
+        //                     &unique_id.iter().map(|x| *x as u8).collect::<Vec<u8>>(),
+        //                 )
+        //                 .unwrap_or("")
+        //                 .to_string(),
+        //                 "Not Found".to_string(),
+        //             ))
+        //         }
+        //     }
+        // }
+
+        pub fn index(&self) -> &CameraIndex {
+            self.device_specifier.index()
+        }
+
+        pub fn name(&self) -> String {
+            self.device_specifier.human_name()
+        }
+
+        pub fn symlink(&self) -> String {
+            self.device_specifier.misc()
+        }
+
+        pub fn compatible_format_list(&mut self) -> Result<Vec<CameraFormat>, NokhwaError> {
+            let mut camera_format_list = vec![];
+            let mut index = 0;
+
+            while let Ok(media_type) = unsafe {
+                self.source_reader
+                    .GetNativeMediaType(MEDIA_FOUNDATION_FIRST_VIDEO_STREAM, index)
+            } {
+                index += 1;
+                let fourcc = match unsafe { media_type.GetGUID(&MF_MT_SUBTYPE) } {
+                    Ok(fcc) => fcc,
+                    Err(why) => {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: "MF_MT_SUBTYPE".to_string(),
+                            error: why.to_string(),
+                        })
+                    }
+                };
+
+                let (width, height) = match unsafe { media_type.GetUINT64(&MF_MT_FRAME_SIZE) } {
+                    Ok(res_u64) => {
+                        let width = (res_u64 >> 32) as u32;
+                        let height = res_u64 as u32; // the cast will truncate the upper bits
+                        (width, height)
+                    }
+                    Err(why) => {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: "MF_MT_FRAME_SIZE".to_string(),
+                            error: why.to_string(),
+                        })
+                    }
+                };
+
+                // PATCHED (Input Viewer): the original zeroed every rate whose
+                // denominator was not 1, so 59.94 fps (60000/1001) was thrown away.
+                let framerate_list = frame_rates_of(&media_type);
+
+                let frame_fmt = match guid_to_frameformat(fourcc) {
+                    Some(fcc) => fcc,
+                    None => continue,
+                };
+
+                for frame_rate in framerate_list {
+                    if frame_rate != 0 {
+                        camera_format_list.push(CameraFormat::new(
+                            Resolution::new(width, height),
+                            frame_fmt,
+                            frame_rate,
+                        ));
+                    }
+                }
+            }
+            Ok(camera_format_list)
+        }
+
+        pub fn control(&self, control: KnownCameraControl) -> Result<CameraControl, NokhwaError> {
+            let camera_control = unsafe {
+                let mut receiver: MaybeUninit<IAMCameraControl> = MaybeUninit::uninit();
+                let ptr_receiver = receiver.as_mut_ptr();
+                if let Err(why) = self.source_reader.GetServiceForStream(
+                    MF_SOURCE_READER_MEDIASOURCE,
+                    &GUID_NULL,
+                    &IAMCameraControl::IID,
+                    ptr_receiver
+                        .cast::<IAMCameraControl>()
+                        .cast::<*mut c_void>(),
+                ) {
+                    return Err(NokhwaError::SetPropertyError {
+                        property: "MF_SOURCE_READER_MEDIASOURCE".to_string(),
+                        value: "IAMCameraControl".to_string(),
+                        error: why.to_string(),
+                    });
+                }
+                receiver.assume_init()
+            };
+            let video_proc_amp = unsafe {
+                let mut receiver: MaybeUninit<IAMVideoProcAmp> = MaybeUninit::uninit();
+                let ptr_receiver = receiver.as_mut_ptr();
+                if let Err(why) = self.source_reader.GetServiceForStream(
+                    MF_SOURCE_READER_MEDIASOURCE,
+                    &GUID_NULL,
+                    &IAMVideoProcAmp::IID,
+                    ptr_receiver.cast::<IAMVideoProcAmp>().cast::<*mut c_void>(),
+                ) {
+                    return Err(NokhwaError::SetPropertyError {
+                        property: "MF_SOURCE_READER_MEDIASOURCE".to_string(),
+                        value: "IAMVideoProcAmp".to_string(),
+                        error: why.to_string(),
+                    });
+                }
+                receiver.assume_init()
+            };
+
+            let mut min = 0;
+            let mut max = 0;
+            let mut step = 0;
+            let mut default = 0;
+            let mut value = 0;
+            let mut flag = 0;
+
+            let control_id = kcc_to_i32(control).ok_or(NokhwaError::SetPropertyError {
+                property: "CameraControl".to_string(),
+                value: control.to_string(),
+                error: "Does not exist".to_string(),
+            })?;
+
+            let ctrl_value_set = match control_id {
+                MFControlId::ProcAmpBoolean(id) => unsafe {
+                    if let Err(why) = video_proc_amp.GetRange(
+                        id,
+                        &mut min,
+                        &mut max,
+                        &mut step,
+                        &mut default,
+                        &mut flag,
+                    ) {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: format!("{:?}: {} - Range", control_id, control),
+                            error: why.to_string(),
+                        });
+                    }
+                    if let Err(why) = video_proc_amp.Get(id, &mut value, &mut flag) {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: format!("{:?}: {} - Value", control_id, control),
+                            error: why.to_string(),
+                        });
+                    }
+
+                    let boolval = value != 0;
+                    let booldef = default != 0;
+                    ControlValueDescription::Boolean {
+                        value: boolval,
+                        default: booldef,
+                    }
+                },
+                MFControlId::ProcAmpRange(id) => unsafe {
+                    if let Err(why) = video_proc_amp.GetRange(
+                        id,
+                        &mut min,
+                        &mut max,
+                        &mut step,
+                        &mut default,
+                        &mut flag,
+                    ) {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: format!("{:?}: {} - Range", control_id, control),
+                            error: why.to_string(),
+                        });
+                    }
+                    if let Err(why) = video_proc_amp.Get(id, &mut value, &mut flag) {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: format!("{:?}: {} - Value", control_id, control),
+                            error: why.to_string(),
+                        });
+                    }
+                    ControlValueDescription::IntegerRange {
+                        min: i64::from(min),
+                        max: i64::from(max),
+                        value: i64::from(value),
+                        step: i64::from(step),
+                        default: i64::from(default),
+                    }
+                },
+                MFControlId::CCValue(id) => unsafe {
+                    if let Err(why) = camera_control.GetRange(
+                        id,
+                        &mut min,
+                        &mut max,
+                        &mut step,
+                        &mut default,
+                        &mut flag,
+                    ) {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: format!("{:?}: {} - Range", control_id, control),
+                            error: why.to_string(),
+                        });
+                    }
+                    if let Err(why) = camera_control.Get(id, &mut value, &mut flag) {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: format!("{:?}: {} - Value", control_id, control),
+                            error: why.to_string(),
+                        });
+                    }
+
+                    ControlValueDescription::Integer {
+                        value: i64::from(value),
+                        default: i64::from(default),
+                        step: i64::from(step),
+                    }
+                },
+                MFControlId::CCRange(id) => unsafe {
+                    if let Err(why) = camera_control.GetRange(
+                        id,
+                        &mut min,
+                        &mut max,
+                        &mut step,
+                        &mut default,
+                        &mut flag,
+                    ) {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: format!("{:?}: {} - Range", control_id, control),
+                            error: why.to_string(),
+                        });
+                    }
+                    if let Err(why) = camera_control.Get(id, &mut value, &mut flag) {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: format!("{:?}: {} - Value", control_id, control),
+                            error: why.to_string(),
+                        });
+                    }
+                    ControlValueDescription::IntegerRange {
+                        min: i64::from(min),
+                        max: i64::from(max),
+                        value: i64::from(value),
+                        step: i64::from(step),
+                        default: i64::from(default),
+                    }
+                },
+            };
+
+            let is_manual = if flag == CameraControl_Flags_Manual.0 {
+                KnownCameraControlFlag::Manual
+            } else {
+                KnownCameraControlFlag::Automatic
+            };
+
+            Ok(CameraControl::new(
+                control,
+                control.to_string(),
+                ctrl_value_set,
+                vec![is_manual],
+                true,
+            ))
+        }
+
+        pub fn set_control(
+            &mut self,
+            control: KnownCameraControl,
+            value: ControlValueSetter,
+        ) -> Result<(), NokhwaError> {
+            let current_value = self.control(control)?;
+
+            let camera_control = unsafe {
+                let mut receiver: MaybeUninit<IAMCameraControl> = MaybeUninit::uninit();
+                let ptr_receiver = receiver.as_mut_ptr();
+                if let Err(why) = self.source_reader.GetServiceForStream(
+                    MF_SOURCE_READER_MEDIASOURCE,
+                    &GUID_NULL,
+                    &IAMCameraControl::IID,
+                    ptr_receiver
+                        .cast::<IAMCameraControl>()
+                        .cast::<*mut c_void>(),
+                ) {
+                    return Err(NokhwaError::SetPropertyError {
+                        property: "MF_SOURCE_READER_MEDIASOURCE".to_string(),
+                        value: "IAMCameraControl".to_string(),
+                        error: why.to_string(),
+                    });
+                }
+                receiver.assume_init()
+            };
+            let video_proc_amp = unsafe {
+                let mut receiver: MaybeUninit<IAMVideoProcAmp> = MaybeUninit::uninit();
+                let ptr_receiver = receiver.as_mut_ptr();
+                if let Err(why) = self.source_reader.GetServiceForStream(
+                    MF_SOURCE_READER_MEDIASOURCE,
+                    &GUID_NULL,
+                    &IAMVideoProcAmp::IID,
+                    ptr_receiver.cast::<IAMVideoProcAmp>().cast::<*mut c_void>(),
+                ) {
+                    return Err(NokhwaError::SetPropertyError {
+                        property: "MF_SOURCE_READER_MEDIASOURCE".to_string(),
+                        value: "IAMVideoProcAmp".to_string(),
+                        error: why.to_string(),
+                    });
+                }
+                receiver.assume_init()
+            };
+
+            let control_id = kcc_to_i32(control).ok_or(NokhwaError::SetPropertyError {
+                property: "CameraControl".to_string(),
+                value: control.to_string(),
+                error: "Does not exist".to_string(),
+            })?;
+
+            let ctrl_value = match value {
+                ControlValueSetter::Integer(i) => i as i32,
+                ControlValueSetter::Boolean(b) => i32::from(b),
+                v => {
+                    return Err(NokhwaError::StructureError {
+                        structure: format!("ControlValueSetter {}", v),
+                        error: "invalid value type".to_string(),
+                    })
+                }
+            };
+
+            let flag = current_value
+                .flag()
+                .get(0)
+                .map(|x| {
+                    if *x == KnownCameraControlFlag::Automatic {
+                        CameraControl_Flags_Auto
+                    } else {
+                        CameraControl_Flags_Manual
+                    }
+                })
+                .ok_or(NokhwaError::StructureError {
+                    structure: "KnownCameraControlFlag".to_string(),
+                    error: "could not cast to i32".to_string(),
+                })?;
+
+            match control_id {
+                MFControlId::ProcAmpBoolean(id) | MFControlId::ProcAmpRange(id) => unsafe {
+                    if let Err(why) = video_proc_amp.Set(id, ctrl_value, flag.0) {
+                        return Err(NokhwaError::SetPropertyError {
+                            property: control.to_string(),
+                            value: ctrl_value.to_string(),
+                            error: why.to_string(),
+                        });
+                    }
+                },
+                MFControlId::CCValue(id) | MFControlId::CCRange(id) => unsafe {
+                    if let Err(why) = camera_control.Set(id, ctrl_value, flag.0) {
+                        return Err(NokhwaError::SetPropertyError {
+                            property: control.to_string(),
+                            value: ctrl_value.to_string(),
+                            error: why.to_string(),
+                        });
+                    }
+                },
+            }
+
+            Ok(())
+        }
+
+        #[allow(clippy::cast_sign_loss)]
+        pub fn format_refreshed(&mut self) -> Result<CameraFormat, NokhwaError> {
+            match unsafe {
+                self.source_reader
+                    .GetCurrentMediaType(MF_SOURCE_READER_FIRST_VIDEO_STREAM.0 as u32)
+            } {
+                Ok(media_type) => {
+                    let resolution = match unsafe { media_type.GetUINT64(&MF_MT_FRAME_SIZE) } {
+                        Ok(res) => {
+                            let width = (res >> 32) as u32;
+                            let height = ((res << 32) >> 32) as u32;
+
+                            Resolution {
+                                width_x: width,
+                                height_y: height,
+                            }
+                        }
+                        Err(why) => {
+                            return Err(NokhwaError::GetPropertyError {
+                                property: "MF_MT_FRAME_SIZE".to_string(),
+                                error: why.to_string(),
+                            })
+                        }
+                    };
+
+                    // PATCHED (Input Viewer): `fps as u32` kept only the low 32
+                    // bits -- the denominator -- so 60000/1001 read as 1001.
+                    let frame_rate = match unsafe { media_type.GetUINT64(&MF_MT_FRAME_RATE) } {
+                        Ok(fps) => ratio_fps(fps),
+                        Err(why) => {
+                            return Err(NokhwaError::GetPropertyError {
+                                property: "MF_MT_FRAME_RATE".to_string(),
+                                error: why.to_string(),
+                            })
+                        }
+                    };
+
+                    let format = match unsafe { media_type.GetGUID(&MF_MT_SUBTYPE) } {
+                        Ok(fcc) => match guid_to_frameformat(fcc) {
+                            Some(ff) => ff,
+                            None => {
+                                return Err(NokhwaError::GetPropertyError {
+                                    property: "MF_MT_SUBTYPE".to_string(),
+                                    error: "Unknown".to_string(),
+                                })
+                            }
+                        },
+                        Err(why) => {
+                            return Err(NokhwaError::GetPropertyError {
+                                property: "MF_MT_SUBTYPE".to_string(),
+                                error: why.to_string(),
+                            })
+                        }
+                    };
+
+                    let cfmt = CameraFormat::new(resolution, format, frame_rate);
+                    self.device_format = cfmt;
+
+                    Ok(cfmt)
+                }
+                Err(why) => Err(NokhwaError::GetPropertyError {
+                    property: "MF_SOURCE_READER_FIRST_VIDEO_STREAM".to_string(),
+                    error: why.to_string(),
+                }),
+            }
+        }
+
+        pub fn format(&self) -> CameraFormat {
+            self.device_format
+        }
+
+        pub fn set_format(&mut self, format: CameraFormat) -> Result<(), NokhwaError> {
+            // We need to make sure to use all the original attributes of the IMFMediaType to avoid problems.
+            // Otherwise, constructing IMFMediaType from scratch can sometimes fail due to not exactly matching.
+            // Therefore, we search for the first media_type that matches and also works correctly.
+
+            let mut last_error: Option<NokhwaError> = None;
+            let mut range_fallback: Option<IMFMediaType> = None;
+
+            let mut index = 0;
+            while let Ok(media_type) = unsafe {
+                self.source_reader
+                    .GetNativeMediaType(MEDIA_FOUNDATION_FIRST_VIDEO_STREAM, index)
+            } {
+                index += 1;
+                let fourcc = match unsafe { media_type.GetGUID(&MF_MT_SUBTYPE) } {
+                    Ok(fcc) => fcc,
+                    Err(why) => {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: "MF_MT_SUBTYPE".to_string(),
+                            error: why.to_string(),
+                        })
+                    }
+                };
+
+                let frame_fmt = match guid_to_frameformat(fourcc) {
+                    Some(fcc) => fcc,
+                    None => continue,
+                };
+
+                if frame_fmt != format.format() {
+                    continue;
+                }
+
+                let (width, height) = match unsafe { media_type.GetUINT64(&MF_MT_FRAME_SIZE) } {
+                    Ok(res_u64) => {
+                        let width = (res_u64 >> 32) as u32;
+                        let height = res_u64 as u32; // the cast will truncate the upper bits
+                        (width, height)
+                    }
+                    Err(why) => {
+                        return Err(NokhwaError::GetPropertyError {
+                            property: "MF_MT_FRAME_SIZE".to_string(),
+                            error: why.to_string(),
+                        })
+                    }
+                };
+
+                if (Resolution {
+                    width_x: width,
+                    height_y: height,
+                }) != format.resolution()
+                {
+                    continue;
+                }
+
+                // PATCHED (Input Viewer): see frame_rates_of.
+                let framerate_list = frame_rates_of(&media_type);
+
+                // PATCHED (Input Viewer): the original accepted a type when ANY of
+                // its range max / current / range min matched, and then set the type
+                // as it was -- whose own MF_MT_FRAME_RATE could be a low step of the
+                // driver's ladder. On an Elgato 4K60 Pro MK.2 that delivered ~13 fps
+                // where Chromium got 59.94. A type whose own rate matches wins; a
+                // type that only covers the rate in its range is used as a fallback,
+                // with MF_MT_FRAME_RATE set to the requested rate.
+                let own = unsafe { media_type.GetUINT64(&MF_MT_FRAME_RATE) }.ok();
+                if own.map(ratio_fps) == Some(format.frame_rate()) {
+                    let result = unsafe {
+                        self.source_reader.SetCurrentMediaType(
+                            MEDIA_FOUNDATION_FIRST_VIDEO_STREAM,
+                            None,
+                            &media_type,
+                        )
+                    };
+                    match result {
+                        Ok(_) => {
+                            self.device_format = format;
+                            self.format_refreshed()?;
+                            return Ok(());
+                        }
+                        Err(why) => {
+                            last_error = Some(NokhwaError::SetPropertyError {
+                                property: "MEDIA_FOUNDATION_FIRST_VIDEO_STREAM".to_string(),
+                                value: format!("{media_type:?}"),
+                                error: why.to_string(),
+                            });
+                        }
+                    }
+                } else if range_fallback.is_none() && framerate_list.contains(&format.frame_rate()) {
+                    range_fallback = Some(media_type.clone());
+                }
+            }
+
+            if let Some(media_type) = range_fallback {
+                let wanted = format.frame_rate();
+                // Keep the driver's exact ratio when its range max rounds to the
+                // rate (60000/1001 stays 60000/1001), else ask for wanted/1.
+                let packed = unsafe { media_type.GetUINT64(&MF_MT_FRAME_RATE_RANGE_MAX) }
+                    .ok()
+                    .filter(|&max| ratio_fps(max) == wanted)
+                    .unwrap_or((u64::from(wanted) << 32) | 1);
+                let result = unsafe {
+                    media_type
+                        .SetUINT64(&MF_MT_FRAME_RATE, packed)
+                        .and_then(|()| {
+                            self.source_reader.SetCurrentMediaType(
+                                MEDIA_FOUNDATION_FIRST_VIDEO_STREAM,
+                                None,
+                                &media_type,
+                            )
+                        })
+                };
+                match result {
+                    Ok(_) => {
+                        self.device_format = format;
+                        self.format_refreshed()?;
+                        return Ok(());
+                    }
+                    Err(why) => {
+                        last_error = Some(NokhwaError::SetPropertyError {
+                            property: "MF_MT_FRAME_RATE".to_string(),
+                            value: format!("{packed:#x}"),
+                            error: why.to_string(),
+                        });
+                    }
+                }
+            }
+
+            if let Some(err) = last_error {
+                return Err(err);
+            }
+
+            Err(NokhwaError::InitializeError {
+                backend: ApiBackend::MediaFoundation,
+                error: "Failed to fulfill requested format".to_string(),
+            })
+        }
+
+        pub fn is_stream_open(&self) -> bool {
+            self.is_open.get()
+        }
+
+        pub fn start_stream(&mut self) -> Result<(), NokhwaError> {
+            if let Err(why) = unsafe {
+                self.source_reader
+                    .SetStreamSelection(MEDIA_FOUNDATION_FIRST_VIDEO_STREAM, true)
+            } {
+                return Err(NokhwaError::OpenStreamError(why.to_string()));
+            }
+
+            self.stream_epoch = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .ok();
+            self.is_open.set(true);
+            Ok(())
+        }
+
+        pub fn raw_bytes(&mut self) -> Result<(Cow<'_, [u8]>, Option<Duration>), NokhwaError> {
+            let mut imf_sample: Option<IMFSample> = match unsafe { MFCreateSample() } {
+                Ok(sample) => Some(sample),
+                Err(why) => {
+                    return Err(NokhwaError::ReadFrameError(why.to_string()));
+                }
+            };
+            let mut stream_flags = 0;
+            let mut sample_time_100ns: i64 = 0;
+            {
+                loop {
+                    if let Err(why) = unsafe {
+                        self.source_reader.ReadSample(
+                            MEDIA_FOUNDATION_FIRST_VIDEO_STREAM,
+                            0,
+                            None,
+                            Some(&mut stream_flags),
+                            Some(&mut sample_time_100ns),
+                            Some(&mut imf_sample),
+                        )
+                    } {
+                        return Err(NokhwaError::ReadFrameError(why.to_string()));
+                    }
+
+                    if imf_sample.is_some() {
+                        break;
+                    }
+                }
+            }
+
+            let imf_sample = match imf_sample {
+                Some(sample) => sample,
+                None => {
+                    // shouldn't happen
+                    return Err(NokhwaError::ReadFrameError("No sample".to_string()));
+                }
+            };
+
+            // Calculate absolute capture timestamp.
+            let capture_ts = if sample_time_100ns > 0 {
+                let sample_offset = Duration::from_nanos(sample_time_100ns as u64 * 100);
+                self.stream_epoch
+                    .and_then(|epoch| epoch.checked_add(sample_offset))
+            } else {
+                None
+            };
+
+            let buffer = match unsafe { imf_sample.ConvertToContiguousBuffer() } {
+                Ok(buf) => buf,
+                Err(why) => return Err(NokhwaError::ReadFrameError(why.to_string())),
+            };
+
+            let mut buffer_valid_length = 0;
+            let mut buffer_start_ptr = std::ptr::null_mut::<u8>();
+
+            if let Err(why) =
+                unsafe { buffer.Lock(&mut buffer_start_ptr, None, Some(&mut buffer_valid_length)) }
+            {
+                return Err(NokhwaError::ReadFrameError(why.to_string()));
+            }
+
+            if buffer_start_ptr.is_null() {
+                return Err(NokhwaError::ReadFrameError(
+                    "Buffer Pointer Null".to_string(),
+                ));
+            }
+
+            if buffer_valid_length == 0 {
+                return Err(NokhwaError::ReadFrameError("Buffer Size is 0".to_string()));
+            }
+
+            let mut data_slice = Vec::with_capacity(buffer_valid_length as usize);
+
+            unsafe {
+                // Copy pointer because we're bout to drop IMFSample
+                data_slice.extend_from_slice(std::slice::from_raw_parts_mut(
+                    buffer_start_ptr,
+                    buffer_valid_length as usize,
+                ) as &[u8]);
+            }
+
+            Ok((Cow::from(data_slice), capture_ts))
+        }
+
+        pub fn stop_stream(&mut self) {
+            self.stream_epoch = None;
+            self.is_open.set(false);
+        }
+    }
+
+    impl Drop for MediaFoundationDevice {
+        fn drop(&mut self) {
+            // swallow errors
+            unsafe {
+                if self
+                    .source_reader
+                    .Flush(MEDIA_FOUNDATION_FIRST_VIDEO_STREAM)
+                    .is_ok()
+                {}
+
+                // decrement refcnt
+                if CAMERA_REFCNT.load(Ordering::SeqCst) > 0 {
+                    CAMERA_REFCNT.store(CAMERA_REFCNT.load(Ordering::SeqCst) - 1, Ordering::SeqCst);
+                }
+                if CAMERA_REFCNT.load(Ordering::SeqCst) == 0 {
+                    #[allow(clippy::let_underscore_drop)]
+                    let _ = de_initialize_mf();
+                }
+            }
+        }
+    }
+}
+
+#[cfg(any(not(windows), feature = "docs-only"))]
+#[allow(clippy::missing_errors_doc)]
+#[allow(clippy::unused_self)]
+#[allow(clippy::needless_pass_by_value)]
+#[allow(clippy::must_use_candidate)]
+pub mod wmf {
+    use nokhwa_core::error::NokhwaError;
+    use nokhwa_core::types::{
+        CameraControl, CameraFormat, CameraIndex, CameraInfo, ControlValueSetter,
+        KnownCameraControl,
+    };
+    use std::{borrow::Cow, time::Duration};
+
+    pub fn initialize_mf() -> Result<(), NokhwaError> {
+        Err(NokhwaError::NotImplementedError(
+            "Not on windows".to_string(),
+        ))
+    }
+
+    pub fn de_initialize_mf() -> Result<(), NokhwaError> {
+        Err(NokhwaError::NotImplementedError(
+            "Not on windows".to_string(),
+        ))
+    }
+
+    pub fn query_msmf() -> Result<Vec<CameraInfo>, NokhwaError> {
+        Err(NokhwaError::NotImplementedError(
+            "Not on windows".to_string(),
+        ))
+    }
+
+    pub struct MediaFoundationDevice {
+        camera: CameraIndex,
+    }
+
+    impl MediaFoundationDevice {
+        pub fn new(_index: CameraIndex) -> Result<Self, NokhwaError> {
+            Ok(MediaFoundationDevice {
+                camera: CameraIndex::Index(0),
+            })
+        }
+
+        pub fn index(&self) -> &CameraIndex {
+            &self.camera
+        }
+
+        pub fn name(&self) -> String {
+            String::new()
+        }
+
+        pub fn symlink(&self) -> String {
+            String::new()
+        }
+
+        pub fn compatible_format_list(&mut self) -> Result<Vec<CameraFormat>, NokhwaError> {
+            Err(NokhwaError::NotImplementedError(
+                "Only on Windows".to_string(),
+            ))
+        }
+
+        pub fn control(&self, _control: KnownCameraControl) -> Result<CameraControl, NokhwaError> {
+            Err(NokhwaError::NotImplementedError(
+                "Only on Windows".to_string(),
+            ))
+        }
+
+        pub fn set_control(
+            &mut self,
+            _control: KnownCameraControl,
+            _value: ControlValueSetter,
+        ) -> Result<(), NokhwaError> {
+            Err(NokhwaError::NotImplementedError(
+                "Only on Windows".to_string(),
+            ))
+        }
+
+        pub fn format_refreshed(&mut self) -> Result<CameraFormat, NokhwaError> {
+            Err(NokhwaError::NotImplementedError(
+                "Only on Windows".to_string(),
+            ))
+        }
+
+        pub fn format(&self) -> CameraFormat {
+            CameraFormat::default()
+        }
+
+        pub fn set_format(&mut self, _format: CameraFormat) -> Result<(), NokhwaError> {
+            Err(NokhwaError::NotImplementedError(
+                "Only on Windows".to_string(),
+            ))
+        }
+
+        pub fn is_stream_open(&self) -> bool {
+            false
+        }
+
+        pub fn start_stream(&mut self) -> Result<(), NokhwaError> {
+            Err(NokhwaError::NotImplementedError(
+                "Only on Windows".to_string(),
+            ))
+        }
+
+        pub fn raw_bytes(&mut self) -> Result<(Cow<'_, [u8]>, Option<Duration>), NokhwaError> {
+            Err(NokhwaError::NotImplementedError(
+                "Only on Windows".to_string(),
+            ))
+        }
+
+        pub fn stop_stream(&mut self) {}
+    }
+
+    impl Drop for MediaFoundationDevice {
+        fn drop(&mut self) {}
+    }
+}