//! cce-browser — a web browser on the embedded Servo engine.
 //!
 //! Servo renders pages into a CPU (software) rendering context; each
 //! finished frame is read back and uploaded to cce-ui's image registry,
 //! then drawn as a single quad under the chrome: the DE's circular corner
 //! control (`cce_ui::widget::plate_dock`), which here toggles the utility
 //! bar (tabs, the favorites strip, back / forward / reload, URL field) that
 //! unfolds from under it. Input over the page area is translated into Servo input events; the
 //! URL bar is a small hand-rolled line editor.
 
 mod accounts;
 mod downloads;
 mod instance;
 mod pages;
 mod raindrop;
 mod session;
 mod settings;
 /// Vi-style modal keys, after qutebrowser (`browser.vi-mode`).
 mod vi;
 /// The retired Servo backend; compiled only under `--features servo`.
 #[cfg(feature = "servo")]
 mod webview;
 /// The in-progress WPE WebKit backend (see WPE-PORT.md). Compiled only under
 /// `--features wpe`; the shipping browser is still Servo.
 #[cfg(feature = "wpe")]
 mod wpe;
 
 use url::Url;
 
 use cce_ui::engine::{Application, EngineState, LogicalPosition, LogicalSize, WindowSettings};
 use cce_ui::scene::layout::Rect;
 use cce_ui::scene::paint::{DisplayList, PaintCtx};
 use cce_ui::widget::display::measure_text_width;
 use cce_ui::widget::plate_dock;
 use cce_ui::widget::{ElementState, Key, KeyEvent, MouseButton, MouseScrollDelta, NamedKey};
 
 #[cfg(all(not(feature = "wpe"), feature = "servo"))]
 use webview::ServoHost as Host;
 #[cfg(feature = "wpe")]
 use wpe::WebKitHost as Host;
 #[cfg(not(any(feature = "wpe", feature = "servo")))]
 compile_error!(
     "cce-browser needs an engine: build with the default `wpe` feature \
      (pacman -S wpewebkit), or --no-default-features --features servo"
 );
 
 /// Clipboard action, named by neither engine. Each backend maps it to its
 /// own vocabulary — Servo needs an `EditingActionEvent`, WebKit a named
 /// editing command — so the chrome never learns either.
 #[derive(Debug, Clone, Copy)]
 pub enum EditingCommand {
     Copy,
     Cut,
     Paste,
 }
 
 // Spacing is the DE's ladder (cce-ui `layout.rs`), never a number of this
 // app's own. Five readings of it cover the whole chrome:
 
 /// The bar's inset from the window edge: it stands on the root plate.
 fn bar_margin() -> f32 {
     cce_ui::layout::root_plate_inset()
 }
 
 /// Inset from a plate's rim to its content — the bar's, and every popover's
 /// (bookmarks, accounts, the context menu, a modal).
 fn plate_pad() -> f32 {
     cce_ui::layout::plate_padding()
 }
 
 /// Gap between items next to each other in a row of the bar (tabs, pills,
 /// buttons), and between the bar and a menu it drops: siblings on the root
 /// plate.
 fn item_gap() -> f32 {
     cce_ui::layout::root_plate_gap()
 }
 
 /// Gap between siblings inside a plate: the bar's rows, a modal's fields
 /// and its button pair.
 fn inner_gap() -> f32 {
     cce_ui::layout::plate_gap()
 }
 
 /// Inset from a control's rim to its label — a pill, a field, a menu row —
 /// the DE's own button padding.
 fn text_pad() -> f32 {
     cce_ui::layout::button_padding()
 }
 
 // Control heights are the toolkit's too, one per kind of control:
 
 /// Every button, tab and favorites pill. The glyph buttons are square at it.
 fn btn_h() -> f32 {
     cce_ui::layout::button_height()
 }
 
 /// Every line field: the URL field, a dialog's fields, the bookmarks search.
 fn field_h() -> f32 {
     cce_ui::layout::textbox_height()
 }
 
 /// The controls row holds both kinds, each centred in it.
 fn controls_h() -> f32 {
     btn_h().max(field_h())
 }
 
 /// Two rows — tab strip on top, nav controls + URL field below — with the
 /// favorites strip between them whenever there is one to show. The bar
 /// does not carry an empty row: no favorites, no strip, two-row bar.
 fn bar_h(favorites: bool) -> f32 {
     let favs = if favorites { btn_h() + inner_gap() } else { 0.0 };
     plate_pad() + btn_h() + inner_gap() + favs + controls_h() + plate_pad()
 }
 const BAR_RADIUS: f32 = 10.0;
 /// Seconds for the bar to unfold from the corner control (and back).
 const CHROME_ANIM_S: f32 = 0.18;
 /// How long the bar stays out after a tab opens in the background — long
 /// enough to see the new tab land in the strip — before folding itself.
 const CHROME_PEEK: std::time::Duration = std::time::Duration::from_millis(1500);
 /// How long a press into the page has to reach WebKit and move its focus
 /// before an open page field is announced again (`defer_page_press`). Well
 /// inside the compositor's 800 ms touch window, which the announcement has
 /// to land in to raise the on-screen keyboard.
 #[cfg(feature = "wpe")]
 const PAGE_PRESS_SETTLE: std::time::Duration = std::time::Duration::from_millis(150);
 
 /// One frame of the bar's unfold: `t` moves `dt` worth toward `target`
 /// (0 folded, 1 open), or straight onto it when the DE's animations switch
 /// (`cce_ui::motion::enabled`) is off — "snap, never freeze", as every
 /// cce-ui widget does, so the bar still opens and shuts, just without the
 /// glide.
 fn chrome_step(t: f32, target: f32, dt: f32, animate: bool) -> f32 {
     if !animate {
         return target;
     }
     let step = dt / CHROME_ANIM_S;
     if target > t {
         (t + step).min(target)
     } else {
         (t - step).max(target)
     }
 }
 /// Radius of the corner control, drawn and hit. The DE's dot
 /// (`plate_dock::CORNER_R`) is sized for a pane's corner; the browser's is
 /// the whole chrome while folded, so it is drawn bigger — a circular
 /// plate rather than a pane's dot, easier to see and to hit.
 const DOT_R: f32 = 1.75 * plate_dock::CORNER_R;
 /// Centre inset from the bar's corner, on both axes: the DE's margin
 /// between the dot and the plate edge, kept as the dot grew.
 const DOT_INSET: f32 = plate_dock::CORNER_INSET + (DOT_R - plate_dock::CORNER_R);
 /// Width reserved at the right end of the row the corner control sits on
 /// (the tab row for a top bar, the controls row for a bottom one), so the
 /// new-tab plus or the bookmark star clears the dot in the bar's corner.
 const DOT_COL: f32 = 2.0 * DOT_INSET;
 
 /// The reservation a row makes for the corner control: `DOT_COL` on the
 /// row in the bar's anchored corner, nothing on the other.
 fn dot_col(position: settings::BarPosition, tabs_row: bool) -> f32 {
     let dot_on_tabs = matches!(position, settings::BarPosition::Top);
     if dot_on_tabs == tabs_row { DOT_COL } else { 0.0 }
 }
 const TAB_MIN_W: f32 = 56.0;
 const TAB_MAX_W: f32 = 200.0;
 /// Tabs at least this wide get a close (`x` glyph) region on their right edge.
 const TAB_CLOSE_MIN_W: f32 = 72.0;
 const TAB_CLOSE_W: f32 = 18.0;
 /// The favorites strip: a row of pills, each one page. Pills take their
 /// label's width up to `FAV_MAX_W`, and the strip simply stops at the bar's
 /// edge — favorites are a handful by design, not a scrolling list.
 const FAV_MAX_W: f32 = 150.0;
 const FAV_FONT: f32 = 12.0;
 /// The bookmarks menu: a plate of rows dropped from the controls row's
 /// bookmarks button — the bar's own way to visit and manage what the star saves.
 const BM_W: f32 = 320.0;
 const BM_ROW_H: f32 = 24.0;
 /// Height of the rule between the menu's three sections.
 const BM_SEP_H: f32 = 9.0;
 /// The remove hit region at a bookmark row's right end.
 const BM_RM_W: f32 = 24.0;
 const BM_FONT: f32 = 13.0;
 /// The account list: suggestions from cce-secrets, dropped at the login
 /// field they are for rather than at the bar, because that is where the
 /// person is looking.
 const AC_W: f32 = 300.0;
 const AC_ROW_H: f32 = 34.0;
 /// Rows before the list scrolls with the selection.
 const AC_MAX_ROWS: usize = 6;
 const AC_FONT: f32 = 13.0;
 const AC_SUB_FONT: f32 = 11.0;
 /// Utility-bar fill; the negative alpha marks the plate as blur-behind.
 /// The blurred page is the base and this color tints it at |alpha|
 /// opacity — keep |alpha| low so the frosted content shows through.
 const BAR_FILL: [f32; 4] = [0.11, 0.12, 0.13, -0.28];
 const URL_FONT: f32 = 14.0;
 /// Pixels per wheel notch when the DE reports discrete line deltas.
 const LINE_PX: f64 = 76.0;
 /// A vi `j`/`k` line, in wheel notches.
 const VI_LINE: f32 = 0.5;
 /// How soon after a click a field taking focus counts as clicked into — what
 /// separates the person entering a field from a page focusing one itself.
 const VI_CLICK_WINDOW: std::time::Duration = std::time::Duration::from_millis(1000);
 /// How long a vi status message stays up.
 const VI_MSG_TIME: std::time::Duration = std::time::Duration::from_secs(3);
 /// The vi status line: mode, pending keys, messages, the `:` line.
 const VI_LINE_H: f32 = 28.0;
 const VI_FONT: f32 = 13.0;
 /// Hint labels over the page: qutebrowser's yellow, because a label has to
 /// read over any page at all, and the chrome's dark plates vanish into a
 /// dark one.
 const HINT_H: f32 = 19.0;
 const HINT_FONT: f32 = 13.0;
 const HINT_BG: [f32; 4] = [0.98, 0.84, 0.30, 1.0];
 const HINT_RIM: [f32; 4] = [0.45, 0.34, 0.04, 1.0];
 const HINT_TEXT: [u8; 3] = [20, 18, 10];
 /// The part of a label already typed.
 const HINT_TYPED: [u8; 3] = [140, 112, 30];
 
 
 const PAGE_BG: [f32; 4] = [0.10, 0.10, 0.11, 1.0];
 const FIELD_BG: [f32; 4] = [0.09, 0.09, 0.10, 0.40];
 const BTN_BG: [f32; 4] = [0.20, 0.21, 0.23, 0.40];
 const TAB_BG: [f32; 4] = [0.15, 0.16, 0.18, 0.30];
 const TAB_ACTIVE_BG: [f32; 4] = [0.32, 0.34, 0.38, 0.55];
 const RIM: [f32; 4] = [0.22, 0.23, 0.25, 1.0];
 const RIM_FOCUS: [f32; 4] = [0.33, 0.48, 0.72, 1.0];
 /// URL-bar selection highlight; the text is drawn over it.
 const SEL_BG: [f32; 4] = [0.24, 0.38, 0.60, 0.95];
 const ACCENT: [f32; 4] = [0.35, 0.55, 0.85, 1.0];
 const TEXT: [u8; 3] = [220, 220, 225];
 const TEXT_DIM: [u8; 3] = [120, 122, 128];
 /// A line field's caret, and the underline under an input method's
 /// composition.
 const CARET: [f32; 4] = [0.85, 0.87, 0.92, 1.0];
 
 /// One of the chrome's line fields. The one with the keyboard
 /// (`BrowserApp::keyboard_field`) is the one keys edit and an input method
 /// composes into.
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 enum LineField {
     Url,
     BmSearch,
     /// The vi command line (`:` or `/`), while it is open.
     ViCmd,
     /// The open dialog's field at this index.
     #[cfg(feature = "wpe")]
     Dialog(usize),
 }
 
 /// The accessibility node the app numbers a line field by (`AppNodes::id`): the address
 /// bar 1, the bookmarks search 2, the vi command line 3, a dialog's fields from 16.
 fn a11y_node(field: LineField) -> u64 {
     match field {
         LineField::Url => 1,
         LineField::BmSearch => 2,
         LineField::ViCmd => 3,
         #[cfg(feature = "wpe")]
         LineField::Dialog(i) => 16 + i as u64,
     }
 }
 
 /// The open dialog's own node, which holds its fields.
 #[cfg(feature = "wpe")]
 const A11Y_DIALOG: u64 = 8;
 
 /// The line field an accessibility node number names ([`a11y_node`]'s inverse).
 fn a11y_field(n: u64) -> Option<LineField> {
     match n {
         1 => Some(LineField::Url),
         2 => Some(LineField::BmSearch),
         3 => Some(LineField::ViCmd),
         #[cfg(feature = "wpe")]
         16.. => Some(LineField::Dialog((n - 16) as usize)),
         _ => None,
     }
 }
 
 /// What a line field draws, and where on it its caret, selection and an
 /// input method's composition fall — x offsets from the text's origin, read
 /// off the same shaped run the text is drawn as.
 struct FieldMarks {
     /// `LineEdit::display`: the text with a composition at the caret,
     /// bullets for a password.
     shown: String,
     caret: f32,
     selection: Option<(f32, f32)>,
     composition: Option<(f32, f32)>,
 }
 
 impl FieldMarks {
     /// Measure `edit` as it will be drawn. Every offset the field holds is
     /// into its text, so each goes through `display_index` onto `shown`.
     fn of(fs: &mut cce_ui::cosmic_text::FontSystem, edit: &cce_ui::widget::LineEdit) -> Self {
         let shown = edit.display();
         let mut x = |byte: usize| x_of_boundary_in(fs, &shown, byte);
         let caret = x(edit.display_index(edit.cursor));
         let selection = edit
             .selection
             .filter(|&(a, b)| a < b)
             .map(|(a, b)| (x(edit.display_index(a)), x(edit.display_index(b))));
         let composition = edit.composition_range().map(|(a, b)| (x(a), x(b)));
         Self { shown, caret, selection, composition }
     }
 }
 
 /// Draw a line field's text in `f` with its marks: the selection under the
 /// text, `placeholder` dimmed in place of an empty field, the composition
 /// underlined, and the caret when `caret` is set. Returns the caret's rect,
 /// which the field with the keyboard reports to the input method.
 ///
 /// style: deliberate — caret and selection stand 4px inside the rim: the
 /// glyph box's inset, not a gap.
 fn paint_field(pc: &mut PaintCtx, f: Rect, marks: &FieldMarks, placeholder: &str, caret: bool) -> Rect {
     let ty = cce_ui::layout::align_text_y(f.y, f.height, URL_FONT, 0.0);
     let x0 = f.x + text_pad();
     let caret_rect = Rect { x: x0 + marks.caret, y: f.y + 4.0, width: 1.0, height: f.height - 8.0 };
     pc.clip(f, |pc| {
         if let Some((a, b)) = marks.selection {
             pc.quad(Rect { x: x0 + a, y: f.y + 4.0, width: b - a, height: f.height - 8.0 }, SEL_BG);
         }
         if marks.shown.is_empty() && !placeholder.is_empty() {
             pc.text(placeholder.to_string(), x0, ty, URL_FONT, TEXT_DIM);
         } else {
             pc.text(marks.shown.clone(), x0, ty, URL_FONT, TEXT);
         }
         if let Some((a, b)) = marks.composition {
             pc.quad(Rect { x: x0 + a, y: f.y + f.height - 5.0, width: b - a, height: 1.0 }, CARET);
         }
         if caret {
             pc.quad(caret_rect, CARET);
         }
     });
     caret_rect
 }
 
 /// Tell the input method where the caret is: where its candidates open, and
 /// that text is wanted at all. Only the field with the keyboard calls it,
 /// as it paints.
 fn report_caret(r: Rect) {
     cce_ui::ime::report_caret(r.x, r.y, r.width, r.height);
 }
 
 /// X offset (text-origin relative) of byte `byte` of `text`, on the shaped
 /// run a field draws (`URL_FONT`, font=None, matching `pc.text`).
 fn x_of_boundary_in(fs: &mut cce_ui::cosmic_text::FontSystem, text: &str, byte: usize) -> f32 {
     cce_ui::engine::shaped_cluster_offsets(fs, text, URL_FONT, None)
         .iter()
         .rev()
         .find(|&&(b, _)| b <= byte)
         .map(|&(_, x)| x)
         .unwrap_or(0.0)
 }
 
 /// A page-blocking prompt drawn over the content.
 ///
 /// Modal on purpose: the page is genuinely blocked inside WebKit until it is
 /// answered, so letting the chrome carry on as if nothing were pending would
 /// misrepresent what the engine is doing.
 #[cfg(feature = "wpe")]
 struct Modal {
     title: String,
     message: String,
     /// Editable fields, in tab order. Empty for a bare alert or confirm.
     fields: Vec<(&'static str, cce_ui::widget::LineEdit)>,
     focused: usize,
     has_cancel: bool,
     kind: ModalKind,
 }
 
 #[cfg(feature = "wpe")]
 enum ModalKind {
     /// `alert` / `confirm` / `prompt`.
     Script,
     /// An HTTP auth challenge.
     Auth,
     /// The active tab's WebProcess stopped answering. Unlike the other two
     /// the page is not waiting on this — it is stuck — so nothing in WebKit
     /// is held open; the answer is to kill the process or leave it be.
     Unresponsive,
 }
 
 #[cfg(feature = "wpe")]
 const MODAL_W: f32 = 420.0;
 #[cfg(feature = "wpe")]
 const MODAL_BTN_W: f32 = 84.0;
 
 #[cfg(feature = "wpe")]
 impl Modal {
     fn height(&self) -> f32 {
         plate_pad() * 2.0
             + 20.0
             + 22.0
             + self.fields.len() as f32 * (field_h() + inner_gap())
             + inner_gap()
             + btn_h()
     }
 
     /// Centred, and clamped so it stays on screen on a small window.
     fn rect(&self, win: (f32, f32)) -> Rect {
         let w = MODAL_W.min(win.0 - 2.0 * bar_margin()).max(240.0);
         let h = self.height();
         Rect {
             x: ((win.0 - w) / 2.0).max(0.0),
             y: ((win.1 - h) / 2.0).max(0.0),
             width: w,
             height: h,
         }
     }
 
     fn field_rect(&self, r: &Rect, i: usize) -> Rect {
         Rect {
             x: r.x + plate_pad(),
             y: r.y + plate_pad() + 42.0 + i as f32 * (field_h() + inner_gap()),
             width: r.width - plate_pad() * 2.0,
             height: field_h(),
         }
     }
 
     /// The (ok, cancel) button labels.
     fn labels(&self) -> (&'static str, &'static str) {
         match self.kind {
             ModalKind::Unresponsive => ("Stop page", "Wait"),
             _ => ("OK", "Cancel"),
         }
     }
 
     /// (ok, cancel) — cancel is `None` for a bare alert.
     fn button_rects(&self, r: &Rect) -> (Rect, Option<Rect>) {
         let y = r.y + r.height - plate_pad() - btn_h();
         let ok = Rect {
             x: r.x + r.width - plate_pad() - MODAL_BTN_W,
             y,
             width: MODAL_BTN_W,
             height: btn_h(),
         };
         let cancel = self.has_cancel.then(|| Rect {
             x: ok.x - MODAL_BTN_W - inner_gap(),
             ..ok
         });
         (ok, cancel)
     }
 }
 
 /// The right-click menu, drawn by the chrome at the pointer.
 ///
 /// Not modal: the page is not blocked (unlike a script dialog), so this only
 /// intercepts input for as long as it is open, and any click outside closes
 /// it and is otherwise swallowed.
 #[cfg(feature = "wpe")]
 struct CtxMenu {
     items: Vec<CtxItem>,
     /// Top-left corner, already clamped to the window.
     pos: (f32, f32),
 }
 
 #[cfg(feature = "wpe")]
 struct CtxItem {
     label: String,
     action: CtxAction,
     enabled: bool,
 }
 
 #[cfg(feature = "wpe")]
 enum CtxAction {
     Back,
     Forward,
     Reload,
     /// Copy the page's current selection (through the engine, so it lands on
     /// the system clipboard via the clipboard bridge).
     CopySelection,
     Paste,
     OpenInTab(String),
     /// Put this text on the clipboard directly (link/image addresses).
     CopyText(String),
     /// Fetch through WebKit's download pipeline.
     Download(String),
     OpenExternal,
     /// Add the page to the favorites strip, or take it out.
     ToggleFavorite,
 }
 
 #[cfg(feature = "wpe")]
 const CTX_ROW_H: f32 = 24.0;
 #[cfg(feature = "wpe")]
 const CTX_W: f32 = 200.0;
 
 #[cfg(feature = "wpe")]
 impl CtxMenu {
     fn rect(&self) -> Rect {
         Rect {
             x: self.pos.0,
             y: self.pos.1,
             width: CTX_W,
             height: plate_pad() * 2.0 + self.items.len() as f32 * CTX_ROW_H,
         }
     }
 
     fn row_rect(&self, i: usize) -> Rect {
         // style: deliberate — a 2px hairline keeps the row highlight off the
         // plate's roll; the rung padding is the vertical one.
         Rect {
             x: self.pos.0 + 2.0,
             y: self.pos.1 + plate_pad() + i as f32 * CTX_ROW_H,
             width: CTX_W - 4.0,
             height: CTX_ROW_H,
         }
     }
 
     fn item_at(&self, x: f32, y: f32) -> Option<usize> {
         (0..self.items.len()).find(|&i| self.row_rect(i).contains(x, y))
     }
 }
 
 /// A page `<select>`'s list, drawn by the chrome at the select.
 ///
 /// WPE has no popup of its own — a select nobody answers never opens — so
 /// the engine hands the options over (`take_option_menu`) and waits for a
 /// pick or a close. Like the right-click menu it owns the pointer and the
 /// keyboard while it is up, and a click off it closes it and goes no
 /// further, which is also how clicking the select again folds it.
 #[cfg(feature = "wpe")]
 struct OptMenu {
     items: Vec<wpe::OptionItem>,
     /// The select's box, in the chrome's logical pixels.
     anchor: Rect,
     /// The select's width, or the widest label's when that is wider.
     width: f32,
     /// The highlighted row. The pointer and the arrow keys move the same
     /// one, as in a native list; it starts on the select's current value.
     highlight: Option<usize>,
     /// First visible row, when the list is longer than the room it has.
     scroll: usize,
     /// Wheel travel not yet worth a whole row. A trackpad sends pixels a
     /// few at a time, and rounding each event alone never moves at all.
     wheel_rest: f64,
     /// Type-to-find: what has been typed, and when the last key came.
     typed: String,
     typed_at: std::time::Instant,
 }
 
 #[cfg(feature = "wpe")]
 const OPT_ROW_H: f32 = 24.0;
 #[cfg(feature = "wpe")]
 const OPT_FONT: f32 = 13.0;
 /// The gutter the current value's dot sits in; an optgroup's options are
 /// indented by it again.
 #[cfg(feature = "wpe")]
 const OPT_INDENT: f32 = 12.0;
 /// Type-to-find starts over after this long without a key.
 #[cfg(feature = "wpe")]
 const OPT_TYPE_RESET: std::time::Duration = std::time::Duration::from_millis(1000);
 
 /// The select list's plate and rows, from `opt_layout`: the one geometry
 /// draw and hit-test read.
 #[cfg(feature = "wpe")]
 struct OptLayout {
     plate: Rect,
     /// `(rect, index into items)` for each row the plate shows.
     rows: Vec<(Rect, usize)>,
     /// How many rows fit; more than this and the list scrolls.
     cap: usize,
 }
 
 #[cfg(feature = "wpe")]
 impl OptMenu {
     /// A row that can be picked: an enabled option, not a group heading.
     fn pickable(&self, i: usize) -> bool {
         self.items.get(i).is_some_and(|it| it.enabled && !it.group_label)
     }
 
     /// The pickable row `steps` pickable rows away from the highlight,
     /// stopping at the ends rather than wrapping, as a native list does.
     fn step(&mut self, steps: isize) {
         let mut at = self.highlight;
         for _ in 0..steps.unsigned_abs() {
             let next = if steps > 0 {
                 let from = at.map_or(0, |h| h + 1);
                 (from..self.items.len()).find(|&i| self.pickable(i))
             } else {
                 let to = at.unwrap_or(self.items.len());
                 (0..to).rev().find(|&i| self.pickable(i))
             };
             match next {
                 Some(i) => at = Some(i),
                 None => break,
             }
         }
         self.highlight = at;
     }
 
     /// Type-to-find. Letters typed in quick succession are one prefix
     /// ("1", "0" finds "10"); the same letter again cycles through the rows
     /// starting with it.
     fn find_typed(&mut self, text: &str) {
         let now = std::time::Instant::now();
         if now.duration_since(self.typed_at) > OPT_TYPE_RESET {
             self.typed.clear();
         }
         self.typed_at = now;
         self.typed.push_str(&text.to_lowercase());
         let first = self.typed.chars().next().unwrap_or(' ');
         let cycling = self.typed.chars().all(|c| c == first);
         let (prefix, from) = if cycling {
             (first.to_string(), self.highlight.map_or(0, |h| h + 1))
         } else {
             (self.typed.clone(), self.highlight.unwrap_or(0))
         };
         let n = self.items.len();
         if let Some(i) = (0..n).map(|k| (from + k) % n).find(|&i| {
             self.pickable(i)
                 && self.items[i].label.trim_start().to_lowercase().starts_with(&prefix)
         }) {
             self.highlight = Some(i);
         }
     }
 
     /// Scroll just far enough that the highlighted row is in view.
     fn reveal(&mut self, cap: usize) {
         let Some(h) = self.highlight else { return };
         if h < self.scroll {
             self.scroll = h;
         } else if h >= self.scroll + cap {
             self.scroll = h + 1 - cap;
         }
     }
 }
 
 /// The bookmarks menu: the bar's list of saved pages, open under (or over)
 /// the bookmarks button in the controls row.
 ///
 /// It holds a **snapshot** of the store rather than reading it per frame:
 /// the list a pointer is travelling down must not reorder underneath it,
 /// and the two edits it offers (bookmark this page, remove a row) re-read
 /// explicitly. Unlike the right-click menu this is not gated on an engine
 /// backend — bookmarks are app state, so the menu works on either.
 struct BmMenu {
     /// Every bookmark, as the store held them when the menu opened (or was
     /// last refreshed through it).
     all: Vec<pages::Link>,
     /// The ones the search lets through, in store order — what the rows
     /// show and what an `Entry` index points into.
     items: Vec<pages::Link>,
     /// The search field at the top of the plate. It has the keyboard while
     /// the menu is open.
     query: cce_ui::widget::LineEdit,
     /// First listed bookmark, when there are more than the plate can show.
     scroll: usize,
     hover: Option<BmHit>,
     /// The keyboard's row, an index into `items`: Up/Down move it and Enter
     /// visits it. Highlighted like a hovered row, as the account list does.
     selected: usize,
 }
 
 impl BmMenu {
     fn new(all: Vec<pages::Link>) -> Self {
         let mut m = BmMenu {
             all,
             items: Vec::new(),
             query: cce_ui::widget::LineEdit::default(),
             scroll: 0,
             hover: None,
             selected: 0,
         };
         m.filter();
         m
     }
 
     /// Re-derive `items` from `all` and the query: every word typed must
     /// appear in the title or the address, ignoring case.
     fn filter(&mut self) {
         let words: Vec<String> =
             self.query.text.split_whitespace().map(str::to_lowercase).collect();
         self.items = self
             .all
             .iter()
             .filter(|l| {
                 let hay = format!("{}\n{}", l.label, l.url).to_lowercase();
                 words.iter().all(|w| hay.contains(w.as_str()))
             })
             .cloned()
             .collect();
         self.selected = self.selected.min(self.items.len().saturating_sub(1));
     }
 
     /// Move the keyboard selection by `delta` rows, wrapping at the ends as
     /// the account list does, and scroll so it stays among the `visible`
     /// rows the plate shows.
     fn step(&mut self, delta: isize, visible: usize) {
         if self.items.is_empty() {
             return;
         }
         let n = self.items.len() as isize;
         self.selected = (((self.selected as isize + delta) % n + n) % n) as usize;
         let visible = visible.max(1);
         if self.selected < self.scroll {
             self.scroll = self.selected;
         } else if self.selected >= self.scroll + visible {
             self.scroll = self.selected + 1 - visible;
         }
     }
 }
 
 /// What a pointer position falls on inside the menu.
 #[derive(Debug, Clone, Copy, PartialEq)]
 enum BmHit {
     /// The search field.
     Search,
     /// The add/remove row for the page in the active tab.
     Toggle,
     /// A bookmark row: its index, and whether the pointer is on the remove
     /// region at the row's right end rather than on the row itself.
     Entry(usize, bool),
     /// Hands the whole collection to `cce://bookmarks`.
     Manage,
 }
 
 /// The account list: what cce-secrets can offer the login field that is
 /// focused right now.
 ///
 /// It belongs to a *field*, not to the bar — it opens when one takes focus,
 /// follows it when the page scrolls, and goes when focus does. Only accounts
 /// matching the site the field sends to are in it — plus, for a sign-in frame
 /// from another site, the page's own, marked as such — and no password is
 /// fetched to build it: a pick is what asks the keyring for one.
 #[cfg(feature = "wpe")]
 struct AcMenu {
     /// Matches for this field, before filtering: the form's site's first,
     /// then — for a sign-in frame from another site — the page's.
     all: Vec<accounts::Account>,
     /// What survives what has been typed into the username field.
     shown: Vec<accounts::Account>,
     /// Keyboard selection, an index into `shown`.
     selected: usize,
     /// First visible row, when `shown` is longer than the list can show.
     scroll: usize,
     /// The field, in its own frame's viewport coordinates. The top frame's
     /// are the chrome's; a child frame's are moved by `frame_offsets`.
     field: Rect,
     /// The reporting document's token: where the fill goes, and whose
     /// offset places the list.
     frame: String,
     top: bool,
     /// The host of the frame the field is in — where the password would go.
     /// Differs from `host` only for a sign-in frame from another site.
     form_host: String,
     /// The tab's host when this list was built. A fetched password is
     /// checked against it before it is filled: the keyring answers
     /// asynchronously, and by then the tab could be somewhere else entirely.
     host: String,
     /// The page is not on a secure origin — worth saying before a password
     /// goes into it.
     insecure: bool,
     /// Pointer-hovered row.
     hover: Option<usize>,
 }
 
 /// A sign-in the keyring does not know yet, offered for saving.
 ///
 /// Not modal and not tied to the page: the sign-in it came from usually
 /// navigates away at once, and the offer has to outlive that. It waits in the
 /// corner for an answer — Save, Never for this site, or Not now — and holds
 /// the typed password only until then.
 #[cfg(feature = "wpe")]
 struct SaveOffer {
     /// The frame's origin, stored as the entry's `URL`: the place the
     /// credential was typed into, so it is offered there next time.
     origin: String,
     /// Host of `origin`, and what "Never" remembers.
     form_host: String,
     /// The tab's host, which titles the entry: the site the person was
     /// signing in to, even when the form was a frame from somewhere else.
     page_host: String,
     username: String,
     password: accounts::Secret,
     stage: SaveStage,
 }
 
 #[cfg(feature = "wpe")]
 #[derive(Clone, PartialEq)]
 enum SaveStage {
     /// The account index is still being read; whether this is new is not
     /// known yet, so nothing is shown.
     Checking,
     Asking,
     Saving,
     Failed(String),
 }
 
 #[cfg(feature = "wpe")]
 const SAVE_W: f32 = 340.0;
 #[cfg(feature = "wpe")]
 const SAVE_BTN_W: f32 = 92.0;
 
 /// The save offer's plate and buttons, from `save_layout`: the one geometry
 /// draw and hit-test read.
 #[cfg(feature = "wpe")]
 struct SaveLayout {
     plate: Rect,
     /// Save, Never, Not now — or only the last, as Close, after a failure.
     buttons: Vec<(Rect, SaveButton)>,
 }
 
 #[cfg(feature = "wpe")]
 #[derive(Clone, Copy, PartialEq)]
 enum SaveButton {
     Save,
     Never,
     Dismiss,
 }
 
 #[cfg(feature = "wpe")]
 impl AcMenu {
     /// Narrow the list to what has been typed. Matching is on the username
     /// and the entry's title, case-insensitively and anywhere in either —
     /// people type the middle of an address as readily as its start.
     fn refilter(&mut self, typed: &str) {
         let needle = typed.trim().to_lowercase();
         self.shown = self
             .all
             .iter()
             .filter(|a| {
                 needle.is_empty()
                     || a.username.to_lowercase().contains(&needle)
                     || a.label.to_lowercase().contains(&needle)
             })
             .cloned()
             .collect();
         self.selected = self.selected.min(self.shown.len().saturating_sub(1));
         self.scroll = self.scroll.min(self.shown.len().saturating_sub(1));
         self.keep_selected_visible();
     }
 
     fn first_row(&self) -> usize {
         self.scroll
             .min(self.shown.len().saturating_sub(self.shown.len().min(AC_MAX_ROWS)))
     }
 
     /// Move the keyboard selection, scrolling the window to follow it.
     fn step(&mut self, delta: isize) {
         if self.shown.is_empty() {
             return;
         }
         let n = self.shown.len() as isize;
         self.selected = (((self.selected as isize + delta) % n + n) % n) as usize;
         self.keep_selected_visible();
     }
 
     fn keep_selected_visible(&mut self) {
         let rows = self.shown.len().min(AC_MAX_ROWS);
         if rows == 0 {
             return;
         }
         if self.selected < self.scroll {
             self.scroll = self.selected;
         } else if self.selected >= self.scroll + rows {
             self.scroll = self.selected + 1 - rows;
         }
     }
 }
 
 /// Every rect the menu draws and hit-tests, derived once — the same
 /// one-geometry rule the bar's own helpers follow.
 struct BmLayout {
     plate: Rect,
     /// The search field, the plate's first row.
     search: Rect,
     toggle: Rect,
     /// `(rect, index into items)` for each row the plate can show.
     rows: Vec<(Rect, usize)>,
     /// The "nothing saved yet" row, in place of the list.
     empty: Option<Rect>,
     manage: Rect,
     /// How many bookmarks fit; more than this and the list scrolls.
     cap: usize,
 }
 
 /// What a vi script evaluation in flight was for.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum ViAsk {
     Hints,
     FocusInput,
     ClickCheck,
 }
 
 #[derive(Debug, Clone)]
 pub enum Message {
     /// The accounts worker answered a load: the index, or why it failed.
     Accounts(Result<Vec<accounts::Account>, String>),
     /// One entry's password arrived for the account at this object path.
     /// The payload prints as `Secret(…)`; see `accounts::Secret`.
     Credential(String, accounts::Secret),
     /// A save to the keyring finished: the new entry's title, or why not.
     Saved(Result<String, String>),
     /// Servo requested an event-loop spin (waker or delegate signal).
     Spin,
     /// Last tab closed: exit the app.
     Quit,
     /// A later launch forwarded its argument here (see `instance.rs`):
     /// `Some` is a URL or file path to open in a new tab, `None` a bare
     /// launch that becomes a blank tab.
     OpenExternal(Option<String>),
 }
 
 struct BrowserApp {
     host: Host,
     /// Whether a renderer has been handed over yet — the first one is the
     /// process's own, any later one is a replacement after a reconnect. See
     /// `renderer_init`.
     seen_renderer: bool,
     /// Loaded from the app config; re-read when the window regains focus.
     settings: settings::Settings,
     win: (f32, f32),
     scale: f64,
     pointer: (f32, f32),
     /// Buttons whose press was handed to the page and whose release it is
     /// therefore still owed. The chrome opens menus on a press — a
     /// right-click opens the context menu — and every menu branch below
     /// swallows the clicks that follow, so without this the engine never
     /// sees the button come back up.
     page_buttons: Vec<MouseButton>,
     /// URL bar contents; mirrors the page URL unless the bar is focused.
     /// Text, caret and selection all live in the shared editor — the same
     /// one the dialog fields use.
     url: cce_ui::widget::LineEdit,
     url_focused: bool,
     /// The press that is dragging in the URL field is the one that entered
     /// it. Entering selects the whole URL — unless the press is dragged, in
     /// which case it selects what the drag covers; so the select-all waits
     /// for a release that no motion came before.
     url_entry_press: bool,
     /// Shift, from its own key events (pointer events carry no modifiers):
     /// what makes a press in the URL field a shift+click.
     shift_held: bool,
     /// The circle menu: the DE's corner control toggles the utility bar,
     /// which unfolds from under it. `chrome_t` is the unfold progress
     /// (0 = closed, 1 = bar), animated in `tick` toward whichever state
     /// `chrome_open` names.
     chrome_open: bool,
     chrome_t: f32,
     /// Set while the bar is out on its own — unfolded to show a tab that
     /// opened in the background — and when it folds again. Anything the
     /// person does with the bar makes it theirs (`None`), and then it stays.
     chrome_peek: Option<std::time::Instant>,
     /// When a press into an open page field is announced again
     /// (`defer_page_press`).
     #[cfg(feature = "wpe")]
     page_press_settle: Option<std::time::Instant>,
     /// Where the pointer was when the peek began. Still there is not a
     /// hover: a link middle-clicked near the top of the page sits under
     /// the bar it unfolds, and must not hold it out.
     peek_pointer: (f32, f32),
     /// Pointer over the corner control — its hover emphasis is a repaint.
     dot_hover: bool,
     loading: bool,
     /// Page title; drives the toplevel title (the engine re-applies
     /// `settings().title` whenever it changes).
     title: Option<String>,
     /// The page-blocking dialog or auth challenge currently on screen, if
     /// any. Only the WPE backend raises these — Servo has no delegate hooks
     /// for them, which is why they were listed as "not implemented".
     #[cfg(feature = "wpe")]
     modal: Option<Modal>,
     /// Open right-click menu, if any.
     #[cfg(feature = "wpe")]
     ctx_menu: Option<CtxMenu>,
     #[cfg(feature = "wpe")]
     opt_menu: Option<OptMenu>,
     /// Kept so the WPE backend's calloop sources can fire `Spin`; Servo
     /// wakes the loop itself through its `EventLoopWaker`.
     #[cfg(feature = "wpe")]
     sender: calloop::channel::Sender<Message>,
     /// Whether calloop watches the GLib fd (`register_sources`); without it,
     /// pumps come on the heartbeat alone.
     #[cfg(feature = "wpe")]
     glib_fd_watched: bool,
     /// When `update` last pumped GLib, which a heartbeat is measured from.
     #[cfg(feature = "wpe")]
     last_pump: std::time::Instant,
     /// A `Spin` sent from `tick` and not yet pumped: one is enough.
     #[cfg(feature = "wpe")]
     spin_queued: bool,
     /// App-side bundled-fonts `FontSystem` (the same set the toolkit renders
     /// with) for URL-bar caret/click metrics via `shaped_cluster_offsets` —
     /// `measure_text_width`'s inked-extent numbers drift off the drawn glyphs.
     font_system: cce_ui::cosmic_text::FontSystem,
     /// The line field that had the keyboard when the last frame was built,
     /// so the frame it loses it can drop a composition it was showing.
     ime_field: Option<LineField>,
     /// The open-tab set, persisted across restarts (see `session.rs`).
     session: session::Session,
     /// The favorites store, shared with the host (and so with the
     /// `cce://favorites` page, which edits it); `favs` is the strip as last
     /// read from it, refreshed with the rest of the page state.
     favorites: std::sync::Arc<pages::Favorites>,
     favs: Vec<pages::Link>,
     /// The bookmarks store, shared with the host (and so with the
     /// `cce://bookmarks` page); the menu below lists and edits it.
     bookmarks: std::sync::Arc<pages::Bookmarks>,
     /// The open bookmarks menu, if any.
     bm_menu: Option<BmMenu>,
     /// Wheel easing for the page, through the DE's shared scroll model.
     ///
     /// The browser does not own the page's offset — WebKit does — so this
     /// runs as a *virtual* one: notches move its target, `tick` walks the
     /// eased position, and what the engine receives each frame is the
     /// difference since the last one. It is rebased to zero whenever the
     /// glide settles, so nothing accumulates across a session.
     scroll: cce_ui::widget::scroll_motion::ScrollMotion,
     /// The virtual offset already handed to the engine.
     scroll_sent: (f32, f32),
     /// Accounts from cce-secrets, and the worker that reads them.
     accounts: accounts::Accounts,
     /// Hosts the person said never to offer saving on.
     never_save: accounts::NeverSave,
     /// The `browser.raindrop` setting, shared live with the sync worker,
     /// which is started the first time it is on (RAINDROP-SYNC.md).
     raindrop_on: std::sync::Arc<std::sync::atomic::AtomicBool>,
     raindrop_started: bool,
     /// A new sign-in waiting for Save / Never / Not now.
     #[cfg(feature = "wpe")]
     save_offer: Option<SaveOffer>,
     /// Where each child frame's viewport sits in the top frame's, by the
     /// frame's token, as the watchers relay it. Cleared on navigation.
     #[cfg(feature = "wpe")]
     frame_offsets: std::collections::HashMap<String, (f32, f32)>,
     /// The last login field reported, from any frame — replayed when the
     /// account index finishes loading, since a field focused before then got
     /// no list and will not report itself again.
     #[cfg(feature = "wpe")]
     last_field: Option<wpe::FormEvent>,
     /// The open account list, if a login field is focused and something in
     /// the keyring matches the page.
     #[cfg(feature = "wpe")]
     ac_menu: Option<AcMenu>,
     /// The active tab's URL as of the last page-state sync, for spotting an
     /// actual navigation. The engine's dirty flag is not that: it also fires
     /// for a title, a loading transition, a favicon — and treating those as
     /// navigations closed the account list in the same pump that opened it,
     /// and would cut every wheel glide short the moment the page it was
     /// scrolling said anything about itself.
     nav_url: Option<String>,
     /// Hovered pill in the favorites strip — a repaint, like the dot.
     fav_hover: Option<usize>,
     /// Where an eased scroll the keyboard started is aimed: the middle of
     /// the page, not wherever the pointer happens to rest. A real wheel
     /// event takes it back to the pointer.
     scroll_origin: Option<(f32, f32)>,
     /// Submitting the URL bar opens a new tab instead of loading here — vi's
     /// `O` / `gO`.
     url_new_tab: bool,
     /// Recently closed tabs' addresses, newest last, for `u` / `:undo`.
     closed_tabs: Vec<Url>,
     /// Vi mode (`browser.vi-mode`, `src/vi.rs`). Everything below is idle
     /// while the setting is off.
     vi_mode: vi::Mode,
     /// Count and keys typed toward a normal-mode binding.
     vi_keys: vi::Keys,
     /// Labels over the page in hint mode; empty while the page is still
     /// being asked for them.
     vi_hints: Vec<vi::Hint>,
     vi_hint_kind: vi::HintKind,
     vi_hint_typed: String,
     /// The script evaluation whose answer is awaited, by tag; an answer
     /// under any other tag is stale.
     vi_pending: Option<(u32, ViAsk)>,
     vi_tag: u32,
     /// The `:` / `/` / `?` line.
     vi_cmd: cce_ui::widget::LineEdit,
     vi_prompt: vi::Prompt,
     /// Lines submitted, `(is a search, text)`, oldest first; Up/Down walk
     /// the ones of the open prompt's kind.
     vi_history: Vec<(bool, String)>,
     vi_history_at: Option<usize>,
     /// A status message and when it goes.
     vi_msg: Option<(String, std::time::Instant)>,
     /// The last page click (or followed hint) — see `VI_CLICK_WINDOW`.
     vi_click: Option<std::time::Instant>,
     /// Keys whose press vi took, so their release is not handed to the page
     /// unpaired — even when the press changed the mode (`i`).
     vi_swallowed: Vec<String>,
     /// The last search, for `n` / `N` and an empty `/`; and whether its
     /// highlights are up.
     vi_search: Option<String>,
     vi_searching: bool,
 }
 
 
 /// The floating utility bar, overlaid on the page content. Anchored to the
 /// top or bottom window edge per the config; the page is full-bleed either
 /// way, so nothing but the chrome geometry depends on this. Every other
 /// bar-relative rect below is derived from this one — never from
 /// `bar_margin()` directly, or it would stay pinned to the top.
 fn bar_rect(win: (f32, f32), position: settings::BarPosition, favorites: bool) -> Rect {
     let h = bar_h(favorites);
     let y = match position {
         settings::BarPosition::Top => bar_margin(),
         settings::BarPosition::Bottom => (win.1 - bar_margin() - h).max(bar_margin()),
     };
     Rect {
         x: bar_margin(),
         y,
         width: (win.0 - 2.0 * bar_margin()).max(120.0),
         height: h,
     }
 }
 
 /// Y of the tab-strip row.
 fn tabs_y(bar: &Rect) -> f32 {
     bar.y + plate_pad()
 }
 
 /// Y of the favorites strip — under the tabs, where it only exists when
 /// the bar was sized for it.
 fn favs_y(bar: &Rect) -> f32 {
     bar.y + plate_pad() + btn_h() + inner_gap()
 }
 
 /// Y of the nav-controls row: the bar's bottom row, whether or not the
 /// favorites strip sits above it, so it is measured from the bottom edge.
 fn controls_y(bar: &Rect) -> f32 {
     bar.y + bar.height - plate_pad() - controls_h()
 }
 
 /// The favorites strip's pills, one rect per favorite that fits, in strip
 /// order (index into the strip = index into the result). Widths follow the
 /// labels, which is why this takes the font: draw and hit-test both read it
 /// with the same font and get the same rects.
 fn fav_rects(bar: &Rect, favs: &[pages::Link], sans: &str) -> Vec<Rect> {
     let mut rects = Vec::with_capacity(favs.len());
     let right = bar.x + bar.width - plate_pad();
     let mut x = bar.x + plate_pad();
     for f in favs {
         let w = (measure_text_width(&f.label, sans, FAV_FONT) + 2.0 * text_pad())
             .min(FAV_MAX_W)
             .max(btn_h());
         if x + w > right {
             break;
         }
         rects.push(Rect { x, y: favs_y(bar), width: w, height: btn_h() });
         x += w + item_gap();
     }
     rects
 }
 
 fn plus_rect(bar: &Rect, position: settings::BarPosition) -> Rect {
     Rect {
         x: bar.x + bar.width - plate_pad() - dot_col(position, true) - btn_h(),
         y: tabs_y(bar),
         width: btn_h(),
         height: btn_h(),
     }
 }
 
 fn tab_rect(bar: &Rect, position: settings::BarPosition, count: usize, i: usize) -> Rect {
     let avail = bar.width
         - 2.0 * plate_pad()
         - dot_col(position, true)
         - btn_h()
         - item_gap()
         - (count.max(1) - 1) as f32 * item_gap();
     let w = (avail / count.max(1) as f32).clamp(TAB_MIN_W, TAB_MAX_W);
     Rect {
         x: bar.x + plate_pad() + i as f32 * (w + item_gap()),
         y: tabs_y(bar),
         width: w,
         height: btn_h(),
     }
 }
 
 /// The close hit region on a tab pill, when the pill is wide enough.
 fn tab_close_rect(pill: &Rect) -> Option<Rect> {
     (pill.width >= TAB_CLOSE_MIN_W).then(|| Rect {
         x: pill.x + pill.width - TAB_CLOSE_W,
         y: pill.y,
         width: TAB_CLOSE_W,
         height: pill.height,
     })
 }
 
 fn btn_rect(bar: &Rect, i: usize) -> Rect {
     Rect {
         x: bar.x + plate_pad() + i as f32 * (btn_h() + item_gap()),
         y: controls_y(bar) + (controls_h() - btn_h()) / 2.0,
         width: btn_h(),
         height: btn_h(),
     }
 }
 
 /// The bookmark star, at the right end of the controls row — clear of the
 /// corner control when that row holds it.
 fn star_rect(bar: &Rect, position: settings::BarPosition) -> Rect {
     Rect {
         x: bar.x + bar.width - plate_pad() - dot_col(position, false) - btn_h(),
         y: controls_y(bar) + (controls_h() - btn_h()) / 2.0,
         width: btn_h(),
         height: btn_h(),
     }
 }
 
 /// The bookmarks menu button, immediately left of the star: the star is
 /// this page's bookmark, this is all of them.
 fn bm_btn_rect(bar: &Rect, position: settings::BarPosition) -> Rect {
     let star = star_rect(bar, position);
     Rect { x: star.x - item_gap() - btn_h(), ..star }
 }
 
 fn url_rect(bar: &Rect, position: settings::BarPosition) -> Rect {
     let x = bar.x + plate_pad() + 3.0 * (btn_h() + item_gap());
     let right = bm_btn_rect(bar, position).x - item_gap();
     let y = controls_y(bar) + (controls_h() - field_h()) / 2.0;
     Rect { x, y, width: (right - x).max(60.0), height: field_h() }
 }
 
 /// Whether a password filled into this page would leave it in the clear.
 ///
 /// Loopback is not: nothing crosses a network. Everything else that is not
 /// https is, including a `file:` page, which has no origin to speak of.
 #[cfg(feature = "wpe")]
 fn insecure_origin(origin: &str, host: &str) -> bool {
     let secure_scheme = origin.split(':').next() == Some("https");
     let loopback = matches!(host, "localhost" | "127.0.0.1" | "::1")
         || host.ends_with(".localhost");
     !secure_scheme && !loopback
 }
 
 /// Turn URL-bar input into something loadable: a real URL as-is, a bare
 /// host gets https://, anything else becomes a search.
 fn parse_url_input(input: &str, search_prefix: &str) -> Option<Url> {
     let s = input.trim();
     if s.is_empty() {
         return None;
     }
     if s.eq_ignore_ascii_case("about:history") {
         return Url::parse("cce://history").ok();
     }
     if s.eq_ignore_ascii_case("about:bookmarks") {
         return Url::parse("cce://bookmarks").ok();
     }
     if s.eq_ignore_ascii_case("about:favorites") {
         return Url::parse("cce://favorites").ok();
     }
     if s.eq_ignore_ascii_case("about:downloads") {
         return Url::parse("cce://downloads").ok();
     }
     if s.eq_ignore_ascii_case("about:cookies") {
         return Url::parse("cce://cookies").ok();
     }
     if let Ok(u) = Url::parse(s) {
         if matches!(u.scheme(), "http" | "https" | "file" | "data" | "about" | "cce") {
             return Some(u);
         }
     }
     if !s.contains(' ') && s.contains('.') {
         if let Ok(u) = Url::parse(&format!("https://{s}")) {
             return Some(u);
         }
     }
     let q: String = url::form_urlencoded::byte_serialize(s.as_bytes()).collect();
     Url::parse(&format!("{search_prefix}{q}")).ok()
 }
 
 /// Turn the startup argument into something loadable.
 ///
 /// This is deliberately not [`parse_url_input`]: that one is the URL *bar*,
 /// where a dotted word is meant to become a domain guess. Argv is different —
 /// the desktop entry claims `text/html`, and the XDG spec lets a launcher pass
 /// a local file for `%u` "either as a file: URL or as a file path". A plain
 /// path takes the domain-guess branch and turns `/home/me/page.html` into
 /// `https:///home/me/page.html`, so an existing path is resolved to a file:
 /// URL first and only a non-path falls through to the bar's parsing.
 fn parse_startup_arg(arg: &str, search_prefix: &str) -> Option<Url> {
     let path = std::path::Path::new(arg);
     if path.exists() {
         // Relative paths need the cwd joined on before file: URL conversion.
         if let Ok(abs) = std::fs::canonicalize(path) {
             if let Ok(u) = Url::from_file_path(&abs) {
                 return Some(u);
             }
         }
     }
     parse_url_input(arg, search_prefix)
 }
 
 
 
 
 
 impl BrowserApp {
     /// The utility bar's rect for the current window size and configured
     /// edge — the single source every chrome hit-test and draw reads.
     fn bar(&self) -> Rect {
         bar_rect(self.win, self.settings.bar_position, !self.favs.is_empty())
     }
 
     /// The favorites strip's pills for the current bar.
     fn fav_rects(&self, bar: &Rect) -> Vec<Rect> {
         let (sans, ..) = cce_ui::layout::read_preferred_fonts();
         fav_rects(bar, &self.favs, &sans)
     }
 
     /// Re-read the strip from the store. Called with the rest of the page
     /// state, which is also when the `cce://favorites` page's edits — made
     /// on the way into a navigation — become visible.
     fn refresh_favorites(&mut self) {
         let favs = self.favorites.snapshot();
         if favs != self.favs {
             self.favs = favs;
             self.fav_hover = None;
         }
     }
 
     /// Add or remove the active page from the favorites strip.
     fn toggle_favorite(&mut self) {
         self.host.toggle_favorite();
         self.refresh_favorites();
     }
 
     /// Drop any glide in flight and rebase the virtual offset.
     ///
     /// Called wherever the deltas would land somewhere they were not aimed:
     /// another tab, another page.
     fn stop_scroll(&mut self) {
         self.scroll.x.jump_to(0.0);
         self.scroll.y.jump_to(0.0);
         self.scroll_sent = (0.0, 0.0);
         self.scroll_origin = None;
     }
 
     /// Hand the engine what the glide moved since the last frame.
     ///
     /// Deltas, not an offset: WebKit keeps the real scroll position (and
     /// clamps it at the ends of the page), so the model here only has to say
     /// how far to move. Sign flips back on the way out — the shared model
     /// counts an offset that grows as content moves up, the engine takes the
     /// winit convention the rest of this file passes it.
     fn advance_scroll(&mut self, dt: f32) -> bool {
         use cce_ui::widget::scroll_motion::Bounds;
         if !self.scroll.is_animating() {
             // Settled: rebase, so a long session never walks the accumulator
             // out into the far reaches of f32.
             if self.scroll_sent != (0.0, 0.0) {
                 self.stop_scroll();
             }
             return false;
         }
         self.scroll.tick(dt, Bounds::UNBOUNDED, Bounds::UNBOUNDED);
         let (x, y) = (self.scroll.x.pos(), self.scroll.y.pos());
         let (dx, dy) = (x - self.scroll_sent.0, y - self.scroll_sent.1);
         self.scroll_sent = (x, y);
         if dx == 0.0 && dy == 0.0 {
             return true;
         }
         // Say which gesture these belong to rather than inheriting whatever
         // the last real event set: a glide is a wheel, and a stale FingerEnd
         // would tell the engine every frame that a gesture had just ended.
         cce_ui::widget::scroll_motion::set_scroll_phase(cce_ui::widget::ScrollPhase::Wheel);
         let s = self.scale;
         let (px, py) = self.scroll_origin.unwrap_or(self.pointer);
         self.host.wheel(-(dx as f64) * s, -(dy as f64) * s, px * s as f32, py * s as f32);
         true
     }
 
     /// The tab's host, for matching accounts and for checking that a field
     /// event came from the page the chrome thinks is on screen.
     fn page_host(&self) -> Option<String> {
         self.host.url().and_then(|u| u.host_str().map(str::to_string))
     }
 
     /// The accounts a field earns, best first.
     ///
     /// A field is offered the accounts of the site it sends to: `form_host`,
     /// the frame it lives in. When that frame is from another site than the
     /// page — iCloud's sign-in is `idmsa.apple.com` inside `icloud.com` — the
     /// page's own accounts are offered too, after the frame's and marked with
     /// after the frame's, because the entry people have is usually for the
     /// site they typed, and the form's host is an implementation detail of it.
     /// That is a real widening: it hands the page's password to an embedded
     /// site if picked. It is never automatic, the list says which site the
     /// form is from (`ac_notes`), and an ad frame with a password field is
     /// not what sits inside the sites this is for.
     #[cfg(feature = "wpe")]
     fn offered(&self, form_host: &str, page_host: &str) -> Vec<accounts::Account> {
         let mut all = self.accounts.matching(form_host);
         if form_host != page_host {
             for a in self.accounts.matching(page_host) {
                 if !all.iter().any(|b| b.path == a.path) {
                     all.push(a);
                 }
             }
         }
         all
     }
 
     /// The lines under the account list, each with its colour: whose form
     /// this is, when it is not the page's own, and whether the password
     /// would cross the network in the clear.
     #[cfg(feature = "wpe")]
     fn ac_notes(menu: &AcMenu) -> Vec<(String, [u8; 3])> {
         let mut notes = Vec::new();
         if menu.form_host != menu.host {
             notes.push((format!("sign-in form from {}", menu.form_host), TEXT_DIM));
         }
         if menu.insecure {
             notes.push((
                 "insecure page — this password would be sent unencrypted".to_string(),
                 [212, 155, 155],
             ));
         }
         notes
     }
 
     /// A login-field event from a watcher. Open, move, refill or close the
     /// account list; place child frames; take a sign-in for saving.
     ///
     /// Which frame spoke is believable — the watchers run in a world the page
     /// cannot reach, and report their own `location.origin` — so the guard
     /// is: a top frame must be on the tab's own host, and a child frame is
     /// matched against its own.
     #[cfg(feature = "wpe")]
     fn on_form_event(&mut self, event: wpe::FormEvent) -> bool {
         use wpe::FormEvent;
         if !self.settings.accounts {
             return false;
         }
         match event {
             FormEvent::Blur { frame } => {
                 // Only the field's own frame can close its list: focus moving
                 // from one frame to another blurs one and focuses the other,
                 // and the two reports can arrive in either order.
                 let was = self.ac_menu.as_ref().is_some_and(|m| m.frame == frame);
                 if was {
                     self.ac_menu = None;
                 }
                 if self.last_field.as_ref().is_some_and(
                     |e| matches!(e, FormEvent::Field { frame: f, .. } if *f == frame),
                 ) {
                     self.last_field = None;
                 }
                 was
             }
             FormEvent::Frame { frame, offset } => {
                 // A page could invent frames; a bound keeps that from growing.
                 if self.frame_offsets.len() >= 32 && !self.frame_offsets.contains_key(&frame) {
                     self.frame_offsets.clear();
                 }
                 let changed = self.frame_offsets.insert(frame.clone(), offset) != Some(offset);
                 changed && self.ac_menu.as_ref().is_some_and(|m| m.frame == frame)
             }
             FormEvent::Submit { origin, top, username, password, .. } => {
                 self.on_submit(origin, top, username, password.into_inner().into());
                 self.save_offer
                     .as_ref()
                     .is_some_and(|o| o.stage != SaveStage::Checking)
             }
             FormEvent::Field { ref origin, ref frame, top, password, rect, ref value, moved } => {
                 log::debug!(
                     "login field: password={password} moved={moved} top={top} origin={origin} \
                      page={:?} rect={rect:?}",
                     self.page_host()
                 );
                 let Some(host) = self.page_host() else {
                     self.ac_menu = None;
                     return false;
                 };
                 let Some(form_host) = url::Url::parse(origin)
                     .ok()
                     .and_then(|u| u.host_str().map(str::to_string))
                 else {
                     self.ac_menu = None;
                     return false;
                 };
                 if top && form_host != host {
                     self.ac_menu = None;
                     return false;
                 }
                 let (frame, filter, insecure) = (
                     frame.clone(),
                     // A password field filters by nothing; a username field
                     // by what is in it.
                     if password { String::new() } else { value.clone() },
                     insecure_origin(origin, &form_host),
                 );
                 self.last_field = Some(event);
                 // The index is read the first time a login field appears —
                 // never at launch, so a browser that sees no login form never
                 // opens the keyring.
                 self.accounts.ensure_loaded();
                 let field = self.field_rect(rect);
                 let all = self.offered(&form_host, &host);
                 log::debug!("{} accounts match {form_host} (page {host})", all.len());
                 match self.ac_menu.as_mut() {
                     Some(menu) if moved && menu.frame == frame => {
                         menu.field = field;
                         menu.all = all;
                         menu.host = host.clone();
                         menu.form_host = form_host;
                         menu.insecure = insecure;
                         menu.refilter(&filter);
                     }
                     _ => {
                         let mut menu = AcMenu {
                             all,
                             shown: Vec::new(),
                             selected: 0,
                             scroll: 0,
                             field,
                             frame,
                             top,
                             form_host,
                             host: host.clone(),
                             insecure,
                             hover: None,
                         };
                         menu.refilter(&filter);
                         self.ac_menu = Some(menu);
                     }
                 }
                 // An empty list is no list: nothing matched, or the index is
                 // still loading and the next `Accounts` message will reopen.
                 if self.ac_menu.as_ref().is_some_and(|m| m.shown.is_empty()) {
                     self.ac_menu = None;
                 }
                 true
             }
         }
     }
 
     /// A sign-in went out. Hold it as an offer to save, unless it is already
     /// in the keyring, or the site is on the never list.
     ///
     /// Whether it is new can only be answered once the index is read, so the
     /// offer starts as `Checking` and `resolve_save` decides — now, or when
     /// the index arrives.
     #[cfg(feature = "wpe")]
     fn on_submit(&mut self, origin: String, top: bool, username: String, password: accounts::Secret) {
         let Some(page_host) = self.page_host() else { return };
         let Some(form_host) = url::Url::parse(&origin)
             .ok()
             .and_then(|u| u.host_str().map(str::to_string))
         else {
             return;
         };
         // Same guard as a field: a top frame must be the tab's own.
         if top && form_host != page_host {
             return;
         }
         if self.never_save.contains(&form_host) {
             return;
         }
         // The fill path's own submit — or the same sign-in reported twice —
         // is not a second offer.
         if self.save_offer.as_ref().is_some_and(|o| {
             o.form_host == form_host && o.username == username && o.password == password
         }) {
             return;
         }
         self.save_offer = Some(SaveOffer {
             origin,
             form_host,
             page_host,
             username,
             password,
             stage: SaveStage::Checking,
         });
         self.accounts.ensure_loaded();
         self.resolve_save();
     }
 
     /// Decide a `Checking` offer, once the index can answer: drop it when an
     /// entry for that site already has this username, show it otherwise.
     ///
     /// "That site" is everything the field would have been offered, borrowed
     /// entries included — a sign-in filled from the page's own entry into a
     /// frame from another site is that entry, not a new login.
     #[cfg(feature = "wpe")]
     fn resolve_save(&mut self) {
         let Some(offer) = self.save_offer.as_ref() else { return };
         if offer.stage != SaveStage::Checking || !self.accounts.is_ready() {
             return;
         }
         if let Some(e) = self.accounts.error.as_ref() {
             // Nothing could be saved either; saying so on every sign-in
             // would be noise. The load failure is already logged.
             log::info!("not offering to save a login: the keyring is unavailable ({e})");
             self.save_offer = None;
             return;
         }
         let known = self.offered(&offer.form_host, &offer.page_host);
         if accounts::Accounts::knows(&known, &offer.username) {
             self.save_offer = None;
         } else if let Some(o) = self.save_offer.as_mut() {
             o.stage = SaveStage::Asking;
         }
     }
 
     /// Where the save offer sits: in the corner the bar hangs from, under
     /// the dot for a top bar and over it for a bottom one — or past the bar
     /// itself while that is out — so it never covers the controls it sits by.
     #[cfg(feature = "wpe")]
     fn save_layout(&self) -> Option<SaveLayout> {
         let offer = self.save_offer.as_ref()?;
         if offer.stage == SaveStage::Checking {
             return None;
         }
         let width = SAVE_W.min(self.win.0 - 2.0 * bar_margin()).max(220.0);
         let height = plate_pad() * 2.0 + 20.0 + 18.0 + 18.0 + inner_gap() + btn_h();
         let (cx, cy) = self.dot_center();
         let edge = cx + DOT_R;
         let x = (edge - width).clamp(0.0, (self.win.0 - width).max(0.0));
         let gap = item_gap();
         let y = match self.settings.bar_position {
             settings::BarPosition::Top => {
                 let below = if self.chrome_t > 0.0 {
                     let (bar, _) = self.chrome_plate();
                     bar.y + bar.height
                 } else {
                     cy + DOT_R
                 };
                 below + gap
             }
             settings::BarPosition::Bottom => {
                 let above = if self.chrome_t > 0.0 {
                     self.chrome_plate().0.y
                 } else {
                     cy - DOT_R
                 };
                 (above - gap - height).max(0.0)
             }
         };
         let plate = Rect { x, y, width, height };
         let by = plate.y + plate.height - plate_pad() - btn_h();
         let at = |k: f32| Rect {
             x: plate.x + plate.width - plate_pad() - (k + 1.0) * SAVE_BTN_W - k * inner_gap(),
             y: by,
             width: SAVE_BTN_W,
             height: btn_h(),
         };
         let buttons = match offer.stage {
             SaveStage::Failed(_) => vec![(at(0.0), SaveButton::Dismiss)],
             SaveStage::Saving => Vec::new(),
             _ => vec![
                 (at(0.0), SaveButton::Save),
                 (at(1.0), SaveButton::Dismiss),
                 (at(2.0), SaveButton::Never),
             ],
         };
         Some(SaveLayout { plate, buttons })
     }
 
     /// Act on a press at a point over the save offer. Returns whether the
     /// offer took the press — anywhere on its plate does.
     #[cfg(feature = "wpe")]
     fn save_click(&mut self, x: f32, y: f32) -> bool {
         let Some(layout) = self.save_layout() else { return false };
         if !layout.plate.contains(x, y) {
             return false;
         }
         let Some((_, button)) = layout.buttons.iter().find(|(r, _)| r.contains(x, y)) else {
             return true;
         };
         match button {
             SaveButton::Save => {
                 if let Some(offer) = self.save_offer.as_mut() {
                     offer.stage = SaveStage::Saving;
                     let label = offer
                         .page_host
                         .strip_prefix("www.")
                         .unwrap_or(&offer.page_host)
                         .to_string();
                     let login = accounts::NewLogin {
                         label,
                         username: offer.username.clone(),
                         url: offer.origin.clone(),
                         password: offer.password.clone(),
                     };
                     self.accounts.save(login);
                 }
             }
             SaveButton::Never => {
                 if let Some(offer) = self.save_offer.take() {
                     self.never_save.add(&offer.form_host);
                 }
             }
             SaveButton::Dismiss => self.save_offer = None,
         }
         true
     }
 
     /// A viewport rect from the page, in the chrome's coordinates.
     ///
     /// These are the same space, and that is worth stating rather than
     /// rediscovering: `resize` gives WPE the **logical** size and sets the
     /// scale separately (`logical_size`), so a CSS pixel in the page is a
     /// logical pixel in the chrome at any output scale. Verified at scale 2.
     #[cfg(feature = "wpe")]
     fn field_rect(&self, rect: (f32, f32, f32, f32)) -> Rect {
         Rect { x: rect.0, y: rect.1, width: rect.2, height: rect.3 }
     }
 
     /// Hand a picked account's credential to the page and close the list.
     ///
     /// The keyring answers on its own schedule — an unlock prompt can put
     /// seconds between the pick and this — so everything is checked again
     /// here: the list is still open, it still holds the account that was
     /// picked, and the tab is still on the host it was opened for. If any of
     /// that has changed the credential is dropped on the floor rather than
     /// typed into whatever page is there now.
     #[cfg(feature = "wpe")]
     fn fill_account(&mut self, path: &str, secret: &accounts::Secret) {
         let same_page = self
             .ac_menu
             .as_ref()
             .zip(self.page_host())
             .is_some_and(|(menu, host)| menu.host == host);
         let target = self
             .ac_menu
             .as_ref()
             .filter(|_| same_page)
             .and_then(|m| m.shown.iter().find(|a| a.path == path).map(|a| (a, &m.frame)))
             .map(|(a, frame)| (a.username.clone(), frame.clone()));
         // The fill goes to the ask of the document the list was opened for,
         // and only that one; if it has gone, so does the credential.
         let filled = target.is_some_and(|(username, frame)| {
             self.host.fill_credentials(&frame, &username, secret.expose())
         });
         if !filled {
             log::warn!("dropped a credential: the page moved on before it arrived");
         }
         self.ac_menu = None;
     }
 
     /// Ask for the password behind the selected row.
     #[cfg(feature = "wpe")]
     fn pick_account(&mut self, index: usize) {
         let Some(account) = self.ac_menu.as_ref().and_then(|m| m.shown.get(index)) else {
             return;
         };
         // The secret is fetched now, for this one entry, and arrives as
         // `Message::Credential`. Nothing is held in the menu.
         self.accounts.fetch(&account.path);
     }
 
     /// The account list's plate and rows, or `None` when it is closed. Draw
     /// and hit-test read this, as everywhere else in this chrome.
     #[cfg(feature = "wpe")]
     fn ac_layout(&self) -> Option<(Rect, Vec<Rect>)> {
         let menu = self.ac_menu.as_ref()?;
         if menu.shown.is_empty() {
             return None;
         }
         // A child frame's field is placed by the frame's offset, which the
         // watchers relay separately; until it has arrived there is nowhere
         // honest to draw the list, so it waits.
         let (dx, dy) = if menu.top { (0.0, 0.0) } else { *self.frame_offsets.get(&menu.frame)? };
         let anchor = Rect { x: menu.field.x + dx, y: menu.field.y + dy, ..menu.field };
         let rows = menu.shown.len().min(AC_MAX_ROWS);
         let height =
             2.0 * plate_pad() + rows as f32 * AC_ROW_H + Self::ac_notes(menu).len() as f32 * 18.0;
         let width = AC_W.min(self.win.0 - 2.0 * bar_margin()).max(180.0);
         let x = anchor.x.clamp(0.0, (self.win.0 - width).max(0.0));
         // Under the field, or above it when there is no room below — the
         // list must never cover the field it is filling.
         // style: deliberate — 2px off the field, so the list reads as
         // attached to it; the field is page content, not a plate sibling.
         let below = anchor.y + anchor.height + 2.0;
         let y = if below + height <= self.win.1 - bar_margin() {
             below
         } else {
             (anchor.y - 2.0 - height).max(0.0)
         };
         let plate = Rect { x, y, width, height };
         // Row *positions*; which account each shows is `first_row() + k`.
         // style: deliberate — the 2px hairline keeps a row's highlight off
         // the plate's roll.
         let rects = (0..rows)
             .map(|k| Rect {
                 x: plate.x + 2.0,
                 y: plate.y + plate_pad() + (k as f32) * AC_ROW_H,
                 width: plate.width - 4.0,
                 height: AC_ROW_H,
             })
             .collect();
         Some((plate, rects))
     }
 
     /// The account row at a pointer position, if any.
     #[cfg(feature = "wpe")]
     fn ac_hit(&self, x: f32, y: f32) -> Option<usize> {
         let (_, rows) = self.ac_layout()?;
         let first = self.ac_menu.as_ref()?.first_row();
         rows.iter().position(|r| r.contains(x, y)).map(|k| first + k)
     }
 
     /// Whether the active page is one that can be saved at all: an internal
     /// page or a blank tab cannot.
     fn saveable(&self) -> bool {
         self.host
             .url()
             .is_some_and(|u| !matches!(u.scheme(), "cce" | "about"))
     }
 
     /// Drop the bookmarks menu from its button, taking a snapshot of the
     /// store. Focus leaves the URL bar with it: a field behind an open menu
     /// must not keep eating keystrokes, the same reason folding drops it.
     fn open_bm_menu(&mut self) {
         if self.url_focused {
             self.url_focused = false;
             self.url.selection = None;
             self.sync_page_state();
         }
         self.bm_menu = Some(BmMenu::new(self.bookmarks.snapshot()));
     }
 
     fn close_bm_menu(&mut self) {
         self.bm_menu = None;
     }
 
     /// Re-read the store into the open menu after an edit made through it,
     /// keeping the scroll inside the new range.
     fn refresh_bm_menu(&mut self) {
         let all = self.bookmarks.snapshot();
         if let Some(m) = self.bm_menu.as_mut() {
             m.all = all;
             m.filter();
             m.hover = None;
         }
         self.clamp_bm_scroll();
     }
 
     /// Keep the menu's scroll inside the range its (filtered) list has.
     fn clamp_bm_scroll(&mut self) {
         let cap = self.bm_layout().map_or(usize::MAX, |l| l.cap);
         if let Some(m) = self.bm_menu.as_mut() {
             m.scroll = m.scroll.min(m.items.len().saturating_sub(cap));
         }
     }
 
     /// The search field's keys, while the menu is open. Escape never gets
     /// here (it closes the menu first); Enter visits the first match, as a
     /// click on it would; anything that changes the query re-filters the
     /// list and takes it back to the top.
     fn edit_bm_search(&mut self, event: &KeyEvent) {
         // Up/Down walk the matches; the field has no use for them.
         let delta = match event.logical_key {
             Key::Named(NamedKey::ArrowDown) => Some(1),
             Key::Named(NamedKey::ArrowUp) => Some(-1),
             _ => None,
         };
         if let Some(delta) = delta {
             let visible = self.bm_layout().map_or(1, |l| l.rows.len());
             if let Some(m) = self.bm_menu.as_mut() {
                 m.step(delta, visible);
             }
             return;
         }
         let Some(m) = self.bm_menu.as_mut() else { return };
         let before = m.query.text.clone();
         match m.query.handle_key(event) {
             cce_ui::widget::EditOutcome::Submit => {
                 if !m.items.is_empty() {
                     let i = m.selected;
                     self.bm_open(i, false);
                 }
                 return;
             }
             cce_ui::widget::EditOutcome::Cancel => {
                 self.close_bm_menu();
                 return;
             }
             _ => {}
         }
         if m.query.text != before {
             self.bm_query_changed();
         }
     }
 
     /// The query's text changed (a key, a paste, an undo): re-filter and
     /// start the list from its top again.
     fn bm_query_changed(&mut self) {
         if let Some(m) = self.bm_menu.as_mut() {
             m.filter();
             m.scroll = 0;
             m.selected = 0;
             m.hover = None;
         }
     }
 
     /// Byte of the search query under pointer x `x`.
     fn bm_query_index_at(&mut self, x: f32) -> Option<usize> {
         let field = self.bm_layout()?.search;
         let shown = self.bm_menu.as_ref()?.query.display();
         let at = self.boundary_at_x(&shown, x - field.x - text_pad());
         Some(self.bm_menu.as_ref()?.query.text_index(at))
     }
 
     /// The menu's geometry for the current window, bar edge and item count:
     /// `None` when it is closed. Draw and hit-test both read this.
     ///
     /// It hangs off the button that opens it — below the bar on a top bar,
     /// above it on a bottom one — right-aligned with that button and
     /// clamped on screen, and it never grows past the space it has: the
     /// list is capped to what fits and scrolls instead.
     fn bm_layout(&self) -> Option<BmLayout> {
         let menu = self.bm_menu.as_ref()?;
         let bar = self.bar();
         let btn = bm_btn_rect(&bar, self.settings.bar_position);
         let width = BM_W.min(self.win.0 - 2.0 * bar_margin()).max(160.0);
         let x = (btn.x + btn.width - width)
             .clamp(bar_margin(), (self.win.0 - bar_margin() - width).max(bar_margin()));
         // The furniture the list is fitted around: the search field and its
         // gap, the toggle row, two rules and the manage row.
         let fixed = 2.0 * plate_pad() + field_h() + inner_gap() + 2.0 * BM_ROW_H + 2.0 * BM_SEP_H;
         let avail = match self.settings.bar_position {
             settings::BarPosition::Top => self.win.1 - (bar.y + bar.height + item_gap()) - bar_margin(),
             settings::BarPosition::Bottom => bar.y - item_gap() - bar_margin(),
         };
         let cap = (((avail - fixed) / BM_ROW_H).floor().max(1.0)) as usize;
         // The plate is sized for the whole collection, not for what the
         // search lets through, so it keeps its size while a query narrows
         // the list: hanging above a bottom bar, a plate that shrank would
         // slide its search field out from under the pointer mid-typing.
         // An empty list still keeps its one "nothing here" row.
         let slots = menu.all.len().clamp(1, cap);
         let height = fixed + slots as f32 * BM_ROW_H;
         let y = match self.settings.bar_position {
             settings::BarPosition::Top => bar.y + bar.height + item_gap(),
             settings::BarPosition::Bottom => bar.y - item_gap() - height,
         };
         let plate = Rect { x, y, width, height };
         // style: deliberate — the 2px hairline keeps a row's highlight off
         // the plate's roll.
         let row = |dy: f32| Rect {
             x: x + 2.0,
             y: y + plate_pad() + dy,
             width: width - 4.0,
             height: BM_ROW_H,
         };
         let toggle_y = field_h() + inner_gap();
         let list_y = toggle_y + BM_ROW_H + BM_SEP_H;
         let shown = menu.items.len().min(slots);
         let first = menu.scroll.min(menu.items.len().saturating_sub(shown));
         let rows = (0..shown)
             .map(|k| (row(list_y + k as f32 * BM_ROW_H), first + k))
             .collect();
         // The field sits in its row at the plate's text inset, so its text
         // lines up with the rows' labels below it.
         let search = Rect {
             x: x + plate_pad(),
             y: y + plate_pad(),
             width: width - 2.0 * plate_pad(),
             height: field_h(),
         };
         Some(BmLayout {
             plate,
             search,
             toggle: row(toggle_y),
             rows,
             empty: menu.items.is_empty().then(|| row(list_y)),
             manage: row(list_y + slots as f32 * BM_ROW_H + BM_SEP_H),
             cap,
         })
     }
 
     /// What the pointer is on inside the menu — `None` for its padding and
     /// rules as much as for the world outside it, so the caller checks the
     /// plate itself before deciding a click was "outside".
     fn bm_hit(&self, x: f32, y: f32) -> Option<BmHit> {
         let l = self.bm_layout()?;
         if l.search.contains(x, y) {
             return Some(BmHit::Search);
         }
         if l.toggle.contains(x, y) {
             return Some(BmHit::Toggle);
         }
         if l.manage.contains(x, y) {
             return Some(BmHit::Manage);
         }
         l.rows.iter().find(|(r, _)| r.contains(x, y)).map(|(r, i)| {
             BmHit::Entry(*i, x >= r.x + r.width - BM_RM_W)
         })
     }
 
     /// Visit a bookmark from the menu: in the active tab, which is a pick —
     /// menu and bar fold away to show the page — or in a new tab, which
     /// leaves the menu up so several can be opened in a row.
     fn bm_open(&mut self, index: usize, new_tab: bool) {
         let Some(url) = self
             .bm_menu
             .as_ref()
             .and_then(|m| m.items.get(index))
             .and_then(|i| Url::parse(&i.url).ok())
         else {
             return;
         };
         if new_tab {
             self.open_background_tab(url);
         } else {
             self.host.load(url);
             self.loading = true;
             self.close_bm_menu();
             self.close_chrome();
             self.sync_page_state();
         }
     }
 
     /// Drop one bookmark from inside the menu. The list stays open —
     /// pruning is the one thing done several times in a row.
     fn bm_remove(&mut self, index: usize) {
         let Some(url) = self
             .bm_menu
             .as_ref()
             .and_then(|m| m.items.get(index))
             .map(|i| i.url.clone())
         else {
             return;
         };
         self.bookmarks.remove(&url);
         self.refresh_bm_menu();
     }
 
     /// Wheel over the list: one bookmark per notch, clamped to the range
     /// the plate cannot show.
     fn bm_scroll(&mut self, dy: f64) {
         let Some(l) = self.bm_layout() else { return };
         let max = self
             .bm_menu
             .as_ref()
             .map_or(0, |m| m.items.len().saturating_sub(l.cap));
         if let Some(m) = self.bm_menu.as_mut() {
             // Positive dy is up, cce-ui's winit convention.
             let step: isize = if dy > 0.0 { -1 } else { 1 };
             m.scroll = (m.scroll as isize + step).clamp(0, max as isize) as usize;
         }
     }
 
     /// Act on a click inside the menu.
     fn bm_click(&mut self, button: MouseButton, hit: Option<BmHit>) {
         match (button, hit) {
             (MouseButton::Left, Some(BmHit::Toggle)) => {
                 if self.saveable() || self.host.active_bookmarked() {
                     self.host.toggle_bookmark();
                     self.refresh_bm_menu();
                 }
             }
             (MouseButton::Left, Some(BmHit::Entry(i, true))) => self.bm_remove(i),
             (MouseButton::Left, Some(BmHit::Entry(i, false))) => self.bm_open(i, false),
             (MouseButton::Middle, Some(BmHit::Entry(i, _))) => self.bm_open(i, true),
             (MouseButton::Left, Some(BmHit::Manage)) => {
                 self.close_bm_menu();
                 self.close_chrome();
                 self.open_internal_page("cce://bookmarks");
             }
             _ => {}
         }
     }
 
     /// Centre of the corner control: the bar's corner nearest the window
     /// corner it is anchored to — top-right for a top bar, bottom-right for
     /// a bottom one — at the DE's inset. A circle menu is the corner of the
     /// thing it expands into, so it sits where the bar's corner will be and
     /// stays there when the bar is out.
     fn dot_center(&self) -> (f32, f32) {
         let bar = self.bar();
         let inset = DOT_INSET;
         let cy = match self.settings.bar_position {
             settings::BarPosition::Top => bar.y + inset,
             settings::BarPosition::Bottom => bar.y + bar.height - inset,
         };
         (bar.x + bar.width - inset, cy)
     }
 
     fn dot_hit(&self, x: f32, y: f32) -> bool {
         let (cx, cy) = self.dot_center();
         let (dx, dy) = (x - cx, y - cy);
         dx * dx + dy * dy <= DOT_R * DOT_R
     }
 
     /// Unfold progress with easing applied — what the plate is drawn from.
     fn chrome_ease(&self) -> f32 {
         let t = self.chrome_t.clamp(0.0, 1.0);
         t * t * (3.0 - 2.0 * t)
     }
 
     /// The bar plate as currently drawn — the full bar, or the shape it is
     /// unfolding through — and its corner radius. It grows out of the dot
     /// itself: the seed is the dot's own disc, so the control expands as an
     /// object into the bar and, open, is the bar's corner.
     fn chrome_plate(&self) -> (Rect, f32) {
         let e = self.chrome_ease();
         let (cx, cy) = self.dot_center();
         let seed = DOT_R;
         let bar = self.bar();
         let lerp = |a: f32, b: f32| a + (b - a) * e;
         let plate = Rect {
             x: lerp(cx - seed, bar.x),
             y: lerp(cy - seed, bar.y),
             width: lerp(2.0 * seed, bar.width),
             height: lerp(2.0 * seed, bar.height),
         };
         (plate, lerp(seed, BAR_RADIUS))
     }
 
     /// Whether a pointer position is over the chrome: the corner control
     /// always, the plate while any of it is showing.
     fn chrome_hit(&self, x: f32, y: f32) -> bool {
         self.dot_hit(x, y) || (self.chrome_t > 0.0 && self.chrome_plate().0.contains(x, y))
     }
 
     fn open_chrome(&mut self) {
         self.chrome_open = true;
         self.chrome_peek = None;
     }
 
     /// Unfold the bar for a moment, to show a tab that just opened behind
     /// the page. A bar the person already has open is left alone; a peek
     /// already under way runs on from now.
     fn peek_chrome(&mut self) {
         if self.chrome_open && self.chrome_peek.is_none() {
             return;
         }
         self.chrome_open = true;
         self.peek_pointer = self.pointer;
         self.arm_peek();
     }
 
     /// Set the peek's deadline, and a wake for it: an idle page produces
     /// nothing that would turn the loop when it passes.
     fn arm_peek(&mut self) {
         self.chrome_peek = Some(std::time::Instant::now() + CHROME_PEEK);
         let tx = self.sender.clone();
         std::thread::spawn(move || {
             std::thread::sleep(CHROME_PEEK);
             let _ = tx.send(Message::Spin);
         });
     }
 
     /// Fold a peek whose time is up. A pointer brought onto the bar holds
     /// it out a while longer. Returns whether the bar folded.
     fn settle_peek(&mut self) -> bool {
         let Some(at) = self.chrome_peek else { return false };
         if std::time::Instant::now() < at {
             return false;
         }
         if self.pointer != self.peek_pointer && self.chrome_hit(self.pointer.0, self.pointer.1) {
             self.arm_peek();
             return false;
         }
         self.close_chrome();
         true
     }
 
     /// Open `url` in a tab behind the page — a middle-click's tab — and
     /// show the bar for a moment so the new tab is seen to arrive.
     fn open_background_tab(&mut self, url: Url) {
         self.host.open_background_tab(url);
         self.sync_page_state();
         self.persist_session();
         self.peek_chrome();
     }
 
     /// Fold the bar back into the orb; drops URL-bar focus with it, since
     /// a field that is not on screen must not keep eating keystrokes.
     fn close_chrome(&mut self) {
         self.chrome_open = false;
         self.chrome_peek = None;
         self.url_new_tab = false;
         // The menu hangs off a bar that is going away.
         self.bm_menu = None;
         if self.url_focused {
             self.url_focused = false;
             self.url.selection = None;
             self.sync_page_state();
         }
     }
 
     /// The page fills the whole window; the utility bar floats above it.
     fn content_px(&self) -> (u32, u32) {
         (
             (self.win.0 as f64 * self.scale) as u32,
             (self.win.1 as f64 * self.scale) as u32,
         )
     }
 
     /// Pull delegate-observed page state into the chrome.
     fn sync_page_state(&mut self) {
         self.refresh_favorites();
         self.loading = self.host.loading();
         self.title = self.host.title().filter(|t| !t.is_empty());
         if !self.url_focused {
             if let Some(u) = self.host.url() {
                 let s = u.to_string();
                 self.url = cce_ui::widget::LineEdit::with_text(
                     if s == "about:blank" { String::new() } else { s },
                 );
             }
         }
     }
 
     /// Adopt whatever the engine is blocked on. Returns whether the chrome
     /// needs redrawing.
     #[cfg(feature = "wpe")]
     fn sync_modal(&mut self) -> bool {
         if let Some(m) = &self.modal {
             // A hang that cleared on its own takes its question with it.
             if matches!(m.kind, ModalKind::Unresponsive) && !self.host.active_unresponsive() {
                 self.modal = None;
                 return true;
             }
             return false;
         }
         if let Some(d) = self.host.pending_dialog() {
             let mut fields = Vec::new();
             if let Some(default) = d.prompt_default.clone() {
                 let mut e = cce_ui::widget::LineEdit::with_text(default);
                 e.select_all();
                 fields.push(("", e));
             }
             self.modal = Some(Modal {
                 title: "This page says".to_string(),
                 message: d.message,
                 fields,
                 focused: 0,
                 has_cancel: d.has_cancel,
                 kind: ModalKind::Script,
             });
             return true;
         }
         if let Some(a) = self.host.pending_auth() {
             let where_ = if a.realm.is_empty() {
                 a.host.clone()
             } else {
                 format!("{} — {}", a.host, a.realm)
             };
             self.modal = Some(Modal {
                 title: if a.retry {
                     "Sign in failed — try again".to_string()
                 } else {
                     "Sign in".to_string()
                 },
                 message: where_,
                 fields: vec![
                     ("Username", cce_ui::widget::LineEdit::default()),
                     ("Password", cce_ui::widget::LineEdit::masked()),
                 ],
                 focused: 0,
                 has_cancel: true,
                 kind: ModalKind::Auth,
             });
             return true;
         }
         if self.host.active_unresponsive() {
             let site = self
                 .host
                 .url()
                 .map(|u| u.host_str().map_or_else(|| u.to_string(), str::to_string))
                 .unwrap_or_default();
             self.modal = Some(Modal {
                 title: "This page isn't responding".to_string(),
                 message: site,
                 fields: Vec::new(),
                 focused: 0,
                 has_cancel: true,
                 kind: ModalKind::Unresponsive,
             });
             return true;
         }
         false
     }
 
     /// Answer the engine and dismiss. `ok` false is cancel.
     #[cfg(feature = "wpe")]
     fn close_modal(&mut self, ok: bool) {
         let Some(m) = self.modal.take() else { return };
         match m.kind {
             ModalKind::Script => {
                 let text = m.fields.first().map(|(_, e)| e.text.clone());
                 self.host.respond_dialog(ok, text.as_deref());
             }
             ModalKind::Unresponsive => {
                 if ok {
                     self.host.stop_unresponsive();
                 } else {
                     self.host.wait_unresponsive();
                 }
             }
             ModalKind::Auth => {
                 if ok {
                     let user = m.fields[0].1.text.clone();
                     let password = m.fields[1].1.text.clone();
                     self.host.respond_auth(Some((&user, &password)));
                 } else {
                     self.host.respond_auth(None);
                 }
             }
         }
     }
 
     /// Put a select's list up at the select, highlighting its current value.
     #[cfg(feature = "wpe")]
     fn open_opt_menu(&mut self, info: wpe::OptionMenuInfo) {
         let (sans, ..) = cce_ui::layout::read_preferred_fonts();
         let widest = info
             .items
             .iter()
             .map(|it| {
                 let indent = if it.group_child { OPT_INDENT } else { 0.0 };
                 measure_text_width(&it.label, &sans, OPT_FONT) + indent
             })
             .fold(0.0, f32::max);
         let (x, y, width, height) = info.anchor;
         // Room for the dot's gutter, the text padding, the row inset and a
         // scroll thumb on top of the widest label.
         let menu_w = (widest + OPT_INDENT + 2.0 * text_pad() + 12.0).max(width).max(80.0);
         let mut menu = OptMenu {
             highlight: info.items.iter().position(|it| it.selected),
             items: info.items,
             anchor: Rect { x, y, width, height },
             width: menu_w,
             scroll: 0,
             wheel_rest: 0.0,
             typed: String::new(),
             typed_at: std::time::Instant::now(),
         };
         if menu.highlight.is_some_and(|h| !menu.pickable(h)) {
             menu.highlight = None;
         }
         self.opt_menu = Some(menu);
         self.opt_reveal();
     }
 
     /// Take the select's list down without a pick.
     #[cfg(feature = "wpe")]
     fn close_opt_menu(&mut self) {
         if self.opt_menu.take().is_some() {
             self.host.close_option_menu();
         }
     }
 
     /// Pick row `index`, if it can be picked. A heading or a disabled
     /// option does nothing and leaves the list up.
     #[cfg(feature = "wpe")]
     fn pick_opt(&mut self, index: usize) {
         if self.opt_menu.as_ref().is_some_and(|m| m.pickable(index)) {
             self.opt_menu = None;
             self.host.pick_option(index);
         }
     }
 
     /// Keep the highlighted row in view.
     #[cfg(feature = "wpe")]
     fn opt_reveal(&mut self) {
         let Some(cap) = self.opt_layout().map(|l| l.cap) else { return };
         if let Some(m) = self.opt_menu.as_mut() {
             m.reveal(cap);
         }
     }
 
     /// The select list's plate and rows, or `None` when it is closed.
     ///
     /// Under the select, or over it when there is more room above — never
     /// covering the select itself, and never past the window: a list longer
     /// than the room scrolls.
     #[cfg(feature = "wpe")]
     fn opt_layout(&self) -> Option<OptLayout> {
         let m = self.opt_menu.as_ref()?;
         let n = m.items.len();
         if n == 0 {
             return None;
         }
         let margin = bar_margin();
         // style: deliberate — 2px off the select, so the list reads as
         // attached to it; the select is page content, not a plate sibling.
         let below = self.win.1 - margin - (m.anchor.y + m.anchor.height + 2.0);
         let above = m.anchor.y - 2.0 - margin;
         let need = 2.0 * plate_pad() + n as f32 * OPT_ROW_H;
         let down = need <= below || below >= above;
         let room = if down { below } else { above };
         let cap = (((room - 2.0 * plate_pad()) / OPT_ROW_H).floor().max(1.0) as usize).min(n);
         let height = 2.0 * plate_pad() + cap as f32 * OPT_ROW_H;
         let y = if down {
             m.anchor.y + m.anchor.height + 2.0
         } else {
             m.anchor.y - 2.0 - height
         }
         .max(0.0);
         let width = m.width.min(self.win.0 - 2.0 * margin);
         let x = m.anchor.x.clamp(0.0, (self.win.0 - width).max(0.0));
         let plate = Rect { x, y, width, height };
         let first = m.scroll.min(n - cap);
         // style: deliberate — the 2px hairline keeps a row's highlight off
         // the plate's roll.
         let rows = (0..cap)
             .map(|k| {
                 let r = Rect {
                     x: plate.x + 2.0,
                     y: plate.y + plate_pad() + k as f32 * OPT_ROW_H,
                     width: plate.width - 4.0,
                     height: OPT_ROW_H,
                 };
                 (r, first + k)
             })
             .collect();
         Some(OptLayout { plate, rows, cap })
     }
 
     /// The select list's row at a pointer position, if any.
     #[cfg(feature = "wpe")]
     fn opt_hit(&self, x: f32, y: f32) -> Option<usize> {
         let l = self.opt_layout()?;
         l.rows.iter().find(|(r, _)| r.contains(x, y)).map(|(_, i)| *i)
     }
 
     /// Scroll the select list by `rows`, positive down.
     #[cfg(feature = "wpe")]
     fn opt_scroll(&mut self, rows: isize) {
         let Some(cap) = self.opt_layout().map(|l| l.cap) else { return };
         if let Some(m) = self.opt_menu.as_mut() {
             let max = m.items.len().saturating_sub(cap) as isize;
             m.scroll = (m.scroll.min(max as usize) as isize + rows).clamp(0, max) as usize;
         }
     }
 
     /// Build the right-click menu from what the hit test found, placed at
     /// the pointer and clamped to the window.
     #[cfg(feature = "wpe")]
     fn open_ctx_menu(&mut self, info: wpe::ContextMenuInfo) {
         let mut items = Vec::new();
         let item = |label: &str, action: CtxAction, enabled: bool| CtxItem {
             label: label.to_string(),
             action,
             enabled,
         };
         if let Some((uri, _label)) = info.link {
             items.push(item("Open Link in New Tab", CtxAction::OpenInTab(uri.clone()), true));
             items.push(item("Copy Link", CtxAction::CopyText(uri.clone()), true));
             items.push(item("Download Link", CtxAction::Download(uri), true));
         }
         if let Some(uri) = info.image_uri {
             items.push(item("Copy Image Address", CtxAction::CopyText(uri.clone()), true));
             items.push(item("Download Image", CtxAction::Download(uri), true));
         }
         if info.is_selection {
             items.push(item("Copy", CtxAction::CopySelection, true));
         }
         if info.is_editable {
             items.push(item("Paste", CtxAction::Paste, true));
         }
         items.push(item("Back", CtxAction::Back, self.host.can_go_back()));
         items.push(item("Forward", CtxAction::Forward, self.host.can_go_forward()));
         items.push(item("Reload", CtxAction::Reload, true));
         let favorited = self.host.active_favorited();
         items.push(item(
             if favorited { "Remove from Favorites" } else { "Add to Favorites" },
             CtxAction::ToggleFavorite,
             favorited || self.saveable(),
         ));
         items.push(item("Open in Other Browser", CtxAction::OpenExternal, true));
 
         let h = plate_pad() * 2.0 + items.len() as f32 * CTX_ROW_H;
         let pos = (
             self.pointer.0.min(self.win.0 - CTX_W - bar_margin()).max(0.0),
             self.pointer.1.min(self.win.1 - h - bar_margin()).max(0.0),
         );
         self.ctx_menu = Some(CtxMenu { items, pos });
     }
 
     #[cfg(feature = "wpe")]
     fn dispatch_ctx_action(&mut self, index: usize) {
         let Some(menu) = self.ctx_menu.take() else { return };
         let Some(it) = menu.items.get(index) else { return };
         if !it.enabled {
             return;
         }
         match &it.action {
             CtxAction::Back => self.host.back(),
             CtxAction::Forward => self.host.forward(),
             CtxAction::Reload => self.host.reload(),
             CtxAction::CopySelection => self.host.editing_action_cmd(EditingCommand::Copy),
             CtxAction::Paste => self.host.editing_action_cmd(EditingCommand::Paste),
             CtxAction::OpenInTab(uri) => {
                 if let Ok(url) = Url::parse(uri) {
                     self.open_background_tab(url);
                 }
             }
             CtxAction::CopyText(text) => {
                 cce_ui::widget::clipboard::copy_to_clipboard(text);
             }
             CtxAction::Download(uri) => self.host.download_uri(uri),
             CtxAction::OpenExternal => self.open_external(),
             CtxAction::ToggleFavorite => self.toggle_favorite(),
         }
     }
 
     /// Hand a page-area press to the engine, remembering it so the matching
     /// release can always follow.
     ///
     /// Releases do not come through here: `drain_page_release` has already
     /// sent them from the top of `handle_mouse_input`, before any of the
     /// branches that swallow a click.
     fn page_press(&mut self, button: MouseButton, pressed: bool, pos: LogicalPosition) {
         if !pressed {
             return;
         }
         if !self.page_buttons.contains(&button) {
             self.page_buttons.push(button);
         }
         #[cfg(feature = "wpe")]
         self.defer_page_press();
         let s = self.scale as f32;
         self.host.mouse_button_ui(button, true, pos.x * s, pos.y * s);
     }
 
     /// A press into the page while one of its text fields is open. The
     /// toolkit announces an open field again after every press
     /// (`ime::note_press`), which is what lets a tap on a field that already
     /// has focus raise the on-screen keyboard — but here it would announce
     /// the field before WebKit has even seen the press, so a tap that is
     /// about to take focus away (a link, the page around the field, a page
     /// that autofocused its search box) would flash the board up. The
     /// announcement is taken back and made once the page has had
     /// `PAGE_PRESS_SETTLE` to answer, and only if the field is still open.
     /// A tap that moves the caret is announced without waiting, as a moved
     /// caret.
     #[cfg(feature = "wpe")]
     fn defer_page_press(&mut self) {
         if self.host.page_text_field().is_none() || !cce_ui::ime::take_press() {
             return;
         }
         self.page_press_settle = Some(std::time::Instant::now() + PAGE_PRESS_SETTLE);
         let tx = self.sender.clone();
         std::thread::spawn(move || {
             std::thread::sleep(PAGE_PRESS_SETTLE);
             let _ = tx.send(Message::Spin);
         });
     }
 
     /// Make the announcement `defer_page_press` held back, once its time is
     /// up. Returns whether a frame is needed to make it.
     #[cfg(feature = "wpe")]
     fn settle_page_press(&mut self) -> bool {
         let Some(at) = self.page_press_settle else { return false };
         if std::time::Instant::now() < at {
             return false;
         }
         self.page_press_settle = None;
         self.host.page_text_field().is_some() && cce_ui::ime::note_press()
     }
 
     /// Give the page the release it is owed, wherever the pointer ended up
     /// and whatever the chrome is about to do with this click.
     ///
     /// A release only means anything to whoever received the press, and the
     /// two are not routed alike: the press goes to the page, then the chrome
     /// may put a menu up — the right-click menu does exactly that, from the
     /// press — and every menu branch below swallows the clicks that arrive
     /// while it is open. A release swallowed there leaves WebKit holding the
     /// button down for good, which is how right-click quietly stops working
     /// until the app is restarted. A release nobody is owed (the one that
     /// dismissed the menu, say) is dropped rather than reaching the page
     /// unpaired.
     fn drain_page_release(&mut self, button: MouseButton, pos: LogicalPosition) {
         let Some(i) = self.page_buttons.iter().position(|b| *b == button) else {
             return;
         };
         self.page_buttons.remove(i);
         let s = self.scale as f32;
         self.host.mouse_button_ui(button, false, pos.x * s, pos.y * s);
     }
 
     fn navigate(&mut self) {
         if let Some(url) = parse_url_input(&self.url.text, &self.settings.search_prefix) {
             if std::mem::take(&mut self.url_new_tab) {
                 self.host.open_tab(url);
                 self.persist_session();
             } else {
                 self.host.load(url);
             }
             self.url_focused = false;
             self.url.selection = None;
             self.loading = true;
             // Submitting is the menu's "pick": it folds away to show the page.
             self.chrome_open = false;
         }
     }
 
     /// Pick up settings edits (system-interface, cce-data-editor) when the
     /// window regains focus. Returns whether anything changed.
     fn reload_settings(&mut self) -> bool {
         let new = settings::load();
         if new == self.settings {
             return false;
         }
         downloads::set_download_dir(new.download_dir.clone());
         #[cfg(feature = "wpe")]
         if new.accounts != self.settings.accounts {
             self.host.set_accounts_enabled(new.accounts);
             if !new.accounts {
                 self.ac_menu = None;
             }
         }
         if new.vi_mode != self.settings.vi_mode {
             self.host.set_vi_enabled(new.vi_mode);
             self.vi_set_mode(vi::Mode::Normal);
             self.vi_msg = None;
             if self.vi_searching {
                 self.host.find_finish();
                 self.vi_searching = false;
             }
         }
         self.raindrop_on.store(new.raindrop, std::sync::atomic::Ordering::SeqCst);
         if new.raindrop && !self.raindrop_started {
             raindrop::sync::spawn(self.host.bookmarks(), self.raindrop_on.clone());
             self.raindrop_started = true;
         }
         self.host.set_history_enabled(new.history);
         self.host.set_color_scheme_dark(new.color_scheme.is_dark());
         self.host.set_force_dark(new.color_scheme.forces_dark());
         self.settings = new;
         true
     }
 
     /// Hand the current page to another browser — the escape hatch for the
     /// places Servo cannot follow, like a Cloudflare challenge that never
     /// completes.
     ///
     /// Prefers the configured command; otherwise asks XDG. The guard matters:
     /// cce-browser's own desktop entry claims http/https, so once it is the
     /// default handler, `xdg-open` would hand the page straight back to us.
     fn open_external(&mut self) {
         let Some(url) = self
             .host
             .url()
             .map(|u| u.to_string())
             .or_else(|| parse_url_input(&self.url.text, &self.settings.search_prefix).map(|u| u.to_string()))
         else {
             return;
         };
         let configured = self.settings.external_browser.clone();
         std::thread::spawn(move || {
             let command = match configured {
                 Some(c) => c,
                 None => {
                     let default = std::process::Command::new("xdg-mime")
                         .args(["query", "default", "x-scheme-handler/https"])
                         .output()
                         .ok()
                         .and_then(|o| String::from_utf8(o.stdout).ok())
                         .unwrap_or_default();
                     if default.trim_start().starts_with("cce-browser") {
                         log::warn!(
                             "cce-browser is the default https handler; set browser.external-browser                              to another command or this would just reopen here"
                         );
                         return;
                     }
                     "xdg-open".to_string()
                 }
             };
             let mut parts = command.split_whitespace();
             let Some(program) = parts.next() else { return };
             let args: Vec<&str> = parts.collect();
             match std::process::Command::new(program).args(args).arg(&url).spawn() {
                 Ok(_) => log::info!("handed {url} to {program}"),
                 Err(e) => log::warn!("could not run {program}: {e}"),
             }
         });
     }
 
     /// Write the open-tab set to the session store (a no-op when nothing
     /// changed). Blank tabs are not worth resurrecting, so they are skipped —
     /// which also means a browser left on nothing but "New Tab" starts fresh.
     fn persist_session(&mut self) {
         let active = self.host.active_index();
         let tabs: Vec<(String, bool)> = (0..self.host.tab_count())
             .filter_map(|i| {
                 let url = self.host.tab(i)?.url.as_ref()?.to_string();
                 (url != "about:blank").then_some((url, i == active))
             })
             .collect();
         self.session.save(&tabs);
     }
 
     /// New blank tab with the URL bar focused for typing.
     fn new_tab(&mut self) {
         let url = Url::parse("about:blank").expect("about:blank");
         self.host.open_tab(url);
         self.url = cce_ui::widget::LineEdit::default();
         self.url_focused = true;
         self.url_new_tab = false;
         // The focused field has to be on screen, so a new tab unfolds the
         // menu even when it was opened by chord.
         self.open_chrome();
         self.sync_page_state();
         self.persist_session();
     }
 
     /// Close a tab; returns `Message::Quit` when it was the last one.
     fn close_tab(&mut self, index: usize) -> Option<Message> {
         // The host closes the list's engine side with the tab.
         #[cfg(feature = "wpe")]
         {
             self.opt_menu = None;
         }
         if let Some(url) = self.host.tab(index).and_then(|t| t.url.clone()) {
             if url.as_str() != "about:blank" {
                 self.closed_tabs.push(url);
                 if self.closed_tabs.len() > 20 {
                     self.closed_tabs.remove(0);
                 }
             }
         }
         if index == self.host.active_index() {
             self.vi_page_changed();
         }
         if !self.host.close_tab(index) {
             // Deliberately emptied: save the empty set so the next launch
             // starts on the homepage instead of restoring what was closed.
             self.persist_session();
             return Some(Message::Quit);
         }
         self.url_focused = false;
         self.sync_page_state();
         self.persist_session();
         None
     }
 
     fn switch_tab(&mut self, index: usize) {
         // A glide aimed at this page must not land on the next one.
         self.stop_scroll();
         if index != self.host.active_index() {
             self.vi_page_changed();
         }
         // The other tab has its own fields, and may have none.
         #[cfg(feature = "wpe")]
         {
             self.ac_menu = None;
             self.last_field = None;
             self.host.clear_form_events();
             // The host closes the list's engine side as it switches.
             self.opt_menu = None;
         }
         self.host.activate(index);
         self.url_focused = false;
         self.sync_page_state();
         self.persist_session();
     }
 
     /// Show an internal page: reuse a tab already on it (reloading, so
     /// live pages like downloads refresh), otherwise open a new one.
     fn open_internal_page(&mut self, page: &str) {
         let Ok(url) = Url::parse(page) else { return };
         for i in 0..self.host.tab_count() {
             let on_page = self
                 .host
                 .tab(i)
                 .and_then(|t| t.url.as_ref().map(|u| u.as_str().starts_with(page)))
                 .unwrap_or(false);
             if on_page {
                 self.switch_tab(i);
                 self.host.reload();
                 return;
             }
         }
         self.host.open_tab(url);
         self.url_focused = false;
         self.sync_page_state();
         self.persist_session();
     }
 
     /// Widest prefix of `text` fitting `avail`, with a "…"-style tail cut.
     fn fit_text(text: &str, sans: &str, size: f32, avail: f32) -> String {
         if measure_text_width(text, sans, size) <= avail {
             return text.to_string();
         }
         let mut end = text.len();
         while end > 0 {
             end = cce_ui::widget::line_edit::prev_boundary(text, end);
             let cut = format!("{}...", &text[..end]);
             if measure_text_width(&cut, sans, size) <= avail {
                 return cut;
             }
         }
         String::new()
     }
 
     /// A cce-icons glyph `size` px square, centred in `r` and tinted
     /// `color` as text is — the one way this chrome draws a symbol, never a
     /// character standing in for one. Should the icon set be missing,
     /// `fallback` (a plain word, never a symbol) is drawn small in its
     /// place, cut to the rect.
     fn glyph(pc: &mut PaintCtx, sans: &str, name: &str, fallback: &str, r: Rect, size: f32, color: [u8; 3]) {
         let g = Rect {
             x: r.x + (r.width - size) / 2.0,
             y: r.y + (r.height - size) / 2.0,
             width: size,
             height: size,
         };
         let c = color.map(|v| v as f32 / 255.0);
         if pc.icon(name, g, [c[0], c[1], c[2], 1.0]) {
             return;
         }
         const FALLBACK_FONT: f32 = 9.0;
         let word = Self::fit_text(fallback, sans, FALLBACK_FONT, r.width - 2.0);
         let w = measure_text_width(&word, sans, FALLBACK_FONT);
         pc.text(
             word,
             r.x + (r.width - w) / 2.0,
             cce_ui::layout::align_text_y(r.y, r.height, FALLBACK_FONT, 0.0),
             FALLBACK_FONT,
             color,
         );
     }
 
     /// Draw the page-blocking prompt, if one is up. Same primitives as the
     /// utility bar — there are no cce-ui widgets in this app — with a scrim
     /// over the page so it reads as blocked, which it genuinely is.
     #[cfg(feature = "wpe")]
     fn paint_modal(&mut self, pc: &mut PaintCtx, sans: &str) {
         let Some(m) = self.modal.as_ref() else { return };
         let r = m.rect(self.win);
 
         pc.quad(
             Rect { x: 0.0, y: 0.0, width: self.win.0, height: self.win.1 },
             [0.0, 0.0, 0.0, 0.45],
         );
         let radii = (BAR_RADIUS, BAR_RADIUS, BAR_RADIUS, BAR_RADIUS);
         pc.plate(r, radii, &cce_ui::scene::Material::opaque([0.13, 0.14, 0.16, 1.0]), cce_ui::layout::bevel_width().min(4.0));
 
         pc.text(
             m.title.clone(),
             r.x + plate_pad(),
             r.y + plate_pad(),
             14.0,
             TEXT,
         );
         pc.text(
             Self::fit_text(&m.message, sans, 13.0, r.width - plate_pad() * 2.0),
             r.x + plate_pad(),
             r.y + plate_pad() + 22.0,
             13.0,
             TEXT_DIM,
         );
 
         // What each field draws (bullets for a password) and where its marks
         // fall; only the focused field shows a selection.
         let marks: Vec<FieldMarks> = m
             .fields
             .iter()
             .enumerate()
             .map(|(i, (_, edit))| {
                 let mut marks = FieldMarks::of(&mut self.font_system, edit);
                 if i != m.focused {
                     marks.selection = None;
                 }
                 marks
             })
             .collect();
 
         for (i, ((label, _), marks)) in m.fields.iter().zip(&marks).enumerate() {
             let f = m.field_rect(&r, i);
             let focused = i == m.focused;
             pc.rounded_rect(
                 Rect { x: f.x - 1.0, y: f.y - 1.0, width: f.width + 2.0, height: f.height + 2.0 },
                 7.0,
                 (true, true, true, true),
                 if focused { RIM_FOCUS } else { RIM },
             );
             pc.rounded_rect(f, 6.0, (true, true, true, true), FIELD_BG);
             // `display()` masks a password field; the text itself never
             // reaches the paint list. The dialog blocks everything else, so
             // its focused field is the one with the keyboard.
             let caret = paint_field(pc, f, marks, label, focused);
             if focused {
                 report_caret(caret);
             }
         }
 
         let (ok, cancel) = m.button_rects(&r);
         let (ok_label, cancel_label) = m.labels();
         for (rect, label, accent) in [(Some(ok), ok_label, true), (cancel, cancel_label, false)]
             .into_iter()
             .filter_map(|(rc, l, a)| rc.map(|rc| (rc, l, a)))
         {
             pc.rounded_rect(
                 rect,
                 6.0,
                 (true, true, true, true),
                 if accent { ACCENT } else { BTN_BG },
             );
             let w = measure_text_width(label, sans, 13.0);
             pc.text(
                 label,
                 rect.x + (rect.width - w) / 2.0,
                 cce_ui::layout::align_text_y(rect.y, rect.height, 13.0, 0.0),
                 13.0,
                 TEXT,
             );
         }
     }
 
     /// Draw the account list at the login field it belongs to.
     ///
     /// Two lines per row: the username that will be filled, and the entry's
     /// own title under it, because a keyring holds several accounts on one
     /// site and the title is how they were told apart when they were saved.
     #[cfg(feature = "wpe")]
     fn paint_ac_menu(&mut self, pc: &mut PaintCtx, sans: &str) {
         let Some((plate, rows)) = self.ac_layout() else { return };
         let Some(menu) = self.ac_menu.as_ref() else { return };
         let first = menu.first_row();
         pc.plate(
             plate,
             (8.0, 8.0, 8.0, 8.0),
             &cce_ui::scene::Material::opaque([0.13, 0.14, 0.16, 1.0]),
             cce_ui::layout::bevel_width().min(3.0),
         );
         for (k, r) in rows.iter().enumerate() {
             let Some(account) = menu.shown.get(first + k) else { continue };
             let picked = first + k == menu.selected || menu.hover == Some(first + k);
             if picked {
                 pc.rounded_rect(*r, 5.0, (true, true, true, true), TAB_ACTIVE_BG);
             }
             let width = r.width - 2.0 * text_pad();
             let user = if account.username.is_empty() {
                 account.label.clone()
             } else {
                 account.username.clone()
             };
             pc.text(
                 Self::fit_text(&user, sans, AC_FONT, width),
                 r.x + text_pad(),
                 r.y + 5.0,
                 AC_FONT,
                 TEXT,
             );
             // The second line names where the entry came from: its title, and
             // the site it is stored against when that is not the title.
             let mut sub = account.label.clone();
             if let Some(host) = account.host() {
                 if !sub.to_lowercase().contains(&host) {
                     sub = if sub.is_empty() { host } else { format!("{sub} — {host}") };
                 }
             }
             pc.text(
                 Self::fit_text(&sub, sans, AC_SUB_FONT, width),
                 r.x + text_pad(),
                 r.y + 5.0 + AC_FONT + 3.0,
                 AC_SUB_FONT,
                 TEXT_DIM,
             );
         }
         // Say it plainly when the form is another site's, and when the page
         // is not https: the password is about to go somewhere the person may
         // not have expected, and only they can decide that is fine.
         let notes = Self::ac_notes(menu);
         let first_note = plate.y + plate.height - plate_pad() - notes.len() as f32 * 18.0;
         for (k, (note, color)) in notes.into_iter().enumerate() {
             pc.text(
                 Self::fit_text(&note, sans, AC_SUB_FONT, plate.width - 2.0 * text_pad()),
                 plate.x + text_pad(),
                 first_note + k as f32 * 18.0 + 3.0,
                 AC_SUB_FONT,
                 color,
             );
         }
     }
 
     /// Draw the save offer: what would be saved, and the three answers.
     /// The password itself is never drawn.
     #[cfg(feature = "wpe")]
     fn paint_save_offer(&mut self, pc: &mut PaintCtx, sans: &str) {
         let Some(l) = self.save_layout() else { return };
         let Some(offer) = self.save_offer.as_ref() else { return };
         pc.plate(
             l.plate,
             (8.0, 8.0, 8.0, 8.0),
             &cce_ui::scene::Material::opaque([0.13, 0.14, 0.16, 1.0]),
             cce_ui::layout::bevel_width().min(3.0),
         );
         let x = l.plate.x + plate_pad();
         let w = l.plate.width - 2.0 * plate_pad();
         let y = l.plate.y + plate_pad();
         let (title, line, sub, sub_color) = match &offer.stage {
             SaveStage::Failed(why) => {
                 ("Password not saved".to_string(), why.clone(), String::new(), TEXT_DIM)
             }
             stage => {
                 let title = if *stage == SaveStage::Saving {
                     "Saving to the keyring…"
                 } else {
                     "Save this password?"
                 };
                 let who = if offer.username.is_empty() {
                     "(no username)".to_string()
                 } else {
                     offer.username.clone()
                 };
                 let site = if offer.form_host == offer.page_host {
                     offer.form_host.clone()
                 } else {
                     format!("{} — form from {}", offer.page_host, offer.form_host)
                 };
                 (title.to_string(), who, site, TEXT_DIM)
             }
         };
         pc.text(title, x, y, 14.0, TEXT);
         pc.text(Self::fit_text(&line, sans, 13.0, w), x, y + 22.0, 13.0, TEXT);
         pc.text(Self::fit_text(&sub, sans, 12.0, w), x, y + 40.0, 12.0, sub_color);
         for (rect, button) in &l.buttons {
             let (label, accent) = match (button, &offer.stage) {
                 (SaveButton::Save, _) => ("Save", true),
                 (SaveButton::Never, _) => ("Never", false),
                 (SaveButton::Dismiss, SaveStage::Failed(_)) => ("Close", false),
                 (SaveButton::Dismiss, _) => ("Not now", false),
             };
             pc.rounded_rect(*rect, 6.0, (true, true, true, true), if accent { ACCENT } else { BTN_BG });
             let tw = measure_text_width(label, sans, 13.0);
             pc.text(
                 label,
                 rect.x + (rect.width - tw) / 2.0,
                 cce_ui::layout::align_text_y(rect.y, rect.height, 13.0, 0.0),
                 13.0,
                 TEXT,
             );
         }
     }
 
     /// Draw the bookmarks menu: the same plate-and-rows vocabulary as the
     /// right-click menu, in three sections — what to do with this page, the
     /// pages already saved, and the way out to the full collection.
     fn paint_bm_menu(&mut self, pc: &mut PaintCtx, sans: &str) {
         let Some(l) = self.bm_layout() else { return };
         // The field's marks are measured here, before painting borrows
         // anything, on the same shaped run it draws.
         let (total, items, hover, scroll, searching, marks, selected) = match self.bm_menu.as_ref() {
             Some(m) => (
                 m.all.len(),
                 m.items.clone(),
                 m.hover,
                 m.scroll,
                 !m.query.text.is_empty(),
                 FieldMarks::of(&mut self.font_system, &m.query),
                 m.selected,
             ),
             None => return,
         };
         let has_keyboard = self.bm_search_has_keyboard();
         pc.plate(
             l.plate,
             (8.0, 8.0, 8.0, 8.0),
             &cce_ui::scene::Material::opaque([0.13, 0.14, 0.16, 1.0]),
             cce_ui::layout::bevel_width().min(3.0),
         );
 
         // The search field. It has the keyboard whenever the menu is open,
         // so it always wears the focused rim and shows its caret.
         let f = l.search;
         pc.rounded_rect(
             Rect { x: f.x - 1.0, y: f.y - 1.0, width: f.width + 2.0, height: f.height + 2.0 },
             7.0,
             (true, true, true, true),
             RIM_FOCUS,
         );
         pc.rounded_rect(f, 6.0, (true, true, true, true), FIELD_BG);
         let caret = paint_field(pc, f, &marks, "Search bookmarks", true);
         if has_keyboard {
             report_caret(caret);
         }
 
         let text_at = |pc: &mut PaintCtx, r: &Rect, s: String, color: [u8; 3]| {
             pc.text(
                 s,
                 r.x + text_pad(),
                 cce_ui::layout::align_text_y(r.y, r.height, BM_FONT, 0.0),
                 BM_FONT,
                 color,
             );
         };
         let highlight = |pc: &mut PaintCtx, r: &Rect| {
             pc.rounded_rect(*r, 5.0, (true, true, true, true), TAB_ACTIVE_BG);
         };
 
         // What this page can do: the toggle names the state in words, where
         // the star only lights up.
         let saved = self.host.active_bookmarked();
         let can_save = saved || self.saveable();
         if hover == Some(BmHit::Toggle) && can_save {
             highlight(pc, &l.toggle);
         }
         let label = if saved { "Remove Bookmark" } else { "Bookmark This Page" };
         text_at(
             pc,
             &l.toggle,
             Self::fit_text(label, sans, BM_FONT, l.toggle.width - 2.0 * text_pad()),
             if can_save { TEXT } else { TEXT_DIM },
         );
 
         // The saved pages themselves, newest first.
         for (r, i) in &l.rows {
             let Some(item) = items.get(*i) else { continue };
             let hovered = matches!(hover, Some(BmHit::Entry(h, _)) if h == *i);
             if hovered || *i == selected {
                 highlight(pc, r);
             }
             text_at(
                 pc,
                 r,
                 Self::fit_text(
                     &item.label,
                     sans,
                     BM_FONT,
                     r.width - 2.0 * text_pad() - BM_RM_W,
                 ),
                 // Full brightness whether hovered or not: dim means
                 // *unavailable* everywhere else in this chrome, and every
                 // saved page is available. Hover is the highlight's job.
                 TEXT,
             );
             // The remove glyph shows on the hovered row only — always-on x's
             // down a whole list read as clutter, and as a hazard.
             if hovered {
                 let on_rm = hover == Some(BmHit::Entry(*i, true));
                 let rm = Rect { x: r.x + r.width - BM_RM_W, width: BM_RM_W, ..*r };
                 Self::glyph(
                     pc,
                     sans,
                     "x",
                     "Remove",
                     rm,
                     10.0,
                     if on_rm { [212, 155, 155] } else { TEXT_DIM },
                 );
             }
         }
         if let Some(r) = l.empty {
             let what = if searching { "No matches" } else { "No bookmarks yet" };
             text_at(pc, &r, what.to_string(), TEXT_DIM);
         }
 
         // Scroll position, when the list is longer than the plate.
         if items.len() > l.rows.len() && !l.rows.is_empty() {
             let first = l.rows[0].0;
             let track = Rect {
                 x: l.plate.x + l.plate.width - 5.0,
                 y: first.y,
                 width: 2.0,
                 height: l.rows.len() as f32 * BM_ROW_H,
             };
             let frac = l.rows.len() as f32 / items.len() as f32;
             let offset = scroll as f32 / items.len() as f32;
             pc.rounded_rect(
                 Rect {
                     y: track.y + offset * track.height,
                     height: (frac * track.height).max(12.0),
                     ..track
                 },
                 1.0,
                 (true, true, true, true),
                 RIM,
             );
         }
 
         // The rules between the three sections.
         for y in [l.toggle.y + BM_ROW_H + BM_SEP_H / 2.0, l.manage.y - BM_SEP_H / 2.0] {
             pc.quad(
                 Rect {
                     x: l.plate.x + text_pad(),
                     y,
                     width: l.plate.width - 2.0 * text_pad(),
                     height: 1.0,
                 },
                 RIM,
             );
         }
 
         if hover == Some(BmHit::Manage) {
             highlight(pc, &l.manage);
         }
         text_at(
             pc,
             &l.manage,
             // The whole collection: this row hands all of it to the page.
             format!("Manage Bookmarks ({total})"),
             TEXT,
         );
     }
 
     /// Draw a select's list: its options, the current value marked with a
     /// check glyph, optgroup headings dim and their options indented under them.
     #[cfg(feature = "wpe")]
     fn paint_opt_menu(&mut self, pc: &mut PaintCtx, sans: &str) {
         let Some(l) = self.opt_layout() else { return };
         let Some(m) = self.opt_menu.as_ref() else { return };
         pc.plate(
             l.plate,
             (8.0, 8.0, 8.0, 8.0),
             &cce_ui::scene::Material::opaque([0.13, 0.14, 0.16, 1.0]),
             cce_ui::layout::bevel_width().min(3.0),
         );
         let n = m.items.len();
         let scrolls = n > l.cap;
         for (r, i) in &l.rows {
             let Some(it) = m.items.get(*i) else { continue };
             if m.highlight == Some(*i) && m.pickable(*i) {
                 pc.rounded_rect(*r, 5.0, (true, true, true, true), TAB_ACTIVE_BG);
             }
             let gutter = r.x + text_pad();
             if it.selected {
                 let mark = Rect { x: gutter - 2.0, y: r.y, width: OPT_INDENT, height: r.height };
                 Self::glyph(pc, sans, "check", "", mark, 10.0, TEXT);
             }
             let x = gutter + OPT_INDENT + if it.group_child { OPT_INDENT } else { 0.0 };
             let avail = r.x + r.width - x - text_pad() - if scrolls { 6.0 } else { 0.0 };
             let color = if m.pickable(*i) { TEXT } else { TEXT_DIM };
             pc.text(
                 Self::fit_text(&it.label, sans, OPT_FONT, avail),
                 x,
                 cce_ui::layout::align_text_y(r.y, r.height, OPT_FONT, 0.0),
                 OPT_FONT,
                 color,
             );
         }
         // A long list says where in it the view is.
         if scrolls {
             let track = l.plate.height - 2.0 * plate_pad();
             let thumb = (track * l.cap as f32 / n as f32).max(12.0);
             let first = l.rows.first().map_or(0, |(_, i)| *i);
             let at = (track - thumb) * first as f32 / (n - l.cap) as f32;
             pc.rounded_rect(
                 Rect {
                     x: l.plate.x + l.plate.width - 7.0,
                     y: l.plate.y + plate_pad() + at,
                     width: 3.0,
                     height: thumb,
                 },
                 1.5,
                 (true, true, true, true),
                 [0.6, 0.62, 0.66, 0.5],
             );
         }
     }
 
     /// Draw the right-click menu: a small plate at the pointer, rows with a
     /// hover highlight, disabled rows dimmed. Same primitives as everything
     /// else in this chrome.
     #[cfg(feature = "wpe")]
     fn paint_ctx_menu(&mut self, pc: &mut PaintCtx, sans: &str) {
         let Some(menu) = self.ctx_menu.as_ref() else { return };
         let r = menu.rect();
         pc.plate(
             r,
             (8.0, 8.0, 8.0, 8.0),
             &cce_ui::scene::Material::opaque([0.13, 0.14, 0.16, 1.0]),
             cce_ui::layout::bevel_width().min(3.0),
         );
         let hovered = menu.item_at(self.pointer.0, self.pointer.1);
         for (i, it) in menu.items.iter().enumerate() {
             let row = menu.row_rect(i);
             if hovered == Some(i) && it.enabled {
                 pc.rounded_rect(row, 5.0, (true, true, true, true), TAB_ACTIVE_BG);
             }
             let color = if it.enabled { TEXT } else { TEXT_DIM };
             pc.text(
                 Self::fit_text(&it.label, sans, 13.0, row.width - 2.0 * text_pad()),
                 row.x + text_pad(),
                 cce_ui::layout::align_text_y(row.y, row.height, 13.0, 0.0),
                 13.0,
                 color,
             );
         }
     }
 
     /// The byte of the URL under pointer x `click_x`. The bar draws
     /// `display()` — with a composition in it while one is up — so the hit
     /// lands in that and `text_index` carries it back to the text.
     fn cursor_from_click(&mut self, click_x: f32, field: &Rect) -> usize {
         let shown = self.url.display();
         let at = self.boundary_at_x(&shown, click_x - field.x - text_pad());
         self.url.text_index(at)
     }
 
     /// The char boundary of `text` nearest `rel_x` (text-origin relative),
     /// off the same shaped run a field draws (`URL_FONT`, font=None,
     /// matching `pc.text`). The URL bar and the dialog fields both read it,
     /// so a click lands where the glyphs are.
     fn boundary_at_x(&mut self, text: &str, rel_x: f32) -> usize {
         let offsets =
             cce_ui::engine::shaped_cluster_offsets(&mut self.font_system, text, URL_FONT, None);
         offsets
             .iter()
             .min_by(|a, b| (a.1 - rel_x).abs().total_cmp(&(b.1 - rel_x).abs()))
             .map(|&(b, _)| b)
             .unwrap_or(text.len())
     }
 
     /// The byte of dialog field `i`'s text under pointer x `x`. The field
     /// draws `display()` — bullets, for a password — so the hit lands in
     /// that and `text_index` carries it back to the text.
     #[cfg(feature = "wpe")]
     fn modal_index_at(&mut self, i: usize, x: f32) -> Option<usize> {
         let m = self.modal.as_ref()?;
         let f = m.field_rect(&m.rect(self.win), i);
         let shown = m.fields.get(i)?.1.display();
         let at = self.boundary_at_x(&shown, x - f.x - text_pad());
         Some(self.modal.as_ref()?.fields[i].1.text_index(at))
     }
 
     /// Select the whole URL, caret at the end — what entering the bar does,
     /// whether from a click, Ctrl+L or Ctrl+A. No-op on an empty field.
     fn select_all_url(&mut self) {
         self.url.select_all();
     }
 
     /// The line field that has the keyboard, if any: a dialog's focused field
     /// while one is up (it blocks everything else), else the URL bar while
     /// it is focused. Undo and redo act on this.
     fn focused_edit(&mut self) -> Option<&mut cce_ui::widget::LineEdit> {
         let field = self.keyboard_field()?;
         self.line_field(field)
     }
 
     /// Which line field has the keyboard: a dialog's focused field while
     /// one is up, else the vi command line while it is open, else the
     /// bookmarks menu's search while it is open, else the URL bar while it
     /// is focused.
     fn keyboard_field(&self) -> Option<LineField> {
         #[cfg(feature = "wpe")]
         if let Some(m) = self.modal.as_ref() {
             return (m.focused < m.fields.len()).then_some(LineField::Dialog(m.focused));
         }
         if self.settings.vi_mode && self.vi_mode == vi::Mode::Command {
             return Some(LineField::ViCmd);
         }
         if self.bm_menu.is_some() {
             return Some(LineField::BmSearch);
         }
         self.url_focused.then_some(LineField::Url)
     }
 
     /// The editor behind `field`, while it exists.
     fn line_field(&mut self, field: LineField) -> Option<&mut cce_ui::widget::LineEdit> {
         match field {
             LineField::Url => Some(&mut self.url),
             LineField::BmSearch => self.bm_menu.as_mut().map(|m| &mut m.query),
             LineField::ViCmd => Some(&mut self.vi_cmd),
             #[cfg(feature = "wpe")]
             LineField::Dialog(i) => self.modal.as_mut()?.fields.get_mut(i).map(|(_, e)| e),
         }
     }
 
     /// Before a frame is drawn: the field with the keyboard takes up the
     /// input method's composition, and one that has just lost the keyboard
     /// drops what it was showing. A field that is gone with it — a dialog
     /// answered, the bookmarks menu closed — cannot, so a composition still
     /// up once the old field has let go is cancelled here: it was that
     /// field's, since the new one has not taken anything yet.
     fn sync_ime(&mut self) {
         let now = self.keyboard_field();
         if now != self.ime_field {
             let before = self.ime_field;
             if let Some(edit) = before.and_then(|f| self.line_field(f)) {
                 edit.drop_composition();
             }
             if cce_ui::ime::preedit().is_some() {
                 cce_ui::ime::request_reset();
             }
             self.ime_field = now;
         }
         if let Some(edit) = now.and_then(|f| self.line_field(f)) {
             edit.sync_ime();
         }
     }
 
     /// Whether `focused_edit` is the bookmarks menu's search field — an undo
     /// there changes the query, so the list has to follow.
     fn bm_search_has_keyboard(&self) -> bool {
         self.keyboard_field() == Some(LineField::BmSearch)
     }
 
 
 
     /// URL-bar keys. Editing is the shared [`cce_ui::widget::LineEdit`]; only what
     /// makes this bar a *URL* bar — Enter navigates, Escape returns focus to
     /// the page — is decided here.
     fn edit_url(&mut self, event: &KeyEvent) {
         match self.url.handle_key(event) {
             cce_ui::widget::EditOutcome::Submit => self.navigate(),
             cce_ui::widget::EditOutcome::Cancel => {
                 self.url_focused = false;
                 self.url_new_tab = false;
                 self.url.selection = None;
                 self.sync_page_state();
             }
             cce_ui::widget::EditOutcome::Edited | cce_ui::widget::EditOutcome::Ignored => {}
         }
     }
 }
 
 /// A key's identity across its press and release: the logical key, case
 /// folded, since Shift can be let go between the two (`G` comes up as `g`).
 fn key_id(event: &KeyEvent) -> String {
     format!("{:?}", event.logical_key).to_lowercase()
 }
 
 // ---- vi mode (`src/vi.rs`) ----
 impl BrowserApp {
     /// Change mode, dropping whatever the old one had up.
     fn vi_set_mode(&mut self, mode: vi::Mode) {
         if mode != vi::Mode::Hint {
             self.vi_hints.clear();
             self.vi_hint_typed.clear();
             if matches!(self.vi_pending, Some((_, ViAsk::Hints))) {
                 self.vi_pending = None;
             }
         }
         self.vi_keys.clear();
         self.vi_mode = mode;
     }
 
     /// The page went away under vi: a navigation, or another tab shown.
     /// Insert mode and hints belonged to it; so did any search highlight.
     fn vi_page_changed(&mut self) {
         if matches!(self.vi_mode, vi::Mode::Insert | vi::Mode::Hint) {
             self.vi_set_mode(vi::Mode::Normal);
         }
         self.vi_pending = None;
         self.vi_searching = false;
         // A click that navigated must not let the next page's autofocus
         // count as clicked into.
         self.vi_click = None;
     }
 
     /// Show a message on the status line for a while. The wake is needed for
     /// the same reason as the peek's: an idle page turns no loop.
     fn vi_say(&mut self, text: impl Into<String>) {
         self.vi_msg = Some((text.into(), std::time::Instant::now() + VI_MSG_TIME));
         let tx = self.sender.clone();
         std::thread::spawn(move || {
             std::thread::sleep(VI_MSG_TIME);
             let _ = tx.send(Message::Spin);
         });
     }
 
     /// Ask the page something; the answer arrives in `vi_drain`.
     fn vi_ask(&mut self, ask: ViAsk, script: &str) {
         self.vi_tag = self.vi_tag.wrapping_add(1).max(1);
         self.vi_pending = Some((self.vi_tag, ask));
         self.host.vi_eval(script, self.vi_tag);
     }
 
     /// Take in what the page side said since the last pump: script answers,
     /// focus moves, a search's outcome, and a message's time running out.
     /// Returns whether anything shows differently.
     fn vi_drain(&mut self) -> bool {
         let mut changed = false;
         while let Some((tag, text)) = self.host.take_vi_result() {
             let Some((want, ask)) = self.vi_pending else { continue };
             if tag != want {
                 continue;
             }
             self.vi_pending = None;
             changed = true;
             match ask {
                 ViAsk::Hints if self.vi_mode == vi::Mode::Hint => {
                     self.vi_hints = vi::parse_hints(&text);
                     if self.vi_hints.is_empty() {
                         self.vi_set_mode(vi::Mode::Normal);
                         self.vi_say("No elements found");
                     }
                 }
                 ViAsk::Hints => {}
                 ViAsk::FocusInput if text == "yes" => self.vi_set_mode(vi::Mode::Insert),
                 ViAsk::FocusInput => self.vi_say("No text field found"),
                 ViAsk::ClickCheck => {
                     if text == "yes" && self.vi_mode == vi::Mode::Normal {
                         self.vi_set_mode(vi::Mode::Insert);
                     }
                 }
             }
         }
         if let Some(editable) = self.host.take_vi_focus() {
             if self.settings.vi_mode {
                 let clicked = self.vi_click.is_some_and(|t| t.elapsed() < VI_CLICK_WINDOW);
                 match (self.vi_mode, editable) {
                     (vi::Mode::Normal, true) if clicked => self.vi_set_mode(vi::Mode::Insert),
                     (vi::Mode::Insert, false) => self.vi_set_mode(vi::Mode::Normal),
                     _ => {}
                 }
                 changed = true;
             }
         }
         if self.host.take_find_result() == Some(0) {
             let text = self.vi_search.clone().unwrap_or_default();
             self.vi_say(format!("Text not found: {text}"));
             changed = true;
         }
         if self.vi_msg.as_ref().is_some_and(|(_, at)| std::time::Instant::now() >= *at) {
             self.vi_msg = None;
             changed = true;
         }
         changed
     }
 
     /// Mark a press as taken, so its release is too.
     fn vi_swallow(&mut self, event: &KeyEvent) {
         if self.vi_swallowed.len() >= 16 {
             self.vi_swallowed.remove(0);
         }
         self.vi_swallowed.push(key_id(event));
     }
 
     /// The vi stage of `handle_key_input`. `Some` when vi took the key —
     /// carrying what the key did, which can be quitting — `None` to let it
     /// go on down the funnel.
     fn vi_key(&mut self, event: &KeyEvent, needs_rebuild: &mut bool) -> Option<Option<Message>> {
         use vi::Mode;
         if !self.settings.vi_mode {
             return None;
         }
         let owns_keyboard = matches!(self.vi_mode, Mode::Hint | Mode::Command);
         if event.state != ElementState::Pressed {
             let id = key_id(event);
             if let Some(i) = self.vi_swallowed.iter().position(|k| *k == id) {
                 self.vi_swallowed.remove(i);
                 return Some(None);
             }
             return owns_keyboard.then_some(None);
         }
         // A modifier on its own means nothing to vi.
         if matches!(
             event.logical_key,
             Key::Named(NamedKey::Shift | NamedKey::Control | NamedKey::Alt | NamedKey::Super)
         ) {
             return owns_keyboard.then_some(None);
         }
         match self.vi_mode {
             Mode::Command => {
                 self.vi_swallow(event);
                 *needs_rebuild = true;
                 return Some(self.vi_cmd_key(event));
             }
             Mode::Hint => {
                 self.vi_swallow(event);
                 *needs_rebuild = true;
                 self.vi_hint_key(event);
                 return Some(None);
             }
             _ => {}
         }
         // A field of the chrome's own has the keyboard; vi stays out of it.
         if self.url_focused || self.bm_menu.is_some() {
             return None;
         }
         let escape = event.logical_key == Key::Named(NamedKey::Escape);
         match self.vi_mode {
             Mode::Passthrough => {
                 if escape && event.shift {
                     self.vi_swallow(event);
                     self.vi_set_mode(Mode::Normal);
                     *needs_rebuild = true;
                 } else {
                     self.host.key_ui(event);
                 }
                 return Some(None);
             }
             Mode::Insert => {
                 if !escape {
                     return None;
                 }
                 self.vi_swallow(event);
                 self.vi_set_mode(Mode::Normal);
                 *needs_rebuild = true;
                 return Some(None);
             }
             _ => {}
         }
 
         // Normal mode. Escape clears what vi has going — pending keys, a
         // message, a search's highlights — and only with none of that does
         // it go on, to fold the bar or reach the page.
         if escape {
             let mut used = !self.vi_keys.is_empty() || self.vi_msg.take().is_some();
             self.vi_keys.clear();
             if self.vi_searching {
                 self.host.find_finish();
                 self.vi_searching = false;
                 used = true;
             }
             if !used {
                 return None;
             }
             self.vi_swallow(event);
             *needs_rebuild = true;
             return Some(None);
         }
         *needs_rebuild = true;
         // Named keys are never commands: they end a sequence and go on.
         let Some(token) = vi::token(event) else {
             self.vi_keys.clear();
             return None;
         };
         // A chord vi has no binding for is the chrome's, or the page's.
         if (event.ctrl || event.alt) && !self.vi_keys.takes(&token) {
             self.vi_keys.clear();
             return None;
         }
         self.vi_swallow(event);
         self.vi_msg = None;
         match self.vi_keys.feed(&token) {
             vi::Fed::Run(action, count) => Some(self.vi_run(action, count)),
             vi::Fed::Pending | vi::Fed::Unbound => Some(None),
         }
     }
 
     /// Do a normal-mode command.
     fn vi_run(&mut self, action: vi::Action, count: Option<u32>) -> Option<Message> {
         use vi::Action as A;
         let n = count.unwrap_or(1).max(1) as usize;
         let tabs = self.host.tab_count();
         let cur = self.host.active_index();
         match action {
             A::ScrollLines(dx, dy) => self.vi_scroll_lines(dx * n as f32, dy * n as f32),
             A::ScrollPage(f) => {
                 let js = vi::scroll_js(Some(f * n as f32), None, cce_ui::motion::enabled());
                 self.host.vi_eval(&js, 0);
             }
             A::Top | A::Bottom => {
                 let end = if action == A::Top { 0.0 } else { 1.0 };
                 let to = count.map_or(end, |c| c.min(100) as f32 / 100.0);
                 self.host.vi_eval(&vi::scroll_js(None, Some(to), false), 0);
             }
             A::Back => self.host.back(),
             A::Forward => self.host.forward(),
             A::Reload => self.host.reload(),
             A::TabNext if tabs > 1 => self.switch_tab((cur + n) % tabs),
             A::TabPrev if tabs > 1 => self.switch_tab((cur + tabs - n % tabs) % tabs),
             A::TabGoto => match count {
                 Some(c) => return self.vi_run(A::TabFocus(c as usize), None),
                 None => return self.vi_run(A::TabNext, None),
             },
             A::TabFocus(i) if (1..=tabs).contains(&i) => self.switch_tab(i - 1),
             A::TabFocus(i) => self.vi_say(format!("There is no tab {i}")),
             A::TabFirst => self.switch_tab(0),
             A::TabLast => self.switch_tab(tabs.saturating_sub(1)),
             A::TabNext | A::TabPrev => {}
             A::TabClose => return self.close_tab(cur),
             A::TabOnly => {
                 for i in (0..tabs).rev().filter(|&i| i != cur) {
                     self.close_tab(i);
                 }
             }
             A::UndoClose => match self.closed_tabs.pop() {
                 Some(url) => {
                     self.host.open_tab(url);
                     self.sync_page_state();
                     self.persist_session();
                 }
                 None => self.vi_say("No closed tabs"),
             },
             A::Open { tab, edit } => {
                 self.open_chrome();
                 let text = if edit {
                     self.host.url().map(|u| u.to_string()).unwrap_or_default()
                 } else {
                     String::new()
                 };
                 self.url = cce_ui::widget::LineEdit::with_text(text);
                 self.url_focused = true;
                 self.url_new_tab = tab;
             }
             A::Hint(kind) => {
                 self.vi_set_mode(vi::Mode::Hint);
                 self.vi_hint_kind = kind;
                 self.vi_ask(ViAsk::Hints, &vi::hints_js(kind != vi::HintKind::Follow));
             }
             A::YankUrl => match self.host.url() {
                 Some(u) => {
                     cce_ui::widget::clipboard::copy_to_clipboard(u.as_str());
                     self.vi_say(format!("Yanked {u}"));
                 }
                 None => self.vi_say("No address to yank"),
             },
             A::YankTitle => match self.title.clone().filter(|t| !t.is_empty()) {
                 Some(t) => {
                     cce_ui::widget::clipboard::copy_to_clipboard(&t);
                     self.vi_say(format!("Yanked {t}"));
                 }
                 None => self.vi_say("No title to yank"),
             },
             A::Paste { tab } => {
                 let url = cce_ui::widget::clipboard::read_from_clipboard()
                     .map(|t| t.trim().to_string())
                     .filter(|t| !t.is_empty())
                     .and_then(|t| parse_url_input(&t, &self.settings.search_prefix));
                 match url {
                     Some(url) if tab => {
                         self.host.open_tab(url);
                         self.sync_page_state();
                         self.persist_session();
                     }
                     Some(url) => {
                         self.host.load(url);
                         self.loading = true;
                     }
                     None => self.vi_say("Nothing to open in the clipboard"),
                 }
             }
             A::Insert => self.vi_set_mode(vi::Mode::Insert),
             A::FocusInput => self.vi_ask(ViAsk::FocusInput, &vi::focus_input_js()),
             A::Passthrough => self.vi_set_mode(vi::Mode::Passthrough),
             A::Prompt(p) => {
                 self.vi_set_mode(vi::Mode::Command);
                 self.vi_prompt = p;
                 self.vi_cmd = cce_ui::widget::LineEdit::default();
                 self.vi_history_at = None;
             }
             A::SearchNext | A::SearchPrev => {
                 if self.vi_searching {
                     for _ in 0..n {
                         if action == A::SearchNext {
                             self.host.find_next();
                         } else {
                             self.host.find_prev();
                         }
                     }
                 } else if let Some(text) = self.vi_search.clone() {
                     // A search from before a navigation: start it again here.
                     self.host.find(&text, action == A::SearchPrev);
                     self.vi_searching = true;
                 } else {
                     self.vi_say("No previous search");
                 }
             }
             A::Bookmark => {
                 self.host.toggle_bookmark();
                 let on = self.host.active_bookmarked();
                 self.vi_say(if on { "Bookmarked" } else { "Bookmark removed" });
             }
             A::Page(page) => self.open_internal_page(page),
             A::Up | A::Root => {
                 let to = self.host.url().and_then(|u| {
                     if action == A::Up { vi::url_up(&u) } else { vi::url_root(&u) }
                 });
                 if let Some(url) = to {
                     self.host.load(url);
                     self.loading = true;
                 }
             }
         }
         None
     }
 
     /// `j`/`k`/`h`/`l`: a wheel's worth of lines through the same eased
     /// model a notch takes, aimed at the middle of the page.
     fn vi_scroll_lines(&mut self, dx: f32, dy: f32) {
         let center = (self.win.0 / 2.0, self.win.1 / 2.0);
         // Lines down are a negative wheel delta (winit: positive = up).
         let (lx, ly) = (-dx * VI_LINE, -dy * VI_LINE);
         if cce_ui::widget::scroll_motion::scroll_settings().smooth {
             use cce_ui::widget::scroll_motion::Bounds;
             self.scroll_origin = Some(center);
             self.scroll.apply(
                 &MouseScrollDelta::LineDelta(lx, ly),
                 (LINE_PX as f32, LINE_PX as f32),
                 Bounds::UNBOUNDED,
                 Bounds::UNBOUNDED,
             );
         } else {
             cce_ui::widget::scroll_motion::set_scroll_phase(cce_ui::widget::ScrollPhase::Wheel);
             let s = self.scale;
             self.host.wheel(
                 lx as f64 * LINE_PX * s,
                 ly as f64 * LINE_PX * s,
                 center.0 * s as f32,
                 center.1 * s as f32,
             );
         }
     }
 
     /// Keys while the labels are up: letters narrow them down, a whole label
     /// picks, Backspace takes a letter back, Escape gives up.
     fn vi_hint_key(&mut self, event: &KeyEvent) {
         match &event.logical_key {
             Key::Named(NamedKey::Escape) => self.vi_set_mode(vi::Mode::Normal),
             Key::Named(NamedKey::Backspace) => {
                 self.vi_hint_typed.pop();
             }
             Key::Character(c) if !event.ctrl && !event.alt => {
                 let next = format!("{}{}", self.vi_hint_typed, c.to_lowercase());
                 // A letter no label continues with is ignored, not an error.
                 if self.vi_hints.iter().any(|h| h.label.starts_with(&next)) {
                     let hit = self.vi_hints.iter().find(|h| h.label == next).cloned();
                     self.vi_hint_typed = next;
                     if let Some(h) = hit {
                         self.vi_follow(h);
                     }
                 }
             }
             _ => {}
         }
     }
 
     fn vi_follow(&mut self, hint: vi::Hint) {
         let kind = self.vi_hint_kind;
         self.vi_set_mode(vi::Mode::Normal);
         match kind {
             // A real click, at the element: the page sees a person's click
             // (popups allowed, focus moved, cross-origin frames and all), and
             // a field picked this way is clicked into.
             vi::HintKind::Follow => {
                 self.vi_click = Some(std::time::Instant::now());
                 self.click_page(MouseButton::Left, hint.at);
                 self.vi_ask(ViAsk::ClickCheck, &vi::active_editable_js());
             }
             // A middle-click: the link becomes a background tab by the same
             // route a pointer's middle-click takes.
             vi::HintKind::Background => self.click_page(MouseButton::Middle, hint.at),
             vi::HintKind::Yank => match hint.href {
                 Some(href) => {
                     cce_ui::widget::clipboard::copy_to_clipboard(&href);
                     self.vi_say(format!("Yanked {href}"));
                 }
                 None => self.vi_say("That has no link to yank"),
             },
         }
     }
 
     /// Press and release `button` on the page at `at` (logical pixels).
     fn click_page(&mut self, button: MouseButton, at: (f32, f32)) {
         let s = self.scale as f32;
         let (x, y) = (at.0 * s, at.1 * s);
         self.host.mouse_move(x, y);
         self.host.mouse_button_ui(button, true, x, y);
         self.host.mouse_button_ui(button, false, x, y);
     }
 
     /// Keys for the `:` / `/` / `?` line. Editing is the shared `LineEdit`;
     /// Up/Down walk earlier lines of the same kind, and Backspace on an empty
     /// line leaves it, as in vim.
     fn vi_cmd_key(&mut self, event: &KeyEvent) -> Option<Message> {
         let search = self.vi_prompt != vi::Prompt::Command;
         match event.logical_key {
             Key::Named(NamedKey::ArrowUp | NamedKey::ArrowDown) => {
                 let up = event.logical_key == Key::Named(NamedKey::ArrowUp);
                 let past: Vec<String> = self
                     .vi_history
                     .iter()
                     .filter(|(s, _)| *s == search)
                     .map(|(_, t)| t.clone())
                     .collect();
                 if past.is_empty() {
                     return None;
                 }
                 let at = match (self.vi_history_at, up) {
                     (None, true) => Some(past.len() - 1),
                     (None, false) => None,
                     (Some(i), true) => Some(i.saturating_sub(1)),
                     (Some(i), false) => (i + 1 < past.len()).then_some(i + 1),
                 };
                 self.vi_history_at = at;
                 self.vi_cmd = cce_ui::widget::LineEdit::with_text(at.map_or(String::new(), |i| past[i].clone()));
                 return None;
             }
             Key::Named(NamedKey::Backspace) if self.vi_cmd.text.is_empty() => {
                 self.vi_set_mode(vi::Mode::Normal);
                 return None;
             }
             _ => {}
         }
         match self.vi_cmd.handle_key(event) {
             cce_ui::widget::EditOutcome::Submit => {
                 let line = self.vi_cmd.text.clone();
                 self.vi_set_mode(vi::Mode::Normal);
                 if !line.trim().is_empty() {
                     self.vi_history.retain(|(s, t)| !(*s == search && *t == line));
                     self.vi_history.push((search, line.clone()));
                     if self.vi_history.len() > 100 {
                         self.vi_history.remove(0);
                     }
                 }
                 self.vi_submit(&line)
             }
             cce_ui::widget::EditOutcome::Cancel => {
                 self.vi_set_mode(vi::Mode::Normal);
                 None
             }
             _ => None,
         }
     }
 
     fn vi_submit(&mut self, line: &str) -> Option<Message> {
         match self.vi_prompt {
             vi::Prompt::Search | vi::Prompt::SearchBack => {
                 // An empty search repeats the last one, as in vim.
                 let text = Some(line.to_string()).filter(|l| !l.is_empty()).or_else(|| self.vi_search.clone());
                 if let Some(text) = text {
                     self.host.find(&text, self.vi_prompt == vi::Prompt::SearchBack);
                     self.vi_search = Some(text);
                     self.vi_searching = true;
                 }
                 None
             }
             vi::Prompt::Command => match vi::parse_command(line) {
                 Ok(vi::Cmd::Run(action)) => self.vi_run(action, None),
                 Ok(vi::Cmd::Open { target, tab, background }) => {
                     match parse_url_input(&target, &self.settings.search_prefix) {
                         Some(url) if background => self.open_background_tab(url),
                         Some(url) if tab => {
                             self.host.open_tab(url);
                             self.sync_page_state();
                             self.persist_session();
                         }
                         Some(url) => {
                             self.host.load(url);
                             self.loading = true;
                         }
                         None => self.vi_say(format!("Cannot open {target}")),
                     }
                     None
                 }
                 // Like closing the window: the tabs are kept for next time.
                 Ok(vi::Cmd::Quit) => Some(Message::Quit),
                 Ok(vi::Cmd::Empty) => None,
                 Err(why) => {
                     self.vi_say(why);
                     None
                 }
             },
         }
     }
 
     /// Where the status line goes: the bottom-left corner, clear of the
     /// dot (which is on the right), lifted over a bottom bar while it shows.
     fn vi_line_rect(&self, width: f32) -> Rect {
         let mut y = self.win.1 - bar_margin() - VI_LINE_H;
         if self.settings.bar_position == settings::BarPosition::Bottom && self.chrome_ease() > 0.0 {
             y = y.min(self.chrome_plate().0.y - item_gap() - VI_LINE_H);
         }
         let width = width.min(self.win.0 - 2.0 * bar_margin()).max(0.0);
         Rect { x: bar_margin(), y, width, height: VI_LINE_H }
     }
 
     /// Hint labels over the page, and the status line: the mode, pending
     /// keys, a message, or the `:` line being typed. Normal mode with
     /// nothing to say draws nothing — the chrome stays a dot.
     fn paint_vi(&mut self, pc: &mut PaintCtx, sans: &str) {
         if !self.settings.vi_mode {
             return;
         }
         if self.vi_mode == vi::Mode::Hint {
             let typed = self.vi_hint_typed.clone();
             let typed_w = measure_text_width(&typed, sans, HINT_FONT);
             for h in self.vi_hints.iter().filter(|h| h.label.starts_with(&typed)) {
                 let w = measure_text_width(&h.label, sans, HINT_FONT) + 8.0;
                 let x = h.rect.0.clamp(0.0, (self.win.0 - w).max(0.0));
                 let y = h.rect.1.clamp(0.0, (self.win.1 - HINT_H).max(0.0));
                 pc.rounded_rect(
                     Rect { x: x - 1.0, y: y - 1.0, width: w + 2.0, height: HINT_H + 2.0 },
                     5.0,
                     (true, true, true, true),
                     HINT_RIM,
                 );
                 pc.rounded_rect(Rect { x, y, width: w, height: HINT_H }, 4.0, (true, true, true, true), HINT_BG);
                 let ty = cce_ui::layout::align_text_y(y, HINT_H, HINT_FONT, 0.0);
                 if !typed.is_empty() {
                     pc.text(typed.clone(), x + 4.0, ty, HINT_FONT, HINT_TYPED);
                 }
                 pc.text(h.label[typed.len()..].to_string(), x + 4.0 + typed_w, ty, HINT_FONT, HINT_TEXT);
             }
         }
 
         let material = cce_ui::scene::Material::opaque([0.13, 0.14, 0.16, 1.0]);
         let bevel = cce_ui::layout::bevel_width().min(3.0);
         if self.vi_mode == vi::Mode::Command {
             let r = self.vi_line_rect((self.win.0 * 0.5).clamp(320.0, 720.0));
             pc.plate(r, (8.0, 8.0, 8.0, 8.0), &material, bevel);
             let sigil = self.vi_prompt.sigil().to_string();
             let x = r.x + text_pad();
             let ty = cce_ui::layout::align_text_y(r.y, r.height, URL_FONT, 0.0);
             // What the field shows: an input method's composition at the
             // caret, underlined (`FieldMarks`, as every chrome field).
             let marks = FieldMarks::of(&mut self.font_system, &self.vi_cmd);
             let tx = x + measure_text_width(&sigil, sans, URL_FONT) + 3.0;
             let caret_rect = Rect { x: tx + marks.caret, y: r.y + 5.0, width: 1.0, height: r.height - 10.0 };
             pc.clip(r, |pc| {
                 pc.text(sigil, x, ty, URL_FONT, [150, 190, 240]);
                 if let Some((x0, x1)) = marks.selection {
                     pc.quad(Rect { x: tx + x0, y: r.y + 5.0, width: x1 - x0, height: r.height - 10.0 }, SEL_BG);
                 }
                 pc.text(marks.shown.clone(), tx, ty, URL_FONT, TEXT);
                 if let Some((x0, x1)) = marks.composition {
                     pc.quad(Rect { x: tx + x0, y: r.y + r.height - 6.0, width: x1 - x0, height: 1.0 }, CARET);
                 }
                 pc.quad(caret_rect, [0.85, 0.87, 0.92, 1.0]);
             });
             report_caret(caret_rect);
             return;
         }
 
         let (text, color) = if let Some((msg, _)) = &self.vi_msg {
             (msg.clone(), TEXT)
         } else {
             let keys = self.vi_keys.shown();
             match self.vi_mode.label() {
                 Some(label) => (label.to_string(), [150, 190, 240]),
                 None if !keys.is_empty() => (keys, TEXT),
                 None => return,
             }
         };
         let avail = self.win.0 - 2.0 * bar_margin() - 2.0 * text_pad();
         let text = Self::fit_text(&text, sans, VI_FONT, avail);
         let r = self.vi_line_rect(measure_text_width(&text, sans, VI_FONT) + 2.0 * text_pad());
         pc.plate(r, (8.0, 8.0, 8.0, 8.0), &material, bevel);
         pc.text(
             text,
             r.x + text_pad(),
             cce_ui::layout::align_text_y(r.y, r.height, VI_FONT, 0.0),
             VI_FONT,
             color,
         );
     }
 }
 
 impl BrowserApp {
     /// When GLib next needs a pump nothing else will cause: its own timeout
     /// as of the last pump, or a heartbeat while one is needed (no fd
     /// watched, or the deadlock watch running). `None`: sleep until an
     /// event — an idle static page used to be pumped four times a second
     /// regardless (a fixed timer, 100 ms when GLib asked for no timeout and
     /// never more than 250 ms, re-armed from the timeout of the pump BEFORE
     /// the one it triggered).
     #[cfg(feature = "wpe")]
     fn next_glib_pump(&self) -> Option<std::time::Instant> {
         const HEARTBEAT: std::time::Duration = std::time::Duration::from_millis(250);
         let heartbeat = (!self.glib_fd_watched || self.host.wants_heartbeat()).then(|| self.last_pump + HEARTBEAT);
         match (self.host.glib_deadline(), heartbeat) {
             (Some(a), Some(b)) => Some(a.min(b)),
             (a, b) => a.or(b),
         }
     }
 }
 
 impl Application for BrowserApp {
     type Message = Message;
 
     fn create(sender: cce_ui::engine::AppSender<Self::Message>) -> Self {
         // The app keeps calloop's sender; `AppSender` converts into it.
         let sender: calloop::channel::Sender<Self::Message> = sender.into();
         // Serve the instance socket claimed in main(), if this launch won it.
         instance::spawn_listener(sender.clone());
         let settings = settings::load();
         downloads::set_download_dir(settings.download_dir.clone());
         // Optional CLI arg: the start URL (same parsing as the URL bar).
         let arg = std::env::args()
             .nth(1)
             .and_then(|arg| parse_startup_arg(&arg, &settings.search_prefix));
         // The previous run's tabs. When there are some, they come back in
         // order and an argv URL opens as an extra tab on top of them —
         // otherwise the argument (or the configured homepage) is the one
         // starting tab, as before session restore existed.
         let mut session = session::Session::new();
         let (saved, saved_active) = session.load();
         let restored = !saved.is_empty();
         let mut queue = saved;
         if queue.is_empty() {
             queue.push(
                 arg.clone()
                     .or_else(|| parse_url_input(&settings.homepage, &settings.search_prefix))
                     .unwrap_or_else(|| {
                         Url::parse(settings::DEFAULT_HOMEPAGE).expect("home url")
                     }),
             );
         }
         let first = queue.remove(0);
 
         #[cfg(all(not(feature = "wpe"), feature = "servo"))]
         let mut host =
             Host::new(sender.clone(), first, (1200, 800), settings.color_scheme.forces_dark());
         #[cfg(feature = "wpe")]
         let mut host = {
             let _ = &sender; // WPE wakes through register_sources, not a waker
             Host::new(first, (1200, 800))
         };
         for url in queue {
             host.open_tab(url);
         }
         if restored {
             host.activate(saved_active.min(host.tab_count() - 1));
             if let Some(url) = arg {
                 host.open_tab(url);
             }
         }
         // The bar mirrors whichever tab ended up active.
         let url_text = host
             .url()
             .map(|u| u.to_string())
             .filter(|s| s != "about:blank")
             .unwrap_or_default();
         host.set_history_enabled(settings.history);
         host.set_color_scheme_dark(settings.color_scheme.is_dark());
         #[cfg(feature = "wpe")]
         host.set_force_dark(settings.color_scheme.forces_dark());
         #[cfg(feature = "wpe")]
         host.set_accounts_enabled(settings.accounts);
         host.set_vi_enabled(settings.vi_mode);
         let accounts = accounts::Accounts::spawn(sender.clone());
         let raindrop_on = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(settings.raindrop));
         let raindrop_started = settings.raindrop;
         if raindrop_started {
             raindrop::sync::spawn(host.bookmarks(), raindrop_on.clone());
         }
         let favorites = host.favorites();
         let favs = favorites.snapshot();
         let bookmarks = host.bookmarks();
         Self {
             host,
             seen_renderer: false,
             settings,
             win: (1200.0, 800.0),
             scale: 1.0,
             pointer: (0.0, 0.0),
             page_buttons: Vec::new(),
             url: cce_ui::widget::LineEdit::with_text(url_text),
             url_focused: false,
             url_entry_press: false,
             shift_held: false,
             chrome_open: false,
             chrome_t: 0.0,
             chrome_peek: None,
             #[cfg(feature = "wpe")]
             page_press_settle: None,
             peek_pointer: (0.0, 0.0),
             dot_hover: false,
             loading: true,
             title: None,
             #[cfg(feature = "wpe")]
             modal: None,
             #[cfg(feature = "wpe")]
             ctx_menu: None,
             #[cfg(feature = "wpe")]
             opt_menu: None,
             #[cfg(feature = "wpe")]
             sender,
             font_system: cce_ui::create_font_system(),
             ime_field: None,
             session,
             favorites,
             favs,
             fav_hover: None,
             bookmarks,
             bm_menu: None,
             scroll: cce_ui::widget::scroll_motion::ScrollMotion::new(),
             scroll_sent: (0.0, 0.0),
             accounts,
             never_save: accounts::NeverSave::load(),
             raindrop_on,
             raindrop_started,
             #[cfg(feature = "wpe")]
             save_offer: None,
             #[cfg(feature = "wpe")]
             frame_offsets: std::collections::HashMap::new(),
             #[cfg(feature = "wpe")]
             last_field: None,
             #[cfg(feature = "wpe")]
             ac_menu: None,
             nav_url: None,
             scroll_origin: None,
             url_new_tab: false,
             closed_tabs: Vec::new(),
             vi_mode: vi::Mode::Normal,
             vi_keys: vi::Keys::default(),
             vi_hints: Vec::new(),
             vi_hint_kind: vi::HintKind::Follow,
             vi_hint_typed: String::new(),
             vi_pending: None,
             vi_tag: 0,
             vi_cmd: cce_ui::widget::LineEdit::default(),
             vi_prompt: vi::Prompt::Command,
             vi_history: Vec::new(),
             vi_history_at: None,
             vi_msg: None,
             vi_click: None,
             vi_swallowed: Vec::new(),
             vi_search: None,
             vi_searching: false,
             #[cfg(feature = "wpe")]
             glib_fd_watched: false,
             #[cfg(feature = "wpe")]
             last_pump: std::time::Instant::now(),
             #[cfg(feature = "wpe")]
             spin_queued: false,
         }
     }
 
     /// Wake on GLib activity rather than polling for it.
     ///
     /// Servo pushed `Message::Spin` into calloop from its own threads; WPE
     /// runs a GLib main context, so we register the epoll fd carrying its
     /// pollfd set; it fires `Spin`, which lands in `update` and calls `pump`
     /// — the same path the Servo waker used. GLib's own timeouts, which no
     /// fd reports, are kept by the runner's idle sleep instead
     /// (`idle_poll_interval` / `tick`, from [`Self::next_glib_pump`]).
     #[cfg(feature = "wpe")]
     fn register_sources(&mut self, handle: &calloop::LoopHandle<'_, EngineState<Self>>) {
         use calloop::{generic::Generic, Interest, Mode, PostAction};
 
         if let Some(fd) = self.host.poll_fd_owned() {
             let tx = self.sender.clone();
             // Level-triggered: `pump` drains the epoll, so an un-consumed
             // socket re-arms rather than being missed.
             let source = Generic::new(fd, Interest::READ, Mode::Level);
             match handle.insert_source(source, move |_, _, _| {
                 let _ = tx.send(Message::Spin);
                 Ok(PostAction::Continue)
             }) {
                 Ok(_) => self.glib_fd_watched = true,
                 Err(e) => log::warn!("could not watch the GLib fd ({e}); pumping on the heartbeat alone"),
             }
         }
         // The first pump, which sets GLib's first deadline.
         self.spin_queued = true;
         let _ = self.sender.send(Message::Spin);
     }
 
 
     fn settings(&self) -> WindowSettings {
         WindowSettings {
             title: self.title.clone().unwrap_or_else(|| "Browser".to_string()),
             app_id: "cce-browser".to_string(),
             width: 1200,
             height: 800,
             fullscreen: false,
             min_size: Some((480, 320)),
         }
     }
 
     fn update(&mut self, msg: Self::Message, needs_rebuild: &mut bool, exit: &mut bool) {
         match msg {
             Message::Spin => {
                 #[cfg(feature = "wpe")]
                 {
                     self.spin_queued = false;
                     self.last_pump = std::time::Instant::now();
                 }
                 let (new_frame, dirty) = self.host.pump();
                 // A page field opening or closing has to reach the frame
                 // that claims it, even when the page repaints nothing.
                 #[cfg(feature = "wpe")]
                 if self.host.take_page_text_field_changed() {
                     *needs_rebuild = true;
                 }
                 #[cfg(feature = "wpe")]
                 if self.settle_page_press() {
                     *needs_rebuild = true;
                 }
                 #[cfg(feature = "wpe")]
                 if self.sync_modal() {
                     *needs_rebuild = true;
                 }
                 #[cfg(feature = "wpe")]
                 if let Some(info) = self.host.take_context_menu() {
                     self.open_ctx_menu(info);
                     *needs_rebuild = true;
                 }
                 #[cfg(feature = "wpe")]
                 if let Some(info) = self.host.take_option_menu() {
                     self.open_opt_menu(info);
                     *needs_rebuild = true;
                 }
                 // The page closed the list itself: the select went away, or
                 // the page navigated.
                 #[cfg(feature = "wpe")]
                 if self.opt_menu.is_some() && !self.host.option_menu_open() {
                     self.opt_menu = None;
                     *needs_rebuild = true;
                 }
                 #[cfg(feature = "wpe")]
                 for url in self.host.take_background_opens() {
                     self.open_background_tab(url);
                     *needs_rebuild = true;
                 }
                 if self.settle_peek() {
                     *needs_rebuild = true;
                 }
                 if self.host.take_download_started() {
                     self.open_internal_page("cce://downloads");
                 }
                 if dirty {
                     // A navigation retires whatever field was focused and
                     // whatever glide was in flight. Only a real one: the URL
                     // changing, not the dirty flag, which also fires while the
                     // page that owns them is still settling.
                     let now = self.host.url().map(|u| u.to_string());
                     if now != self.nav_url {
                         self.nav_url = now;
                         self.stop_scroll();
                         // A load, not a pushState: a search field rewriting
                         // the address on every keystroke must not lose the
                         // keyboard to it.
                         if self.host.loading() {
                             self.vi_page_changed();
                         }
                         #[cfg(feature = "wpe")]
                         {
                             self.ac_menu = None;
                             self.frame_offsets.clear();
                             self.last_field = None;
                         }
                     }
                     self.sync_page_state();
                     // Navigation reaches the tab set through these signals,
                     // so this is where an address change gets persisted.
                     self.persist_session();
                 }
                 if self.vi_drain() {
                     *needs_rebuild = true;
                 }
                 // Drained after the navigation check, so a field reported in
                 // the same pump that finished the load is not thrown away
                 // with the page it arrived on.
                 #[cfg(feature = "wpe")]
                 while let Some(event) = self.host.take_form_event() {
                     if self.on_form_event(event) {
                         *needs_rebuild = true;
                     }
                 }
                 if new_frame || dirty {
                     *needs_rebuild = true;
                 }
             }
             Message::Accounts(result) => {
                 match &result {
                     Ok(list) => log::info!("accounts: {} entries from the keyring", list.len()),
                     Err(e) => log::warn!("accounts unavailable: {e}"),
                 }
                 self.accounts.loaded(result);
                 // A field may have been focused while the index was still
                 // being read; this is when its list can finally open. The
                 // chrome replays its own copy of that report — the frame it
                 // came from may be one it cannot run script in.
                 #[cfg(feature = "wpe")]
                 {
                     if let Some(wpe::FormEvent::Field {
                         origin, frame, top, password, rect, value, ..
                     }) = self.last_field.take()
                     {
                         let replay = wpe::FormEvent::Field {
                             origin, frame, top, password, rect, value, moved: false,
                         };
                         self.on_form_event(replay);
                     }
                     // And a sign-in may be waiting to learn whether it is new.
                     self.resolve_save();
                     *needs_rebuild = true;
                 }
             }
             Message::Saved(result) => {
                 #[cfg(feature = "wpe")]
                 {
                     match result {
                         Ok(label) => {
                             log::info!("accounts: saved a login as \"{label}\"");
                             self.save_offer = None;
                             // The next login field reads the index again, new
                             // entry and all.
                             self.accounts.invalidate();
                         }
                         Err(why) => {
                             log::warn!("accounts: {why}");
                             if let Some(o) = self.save_offer.as_mut() {
                                 o.stage = SaveStage::Failed(why);
                             }
                         }
                     }
                     *needs_rebuild = true;
                 }
                 #[cfg(not(feature = "wpe"))]
                 {
                     let _ = result;
                 }
             }
             Message::Credential(path, secret) => {
                 #[cfg(feature = "wpe")]
                 {
                     self.fill_account(&path, &secret);
                     *needs_rebuild = true;
                 }
                 #[cfg(not(feature = "wpe"))]
                 {
                     let _ = (path, secret);
                 }
             }
             Message::Quit => *exit = true,
             Message::OpenExternal(arg) => {
                 match arg {
                     Some(arg) => {
                         // Same parsing as the launch argument, and for the
                         // same reason: this *is* one, relayed.
                         if let Some(url) = parse_startup_arg(&arg, &self.settings.search_prefix) {
                             self.host.open_tab(url);
                             self.url_focused = false;
                             self.sync_page_state();
                             self.persist_session();
                         }
                     }
                     None => self.new_tab(),
                 }
                 // Bring the window to the user: focus + camera pan + raise
                 // over the control socket. A fresh launch used to get this
                 // from the compositor for free; without it the tab opens in
                 // a window parked somewhere off-camera and the click looks
                 // like it did nothing. (xdg-activation is not the route: the
                 // compositor deliberately answers it with an attention
                 // notification, not focus.)
                 std::thread::spawn(|| {
                     let _ = cce_ui::ipc::focus_window("cce-browser");
                 });
                 *needs_rebuild = true;
             }
         }
     }
 
     /// The DE's undo chord (`input.kdl`, Ctrl+Z by default), offered here by
     /// the runner before it becomes a key: it undoes typing in whichever
     /// field has the keyboard — a dialog's focused field, else the URL bar.
     /// With neither, or nothing to undo, false lets the chord go on as a key,
     /// which is how Ctrl+Z still reaches a web page's own editor.
     fn undo(&mut self, needs_rebuild: &mut bool) -> bool {
         let done = self.focused_edit().is_some_and(|e| e.undo());
         if done && self.bm_search_has_keyboard() {
             self.bm_query_changed();
         }
         *needs_rebuild |= done;
         done
     }
 
     /// Redo — see [`undo`](Self::undo).
     fn redo(&mut self, needs_rebuild: &mut bool) -> bool {
         let done = self.focused_edit().is_some_and(|e| e.redo());
         if done && self.bm_search_has_keyboard() {
             self.bm_query_changed();
         }
         *needs_rebuild |= done;
         done
     }
 
     /// The line fields, for a screen reader: the address bar, and while they are up the
     /// bookmarks search, the vi command line and a dialog with its fields. Each is a text
     /// field a reader reads by character and line and sets (`accessibility_action`).
     fn accessibility(&mut self, nodes: &mut cce_ui::a11y::AppNodes) {
         use cce_ui::a11y::AppNodes;
         let has = self.keyboard_field();
         let focus = |field| (has == Some(field)).then(|| a11y_node(field));
         let mut focused = None;
 
         let bar = self.chrome_open.then(|| url_rect(&self.bar(), self.settings.bar_position));
         let mut t = self.url.a11y_text(has == Some(LineField::Url));
         t.placeholder = Some("Search or enter address".into());
         let url = nodes.text_field(a11y_node(LineField::Url), "Address", &t, bar);
         nodes.push_top(AppNodes::id(a11y_node(LineField::Url)), url);
         focused = focused.or(focus(LineField::Url));
 
         if let Some(m) = self.bm_menu.as_ref() {
             let mut t = m.query.a11y_text(has == Some(LineField::BmSearch));
             t.placeholder = Some("Search bookmarks".into());
             let rect = self.bm_layout().map(|l| l.search);
             let search = nodes.text_field(a11y_node(LineField::BmSearch), "Search bookmarks", &t, rect);
             nodes.push_top(AppNodes::id(a11y_node(LineField::BmSearch)), search);
             focused = focused.or(focus(LineField::BmSearch));
         }
         if self.settings.vi_mode && self.vi_mode == vi::Mode::Command {
             let label = if self.vi_prompt == vi::Prompt::Command { "Command" } else { "Find in page" };
             let line = nodes.text_field(a11y_node(LineField::ViCmd), label, &self.vi_cmd.a11y_text(has == Some(LineField::ViCmd)), None);
             nodes.push_top(AppNodes::id(a11y_node(LineField::ViCmd)), line);
             focused = focused.or(focus(LineField::ViCmd));
         }
         #[cfg(feature = "wpe")]
         if let Some(m) = self.modal.as_ref() {
             // The dialog, modal, its fields inside it: a reader keeps to it, as the keyboard does.
             let rect = m.rect(self.win);
             let mut dialog = cce_ui::accesskit::Node::new(cce_ui::accesskit::Role::Dialog);
             dialog.set_modal();
             if !m.title.is_empty() {
                 dialog.set_label(m.title.as_str());
             }
             if !m.message.is_empty() {
                 dialog.set_description(m.message.as_str());
             }
             let mut children = Vec::new();
             for (i, (label, edit)) in m.fields.iter().enumerate() {
                 let field = LineField::Dialog(i);
                 let mut t = edit.a11y_text(has == Some(field));
                 t.placeholder = Some((*label).to_string());
                 let node = nodes.text_field(a11y_node(field), label, &t, Some(m.field_rect(&rect, i)));
                 nodes.push(AppNodes::id(a11y_node(field)), node);
                 children.push(AppNodes::id(a11y_node(field)));
                 focused = focused.or(focus(field));
             }
             dialog.set_children(children);
             nodes.push_top(AppNodes::id(A11Y_DIALOG), dialog);
         }
         if let Some(n) = focused {
             nodes.set_focus(AppNodes::id(n));
         }
     }
 
     /// A reader's request on a line field: its keyboard, or a new text — set as typing it
     /// would be, the bookmarks list following its search. The address bar takes the
     /// keyboard to be set (unfolding the bar), since out of it the bar shows the page's
     /// address; Enter then goes where it says, as after typing.
     fn accessibility_action(&mut self, n: u64, action: cce_ui::a11y::AppAction) -> bool {
         use cce_ui::a11y::AppAction;
         let Some(field) = a11y_field(n) else { return false };
         let focus = |app: &mut Self| match field {
             LineField::Url => {
                 if !app.url_focused {
                     app.open_chrome();
                     app.url_focused = true;
                     app.url_new_tab = false;
                     app.select_all_url();
                 }
             }
             #[cfg(feature = "wpe")]
             LineField::Dialog(i) => {
                 if let Some(m) = app.modal.as_mut() {
                     m.focused = i;
                 }
             }
             // The keyboard is already the open menu's or the command line's.
             LineField::BmSearch | LineField::ViCmd => {}
         };
         match action {
             AppAction::Focus => {
                 focus(self);
                 true
             }
             AppAction::SetText(text) => {
                 focus(self);
                 let Some(edit) = self.line_field(field) else { return false };
                 let changed = edit.a11y_set_text(&text);
                 if changed && field == LineField::BmSearch {
                     self.bm_query_changed();
                 }
                 changed
             }
             _ => false,
         }
     }
 
     fn tick(&mut self, dt: f32, needs_rebuild: &mut bool) {
         // GLib's deadline (or the heartbeat) has come: pump. Through the
         // sender, so the pump runs in `update` like every other.
         #[cfg(feature = "wpe")]
         if !self.spin_queued && self.next_glib_pump().is_some_and(|t| t <= std::time::Instant::now()) {
             self.spin_queued = true;
             let _ = self.sender.send(Message::Spin);
         }
         // The page's wheel glide, one frame's worth. It feeds the engine, so
         // the frame it produces is what actually redraws; asking for a
         // rebuild here is what keeps the loop turning until it lands.
         if self.advance_scroll(dt) {
             *needs_rebuild = true;
         }
         let target = if self.chrome_open { 1.0 } else { 0.0 };
         if self.chrome_t != target {
             self.chrome_t = chrome_step(self.chrome_t, target, dt, cce_ui::motion::enabled());
             // Keeps the runner's warm loop alive until the morph lands.
             *needs_rebuild = true;
         }
     }
 
     /// Sleep no longer than GLib's next deadline (`next_glib_pump`); the
     /// `tick` that wakes then sends the pump.
     #[cfg(feature = "wpe")]
     fn idle_poll_interval(&self) -> Option<std::time::Duration> {
         self.next_glib_pump()
             .map(|t| t.saturating_duration_since(std::time::Instant::now()).max(std::time::Duration::from_millis(1)))
     }
 
     fn handle_focus_change(&mut self, focused: bool, needs_rebuild: &mut bool) {
         // The page's own focus: without it WebKit paints no text caret.
         self.host.focus(focused);
         // Keys and buttons released while another window had focus never
         // reach us; forget them rather than act on a stale Shift or drag.
         if !focused {
             self.shift_held = false;
             self.vi_swallowed.clear();
             // A select's list is a transient of the page, and goes with focus
             // as a native one does.
             #[cfg(feature = "wpe")]
             self.close_opt_menu();
             if self.url.dragging() {
                 self.url.release();
                 self.url_entry_press = false;
             }
             #[cfg(feature = "wpe")]
             if let Some(m) = self.modal.as_mut() {
                 for (_, edit) in m.fields.iter_mut() {
                     edit.release();
                 }
             }
             if let Some(m) = self.bm_menu.as_mut() {
                 m.query.release();
             }
         }
         // A settings change can move the bar to the other edge, so a reload
         // that changed anything has to redraw the chrome.
         if focused && self.reload_settings() {
             *needs_rebuild = true;
         }
     }
 
     fn handle_resize(&mut self, width: f32, height: f32, scale: f64) {
         // The select the list hangs from is about to move.
         #[cfg(feature = "wpe")]
         if self.win != (width, height) {
             self.close_opt_menu();
         }
         if self.win != (width, height) && self.vi_mode == vi::Mode::Hint {
             self.vi_set_mode(vi::Mode::Normal);
         }
         self.win = (width, height);
         self.scale = scale;
         let (w, h) = self.content_px();
         self.host.resize(w, h, scale as f32);
     }
 
     /// Re-paint the page when the renderer is replaced.
     ///
     /// The tab images are **renderer** ids, and a renderer does not outlive
     /// its session — `window_runner` rebuilds it around the same
     /// `Application` after a lost Wayland transport, and a draw for an
     /// unknown id is skipped rather than reported. See
     /// `Host::renderer_replaced` for why dropping the ids is only half of it.
     ///
     /// Not on the first renderer: no page has rendered yet, and remapping the
     /// view before the first frame would only make the engine repeat work.
     fn renderer_init(&mut self, _renderer: &mut cce_ui::vk::VkRenderer) {
         if std::mem::replace(&mut self.seen_renderer, true) {
             log::info!("[browser] renderer replaced; re-painting the page");
             self.host.renderer_replaced();
         }
     }
 
     fn handle_pointer_move(&mut self, pos: LogicalPosition, _needs_rebuild: &mut bool) {
         self.pointer = (pos.x, pos.y);
         // A drag that began in the URL field owns the pointer until the
         // release, wherever it goes: past either end of the field it selects
         // to that end, and the page never sees the motion.
         #[cfg(feature = "wpe")]
         if let Some(i) = self
             .modal
             .as_ref()
             .and_then(|m| m.fields.iter().position(|(_, e)| e.dragging()))
         {
             if let Some(at) = self.modal_index_at(i, pos.x) {
                 if let Some(m) = self.modal.as_mut() {
                     if m.fields[i].1.drag_to(at) {
                         *_needs_rebuild = true;
                     }
                 }
             }
             return;
         }
         if self.url.dragging() {
             let field = url_rect(&self.bar(), self.settings.bar_position);
             let at = self.cursor_from_click(pos.x, &field);
             if self.url.drag_to(at) {
                 // Moved: the press is a drag, not the click that selects all.
                 self.url_entry_press = false;
                 *_needs_rebuild = true;
             }
             return;
         }
         // A select's list moves its highlight onto a row the pointer could
         // pick; off the rows it stays where it was, as a native list's does.
         // The page under it sees no moves.
         #[cfg(feature = "wpe")]
         if self.opt_menu.is_some() {
             let over = self
                 .opt_hit(pos.x, pos.y)
                 .filter(|&i| self.opt_menu.as_ref().is_some_and(|m| m.pickable(i)));
             if let (Some(i), Some(m)) = (over, self.opt_menu.as_mut()) {
                 if m.highlight != Some(i) {
                     m.highlight = Some(i);
                     *_needs_rebuild = true;
                 }
             }
             return;
         }
         #[cfg(feature = "wpe")]
         if self.ctx_menu.is_some() {
             // Hover highlight tracks the pointer; the page underneath does
             // not see moves while the menu is up.
             *_needs_rebuild = true;
             return;
         }
         // The account list tracks hover the same way, and shields the page
         // under it.
         #[cfg(feature = "wpe")]
         if self.ac_menu.is_some() {
             let over = self.ac_hit(pos.x, pos.y);
             if self.ac_menu.as_ref().is_some_and(|m| m.hover != over) {
                 if let Some(m) = self.ac_menu.as_mut() {
                     m.hover = over;
                 }
                 *_needs_rebuild = true;
             }
             if over.is_some() {
                 return;
             }
         }
 
         // An open bookmarks menu tracks hover, and the page under it sees
         // no moves at all.
         if self.bm_menu.is_some() {
             if self.bm_menu.as_ref().is_some_and(|m| m.query.dragging()) {
                 if let Some(at) = self.bm_query_index_at(pos.x) {
                     if self.bm_menu.as_mut().is_some_and(|m| m.query.drag_to(at)) {
                         *_needs_rebuild = true;
                     }
                 }
                 return;
             }
             let h = self.bm_hit(pos.x, pos.y);
             if self.bm_menu.as_ref().is_some_and(|m| m.hover != h) {
                 if let Some(m) = self.bm_menu.as_mut() {
                     m.hover = h;
                 }
                 *_needs_rebuild = true;
             }
             return;
         }
 
         let over_dot = self.dot_hit(pos.x, pos.y);
         if over_dot != self.dot_hover {
             self.dot_hover = over_dot;
             *_needs_rebuild = true;
         }
         let over_fav = if self.chrome_open && !self.favs.is_empty() {
             let bar = self.bar();
             self.fav_rects(&bar).iter().position(|r| r.contains(pos.x, pos.y))
         } else {
             None
         };
         if over_fav != self.fav_hover {
             self.fav_hover = over_fav;
             *_needs_rebuild = true;
         }
         if !self.chrome_hit(pos.x, pos.y) {
             let s = self.scale as f32;
             self.host.mouse_move(pos.x * s, pos.y * s);
         }
     }
 
     fn handle_mouse_input(
         &mut self,
         button: MouseButton,
         state: ElementState,
         pos: LogicalPosition,
         needs_rebuild: &mut bool,
     ) -> Option<Self::Message> {
         let pressed = state == ElementState::Pressed;
 
         // A click ends hinting (the labels no longer match what is under
         // them once anything moves) and the `:` line, as a click off any
         // other field drops it.
         if pressed && matches!(self.vi_mode, vi::Mode::Hint | vi::Mode::Command) {
             self.vi_set_mode(vi::Mode::Normal);
             *needs_rebuild = true;
         }
 
         // Before any of the branches that swallow a click: a button the page
         // is holding gets its release no matter where it was let go, or the
         // engine goes on believing it is still down.
         if !pressed {
             self.drain_page_release(button, pos);
         }
 
         // The end of a drag in the URL field, wherever the pointer is now.
         if !pressed && button == MouseButton::Left && self.url.dragging() {
             self.url.release();
             if std::mem::take(&mut self.url_entry_press) {
                 self.select_all_url();
             }
             *needs_rebuild = true;
             return None;
         }
 
         #[cfg(feature = "wpe")]
         if self.modal.is_some() {
             // The end of a drag in a dialog field, wherever the pointer is.
             if !pressed && button == MouseButton::Left {
                 if let Some(m) = self.modal.as_mut() {
                     for (_, edit) in m.fields.iter_mut() {
                         edit.release();
                     }
                 }
                 return None;
             }
             if !pressed || button != MouseButton::Left {
                 return None;
             }
             *needs_rebuild = true;
             let (hit_ok, hit_cancel, field) = {
                 let m = self.modal.as_ref().unwrap();
                 let r = m.rect(self.win);
                 let (ok, cancel) = m.button_rects(&r);
                 (
                     ok.contains(pos.x, pos.y),
                     cancel.is_some_and(|c| c.contains(pos.x, pos.y)),
                     (0..m.fields.len()).find(|&i| m.field_rect(&r, i).contains(pos.x, pos.y)),
                 )
             };
             if hit_ok {
                 self.close_modal(true);
             } else if hit_cancel {
                 self.close_modal(false);
             } else if let Some(i) = field {
                 // A press places the caret and starts a drag; Shift extends
                 // the selection — in the field that already had focus.
                 let at = self.modal_index_at(i, pos.x);
                 let shift = self.shift_held;
                 if let (Some(at), Some(m)) = (at, self.modal.as_mut()) {
                     let extend = shift && m.focused == i;
                     m.focused = i;
                     m.fields[i].1.press(at, extend);
                 }
             }
             // Anything else is swallowed: the page must not receive clicks
             // while it is blocked waiting on this.
             return None;
         }
 
         // An open select list owns the next click: on a row it picks, off the
         // plate it closes — clicking the select again included — and either
         // way the click goes no further.
         #[cfg(feature = "wpe")]
         if let Some(l) = self.opt_layout() {
             if pressed {
                 *needs_rebuild = true;
                 match self.opt_hit(pos.x, pos.y) {
                     Some(i) if button == MouseButton::Left => self.pick_opt(i),
                     _ if !l.plate.contains(pos.x, pos.y) => self.close_opt_menu(),
                     _ => {}
                 }
             }
             return None;
         }
 
         // An open context menu owns the next click: on an item it dispatches,
         // anywhere else it just closes — either way the click goes no further.
         #[cfg(feature = "wpe")]
         if let Some(menu) = self.ctx_menu.as_ref() {
             if pressed {
                 *needs_rebuild = true;
                 match (button, menu.item_at(pos.x, pos.y)) {
                     (MouseButton::Left, Some(i)) => self.dispatch_ctx_action(i),
                     _ => self.ctx_menu = None,
                 }
             }
             return None;
         }
 
         // The save offer takes any press on its plate, buttons or not; the
         // page under it never sees one. Presses elsewhere leave it waiting.
         #[cfg(feature = "wpe")]
         if self.save_layout().is_some_and(|l| l.plate.contains(pos.x, pos.y)) {
             if pressed && button == MouseButton::Left {
                 self.save_click(pos.x, pos.y);
             }
             *needs_rebuild = true;
             return None;
         }
 
         // A click on an account row picks it. A click anywhere else closes
         // the list and goes on to the page as usual — unlike the chrome's own
         // menus, this one sits over the page's own controls, and swallowing
         // the click that dismisses it would eat a button press.
         #[cfg(feature = "wpe")]
         if self.ac_menu.is_some() {
             if let Some(index) = self.ac_hit(pos.x, pos.y) {
                 if pressed && button == MouseButton::Left {
                     self.pick_account(index);
                 }
                 *needs_rebuild = true;
                 return None;
             }
             if pressed {
                 self.ac_menu = None;
                 *needs_rebuild = true;
             }
         }
 
         // The bookmarks menu owns the next click while it is open: a row
         // acts, a click off the plate closes it, and either way the click
         // goes no further — the rule the right-click menu already follows.
         if self.bm_menu.is_some() {
             if !pressed {
                 // The end of a drag in the search field, wherever it is.
                 if button == MouseButton::Left {
                     if let Some(m) = self.bm_menu.as_mut() {
                         m.query.release();
                     }
                 }
                 return None;
             }
             *needs_rebuild = true;
             let target = self.bm_hit(pos.x, pos.y);
             // The search field: a press places the caret and starts a drag,
             // Shift extends — the URL bar's rules.
             if target == Some(BmHit::Search) {
                 if button == MouseButton::Left {
                     let at = self.bm_query_index_at(pos.x);
                     let shift = self.shift_held;
                     if let (Some(at), Some(m)) = (at, self.bm_menu.as_mut()) {
                         m.query.press(at, shift);
                     }
                 }
                 return None;
             }
             let inside = self.bm_layout().is_some_and(|l| l.plate.contains(pos.x, pos.y));
             if target.is_some() {
                 self.bm_click(button, target);
             } else if !inside {
                 self.close_bm_menu();
             }
             return None;
         }
 
         let bar = self.bar();
         let pos_edge = self.settings.bar_position;
         if self.chrome_hit(pos.x, pos.y) {
             if !pressed || !matches!(button, MouseButton::Left | MouseButton::Middle) {
                 return None;
             }
             *needs_rebuild = true;
             // Using a bar that was only peeking makes it the person's.
             self.chrome_peek = None;
             // The corner control toggles the bar, open or closed.
             if self.dot_hit(pos.x, pos.y) {
                 if button == MouseButton::Left {
                     if self.chrome_open {
                         self.close_chrome();
                     } else {
                         self.open_chrome();
                     }
                 }
                 return None;
             }
             // Still folding shut: nothing under the plate is live.
             if !self.chrome_open {
                 return None;
             }
             // Tab strip: activate / close (x region or middle click) / new tab.
             let count = self.host.tab_count();
             for i in 0..count {
                 let pill = tab_rect(&bar, pos_edge, count, i);
                 if !pill.contains(pos.x, pos.y) {
                     continue;
                 }
                 let on_close =
                     tab_close_rect(&pill).is_some_and(|r| r.contains(pos.x, pos.y));
                 if button == MouseButton::Middle || on_close {
                     return self.close_tab(i);
                 }
                 self.switch_tab(i);
                 // Picking a tab is a menu choice: the bar folds away. Closing
                 // one is not — several may go in a row.
                 self.close_chrome();
                 return None;
             }
             // Favorites strip: a pill is a menu pick — load it here and fold
             // — or, middle-clicked, a new tab, with the bar left out so
             // several can be opened in a row.
             if let Some(i) = self.fav_rects(&bar).iter().position(|r| r.contains(pos.x, pos.y)) {
                 let Ok(url) = Url::parse(&self.favs[i].url) else { return None };
                 if button == MouseButton::Middle {
                     self.open_background_tab(url);
                 } else {
                     self.host.load(url);
                     self.loading = true;
                     self.close_chrome();
                     self.sync_page_state();
                 }
                 return None;
             }
             if button != MouseButton::Left {
                 return None;
             }
             if plus_rect(&bar, pos_edge).contains(pos.x, pos.y) {
                 self.new_tab();
             } else if btn_rect(&bar, 0).contains(pos.x, pos.y) {
                 self.host.back();
             } else if btn_rect(&bar, 1).contains(pos.x, pos.y) {
                 self.host.forward();
             } else if btn_rect(&bar, 2).contains(pos.x, pos.y) {
                 self.host.reload();
             } else if star_rect(&bar, pos_edge).contains(pos.x, pos.y) {
                 self.host.toggle_bookmark();
             } else if bm_btn_rect(&bar, pos_edge).contains(pos.x, pos.y) {
                 self.open_bm_menu();
             } else {
                 let field = url_rect(&bar, pos_edge);
                 if field.contains(pos.x, pos.y) {
                     let at = self.cursor_from_click(pos.x, &field);
                     // Entering the bar selects the whole URL, so typing
                     // replaces it instead of appending to it — on the
                     // release, if this press is not dragged (see
                     // `url_entry_press`). Inside the bar a press places the
                     // caret, Shift extends to it, and a drag selects.
                     self.url_entry_press = !self.url_focused;
                     let extend = self.url_focused && self.shift_held;
                     if !self.url_focused {
                         self.url_new_tab = false;
                     }
                     self.url_focused = true;
                     self.url.press(at, extend);
                 } else {
                     self.url_focused = false;
                     self.url.selection = None;
                 }
             }
             return None;
         }
 
         // Page area: a click folds the menu (and URL-bar focus with it),
         // then goes to the page. Not a peek, which folds on its own: a run
         // of middle-clicked links keeps it out rather than flapping it.
         if self.chrome_open && pressed && self.chrome_peek.is_none() {
             self.close_chrome();
             *needs_rebuild = true;
         }
         match button {
             MouseButton::Back if pressed => self.host.back(),
             MouseButton::Forward if pressed => self.host.forward(),
             _ => self.page_press(button, pressed, pos),
         }
         if button == MouseButton::Left && self.settings.vi_mode {
             if pressed {
                 self.vi_click = Some(std::time::Instant::now());
             } else if self.vi_mode == vi::Mode::Normal {
                 // Clicking a field that already had focus moves no focus,
                 // so the watcher has nothing to say; ask the page instead.
                 self.vi_ask(ViAsk::ClickCheck, &vi::active_editable_js());
             }
         }
         None
     }
 
     fn handle_mouse_wheel(&mut self, delta: &MouseScrollDelta, pos: LogicalPosition, needs_rebuild: &mut bool) {
         self.scroll_origin = None;
         // The labels would stay put while the page moved under them.
         if self.vi_mode == vi::Mode::Hint {
             self.vi_set_mode(vi::Mode::Normal);
             *needs_rebuild = true;
         }
         // A select's list takes the wheel: over it, it scrolls the list;
         // anywhere else it is swallowed, so the select stays under it.
         #[cfg(feature = "wpe")]
         if let Some(l) = self.opt_layout() {
             if l.plate.contains(pos.x, pos.y) {
                 // Positive is up, cce-ui's winit convention; three rows a
                 // notch, a row per row's height of finger travel.
                 let travel = match delta {
                     MouseScrollDelta::LineDelta(_, y) => -*y as f64 * 3.0,
                     MouseScrollDelta::PixelDelta(p) => -p.y / OPT_ROW_H as f64,
                 };
                 let Some(m) = self.opt_menu.as_mut() else { return };
                 m.wheel_rest += travel;
                 let rows = m.wheel_rest.trunc();
                 m.wheel_rest -= rows;
                 self.opt_scroll(rows as isize);
                 // The rows moved under a pointer that did not.
                 let over = self.opt_hit(pos.x, pos.y);
                 if let (Some(i), Some(m)) = (over, self.opt_menu.as_mut()) {
                     if m.pickable(i) {
                         m.highlight = Some(i);
                     }
                 }
                 *needs_rebuild = true;
             }
             return;
         }
         // The account list moves with its field, so the page keeps the
         // wheel — but not under the plate itself.
         #[cfg(feature = "wpe")]
         if self
             .ac_layout()
             .is_some_and(|(plate, _)| plate.contains(pos.x, pos.y))
         {
             return;
         }
 
         // An open menu takes the wheel: over its plate it scrolls the list,
         // anywhere else it is swallowed rather than scrolling the page
         // behind it.
         if self.bm_menu.is_some() {
             if self.bm_layout().is_some_and(|l| l.plate.contains(pos.x, pos.y)) {
                 let dy = match delta {
                     MouseScrollDelta::LineDelta(_, y) => *y as f64,
                     MouseScrollDelta::PixelDelta(p) => p.y,
                 };
                 self.bm_scroll(dy);
                 *needs_rebuild = true;
             }
             return;
         }
         if self.chrome_hit(pos.x, pos.y) {
             return;
         }
         // A wheel notch eases instead of jumping, through the same model
         // every other cce app scrolls by (`smooth_scroll` / `scroll_ease` in
         // input.kdl, this app's domain then `cce-ui`'s). Without it a notch
         // moved the page LINE_PX in one step, which is the browser feeling
         // unlike the rest of the desktop.
         //
         // Only a *notch* takes this path. A trackpad's pixel deltas already
         // follow the finger, and the engine runs its own kinetic scrolling off
         // the gesture phases this passes it — two coast models fighting over
         // one page would be worse than either.
         let discrete = matches!(delta, MouseScrollDelta::LineDelta(..));
         let phase = cce_ui::widget::scroll_motion::current_scroll_phase();
         if discrete
             && phase == cce_ui::widget::ScrollPhase::Wheel
             && cce_ui::widget::scroll_motion::scroll_settings().smooth
         {
             use cce_ui::widget::scroll_motion::Bounds;
             // Unbounded: the page's real limits are WebKit's business, and it
             // clamps. Notches arriving mid-glide accumulate into one movement
             // rather than a staircase.
             self.scroll.apply(
                 delta,
                 (LINE_PX as f32, LINE_PX as f32),
                 Bounds::UNBOUNDED,
                 Bounds::UNBOUNDED,
             );
             // Keeps the runner's loop warm until the glide lands, the same
             // way the chrome's unfold does.
             *needs_rebuild = true;
             return;
         }
 
         // WheelDelta keeps cce-ui's winit sign convention (positive = scroll
         // up); the engine inverts it into the scroll offset internally, after
         // the page has had its preventDefault chance.
         let (dx, dy) = match delta {
             MouseScrollDelta::LineDelta(x, y) => (*x as f64 * LINE_PX, *y as f64 * LINE_PX),
             MouseScrollDelta::PixelDelta(p) => (p.x, p.y),
         };
         let s = self.scale;
         self.host.wheel(dx * s, dy * s, pos.x * s as f32, pos.y * s as f32);
     }
 
     fn handle_key_input(&mut self, event: &KeyEvent, needs_rebuild: &mut bool) -> Option<Self::Message> {
         // Noted, never consumed: Shift still goes wherever keys go.
         if matches!(event.logical_key, Key::Named(NamedKey::Shift)) {
             self.shift_held = event.state == ElementState::Pressed;
         }
         // An open select list has the keyboard: arrows and paging move the
         // highlight, Enter (or Space, before any type-to-find) picks it,
         // Escape and Tab close, and letters find. Nothing reaches the page or
         // the chrome's chords while it is up.
         #[cfg(feature = "wpe")]
         if self.opt_menu.is_some() && event.state == ElementState::Pressed {
             *needs_rebuild = true;
             let cap = self.opt_layout().map_or(1, |l| l.cap) as isize;
             let typing = self.opt_menu.as_ref().is_some_and(|m| {
                 !m.typed.is_empty() && m.typed_at.elapsed() <= OPT_TYPE_RESET
             });
             let Some(m) = self.opt_menu.as_mut() else { return None };
             match &event.logical_key {
                 Key::Named(NamedKey::ArrowDown) => m.step(1),
                 Key::Named(NamedKey::ArrowUp) => m.step(-1),
                 Key::Named(NamedKey::PageDown) => m.step(cap - 1),
                 Key::Named(NamedKey::PageUp) => m.step(1 - cap),
                 Key::Named(NamedKey::End) => m.step(isize::MAX),
                 Key::Named(NamedKey::Home) => m.step(isize::MIN + 1),
                 Key::Named(NamedKey::Escape | NamedKey::Tab) => {
                     self.close_opt_menu();
                     return None;
                 }
                 Key::Named(NamedKey::Space) if !typing => {
                     if let Some(i) = m.highlight {
                         self.pick_opt(i);
                     }
                     return None;
                 }
                 Key::Named(NamedKey::Enter) => {
                     match m.highlight {
                         Some(i) => self.pick_opt(i),
                         None => self.close_opt_menu(),
                     }
                     return None;
                 }
                 _ if !event.ctrl && !event.alt => {
                     if let Some(text) = event.text.as_deref().filter(|t| !t.is_empty()) {
                         m.find_typed(text);
                     }
                 }
                 _ => {}
             }
             self.opt_reveal();
             return None;
         }
         #[cfg(feature = "wpe")]
         if self.ctx_menu.is_some() && event.state == ElementState::Pressed {
             // Any key dismisses; Escape is just the one people will mean.
             self.ctx_menu = None;
             *needs_rebuild = true;
             return None;
         }
 
         // A modal is exactly that: the page is blocked inside WebKit, so the
         // chrome's own chords must not fire behind it either.
         #[cfg(feature = "wpe")]
         if self.modal.is_some() {
             *needs_rebuild = true;
             if event.state == ElementState::Pressed
                 && event.logical_key == Key::Named(NamedKey::Tab)
             {
                 if let Some(m) = self.modal.as_mut() {
                     if !m.fields.is_empty() {
                         let n = m.fields.len();
                         m.focused = if event.shift {
                             (m.focused + n - 1) % n
                         } else {
                             (m.focused + 1) % n
                         };
                     }
                 }
                 return None;
             }
             let outcome = match self.modal.as_mut() {
                 Some(m) if !m.fields.is_empty() => {
                     let i = m.focused;
                     m.fields[i].1.handle_key(event)
                 }
                 // No field: Enter accepts, Escape cancels, nothing else acts.
                 // Except over a hang, where accepting kills the page: that
                 // question can pop up mid-typing, and an Enter meant for the
                 // page must not throw away what was typed into it.
                 Some(m) => match (&event.logical_key, event.state) {
                     (Key::Named(NamedKey::Enter), ElementState::Pressed)
                         if !matches!(m.kind, ModalKind::Unresponsive) =>
                     {
                         cce_ui::widget::EditOutcome::Submit
                     }
                     (Key::Named(NamedKey::Escape), ElementState::Pressed) => {
                         cce_ui::widget::EditOutcome::Cancel
                     }
                     _ => cce_ui::widget::EditOutcome::Ignored,
                 },
                 None => cce_ui::widget::EditOutcome::Ignored,
             };
             match outcome {
                 cce_ui::widget::EditOutcome::Submit => self.close_modal(true),
                 cce_ui::widget::EditOutcome::Cancel => self.close_modal(false),
                 _ => {}
             }
             return None;
         }
 
         // An open account list takes the keys that drive it, and passes on
         // everything else — the person is typing into the page's own field,
         // and that typing is what filters the list.
         #[cfg(feature = "wpe")]
         if self.ac_layout().is_some() && event.state == ElementState::Pressed && !self.url_focused {
             match &event.logical_key {
                 Key::Named(NamedKey::ArrowDown) => {
                     if let Some(m) = self.ac_menu.as_mut() {
                         m.step(1);
                     }
                     *needs_rebuild = true;
                     return None;
                 }
                 Key::Named(NamedKey::ArrowUp) => {
                     if let Some(m) = self.ac_menu.as_mut() {
                         m.step(-1);
                     }
                     *needs_rebuild = true;
                     return None;
                 }
                 Key::Named(NamedKey::Enter) => {
                     let selected = self.ac_menu.as_ref().map(|m| m.selected);
                     if let Some(i) = selected {
                         self.pick_account(i);
                     }
                     *needs_rebuild = true;
                     return None;
                 }
                 Key::Named(NamedKey::Escape) => {
                     self.ac_menu = None;
                     *needs_rebuild = true;
                     return None;
                 }
                 _ => {}
             }
         }
 
         // An open bookmarks menu owns Escape, ahead of the URL bar and the
         // page both.
         if self.bm_menu.is_some()
             && event.state == ElementState::Pressed
             && event.logical_key == Key::Named(NamedKey::Escape)
         {
             self.close_bm_menu();
             *needs_rebuild = true;
             return None;
         }
 
         // Vi mode, ahead of the chrome's chords: normal mode's Ctrl bindings
         // (Ctrl+D/U/F/B scroll, Ctrl+V is passthrough) win over them, and
         // passthrough hands the page even those.
         if let Some(out) = self.vi_key(event, needs_rebuild) {
             return out;
         }
 
         // Tab shortcuts work regardless of URL-bar focus.
         if event.state == ElementState::Pressed && event.ctrl {
             let count = self.host.tab_count();
             match &event.logical_key {
                 Key::Character(c) if c == "t" => {
                     self.new_tab();
                     *needs_rebuild = true;
                     return None;
                 }
                 Key::Character(c) if c == "w" => {
                     *needs_rebuild = true;
                     return self.close_tab(self.host.active_index());
                 }
                 // Ctrl+Shift+Delete opens the cookie page rather than
                 // clearing outright; the page asks first.
                 Key::Named(NamedKey::Delete) if event.shift => {
                     self.open_internal_page("cce://cookies");
                     *needs_rebuild = true;
                     return None;
                 }
                 // The favorites pair sits a Shift above the bookmarks pair:
                 // Ctrl+Shift+D toggles the page in the strip, Ctrl+Shift+B
                 // opens the page that manages it.
                 Key::Character(c) if event.shift && c.eq_ignore_ascii_case("d") => {
                     self.toggle_favorite();
                     *needs_rebuild = true;
                     return None;
                 }
                 Key::Character(c) if event.shift && c.eq_ignore_ascii_case("b") => {
                     self.open_internal_page("cce://favorites");
                     *needs_rebuild = true;
                     return None;
                 }
                 Key::Character(c) if c == "h" || c == "b" || c == "j" => {
                     let page = match c.as_str() {
                         "h" => "cce://history",
                         "b" => "cce://bookmarks",
                         _ => "cce://downloads",
                     };
                     self.open_internal_page(page);
                     *needs_rebuild = true;
                     return None;
                 }
                 Key::Character(c) if c == "d" => {
                     self.host.toggle_bookmark();
                     *needs_rebuild = true;
                     return None;
                 }
                 // Ctrl+Shift+O: open the current page in another browser.
                 Key::Character(c) if event.shift && c.eq_ignore_ascii_case("o") => {
                     self.open_external();
                     return None;
                 }
                 Key::Named(NamedKey::Tab) if count > 1 => {
                     let cur = self.host.active_index();
                     let next = if event.shift { (cur + count - 1) % count } else { (cur + 1) % count };
                     self.switch_tab(next);
                     *needs_rebuild = true;
                     return None;
                 }
                 _ => {}
             }
         }
 
         // An open bookmarks menu's search field has the keyboard, the way a
         // focused URL bar does (opening the menu drops the bar's focus).
         if self.bm_menu.is_some() {
             if event.state == ElementState::Pressed {
                 self.edit_bm_search(event);
                 *needs_rebuild = true;
             }
             return None;
         }
 
         if self.url_focused {
             if event.state == ElementState::Pressed {
                 self.edit_url(event);
                 *needs_rebuild = true;
             }
             return None;
         }
 
         if event.state == ElementState::Pressed {
             if event.ctrl {
                 if let Key::Character(c) = &event.logical_key {
                     match c.as_str() {
                         // Page clipboard: Servo needs the chord as an
                         // editing action, not as the raw keystroke.
                         "c" | "x" | "v" => {
                             self.host.editing_action_cmd(match c.as_str() {
                                 "c" => EditingCommand::Copy,
                                 "x" => EditingCommand::Cut,
                                 _ => EditingCommand::Paste,
                             });
                             return None;
                         }
                         "l" => {
                             self.open_chrome();
                             self.url_new_tab = false;
                             self.url_focused = true;
                             self.select_all_url();
                             *needs_rebuild = true;
                             return None;
                         }
                         "r" => {
                             self.host.reload();
                             return None;
                         }
                         _ => {}
                     }
                 }
             }
             if event.logical_key == Key::Named(NamedKey::F5) {
                 self.host.reload();
                 return None;
             }
             // An open menu owns Escape; closed, the page keeps it.
             if self.chrome_open && event.logical_key == Key::Named(NamedKey::Escape) {
                 self.close_chrome();
                 *needs_rebuild = true;
                 return None;
             }
         }
 
         self.host.key_ui(event);
         None
     }
 
     fn display_list(&mut self, size: LogicalSize, _scale: f64) -> Option<DisplayList> {
         // Whatever the engine last handed over is about to be on screen. That
         // is what lets the next one be read: until a frame is drawn, reading
         // another would be copying over a picture nobody saw. One already
         // waiting has to be fetched: its page is held up until it is read,
         // and a held-up page makes no noise that would turn the loop.
         #[cfg(feature = "wpe")]
         if self.host.frame_drawn() {
             let _ = self.sender.send(Message::Spin);
         }
         self.win = (size.width, size.height);
         self.sync_ime();
         let mut pc = PaintCtx::new();
         let w = size.width;
 
         let bar = self.bar();
         let pos_edge = self.settings.bar_position;
 
         // The standard root plate (cce-ui PlateSpec::window); the page is full-bleed content drawn on it.
         pc.root_plate(w, size.height);
         // Page: full-bleed under the floating bar.
         let content = Rect { x: 0.0, y: 0.0, width: w, height: size.height };
         if let Some((id, ..)) = self.host.image() {
             pc.image(id, content, 1.0);
         } else {
             // Just clear of the bar, whichever edge it is on.
             let y = match self.settings.bar_position {
                 settings::BarPosition::Top => bar.y + bar.height + item_gap(),
                 settings::BarPosition::Bottom => bar_margin(),
             };
             pc.text("Loading...", bar_margin(), y, 13.0, TEXT_DIM);
         }
         // A text field in the page has focus: claim its caret, so a tap on it
         // raises the on-screen keyboard. First, so a chrome field drawn over
         // the page (URL bar, dialog, vi line) claims last and wins.
         #[cfg(feature = "wpe")]
         if let Some((x, y, w, h)) = self.host.page_text_field() {
             cce_ui::text_input::claim(x, y, w, h);
         }
 
         // The bar plate — or the shape it is unfolding through. Nothing but
         // the corner control shows while closed. Blur-behind, frosting the
         // page under it; the corner exponent eases from circular at the
         // dot-sized seed to the DE's own once it is the bar.
         let e = self.chrome_ease();
         let (plate, radius) = self.chrome_plate();
         let (sans, ..) = cce_ui::layout::read_preferred_fonts();
         if e > 0.0 {
             let shape = 2.0 + (cce_ui::layout::corner_shape() - 2.0) * e;
             pc.plate_shaped(
                 plate,
                 (radius, radius, radius, radius),
                 &cce_ui::scene::Material::from_fill(BAR_FILL),
                 cce_ui::layout::bevel_width().min(4.0),
                 Some(shape),
             );
         }
 
         // Open: the bar's contents, laid out at their final positions and
         // clipped to the plate, so they are revealed as it unfolds.
         if e > 0.0 {
             pc.clip_rounded(plate, radius, |pc| {
                 if self.loading {
                     pc.quad(
                         Rect { x: bar.x, y: bar.y + bar.height - 2.0, width: bar.width, height: 2.0 },
                         ACCENT,
                     );
                 }
 
                 // Tab strip.
             let count = self.host.tab_count();
             let active = self.host.active_index();
             for i in 0..count {
                 let pill = tab_rect(&bar, pos_edge, count, i);
                 let is_active = i == active;
                 pc.rounded_rect(
                     pill,
                     7.0,
                     (true, true, true, true),
                     if is_active { TAB_ACTIVE_BG } else { TAB_BG },
                 );
                 let tab = self.host.tab(i);
                 let title = tab
                     .and_then(|t| t.title.clone().filter(|s| !s.is_empty()))
                     .or_else(|| tab.and_then(|t| t.url.clone()).map(|u| u.to_string()))
                     .filter(|s| s != "about:blank")
                     .unwrap_or_else(|| "New Tab".to_string());
                 let close = tab_close_rect(&pill);
                 let text_avail = pill.width - 2.0 * text_pad() - close.map_or(0.0, |_| TAB_CLOSE_W - 4.0);
                 let label = Self::fit_text(&title, &sans, 12.0, text_avail);
                 let color = if is_active { TEXT } else { TEXT_DIM };
                 pc.text(
                     label,
                     pill.x + text_pad(),
                     cce_ui::layout::align_text_y(pill.y, pill.height, 12.0, 0.0),
                     12.0,
                     color,
                 );
                 if tab.is_some_and(|t| t.loading) {
                     pc.quad(
                         Rect { x: pill.x, y: pill.y + pill.height - 2.0, width: pill.width, height: 2.0 },
                         ACCENT,
                     );
                 }
                 if let Some(cr) = close {
                     let glyph_box = Rect { x: cr.x - 2.0, ..cr };
                     Self::glyph(pc, &sans, "x", "Close", glyph_box, 9.0, TEXT_DIM);
                 }
             }
             let plus = plus_rect(&bar, pos_edge);
             pc.rounded_rect(plus, 7.0, (true, true, true, true), BTN_BG);
             Self::glyph(pc, &sans, "plus", "New", plus, 12.0, TEXT);
 
             // Favorites strip: label pills, the hovered one lifted like an
             // active tab. Labels are cut to the pill, never the other way.
             let fav_rects = self.fav_rects(&bar);
             for (i, r) in fav_rects.iter().enumerate() {
                 let hovered = self.fav_hover == Some(i);
                 pc.rounded_rect(
                     *r,
                     7.0,
                     (true, true, true, true),
                     if hovered { TAB_ACTIVE_BG } else { TAB_BG },
                 );
                 let label =
                     Self::fit_text(&self.favs[i].label, &sans, FAV_FONT, r.width - 2.0 * text_pad());
                 pc.text(
                     label,
                     r.x + text_pad(),
                     cce_ui::layout::align_text_y(r.y, r.height, FAV_FONT, 0.0),
                     FAV_FONT,
                     if hovered { TEXT } else { TEXT_DIM },
                 );
             }
 
             // (glyph, fallback word) for Back, Forward and Reload.
             let faces = [("arrow-left", "Back"), ("arrow-right", "Forward"), ("refresh", "Reload")];
             let enabled = [self.host.can_go_back(), self.host.can_go_forward(), true];
             for (i, (name, word)) in faces.iter().enumerate() {
                 let r = btn_rect(&bar, i);
                 pc.rounded_rect(r, 6.0, (true, true, true, true), BTN_BG);
                 let color = if enabled[i] { TEXT } else { TEXT_DIM };
                 Self::glyph(pc, &sans, name, word, r, 14.0, color);
             }
 
             // Bookmark star: accent-lit when the page is bookmarked.
             let star = star_rect(&bar, pos_edge);
             pc.rounded_rect(star, 6.0, (true, true, true, true), BTN_BG);
             let starred = self.host.active_bookmarked();
             let star_color: [u8; 3] = if starred { [150, 190, 240] } else { TEXT_DIM };
             Self::glyph(pc, &sans, "star", "Save", star, 15.0, star_color);
 
             // Bookmarks menu button: all the saved pages, where the star
             // beside it is only this one. Lit while its menu is open.
             let bmb = bm_btn_rect(&bar, pos_edge);
             pc.rounded_rect(bmb, 6.0, (true, true, true, true), BTN_BG);
             let bm_color = if self.bm_menu.is_some() { [150, 190, 240] } else { TEXT };
             Self::glyph(pc, &sans, "bookmarks", "Saved", bmb, 14.0, bm_color);
 
             // URL field: rim + recess, brighter rim when focused.
             let f = url_rect(&bar, pos_edge);
             let rim = if self.url_focused { RIM_FOCUS } else { RIM };
             pc.rounded_rect(
                 Rect { x: f.x - 1.0, y: f.y - 1.0, width: f.width + 2.0, height: f.height + 2.0 },
                 7.0,
                 (true, true, true, true),
                 rim,
             );
             pc.rounded_rect(f, 6.0, (true, true, true, true), FIELD_BG);
             let marks = FieldMarks::of(&mut self.font_system, &self.url);
             let caret = paint_field(pc, f, &marks, "", self.url_focused);
             // Drawn here only while the bar is out, so a folded bar asks
             // for no text.
             if self.keyboard_field() == Some(LineField::Url) {
                 report_caret(caret);
             }
 
             });
         }
 
         // The corner control, over the bar: a circular plate of the bar's
         // own material — the seed the bar unfolds from, so folded it reads
         // as the bar in miniature, and open it is a plate on the bar's
         // corner. Emphasized while hovered or while the bar is out.
         let (cx, cy) = self.dot_center();
         let r = if self.dot_hover || self.chrome_open { DOT_R * 1.15 } else { DOT_R };
         pc.plate_shaped(
             Rect { x: cx - r, y: cy - r, width: 2.0 * r, height: 2.0 * r },
             (r, r, r, r),
             &cce_ui::scene::Material::from_fill(BAR_FILL),
             cce_ui::layout::bevel_width().min(3.0),
             Some(2.0),
         );
 
         self.paint_vi(&mut pc, &sans);
         self.paint_bm_menu(&mut pc, &sans);
         #[cfg(feature = "wpe")]
         self.paint_ac_menu(&mut pc, &sans);
         #[cfg(feature = "wpe")]
         self.paint_save_offer(&mut pc, &sans);
         #[cfg(feature = "wpe")]
         self.paint_opt_menu(&mut pc, &sans);
         #[cfg(feature = "wpe")]
         self.paint_ctx_menu(&mut pc, &sans);
         #[cfg(feature = "wpe")]
         self.paint_modal(&mut pc, &sans);
 
         Some(pc.finish())
     }
 
     fn display_list_text(&self) -> bool {
         true
     }
 
     fn clear_color(&self) -> [f32; 4] {
         PAGE_BG
     }
 }
 
 /// Turn off Intel's CCS compression for this process and everything it
 /// spawns.
 ///
 /// Mesa's iris driver can deadlock two threads against each other through
 /// the aux map CCS needs: one adds a mapping and wants the buffer manager's
 /// lock, the other reuses a cached buffer under that lock and wants the aux
 /// map's. WebKit's two GPU painting threads hit exactly that and froze a
 /// page for good (2026-10-05; CLAUDE.md, "A dead or hung page"). Without CCS
 /// the aux-map code never runs. The cost is uncompressed surfaces — more
 /// memory bandwidth on the iGPU.
 ///
 /// Set first, before anything has started a thread or opened a GPU device:
 /// WebKit's page processes inherit it through their sandbox, and the chrome's
 /// own Vulkan device reads it too. `CCE_BROWSER_CCS=1` keeps compression, for
 /// measuring what this costs.
 fn disable_intel_ccs() {
     if std::env::var_os("CCE_BROWSER_CCS").is_some_and(|v| v == "1") {
         return;
     }
     let current = std::env::var("INTEL_DEBUG").unwrap_or_default();
     if current.split(',').any(|f| f.trim() == "noccs") {
         return;
     }
     let value = if current.is_empty() { "noccs".to_string() } else { format!("{current},noccs") };
     std::env::set_var("INTEL_DEBUG", value);
 }
 
 fn main() {
     disable_intel_ccs();
     env_logger::init();
     // A read-only look at what a Raindrop sync would do (RAINDROP-SYNC.md).
     // Ahead of the instance hand-off: it is a tool, not a launch, and must
     // work while the browser is running.
     if std::env::args().nth(1).as_deref() == Some("--raindrop-plan") {
         match raindrop::dry_run() {
             Ok(report) => print!("{report}"),
             Err(e) => {
                 eprintln!("raindrop: {e}");
                 std::process::exit(1);
             }
         }
         return;
     }
     // Hand the launch to a running instance before any engine work: an
     // external open (`xdg-open` → `cce-browser %u`) becomes a tab there,
     // and this process never touches Wayland or the shared profile dir.
     if instance::forward_or_claim(std::env::args().nth(1).as_deref()) {
         return;
     }
     cce_ui::engine::run::<BrowserApp>();
     instance::cleanup();
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     const SEARCH: &str = "https://duckduckgo.com/?q=";
 
     #[test]
     fn a_composition_is_drawn_at_the_caret_and_never_held() {
         use cce_ui::ime::{set_preedit, Preedit};
         use cce_ui::widget::LineEdit;
         let mut fs = cce_ui::create_font_system_with_system_fonts();
         let mut x = |s: &str, b: usize| x_of_boundary_in(&mut fs, s, b);
         let (ax, axyzb_1, axyzb_2, axyzb_4) = (x("ab", 1), x("axyzb", 1), x("axyzb", 2), x("axyzb", 4));
         assert!(ax > 0.0 && axyzb_2 > axyzb_1 && axyzb_4 > axyzb_2, "the run has widths to measure");
 
         let mut fs = cce_ui::create_font_system_with_system_fonts();
         let mut url = LineEdit::with_text("ab");
         url.cursor = 1;
         let before = FieldMarks::of(&mut fs, &url);
         assert_eq!((before.shown.as_str(), before.caret, before.composition), ("ab", ax, None));
 
         // "xyz" composing between a and b, the input method's cursor after x.
         set_preedit(Some(Preedit::new("xyz", Some((1, 1)))));
         assert!(url.sync_ime());
         let marks = FieldMarks::of(&mut fs, &url);
         assert_eq!(marks.shown, "axyzb", "drawn at the caret");
         assert_eq!(url.text, "ab", "never in what the bar holds");
         assert_eq!(marks.composition, Some((axyzb_1, axyzb_4)), "underlined where it is drawn");
         assert_eq!(marks.caret, axyzb_2, "the caret where the input method has it");
 
         // A press in it drops it, and lands on the text as held.
         let at = url.text_index(2);
         url.press(at, false);
         url.release();
         assert!(!url.composing() && cce_ui::ime::preedit().is_none());
         assert_eq!(FieldMarks::of(&mut fs, &url).shown, "ab");
 
         // A password field's composition is bullets too.
         let mut password = LineEdit::masked();
         set_preedit(Some(Preedit::new("pw", None)));
         password.sync_ime();
         let marks = FieldMarks::of(&mut fs, &password);
         assert_eq!(marks.shown, "\u{2022}\u{2022}");
         assert!(password.text.is_empty());
         set_preedit(None);
     }
 
     #[test]
     fn the_bookmarks_search_keeps_entries_matching_every_word() {
         let link = |label: &str, url: &str| pages::Link { label: label.into(), url: url.into() };
         let mut m = BmMenu::new(vec![
             link("Rust Book", "https://doc.rust-lang.org/book/"),
             link("Example Domain", "https://example.com/"),
             link("rustup", "https://rustup.rs/"),
         ]);
         assert_eq!(m.items.len(), 3, "an empty query lets everything through");
         m.query.text = "RUST".into();
         m.filter();
         let labels: Vec<_> = m.items.iter().map(|l| l.label.as_str()).collect();
         assert_eq!(labels, ["Rust Book", "rustup"], "case-insensitive, store order kept");
         m.query.text = "rust book".into();
         m.filter();
         assert_eq!(m.items.len(), 1, "every word must match");
         m.query.text = "example.com".into();
         m.filter();
         assert_eq!(m.items[0].label, "Example Domain", "the address counts too");
         m.query.text = "nothing-like-this".into();
         m.filter();
         assert!(m.items.is_empty());
         assert_eq!(m.all.len(), 3, "filtering never drops the snapshot");
     }
 
     #[test]
     fn the_bookmarks_selection_wraps_and_stays_in_view() {
         let link = |n: usize| pages::Link { label: format!("page {n}"), url: format!("https://e.com/{n}") };
         let mut m = BmMenu::new((0..5).map(link).collect());
         assert_eq!(m.selected, 0);
         m.step(1, 3);
         m.step(1, 3);
         assert_eq!((m.selected, m.scroll), (2, 0), "still among the three shown");
         m.step(1, 3);
         assert_eq!((m.selected, m.scroll), (3, 1), "scrolled to keep it in view");
         m.step(1, 3);
         m.step(1, 3);
         assert_eq!((m.selected, m.scroll), (0, 0), "wrapped past the end, back to the top");
         m.step(-1, 3);
         assert_eq!((m.selected, m.scroll), (4, 2), "and back past the start, to the bottom");
         // A narrower query keeps the selection on a match.
         m.query.text = "page 1".into();
         m.filter();
         assert_eq!((m.items.len(), m.selected), (1, 0));
         // Nothing to select: stepping does nothing.
         m.query.text = "none".into();
         m.filter();
         m.step(1, 3);
         assert_eq!(m.selected, 0);
     }
 
     #[test]
     fn the_bar_glides_with_animations_on_and_snaps_with_them_off() {
         let frame = 1.0 / 60.0;
         // On: a frame moves it part of the way, and it lands exactly.
         let t = chrome_step(0.0, 1.0, frame, true);
         assert!(t > 0.0 && t < 1.0, "{t}");
         assert_eq!(chrome_step(0.95, 1.0, frame, true), 1.0);
         assert_eq!(chrome_step(0.05, 0.0, frame, true), 0.0);
         // The whole unfold takes CHROME_ANIM_S, whichever way it goes.
         let frames = (CHROME_ANIM_S / frame).ceil() as usize;
         let open = (0..frames).fold(0.0, |t, _| chrome_step(t, 1.0, frame, true));
         let shut = (0..frames).fold(1.0, |t, _| chrome_step(t, 0.0, frame, true));
         assert_eq!((open, shut), (1.0, 0.0));
         // Off: one frame lands it, from anywhere, either way — snap, not freeze.
         for from in [0.0, 0.3, 1.0] {
             assert_eq!(chrome_step(from, 1.0, frame, false), 1.0);
             assert_eq!(chrome_step(from, 0.0, frame, false), 0.0);
         }
     }
 
     #[test]
     fn startup_arg_resolves_an_existing_path_to_a_file_url() {
         // Scoped to this process, like every other scratch directory in the
         // crate: /tmp is one namespace shared by every user of the machine.
         let dir = std::env::temp_dir()
             .join(format!("cce-browser-argv-test-{}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
         let page = dir.join("page.html");
         std::fs::write(&page, "<html></html>").unwrap();
 
         let u = parse_startup_arg(page.to_str().unwrap(), SEARCH).unwrap();
         assert_eq!(u.scheme(), "file");
         assert!(u.path().ends_with("page.html"), "got {u}");
 
         // The bar parser is what this guards against: a dotted, space-free
         // path takes its bare-host branch and becomes a bogus https URL.
         let bar = parse_url_input(page.to_str().unwrap(), SEARCH).unwrap();
         assert_eq!(bar.scheme(), "https");
 
         // Sole user of this directory, so it can go whole.
         let _ = std::fs::remove_dir_all(&dir);
     }
 
     #[cfg(feature = "wpe")]
     #[test]
     fn only_loopback_escapes_the_insecure_warning() {
         assert!(!insecure_origin("https://example.com", "example.com"));
         assert!(insecure_origin("http://example.com", "example.com"));
         assert!(!insecure_origin("http://localhost:8731", "localhost"));
         assert!(!insecure_origin("http://127.0.0.1:8080", "127.0.0.1"));
         assert!(!insecure_origin("http://dev.localhost", "dev.localhost"));
         // A file: page has no transport to secure, and no origin worth the
         // name; say so rather than stay quiet.
         assert!(insecure_origin("null", ""));
     }
 
     #[test]
     fn startup_arg_still_takes_urls_and_searches() {
         let u = parse_startup_arg("https://example.com/x", SEARCH).unwrap();
         assert_eq!(u.as_str(), "https://example.com/x");
 
         // A bare host that is not a path still guesses https.
         assert_eq!(parse_startup_arg("example.com", SEARCH).unwrap().scheme(), "https");
 
         // A non-existent path is not a file: it falls through to the bar rules.
         let missing = parse_startup_arg("/nonexistent/nope.html", SEARCH).unwrap();
         assert_ne!(missing.scheme(), "file");
     }
 }