From a9e324b156f1b4f25e18561f85cdd6eb0a4185bd Mon Sep 17 00:00:00 2001
From: devmobasa <4170275+devmobasa@users.noreply.github.com>
Date: Tue, 6 Oct 2026 00:02:42 +0200
Subject: [PATCH] Harden session recovery, input handling, and persistence

---
 .../src/app/pages/session/catalog/tests.rs    |   1 +
 configurator/src/app/search/tests.rs          |   1 +
 configurator/src/app/session_catalog/tests.rs |   1 +
 .../src/app/update/session_catalog/tests.rs   |   1 +
 configurator/src/models/session.rs            |  31 +-
 configurator/src/models/session/tests.rs      |  30 +
 docs/codebase-overview.md                     |  49 +-
 .../backend/event_loop/session_save.rs        | 360 +------
 .../event_loop/session_save/diagnostics.rs    |  66 ++
 .../event_loop/session_save/final_save.rs     | 362 +++++++
 .../event_loop/session_save/interaction.rs    |  85 ++
 .../event_loop/session_save/notifications.rs  | 104 +-
 .../backend/event_loop/session_save/tests.rs  | 123 ++-
 src/backend/wayland/handlers/AGENTS.md        |   1 +
 src/backend/wayland/handlers/mod.rs           |   3 +
 src/backend/wayland/handlers/pointer/axis.rs  |   9 +-
 .../wayland/handlers/pointer/enter_leave.rs   |  10 +-
 src/backend/wayland/handlers/pointer/mod.rs   |   5 +-
 .../wayland/handlers/pointer/motion.rs        |  23 +-
 src/backend/wayland/handlers/pointer/press.rs | 221 +---
 .../wayland/handlers/pointer/press/tests.rs   |  17 +
 .../wayland/handlers/pointer/press/toolbar.rs | 162 +++
 .../wayland/handlers/pointer/release.rs       |  40 +
 src/backend/wayland/handlers/pointer/tests.rs | 251 +++++
 src/backend/wayland/handlers/tablet/frame.rs  | 261 ++---
 .../wayland/handlers/tablet/frame/tests.rs    | 390 +++++++
 src/backend/wayland/handlers/tablet/tool.rs   | 240 ++---
 .../wayland/handlers/tablet/tool/tests.rs     |  96 ++
 src/backend/wayland/handlers/test_support.rs  | 172 +++
 src/backend/wayland/handlers/touch.rs         |   2 +-
 src/backend/wayland/session.rs                | 119 +--
 src/backend/wayland/session/AGENTS.md         |   1 +
 src/backend/wayland/session/driver.rs         | 208 +++-
 src/backend/wayland/session/driver/tests.rs   |  47 +-
 .../driver/tests/lifecycle_regressions.rs     |   3 +-
 .../wayland/session/driver/tests/output.rs    | 978 ++++++++++++++++++
 src/backend/wayland/session/home.rs           |  22 -
 src/backend/wayland/session/home/tests.rs     | 324 +++++-
 src/backend/wayland/session/load_outcome.rs   |  82 +-
 .../wayland/session/persistence/worker.rs     |  31 +-
 src/backend/wayland/session/runtime.rs        |   8 +-
 .../wayland/session/runtime/transaction.rs    | 105 +-
 .../session/runtime/transaction/output.rs     | 215 ++++
 .../session/runtime/transaction/phases.rs     |   6 +-
 src/backend/wayland/session/tests.rs          |  84 +-
 src/backend/wayland/session/write_policy.rs   |  87 ++
 src/backend/wayland/state.rs                  |   8 +-
 src/backend/wayland/state/AGENTS.md           |   2 +
 src/backend/wayland/state/clipboard.rs        | 100 +-
 .../wayland/state/clipboard/probe_tests.rs    | 170 +++
 src/backend/wayland/state/contact_owner.rs    | 142 +++
 src/backend/wayland/state/core/accessors.rs   |   2 +-
 src/backend/wayland/state/core/output.rs      |  11 +-
 .../wayland/state/core/output/session_ops.rs  | 142 +--
 .../wayland/state/core/output/tests.rs        |  97 +-
 .../wayland/state/core/output/transition.rs   | 190 ++--
 src/backend/wayland/state/core/session.rs     |  28 +-
 src/backend/wayland/state/input_actions.rs    |   2 +-
 src/backend/wayland/state/onboarding/card.rs  |  12 +-
 .../wayland/state/onboarding/first_run.rs     |   2 +-
 src/backend/wayland/state/pointer_runtime.rs  | 424 +-------
 .../wayland/state/pointer_runtime/chrome.rs   |  73 ++
 .../wayland/state/pointer_runtime/contacts.rs | 307 ++++++
 .../wayland/state/pointer_runtime/tests.rs    | 227 ++++
 .../wayland/state/pointer_runtime/touch.rs    |  53 +
 src/backend/wayland/state/tablet_runtime.rs   | 236 ++++-
 .../wayland/state/tablet_runtime/pressure.rs  | 135 +++
 .../wayland/state/toolbar/drag/tests.rs       |  36 +
 src/backend/wayland/state/toolbar/events.rs   |   5 +-
 .../wayland/state/toolbar/events/session.rs   | 120 +--
 .../state/toolbar/events/session/queued.rs    |  67 ++
 .../state/toolbar/events/session/tests.rs     |  98 ++
 src/backend/wayland/state/toolbar/fade.rs     |   5 +-
 .../wayland/state/toolbar/inline/input.rs     |  39 +
 src/canvas_export/tests/board_grid.rs         |   5 +-
 src/canvas_export/tests/cache_tests.rs        |   5 +-
 src/config/AGENTS.md                          |   1 +
 src/config/io.rs                              |   2 +-
 src/config/tests/document.rs                  |  22 +-
 src/config/tests/file_io.rs                   |   6 +-
 src/config/tests/load.rs                      |  26 +-
 src/config/tests/validate.rs                  |   2 +-
 src/config/tests/write_lock.rs                |   2 +-
 src/config/tests/write_target.rs              |   2 +-
 src/env_vars.rs                               |   2 -
 .../state/core/board_picker/appearance.rs     |  17 +-
 .../core/board_picker/appearance/tests.rs     |  24 +-
 .../state/core/board_picker/layout/helpers.rs |  33 -
 src/input/state/core/board_picker/mod.rs      |  32 -
 .../state/core/board_picker/state/ordering.rs |   4 -
 src/input/state/core/mod.rs                   |   2 +
 src/input/state/core/selection/clipboard.rs   |  71 --
 .../state/core/selection_actions/clipboard.rs |  89 +-
 .../selection_actions/clipboard/duplicate.rs  |   1 -
 src/input/state/core/session.rs               |  10 -
 src/input/state/core/test_support.rs          |  71 ++
 src/input/state/core/utility/pending.rs       |  84 +-
 .../state/interaction/adapters/pointer.rs     |   5 +
 src/input/state/interaction/mod.rs            |   1 +
 src/input/state/interaction/outcome.rs        |  40 +
 src/input/state/mouse/press.rs                |   5 +-
 src/input/state/tests/selection/duplicate.rs  | 257 +----
 src/onboarding.rs                             |   2 +-
 src/palette_recents.rs                        |   2 +-
 src/session/AGENTS.md                         |   5 +
 src/session/artifacts.rs                      |  32 +-
 src/session/artifacts/corrupt_copies.rs       | 104 ++
 src/session/artifacts/kind.rs                 |  49 +
 src/session/artifacts/move_file.rs            |  31 +-
 src/session/artifacts/tests.rs                |  92 ++
 src/session/mod.rs                            |  21 +-
 src/session/options/types.rs                  |  20 -
 src/session/primary.rs                        |  35 +
 src/session/snapshot/compat_tests.rs          | 467 +++++++++
 .../compat/main-a2bb723a/backup-lines-1.json  |  38 +
 .../main-a2bb723a/backup-recoverable.marker   |   1 +
 .../fixtures/compat/main-a2bb723a/blank.json  |  29 +
 .../compat/main-a2bb723a/cleared.marker       |   1 +
 .../compat/main-a2bb723a/lines-1.json         |  38 +
 .../compat/main-a2bb723a/lines-2.json         |  58 ++
 .../compat/main-a2bb723a/lines-4.json.gz      | Bin 0 -> 335 bytes
 .../main-a2bb723a/recovery-lines-3.json       |  78 ++
 .../main-a2bb723a/recovery-recoverable.marker |   1 +
 .../compat/v0.9.25/backup-lines-1.json        |  38 +
 .../compat/v0.9.25/backup-recoverable.marker  |   1 +
 .../fixtures/compat/v0.9.25/blank.json        |  29 +
 .../fixtures/compat/v0.9.25/cleared.marker    |   1 +
 .../fixtures/compat/v0.9.25/lines-1.json      |  38 +
 .../fixtures/compat/v0.9.25/lines-2.json      |  58 ++
 .../fixtures/compat/v0.9.25/lines-4.json.gz   | Bin 0 -> 335 bytes
 .../compat/v0.9.25/recovery-lines-3.json      |  78 ++
 .../v0.9.25/recovery-recoverable.marker       |   1 +
 src/session/snapshot/generation.rs            |  96 ++
 src/session/snapshot/generation/marker.rs     |  68 ++
 src/session/snapshot/generation/probe.rs      | 170 +++
 src/session/snapshot/generation/tests.rs      | 626 +++++++++++
 src/session/snapshot/generation/view.rs       | 167 +++
 src/session/snapshot/load.rs                  | 160 +--
 src/session/snapshot/load/artifact_outcome.rs | 129 +++
 src/session/snapshot/load/corrupt.rs          | 382 ++++++-
 src/session/snapshot/load/fallback.rs         |  96 +-
 src/session/snapshot/load/markers.rs          |  32 +-
 src/session/snapshot/load/named_candidate.rs  |  22 +-
 src/session/snapshot/mod.rs                   |  12 +-
 src/session/snapshot/save.rs                  | 147 +--
 src/session/snapshot/save/estimate.rs         |  67 ++
 src/session/snapshot/save/model.rs            |  14 +-
 src/session/snapshot/save/payload.rs          |  57 +-
 src/session/snapshot/save/recovery.rs         | 107 +-
 src/session/snapshot/save/save_as.rs          |   8 +-
 src/session/snapshot/tests.rs                 | 202 +++-
 src/session/snapshot/types.rs                 |  16 +
 src/session/storage/clear.rs                  |  79 +-
 src/session/storage/tests.rs                  |  30 +
 src/session/storage/tool_state.rs             |  21 +-
 src/session/tests/limits.rs                   |  16 +
 src/session/tests/roundtrip.rs                |   6 +-
 .../repository_guards/shared_dependencies.rs  |  87 +-
 .../shared_dependency_fixtures.json           |  36 +
 159 files changed, 10322 insertions(+), 2870 deletions(-)
 create mode 100644 src/backend/wayland/backend/event_loop/session_save/diagnostics.rs
 create mode 100644 src/backend/wayland/backend/event_loop/session_save/final_save.rs
 create mode 100644 src/backend/wayland/backend/event_loop/session_save/interaction.rs
 create mode 100644 src/backend/wayland/handlers/pointer/press/tests.rs
 create mode 100644 src/backend/wayland/handlers/pointer/press/toolbar.rs
 create mode 100644 src/backend/wayland/handlers/pointer/tests.rs
 create mode 100644 src/backend/wayland/handlers/tablet/frame/tests.rs
 create mode 100644 src/backend/wayland/handlers/tablet/tool/tests.rs
 create mode 100644 src/backend/wayland/handlers/test_support.rs
 create mode 100644 src/backend/wayland/session/driver/tests/output.rs
 create mode 100644 src/backend/wayland/session/runtime/transaction/output.rs
 create mode 100644 src/backend/wayland/session/write_policy.rs
 create mode 100644 src/backend/wayland/state/clipboard/probe_tests.rs
 create mode 100644 src/backend/wayland/state/contact_owner.rs
 create mode 100644 src/backend/wayland/state/pointer_runtime/chrome.rs
 create mode 100644 src/backend/wayland/state/pointer_runtime/contacts.rs
 create mode 100644 src/backend/wayland/state/pointer_runtime/tests.rs
 create mode 100644 src/backend/wayland/state/pointer_runtime/touch.rs
 create mode 100644 src/backend/wayland/state/tablet_runtime/pressure.rs
 create mode 100644 src/backend/wayland/state/toolbar/events/session/queued.rs
 create mode 100644 src/backend/wayland/state/toolbar/events/session/tests.rs
 create mode 100644 src/input/state/core/test_support.rs
 create mode 100644 src/session/artifacts/corrupt_copies.rs
 create mode 100644 src/session/artifacts/kind.rs
 create mode 100644 src/session/snapshot/compat_tests.rs
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/backup-lines-1.json
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/backup-recoverable.marker
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/blank.json
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/cleared.marker
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/lines-1.json
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/lines-2.json
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/lines-4.json.gz
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/recovery-lines-3.json
 create mode 100644 src/session/snapshot/fixtures/compat/main-a2bb723a/recovery-recoverable.marker
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/backup-lines-1.json
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/backup-recoverable.marker
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/blank.json
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/cleared.marker
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/lines-1.json
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/lines-2.json
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/lines-4.json.gz
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/recovery-lines-3.json
 create mode 100644 src/session/snapshot/fixtures/compat/v0.9.25/recovery-recoverable.marker
 create mode 100644 src/session/snapshot/generation.rs
 create mode 100644 src/session/snapshot/generation/marker.rs
 create mode 100644 src/session/snapshot/generation/probe.rs
 create mode 100644 src/session/snapshot/generation/tests.rs
 create mode 100644 src/session/snapshot/generation/view.rs
 create mode 100644 src/session/snapshot/load/artifact_outcome.rs
 create mode 100644 src/session/snapshot/save/estimate.rs

diff --git a/configurator/src/app/pages/session/catalog/tests.rs b/configurator/src/app/pages/session/catalog/tests.rs
index ca61b9129..2a7f42511 100644
--- a/configurator/src/app/pages/session/catalog/tests.rs
+++ b/configurator/src/app/pages/session/catalog/tests.rs
@@ -18,6 +18,7 @@ fn test_item(id: &str, display_name: &str) -> SessionCatalogItem {
             primary_exists: true,
             backup_exists: false,
             recovery_exists: false,
+            unreadable_copy_exists: false,
             clear_marker_exists: false,
             lock_exists: false,
             non_lock_size_bytes: 2048,
diff --git a/configurator/src/app/search/tests.rs b/configurator/src/app/search/tests.rs
index c985c342d..02ddd6b33 100644
--- a/configurator/src/app/search/tests.rs
+++ b/configurator/src/app/search/tests.rs
@@ -842,6 +842,7 @@ fn catalog_item(id: &str) -> SessionCatalogItem {
             primary_exists: false,
             backup_exists: false,
             recovery_exists: false,
+            unreadable_copy_exists: false,
             clear_marker_exists: false,
             lock_exists: false,
             non_lock_size_bytes: 0,
diff --git a/configurator/src/app/session_catalog/tests.rs b/configurator/src/app/session_catalog/tests.rs
index ee903c0d9..ff692fbcb 100644
--- a/configurator/src/app/session_catalog/tests.rs
+++ b/configurator/src/app/session_catalog/tests.rs
@@ -194,6 +194,7 @@ fn session_artifact_status_reports_size_when_present() {
             primary_exists: true,
             backup_exists: false,
             recovery_exists: false,
+            unreadable_copy_exists: false,
             clear_marker_exists: false,
             lock_exists: false,
             non_lock_size_bytes: 4096,
diff --git a/configurator/src/app/update/session_catalog/tests.rs b/configurator/src/app/update/session_catalog/tests.rs
index d87b7cae2..ffc43df96 100644
--- a/configurator/src/app/update/session_catalog/tests.rs
+++ b/configurator/src/app/update/session_catalog/tests.rs
@@ -21,6 +21,7 @@ fn catalog_item(id: &str, display_name: &str) -> SessionCatalogItem {
             primary_exists: false,
             backup_exists: false,
             recovery_exists: false,
+            unreadable_copy_exists: false,
             clear_marker_exists: false,
             lock_exists: false,
             non_lock_size_bytes: 0,
diff --git a/configurator/src/models/session.rs b/configurator/src/models/session.rs
index 5627e3cbb..e2e9881c6 100644
--- a/configurator/src/models/session.rs
+++ b/configurator/src/models/session.rs
@@ -242,6 +242,7 @@ pub struct SessionArtifactSummary {
     pub primary_exists: bool,
     pub backup_exists: bool,
     pub recovery_exists: bool,
+    pub unreadable_copy_exists: bool,
     pub clear_marker_exists: bool,
     pub lock_exists: bool,
     pub non_lock_size_bytes: u64,
@@ -252,34 +253,35 @@ impl SessionArtifactSummary {
         let artifacts = wayscriber::session::named_session_artifact_paths(path);
         let non_lock_paths = wayscriber::session::named_session_non_lock_artifact_paths(path)
             .map_err(|err| err.to_string())?;
-        let recovery_name = artifacts
-            .recovery
-            .file_name()
-            .and_then(|name| name.to_str())
-            .map(str::to_string);
 
         let mut summary = Self {
             primary_exists: artifact_exists(&artifacts.primary)?,
             backup_exists: artifact_exists(&artifacts.backup)?
                 || artifact_exists(&artifacts.backup_recovery_marker)?,
             recovery_exists: false,
+            unreadable_copy_exists: false,
             clear_marker_exists: artifact_exists(&artifacts.clear_marker)?,
             lock_exists: artifact_exists(&artifacts.lock)?,
             non_lock_size_bytes: 0,
         };
 
-        for path in non_lock_paths {
-            let Some(metadata) = artifact_metadata(&path)? else {
+        for artifact in non_lock_paths {
+            let Some(metadata) = artifact_metadata(&artifact)? else {
                 continue;
             };
             summary.non_lock_size_bytes =
                 summary.non_lock_size_bytes.saturating_add(metadata.len());
-            if recovery_name.as_deref().is_some_and(|name| {
-                path.file_name()
-                    .and_then(|value| value.to_str())
-                    .is_some_and(|value| value == name || value.starts_with(&format!("{name}.")))
-            }) {
-                summary.recovery_exists = true;
+            match wayscriber::session::named_session_artifact_kind(path, &artifact) {
+                Some(wayscriber::session::SessionArtifactKind::Backup) => {
+                    summary.backup_exists = true
+                }
+                Some(wayscriber::session::SessionArtifactKind::Recovery) => {
+                    summary.recovery_exists = true
+                }
+                Some(wayscriber::session::SessionArtifactKind::UnreadableCopy) => {
+                    summary.unreadable_copy_exists = true
+                }
+                _ => {}
             }
         }
 
@@ -297,6 +299,9 @@ impl SessionArtifactSummary {
         if self.recovery_exists {
             parts.push("recovery");
         }
+        if self.unreadable_copy_exists {
+            parts.push("unreadable copy");
+        }
         if self.clear_marker_exists {
             parts.push("cleared");
         }
diff --git a/configurator/src/models/session/tests.rs b/configurator/src/models/session/tests.rs
index 6b9ebd578..e3d8f65f9 100644
--- a/configurator/src/models/session/tests.rs
+++ b/configurator/src/models/session/tests.rs
@@ -16,6 +16,7 @@ fn session_catalog_state_replaces_items_and_inputs() {
             primary_exists: false,
             backup_exists: false,
             recovery_exists: false,
+            unreadable_copy_exists: false,
             clear_marker_exists: false,
             lock_exists: false,
             non_lock_size_bytes: 0,
@@ -90,3 +91,32 @@ fn format_byte_count_uses_compact_units() {
     assert_eq!(format_byte_count(4096), "4.0 KiB");
     assert_eq!(format_byte_count(2 * 1024 * 1024), "2.0 MiB");
 }
+
+#[test]
+fn artifact_summary_counts_diagnostic_copies_without_counting_similar_foreign_files() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let primary = temp.path().join("board.wayscriber-session");
+    std::fs::write(&primary, b"primary").unwrap();
+    for suffix in [".corrupt-1", ".bak.corrupt-2", ".recovery.corrupt-3"] {
+        std::fs::write(format!("{}{suffix}", primary.display()), b"diagnostic").unwrap();
+    }
+    std::fs::write(
+        format!("{}.corrupt-01", primary.display()),
+        b"foreign similar name",
+    )
+    .unwrap();
+    let summary = SessionArtifactSummary::from_primary_path(&primary).unwrap();
+    assert!(summary.primary_exists);
+    // Unreadable copies restore nothing, so they are not shown as a backup
+    // or recovery file.
+    assert!(!summary.backup_exists);
+    assert!(!summary.recovery_exists);
+    assert!(summary.unreadable_copy_exists);
+    assert_eq!(summary.non_lock_size_bytes, 7 + 3 * 10);
+    assert_eq!(summary.status_label(), "primary, unreadable copy · 37 B");
+
+    // A primary moved aside still leaves something to show.
+    std::fs::remove_file(&primary).unwrap();
+    let summary = SessionArtifactSummary::from_primary_path(&primary).unwrap();
+    assert_eq!(summary.status_label(), "unreadable copy · 30 B");
+}
diff --git a/docs/codebase-overview.md b/docs/codebase-overview.md
index ae0174753..497098e01 100644
--- a/docs/codebase-overview.md
+++ b/docs/codebase-overview.md
@@ -77,7 +77,7 @@ Daemon mode therefore provides a persistent background service that reacts to us
    - Communicate with `capture::CaptureManager` for screenshot actions.
    - Exit when `InputState.should_exit` is set (Escape, tray close, etc.).
 
-`WaylandState` coordinates the runtime owners handlers need. `FocusState` owns activation, focus, and startup acquisition; `ProtocolGlobals` owns bound globals and toolkit handler state; `PointerRuntime` owns pointer position, board-pan and chrome gestures, cursor, pointer-lock, and single-contact touch protocol lifecycles; `ToolbarChrome` owns toolbar placement, inline interaction, and fade state; `ToolbarDrag` owns built-in and GTK drag lifecycles; `RegionCaptureRuntime` owns region selection generations, active/review/window-snap state, and the window-query and cut-preview workers; `AcquisitionRuntime` owns the capacity-one screen-acquisition and zoom-waiter registries plus eyedropper source correlation; `FrozenState` owns its availability and one-shot startup gate; `SurfaceState` owns output/fullscreen/layer placement and frozen-fullscreen transitions; `OverlaySuppressionState` owns suppression reason, keyboard policy, capture barrier, and clickthrough state; `RenderRuntime` owns the canvas layer cache, reusable image and blur caches, resolved theme, UI paint caches, render-profile baseline, and per-effect damage history; `InputHudRuntime` owns system-reader lifecycle and reconciliation; `SpotlightRuntime` owns render memory, warning latches, and wheel timing; `ClipboardRuntime` owns single-flight clipboard workers and queue policy; `PreferenceStores` groups durable preference stores and workers; `UiAnimationClock` owns animation scheduling; and `FontCatalogPrewarm` owns the one-shot font scan. The root retains cross-owner coordination. `handlers::route::SurfaceRouter` is the single classifier for pointer, touch, and stylus surfaces and supplies overlay screen coordinates before modality-specific dispatch.
+`WaylandState` coordinates the runtime owners handlers need. `FocusState` owns activation, focus, and startup acquisition; `ProtocolGlobals` owns bound globals and toolkit handler state; `PointerRuntime` owns pointer position, board-pan and chrome gestures, cursor, pointer-lock, and single-contact touch protocol lifecycles; `ToolbarChrome` owns toolbar placement, inline interaction, and fade state; `ToolbarDrag` owns built-in and GTK drag lifecycles; `RegionCaptureRuntime` owns region selection generations, active/review/window-snap state, and the window-query and cut-preview workers; `AcquisitionRuntime` owns the capacity-one screen-acquisition and zoom-waiter registries plus eyedropper source correlation; `FrozenState` owns its availability and one-shot startup gate; `SurfaceState` owns output/fullscreen/layer placement and frozen-fullscreen transitions; `OverlaySuppressionState` owns suppression reason, keyboard policy, capture barrier, and clickthrough state; `RenderRuntime` owns the canvas layer cache, reusable image and blur caches, resolved theme, UI paint caches, render-profile baseline, and per-effect damage history; `InputHudRuntime` owns system-reader lifecycle and reconciliation; `SpotlightRuntime` owns render memory, warning latches, and wheel timing; `ClipboardRuntime` owns single-flight clipboard workers and queue policy; `PreferenceStores` groups durable preference stores and workers; `UiAnimationClock` owns animation scheduling; and `FontCatalogPrewarm` owns the one-shot font scan. Mouse buttons and tablet tips retain the owner that accepted their press, while `TouchTarget` binds touch sequences. Canvas motion and release keep that owner when crossing an inline toolbar; strip gaps consume presses and pen strip hover stays separate from layer-shell proximity. Each inline press refreshes hover geometry before claiming a control or gap. Strip pressure cannot change canvas thickness; a palette-consumed pen contact consumes its release even if the palette closes. A pen tap on the onboarding card, a toast, or an open popover acts on that chrome and never starts a stroke, and pen-up keeps a pressure thickness only for a stroke. Canceled canvas and pan gestures reconcile pointer ownership, while live held contacts keep their routing across Leave/Enter. The root retains cross-owner coordination. `handlers::route::SurfaceRouter` is the single classifier for pointer, touch, and stylus surfaces and supplies overlay screen coordinates before modality-specific dispatch.
 
 Within `PointerRuntime`, pending chrome targets and device-owned release suppression have separate lifecycles. Clearing a toast, HUD, or zoom-chip press preserves mouse and touch suppression; cancelling a touch clears only its own release latch.
 
@@ -544,9 +544,54 @@ capture suppression operates on the paired resources without runtime pairing che
 - `src/daemon/protocol_v2/session_target.rs`: writes and reads the per-generation session reports in `daemon-commands/overlay-targets/`.
 - `src/daemon/`: accepts daemon-toggle requests that carry an optional named session target, and remembers the session its overlay last reported across hide and show.
 
+The first startup load blocks once in the surface callback. Earlier input can
+already exist; unresolved ink stays visible and cannot overwrite a saved file.
+A per-output session first loads a placeholder without an output name. Leaving
+it for the first output's own session also runs to completion in the callback,
+after saving ink drawn on the placeholder to the placeholder's file. Later
+retries and output switches use the shared session driver without waiting in
+protocol dispatch. Unresolved sources cannot autosave or save before replacing
+the canvas; at exit, their new drawings go to a `.unsaved-<time>` session beside
+the file (into its recovery file when they exceed the size limit), and the exit
+notice names it. The pending transition keeps its revision until commit;
+changed destinations, source epochs, and live edits
+reject late completions. Guard aborts retry on the short interaction interval;
+I/O failures use the failure backoff. Explicit session commands queue in order,
+with a bounded, deduplicated queue tied to the visible source epoch. A changed
+target refuses those commands, and a queued Clear or tool reset also refuses if
+the session changed after it was requested. Commands that will not run are
+reported together. Shutdown cancels queued commands, names them in a desktop
+notification, and finishes the running command and its daemon report before
+canceling a remaining staged switch and saving the committed target.
+
+Corrupt payloads are preserved as independent `.corrupt-N` side files, retaining up to
+three regular copies per artifact. A corrupt primary can restore a valid backup or
+eligible recovery without overwriting the backup. Named candidates and remembered
+session loads retain their separate validation and fallback rules. Corruption
+restoration atomically repairs a named primary before returning the snapshot,
+replacing only the exact corrupt file it read, and only with bytes within the
+session size limit; larger restored data waits for the next save. A remembered
+primary must remain a usable regular file before and after loading, including
+corruption restoration; while it does,
+normal startup rules select newer recovery or marked backup data. If corruption
+cannot be preserved, automatic writes are blocked to keep the good backup intact.
+A successful reload releases that block. Dirty blocked sources cannot switch
+outputs; Save As can preserve new drawings elsewhere. If a corruption restore
+leaves no primary, the remembered session falls back to home and its recovered
+data remains in the backup or recovery file.
+Offline tool-state clears report preserved corruption rather than silently rewriting
+restored data.
+
+Format 7 now writes an optional `save_generation` immediately after `version`.
+Normal saves allocate a counter under the session lock using bounded payload and
+marker probes. Save As prepares before locking, then quarantines target sidecars.
+Marker format 1 records kind, generation, and a diagnostic timestamp. Load precedence
+and stale-artifact cleanup still use the legacy timestamp rules; the counter is
+writer groundwork for a later change. Legacy or invalid metadata remains unknown.
+
 **Flow:**
 1. CLI `--session-file` creates a named target instead of using configured storage. Named targets force persistence for that run, reject `--no-resume-session`, require an existing parent directory for foreground/open flows, and reject directories, symlinks, and special files.
-2. Backend startup builds `SessionOptions` from config plus any named target, then session loading restores boards/history/tool state before rendering begins.
+2. Backend startup builds `SessionOptions` from config plus any named target. The first load runs once, blocking, when the surface is configured; it restores boards/history/tool state, and ink drawn before it stays on screen.
 3. Runtime Open first saves dirty current data when needed, loads the candidate named session without mutating it, replaces board state only after a valid load, and records the open in the named-session catalog.
 4. Runtime Save As validates the target, prompts before replacing existing artifacts, writes the snapshot, switches the active target, and records the save in the catalog.
 5. Returning home saves dirty current data the same way, then loads the home session as a launch would. A daemon overlay reports each committed target change, so the daemon starts the next overlay in that session; a remembered session that no longer exists falls back to home.
diff --git a/src/backend/wayland/backend/event_loop/session_save.rs b/src/backend/wayland/backend/event_loop/session_save.rs
index 3c4c6fc33..a1ad77853 100644
--- a/src/backend/wayland/backend/event_loop/session_save.rs
+++ b/src/backend/wayland/backend/event_loop/session_save.rs
@@ -9,9 +9,23 @@ use crate::{
 };
 use std::time::{Duration, Instant};
 
-const AUTOSAVE_ACTIVE_INTERACTION_DEFER_MS: u64 = 500;
-
+mod diagnostics;
+mod final_save;
+mod interaction;
 mod notifications;
+use diagnostics::{SessionSaveReason, log_session_save_result, log_snapshot_capture};
+
+use final_save::persist_final_session_and_shutdown;
+pub(in crate::backend::wayland) use interaction::should_defer_for_interaction;
+use interaction::{
+    defer_autosave_for_active_interaction, finalize_spotlight_wheel_for_shutdown_persistence,
+    min_optional_timeout,
+};
+#[cfg(test)]
+use interaction::{
+    defer_pending_autosave_for_interaction, input_persistence_interaction_active,
+    persistence_interaction_active,
+};
 
 pub(super) use notifications::notify_session_failure;
 #[cfg(test)]
@@ -34,169 +48,12 @@ pub(super) fn persist_session(state: &mut WaylandState) -> Result<(), anyhow::Er
         &mut state.input_state,
         state.spotlight.wheel_idle_deadline_mut(),
     );
-    if let Some(pending) = state.session.cancel_pending_output_transition() {
-        log::info!(
-            "Canceling staged output transition to {:?} during shutdown; persisting active epoch {}",
-            pending.physical_output_identity,
-            state.session.target_epoch()
-        );
-    }
     runtime_session::driver::persist_after_pending_commands(
         state,
         persist_final_session_and_shutdown,
     )
 }
 
-fn persist_final_session_and_shutdown(state: &mut WaylandState) -> Result<(), anyhow::Error> {
-    let save_result = persist_final_session(state);
-    let worker_failed = !state.persistence.is_healthy();
-    let shutdown_result = state.persistence.shutdown(state.session.target_epoch());
-    if save_result.is_err() && worker_failed && state.persistence.is_stopped() {
-        log::warn!(
-            "Persistence worker failed before the final save; attempting joined event-thread fallback"
-        );
-        match persist_final_session_direct(state) {
-            Ok(()) => {
-                if let Err(shutdown) = shutdown_result {
-                    log::warn!(
-                        "Persistence worker shutdown failed before successful direct fallback: {shutdown:#}"
-                    );
-                }
-                return Ok(());
-            }
-            Err(fallback) => {
-                let original = save_result.expect_err("fallback requires failed worker save");
-                return Err(anyhow::anyhow!(
-                    "worker final save failed: {original:#}; joined direct fallback also failed: {fallback:#}"
-                ));
-            }
-        }
-    }
-    match (save_result, shutdown_result) {
-        (Err(save), Err(shutdown)) => Err(anyhow::anyhow!(
-            "final session save failed: {save:#}; persistence worker shutdown also failed: {shutdown:#}"
-        )),
-        (Err(save), Ok(())) => Err(save),
-        (Ok(()), Err(shutdown)) => Err(shutdown),
-        (Ok(()), Ok(())) => Ok(()),
-    }
-}
-
-fn persist_final_session_direct(state: &mut WaylandState) -> Result<(), anyhow::Error> {
-    observe_input_dirty(state, Instant::now());
-    let Some(options) = state.session_options().cloned() else {
-        return Ok(());
-    };
-    if should_skip_disabled_final_save(&options) {
-        return Ok(());
-    }
-    if should_skip_protected_session_save(state, &options) {
-        return Ok(());
-    }
-    let snapshot = state
-        .input_state
-        .snapshot_for_persistence_with(state.render.text_measurer(), &options);
-    let has_board_data = snapshot
-        .as_ref()
-        .is_some_and(session::SessionSnapshot::has_board_data);
-    if runtime_session::should_skip_unloaded_contentless_save(
-        state.session.has_loaded_board_data(),
-        state.session.is_dirty(),
-        state.input_state.is_session_dirty(),
-        has_board_data,
-        runtime_session::has_session_artifact(&options),
-    ) {
-        return Ok(());
-    }
-    let snapshot = snapshot_or_empty(state, &options, snapshot)?;
-    let snapshot_board_data = snapshot.has_board_data();
-    let report = session::save_snapshot_with_report_and_clear_boundary(
-        &snapshot,
-        &options,
-        state.session.has_loaded_board_data(),
-    )?;
-    let Some(report) = report else {
-        return Err(anyhow::anyhow!(
-            "joined direct fallback produced no committed session write"
-        ));
-    };
-    let committed_board_data =
-        !matches!(report.outcome, session::SaveSnapshotOutcome::ClearedEmpty)
-            && snapshot_board_data;
-    log_session_save_result(SessionSaveReason::Shutdown, Some(&report), Duration::ZERO);
-    state
-        .session
-        .mark_saved(Instant::now(), committed_board_data);
-    Ok(())
-}
-
-fn persist_final_session(state: &mut WaylandState) -> Result<(), anyhow::Error> {
-    let barrier_result = persistence_barrier(state);
-    if let Some(err) = final_save_barrier_policy(barrier_result, state.persistence.is_healthy())? {
-        log::warn!(
-            "Autosave failed while preparing the final session save; retrying the current live state with the normal save strategy: {err:#}"
-        );
-    }
-    let Some(options) = state.session_options().cloned() else {
-        return Ok(());
-    };
-    if should_skip_disabled_final_save(&options) {
-        return Ok(());
-    }
-
-    if should_skip_protected_session_save(state, &options) {
-        return Ok(());
-    }
-
-    let started = Instant::now();
-    log::info!(
-        "Starting {} session persistence to {}",
-        SessionSaveReason::Shutdown.label(),
-        options.session_file_path().display()
-    );
-    let snapshot_started = Instant::now();
-    let snapshot = state
-        .input_state
-        .snapshot_for_persistence_with(state.render.text_measurer(), &options);
-    log_snapshot_capture(
-        SessionSaveReason::Shutdown,
-        &options,
-        snapshot.as_ref(),
-        snapshot_started.elapsed(),
-    );
-    if should_skip_unloaded_contentless_save(state, &options, snapshot.as_ref())? {
-        return Ok(());
-    }
-    let snapshot = snapshot_or_empty(state, &options, snapshot)?;
-    let outcome = run_persistence_operation(
-        state,
-        PersistenceOperation::Save {
-            snapshot,
-            options,
-            strategy: SaveStrategy::Normal,
-            contentless_clear_boundary: state.session.has_loaded_board_data(),
-        },
-    )?;
-    let PersistenceOutcome::Save(save) = outcome else {
-        return Err(anyhow::anyhow!("unexpected final-save worker outcome"));
-    };
-    if !save.committed() {
-        return Err(anyhow::anyhow!(
-            "final session save produced no committed write"
-        ));
-    }
-    log_session_save_result(
-        SessionSaveReason::Shutdown,
-        save.report.as_ref(),
-        started.elapsed(),
-    );
-    notify_session_save_report(state, save.report.as_ref());
-    state
-        .session
-        .mark_saved(Instant::now(), save.committed_board_data);
-    Ok(())
-}
-
 pub(super) fn autosave_timeout(state: &WaylandState, now: Instant) -> Option<Duration> {
     if state.session_transaction.is_some() {
         // A queued command may outlive a failed autosave completion. Admit it
@@ -266,6 +123,12 @@ pub(super) fn autosave_if_due(state: &mut WaylandState, now: Instant) -> Result<
         return Ok(());
     }
 
+    if !state
+        .session
+        .validate_source_write(state.input_state.is_session_dirty())?
+    {
+        return Ok(());
+    }
     let started = Instant::now();
     let snapshot_started = Instant::now();
     let snapshot = state
@@ -316,7 +179,7 @@ pub(super) fn autosave_if_due(state: &mut WaylandState, now: Instant) -> Result<
             if !state.persistence.is_healthy() {
                 handle_persistence_transport_failure(state, failed_at, &err);
             } else if record_autosave_failure(&mut state.session, failed_at, &options) {
-                show_session_failure_toast(state);
+                show_session_failure_toast(state, &err);
                 notify_session_failure(state, &err);
             }
             return Err(err);
@@ -370,6 +233,7 @@ pub(in crate::backend::wayland) fn run_persistence_operation(
     let result = state
         .persistence
         .run(state.session.target_epoch(), operation);
+    state.session.observe_load_failure(&result);
     if let Err(err) = &result
         && !state.persistence.is_healthy()
     {
@@ -408,10 +272,8 @@ impl PersistenceCompletionRuntime for WaylandState {
         &mut self,
     ) -> Result<Option<PersistenceCompletion>, anyhow::Error> {
         let result = self.persistence.try_receive();
-        if let Err(error) = &result
-            && let Some(transaction) = self.session_transaction.take()
-        {
-            self.fail_session_command(transaction.command(), error);
+        if let Err(error) = &result {
+            runtime_session::driver::fail_pending_commands(self, error);
         }
         result
     }
@@ -478,7 +340,7 @@ pub(in crate::backend::wayland) fn handle_autosave_failure(
         return;
     };
     if record_autosave_failure(&mut state.session, now, &options) {
-        show_session_failure_toast(state);
+        show_session_failure_toast(state, err);
         notify_session_failure(state, err);
     }
 }
@@ -518,159 +380,6 @@ fn record_persistence_transport_failure(
     session.mark_worker_failure_notified()
 }
 
-pub(in crate::backend::wayland) fn should_defer_for_interaction(state: &WaylandState) -> bool {
-    persistence_interaction_active(
-        input_persistence_interaction_active(&state.input_state),
-        state.toolbar_drag.item_dragging(),
-        state.toolbar_drag.is_moving(),
-        state.pointer.board_pan_active(),
-        state.zoom_panning_active(),
-        stylus_tip_down(state),
-    )
-}
-
-fn persistence_interaction_active(
-    input: bool,
-    toolbar_drag: bool,
-    move_drag: bool,
-    board_pan: bool,
-    zoom_pan: bool,
-    stylus_tip: bool,
-) -> bool {
-    input || toolbar_drag || move_drag || board_pan || zoom_pan || stylus_tip
-}
-
-fn input_persistence_interaction_active(input_state: &crate::input::InputState) -> bool {
-    input_state.has_active_pointer_interaction()
-        || matches!(
-            input_state.state,
-            crate::input::DrawingState::TextInput { .. }
-        )
-        || input_state.has_pending_spotlight_magnification_gesture()
-}
-
-pub(in crate::backend::wayland) fn interaction_defer_interval() -> Duration {
-    Duration::from_millis(AUTOSAVE_ACTIVE_INTERACTION_DEFER_MS)
-}
-
-fn min_optional_timeout(a: Option<Duration>, b: Option<Duration>) -> Option<Duration> {
-    match (a, b) {
-        (Some(a), Some(b)) => Some(a.min(b)),
-        (Some(value), None) | (None, Some(value)) => Some(value),
-        (None, None) => None,
-    }
-}
-
-fn defer_pending_autosave_for_interaction(
-    session: &mut SessionState,
-    now: Instant,
-    options: &session::SessionOptions,
-) -> bool {
-    if session.autosave_timeout(now, options).is_none() {
-        return false;
-    }
-
-    let delay = Duration::from_millis(AUTOSAVE_ACTIVE_INTERACTION_DEFER_MS);
-    session.defer_autosave(now, delay);
-    log::debug!(
-        "Deferring autosave for {:?} while an input interaction is active",
-        delay
-    );
-    true
-}
-
-fn defer_autosave_for_active_interaction(
-    session: &mut SessionState,
-    now: Instant,
-    options: &session::SessionOptions,
-    interaction_active: bool,
-) -> bool {
-    interaction_active && defer_pending_autosave_for_interaction(session, now, options)
-}
-
-fn finalize_spotlight_wheel_for_shutdown_persistence(
-    input_state: &mut crate::input::InputState,
-    spotlight_wheel_idle_deadline: &mut Option<Instant>,
-) {
-    input_state.flush_spotlight_magnification_gesture();
-    *spotlight_wheel_idle_deadline = None;
-}
-
-#[cfg(feature = "tablet-input")]
-fn stylus_tip_down(state: &WaylandState) -> bool {
-    state.tablet.tip_down
-}
-
-#[cfg(not(feature = "tablet-input"))]
-fn stylus_tip_down(_state: &WaylandState) -> bool {
-    false
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-enum SessionSaveReason {
-    Autosave,
-    Shutdown,
-}
-
-impl SessionSaveReason {
-    fn label(self) -> &'static str {
-        match self {
-            Self::Autosave => "autosave",
-            Self::Shutdown => "shutdown",
-        }
-    }
-}
-
-fn log_snapshot_capture(
-    reason: SessionSaveReason,
-    options: &session::SessionOptions,
-    snapshot: Option<&session::SessionSnapshot>,
-    elapsed: Duration,
-) {
-    let Some(_snapshot) = snapshot else {
-        log::info!(
-            "Captured {} session snapshot for {} in {:?}: no persistable data",
-            reason.label(),
-            options.session_file_path().display(),
-            elapsed
-        );
-        return;
-    };
-
-    log::info!(
-        "Captured {} session snapshot for {} in {:?}; diagnostics and payload preparation will run on the persistence worker",
-        reason.label(),
-        options.session_file_path().display(),
-        elapsed
-    );
-}
-
-fn log_session_save_result(
-    reason: SessionSaveReason,
-    report: Option<&SaveSnapshotReport>,
-    elapsed: Duration,
-) {
-    let Some(report) = report else {
-        log::info!(
-            "Finished {} session persistence in {:?}: no file write needed",
-            reason.label(),
-            elapsed
-        );
-        return;
-    };
-
-    log::info!(
-        "Finished {} session persistence in {:?}: outcome={:?}, written={} bytes, raw={} bytes, compression={}, path={}",
-        reason.label(),
-        elapsed,
-        report.outcome,
-        report.written_size,
-        report.raw_size,
-        report.compressed,
-        report.path.display()
-    );
-}
-
 fn persistence_enabled(options: &session::SessionOptions) -> bool {
     options.any_enabled() || options.restore_tool_state || options.persist_history
 }
@@ -694,10 +403,17 @@ fn should_skip_protected_session_save(
         .session
         .should_skip_save_for_protected_path(&session_path, state.input_state.is_session_dirty());
     if skip {
-        log::info!(
-            "Skipping session save to {} because a previous oversized compressed session was left protected and no session changes have been made",
-            session_path.display()
-        );
+        if state.session.refuses_source_write(&session_path) {
+            log::warn!(
+                "Skipping session save to {} because unreadable data could not be preserved; repair and reload the session or use Save As",
+                session_path.display()
+            );
+        } else {
+            log::info!(
+                "Skipping session save to {} because an oversized session is protected and no session changes have been made",
+                session_path.display()
+            );
+        }
     }
     skip
 }
diff --git a/src/backend/wayland/backend/event_loop/session_save/diagnostics.rs b/src/backend/wayland/backend/event_loop/session_save/diagnostics.rs
new file mode 100644
index 000000000..d4fba2573
--- /dev/null
+++ b/src/backend/wayland/backend/event_loop/session_save/diagnostics.rs
@@ -0,0 +1,66 @@
+use super::*;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum SessionSaveReason {
+    Autosave,
+    Shutdown,
+}
+
+impl SessionSaveReason {
+    pub(super) fn label(self) -> &'static str {
+        match self {
+            Self::Autosave => "autosave",
+            Self::Shutdown => "shutdown",
+        }
+    }
+}
+
+pub(super) fn log_snapshot_capture(
+    reason: SessionSaveReason,
+    options: &session::SessionOptions,
+    snapshot: Option<&session::SessionSnapshot>,
+    elapsed: Duration,
+) {
+    let Some(_snapshot) = snapshot else {
+        log::info!(
+            "Captured {} session snapshot for {} in {:?}: no persistable data",
+            reason.label(),
+            options.session_file_path().display(),
+            elapsed
+        );
+        return;
+    };
+
+    log::info!(
+        "Captured {} session snapshot for {} in {:?}; diagnostics and payload preparation will run on the persistence worker",
+        reason.label(),
+        options.session_file_path().display(),
+        elapsed
+    );
+}
+
+pub(super) fn log_session_save_result(
+    reason: SessionSaveReason,
+    report: Option<&SaveSnapshotReport>,
+    elapsed: Duration,
+) {
+    let Some(report) = report else {
+        log::info!(
+            "Finished {} session persistence in {:?}: no file write needed",
+            reason.label(),
+            elapsed
+        );
+        return;
+    };
+
+    log::info!(
+        "Finished {} session persistence in {:?}: outcome={:?}, written={} bytes, raw={} bytes, compression={}, path={}",
+        reason.label(),
+        elapsed,
+        report.outcome,
+        report.written_size,
+        report.raw_size,
+        report.compressed,
+        report.path.display()
+    );
+}
diff --git a/src/backend/wayland/backend/event_loop/session_save/final_save.rs b/src/backend/wayland/backend/event_loop/session_save/final_save.rs
new file mode 100644
index 000000000..013364ac2
--- /dev/null
+++ b/src/backend/wayland/backend/event_loop/session_save/final_save.rs
@@ -0,0 +1,362 @@
+use std::path::PathBuf;
+
+use super::*;
+
+pub(super) fn persist_final_session_and_shutdown(
+    state: &mut WaylandState,
+) -> Result<(), anyhow::Error> {
+    let save_result = persist_final_session(state);
+    let worker_failed = !state.persistence.is_healthy();
+    let shutdown_result = state.persistence.shutdown(state.session.target_epoch());
+    if save_result.is_err() && worker_failed && state.persistence.is_stopped() {
+        log::warn!(
+            "Persistence worker failed before the final save; attempting joined event-thread fallback"
+        );
+        match persist_final_session_direct(state) {
+            Ok(()) => {
+                if let Err(shutdown) = shutdown_result {
+                    log::warn!(
+                        "Persistence worker shutdown failed before successful direct fallback: {shutdown:#}"
+                    );
+                }
+                return Ok(());
+            }
+            Err(fallback) => {
+                let original = save_result.expect_err("fallback requires failed worker save");
+                // Context keeps the fallback's typed error for the exit notice.
+                return Err(fallback.context(format!(
+                    "worker final save failed: {original:#}; joined direct fallback also failed"
+                )));
+            }
+        }
+    }
+    match (save_result, shutdown_result) {
+        (Err(save), Err(shutdown)) => Err(save.context(format!(
+            "final session save failed; persistence worker shutdown also failed: {shutdown:#}"
+        ))),
+        (Err(save), Ok(())) => Err(save),
+        (Ok(()), Err(shutdown)) => Err(shutdown),
+        (Ok(()), Ok(())) => Ok(()),
+    }
+}
+
+fn persist_final_session_direct(state: &mut WaylandState) -> Result<(), anyhow::Error> {
+    observe_input_dirty(state, Instant::now());
+    let Some(options) = state.session_options().cloned() else {
+        return Ok(());
+    };
+    match state
+        .session
+        .validate_source_write(state.input_state.is_session_dirty())
+    {
+        Ok(true) => {}
+        Ok(false) => return Ok(()),
+        Err(refusal) => return save_refused_drawings(state, &options, refusal, SideWrite::Direct),
+    }
+    if should_skip_disabled_final_save(&options) {
+        return Ok(());
+    }
+    if should_skip_protected_session_save(state, &options) {
+        return Ok(());
+    }
+    let snapshot = state
+        .input_state
+        .snapshot_for_persistence_with(state.render.text_measurer(), &options);
+    let has_board_data = snapshot
+        .as_ref()
+        .is_some_and(session::SessionSnapshot::has_board_data);
+    if runtime_session::should_skip_unloaded_contentless_save(
+        state.session.has_loaded_board_data(),
+        state.session.is_dirty(),
+        state.input_state.is_session_dirty(),
+        has_board_data,
+        runtime_session::has_session_artifact(&options),
+    ) {
+        return Ok(());
+    }
+    let snapshot = snapshot_or_empty(state, &options, snapshot)?;
+    let snapshot_board_data = snapshot.has_board_data();
+    let report = session::save_snapshot_with_report_and_clear_boundary(
+        &snapshot,
+        &options,
+        state.session.has_loaded_board_data(),
+    )?;
+    let Some(report) = report else {
+        return Err(anyhow::anyhow!(
+            "joined direct fallback produced no committed session write"
+        ));
+    };
+    let committed_board_data =
+        !matches!(report.outcome, session::SaveSnapshotOutcome::ClearedEmpty)
+            && snapshot_board_data;
+    log_session_save_result(SessionSaveReason::Shutdown, Some(&report), Duration::ZERO);
+    state
+        .session
+        .mark_saved(Instant::now(), committed_board_data);
+    Ok(())
+}
+
+fn persist_final_session(state: &mut WaylandState) -> Result<(), anyhow::Error> {
+    let barrier_result = persistence_barrier(state);
+    if let Some(err) = final_save_barrier_policy(barrier_result, state.persistence.is_healthy())? {
+        log::warn!(
+            "Autosave failed while preparing the final session save; retrying the current live state with the normal save strategy: {err:#}"
+        );
+    }
+    if let Some(path) = state.unloaded_remembered_session()
+        && !state.session.is_dirty()
+        && !state.input_state.is_session_dirty()
+        && session::validate_named_session_file_for_open(&path).is_err()
+        && let Some(options) = state.session_options().cloned()
+    {
+        let identity = state
+            .surface
+            .current_output()
+            .as_ref()
+            .and_then(|output| state.output_identity_for(output));
+        state.load_configured_session_for_options(
+            options,
+            identity.as_deref(),
+            "shutdown remembered fallback",
+        )?;
+    }
+    let Some(options) = state.session_options().cloned() else {
+        return Ok(());
+    };
+    match state
+        .session
+        .validate_source_write(state.input_state.is_session_dirty())
+    {
+        Ok(true) => {}
+        Ok(false) => return Ok(()),
+        Err(refusal) => return save_refused_drawings(state, &options, refusal, SideWrite::Worker),
+    }
+    if should_skip_disabled_final_save(&options) {
+        return Ok(());
+    }
+
+    if should_skip_protected_session_save(state, &options) {
+        return Ok(());
+    }
+
+    let started = Instant::now();
+    log::info!(
+        "Starting {} session persistence to {}",
+        SessionSaveReason::Shutdown.label(),
+        options.session_file_path().display()
+    );
+    let snapshot_started = Instant::now();
+    let snapshot = state
+        .input_state
+        .snapshot_for_persistence_with(state.render.text_measurer(), &options);
+    log_snapshot_capture(
+        SessionSaveReason::Shutdown,
+        &options,
+        snapshot.as_ref(),
+        snapshot_started.elapsed(),
+    );
+    if should_skip_unloaded_contentless_save(state, &options, snapshot.as_ref())? {
+        return Ok(());
+    }
+    let snapshot = snapshot_or_empty(state, &options, snapshot)?;
+    let outcome = run_persistence_operation(
+        state,
+        PersistenceOperation::Save {
+            snapshot,
+            options,
+            strategy: SaveStrategy::Normal,
+            contentless_clear_boundary: state.session.has_loaded_board_data(),
+        },
+    )?;
+    let PersistenceOutcome::Save(save) = outcome else {
+        return Err(anyhow::anyhow!("unexpected final-save worker outcome"));
+    };
+    if !save.committed() {
+        return Err(anyhow::anyhow!(
+            "final session save produced no committed write"
+        ));
+    }
+    log_session_save_result(
+        SessionSaveReason::Shutdown,
+        save.report.as_ref(),
+        started.elapsed(),
+    );
+    notify_session_save_report(state, save.report.as_ref());
+    state
+        .session
+        .mark_saved(Instant::now(), save.committed_board_data);
+    Ok(())
+}
+
+/// Drawings that the write policy keeps out of their session file, because
+/// that session never loaded or its unreadable bytes could not be preserved,
+/// were saved beside it at exit instead of closing with the overlay.
+#[derive(Debug)]
+pub(super) struct RefusedDrawingsSaved {
+    pub(super) session: PathBuf,
+    pub(super) saved_to: PathBuf,
+    /// Set when the drawings exceed the size limit and were kept in the new
+    /// session's recovery file, which opening that session restores.
+    pub(super) recovery: Option<PathBuf>,
+}
+
+impl std::fmt::Display for RefusedDrawingsSaved {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            formatter,
+            "drawings that could not be written to {} were saved to {}",
+            self.session.display(),
+            self.saved_to.display()
+        )?;
+        if let Some(recovery) = &self.recovery {
+            write!(formatter, " (recovery file {})", recovery.display())?;
+        }
+        Ok(())
+    }
+}
+
+impl std::error::Error for RefusedDrawingsSaved {}
+
+#[derive(Clone, Copy)]
+enum SideWrite {
+    Worker,
+    Direct,
+}
+
+/// Saves drawings the session file refused into a new named session beside
+/// it, so closing the overlay does not discard them. Only tool settings, with
+/// no drawings, are not worth a file.
+fn save_refused_drawings(
+    state: &mut WaylandState,
+    options: &session::SessionOptions,
+    refusal: anyhow::Error,
+    write: SideWrite,
+) -> Result<(), anyhow::Error> {
+    let side = refused_drawings_options(options);
+    let snapshot = state
+        .input_state
+        .snapshot_for_persistence_with(state.render.text_measurer(), &side)
+        .filter(session::SessionSnapshot::has_board_data);
+    let Some(snapshot) = snapshot else {
+        log::info!("Final save skipped: {refusal:#}; no drawings to keep");
+        return Ok(());
+    };
+
+    Err(match write_side_session(state, &side, snapshot, write) {
+        Ok(recovery) => RefusedDrawingsSaved {
+            session: options.session_file_path(),
+            saved_to: side.session_file_path(),
+            recovery,
+        }
+        .into(),
+        Err(error) => anyhow::anyhow!(
+            "drawings that could not be written to {} were lost: saving them to {} also failed: {error:#}",
+            options.session_file_path().display(),
+            side.session_file_path().display()
+        ),
+    })
+}
+
+/// Writes `snapshot` as a new session at `side`, returning the recovery file
+/// when the drawings exceed the size limit. Like an oversized normal save,
+/// those drawings go to the recovery file beside a primary that holds only
+/// tool settings, and opening the session restores them.
+fn write_side_session(
+    state: &mut WaylandState,
+    side: &session::SessionOptions,
+    snapshot: session::SessionSnapshot,
+    write: SideWrite,
+) -> Result<Option<PathBuf>, anyhow::Error> {
+    let error = match save_side_session_as(state, side, snapshot.clone(), write) {
+        Ok(()) => return Ok(None),
+        Err(error)
+            if error
+                .downcast_ref::<session::SavePayloadTooLarge>()
+                .is_some() =>
+        {
+            error
+        }
+        Err(error) => return Err(error),
+    };
+    log::warn!(
+        "Refused drawings exceed the session size limit; keeping them in recovery: {error:#}"
+    );
+
+    let settings_only = session::SessionSnapshot {
+        active_board_id: snapshot.active_board_id.clone(),
+        boards: Vec::new(),
+        tool_state: snapshot.tool_state.clone(),
+    };
+    save_side_session_as(state, side, settings_only, write)?;
+    let saved = match write {
+        SideWrite::Worker => run_persistence_operation(
+            state,
+            PersistenceOperation::Save {
+                snapshot,
+                options: side.clone(),
+                strategy: SaveStrategy::Normal,
+                contentless_clear_boundary: false,
+            },
+        )
+        .map(drop),
+        SideWrite::Direct => {
+            session::save_snapshot_with_report_and_clear_boundary(&snapshot, side, false).map(drop)
+        }
+    };
+
+    match saved {
+        Ok(()) => Ok(None),
+        Err(error) => error
+            .downcast_ref::<session::SavePayloadTooLarge>()
+            .and_then(|limit| limit.recovery_path.clone())
+            .map(Some)
+            .ok_or(error),
+    }
+}
+
+/// A Save As that never replaces an existing file.
+fn save_side_session_as(
+    state: &mut WaylandState,
+    side: &session::SessionOptions,
+    snapshot: session::SessionSnapshot,
+    write: SideWrite,
+) -> Result<(), anyhow::Error> {
+    match write {
+        SideWrite::Worker => run_persistence_operation(
+            state,
+            PersistenceOperation::SaveAs {
+                snapshot,
+                options: side.clone(),
+                overwrite: session::SaveAsOverwrite::Deny,
+            },
+        )
+        .map(drop),
+        SideWrite::Direct => {
+            session::save_snapshot_as_with_report(&snapshot, side, session::SaveAsOverwrite::Deny)
+                .map(|_| session::catalog::record_named_session_saved(side))
+        }
+    }
+}
+
+/// `<name>.unsaved-<milliseconds>.wayscriber-session` beside the session file.
+fn refused_drawings_options(options: &session::SessionOptions) -> session::SessionOptions {
+    let path = options.session_file_path();
+    let millis = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|elapsed| elapsed.as_millis())
+        .unwrap_or_default();
+    let mut name = path
+        .file_stem()
+        .map(std::ffi::OsStr::to_os_string)
+        .unwrap_or_else(|| "session".into());
+    name.push(format!(".unsaved-{millis}.wayscriber-session"));
+    let parent = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| std::path::Path::new("."));
+
+    let mut side = options.clone();
+    side.set_named_file_target(parent.join(name));
+    side.force_resume_persistence();
+    side
+}
diff --git a/src/backend/wayland/backend/event_loop/session_save/interaction.rs b/src/backend/wayland/backend/event_loop/session_save/interaction.rs
new file mode 100644
index 000000000..cbb254a4c
--- /dev/null
+++ b/src/backend/wayland/backend/event_loop/session_save/interaction.rs
@@ -0,0 +1,85 @@
+use super::*;
+
+pub(in crate::backend::wayland) fn should_defer_for_interaction(state: &WaylandState) -> bool {
+    persistence_interaction_active(
+        input_persistence_interaction_active(&state.input_state),
+        state.toolbar_drag.item_dragging(),
+        state.toolbar_drag.is_moving(),
+        state.pointer.board_pan_active(),
+        state.zoom_panning_active(),
+        stylus_tip_down(state),
+    )
+}
+
+pub(super) fn persistence_interaction_active(
+    input: bool,
+    toolbar_drag: bool,
+    move_drag: bool,
+    board_pan: bool,
+    zoom_pan: bool,
+    stylus_tip: bool,
+) -> bool {
+    input || toolbar_drag || move_drag || board_pan || zoom_pan || stylus_tip
+}
+
+pub(super) fn input_persistence_interaction_active(input_state: &crate::input::InputState) -> bool {
+    input_state.has_active_pointer_interaction()
+        || matches!(
+            input_state.state,
+            crate::input::DrawingState::TextInput { .. }
+        )
+        || input_state.has_pending_spotlight_magnification_gesture()
+}
+
+pub(super) fn min_optional_timeout(a: Option<Duration>, b: Option<Duration>) -> Option<Duration> {
+    match (a, b) {
+        (Some(a), Some(b)) => Some(a.min(b)),
+        (Some(value), None) | (None, Some(value)) => Some(value),
+        (None, None) => None,
+    }
+}
+
+pub(super) fn defer_pending_autosave_for_interaction(
+    session: &mut SessionState,
+    now: Instant,
+    options: &session::SessionOptions,
+) -> bool {
+    if session.autosave_timeout(now, options).is_none() {
+        return false;
+    }
+
+    let delay = runtime_session::interaction_defer_interval();
+    session.defer_autosave(now, delay);
+    log::debug!(
+        "Deferring autosave for {:?} while an input interaction is active",
+        delay
+    );
+    true
+}
+
+pub(super) fn defer_autosave_for_active_interaction(
+    session: &mut SessionState,
+    now: Instant,
+    options: &session::SessionOptions,
+    interaction_active: bool,
+) -> bool {
+    interaction_active && defer_pending_autosave_for_interaction(session, now, options)
+}
+
+pub(super) fn finalize_spotlight_wheel_for_shutdown_persistence(
+    input_state: &mut crate::input::InputState,
+    spotlight_wheel_idle_deadline: &mut Option<Instant>,
+) {
+    input_state.flush_spotlight_magnification_gesture();
+    *spotlight_wheel_idle_deadline = None;
+}
+
+#[cfg(feature = "tablet-input")]
+fn stylus_tip_down(state: &WaylandState) -> bool {
+    state.tablet.is_canvas_gesture()
+}
+
+#[cfg(not(feature = "tablet-input"))]
+fn stylus_tip_down(_state: &WaylandState) -> bool {
+    false
+}
diff --git a/src/backend/wayland/backend/event_loop/session_save/notifications.rs b/src/backend/wayland/backend/event_loop/session_save/notifications.rs
index a02f64a7d..03d1a4145 100644
--- a/src/backend/wayland/backend/event_loop/session_save/notifications.rs
+++ b/src/backend/wayland/backend/event_loop/session_save/notifications.rs
@@ -156,10 +156,7 @@ pub(in crate::backend::wayland::backend::event_loop) fn notify_session_failure(
     notification::send_notification_with_timeout_async(
         &state.tokio_handle,
         "Failed to Save Session".to_string(),
-        format!(
-            "Drawings may not persist. Raise Session > Max file size, remove images, or disable persisted history. Details: {}",
-            err
-        ),
+        session_failure_text(err, true),
         Some("dialog-error".to_string()),
         SESSION_SAVE_NOTIFICATION_TIMEOUT_MS,
     );
@@ -177,11 +174,11 @@ pub(super) fn notify_persistence_worker_failure(state: &WaylandState, err: &anyh
     );
 }
 
-pub(super) fn show_session_failure_toast(state: &mut WaylandState) {
+pub(super) fn show_session_failure_toast(state: &mut WaylandState, error: &anyhow::Error) {
     state.input_state.push_toast(
         ToastPriority::Action,
         "session.save",
-        Toast::warning("Session save failed; drawings may not restore. Check max_file_size_mb.")
+        Toast::warning(session_failure_text(error, false))
             .action("Settings", Action::OpenConfigurator)
             .duration_ms(SESSION_SAVE_WARNING_TOAST_MS),
     );
@@ -199,6 +196,51 @@ pub(super) fn show_persistence_worker_failure_toast(state: &mut WaylandState) {
     );
 }
 
+/// Advice follows the typed storage error and whether shutdown wrote recovery.
+pub(super) fn session_failure_text(error: &anyhow::Error, shutdown: bool) -> String {
+    if let Some(saved) = error.downcast_ref::<super::final_save::RefusedDrawingsSaved>() {
+        let kept = match &saved.recovery {
+            Some(recovery) => format!(
+                "were saved to {} instead, in its recovery file {} because they exceed the session size limit",
+                saved.saved_to.display(),
+                recovery.display()
+            ),
+            None => format!("were saved to {} instead", saved.saved_to.display()),
+        };
+        return format!(
+            "New drawings were not written to {} and {kept}. Open that file to continue them.",
+            saved.session.display()
+        );
+    }
+    if let Some(failure) = error.downcast_ref::<session::SavePayloadTooLarge>() {
+        let advice = match failure.limit {
+            session::SaveLimitExceeded::WrittenSize { .. } => {
+                "Raise Settings > Session > Max file size, or remove images."
+            }
+            session::SaveLimitExceeded::ExpandedSize { .. } => {
+                "Reduce images or undo history to fit the expanded session safety limit."
+            }
+        };
+        let saved = failure
+            .recovery_path
+            .as_ref()
+            .map(|path| {
+                format!(
+                    "Drawings were preserved in the recovery file {}. ",
+                    path.display()
+                )
+            })
+            .unwrap_or_default();
+        return format!("{saved}Session exceeds its size limit. {advice} Details: {error}");
+    }
+    let advice = if shutdown {
+        "Check session files, disk space and permissions."
+    } else {
+        "Check session files, disk space and permissions, or use Save As to keep the current drawings."
+    };
+    format!("Session save failed. {advice} Details: {error}")
+}
+
 fn suggested_limit_mb(projected_written_size: u64, current_limit_bytes: u64) -> u64 {
     const MIB: u64 = 1024 * 1024;
     let projected_mb = projected_written_size.div_ceil(MIB);
@@ -215,3 +257,53 @@ fn config_path_display() -> String {
         .map(|path| path.display().to_string())
         .unwrap_or_else(|_| "~/.config/wayscriber/config.toml".to_string())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn real_size_failures_name_the_limit_and_durable_recovery_without_save_as_advice() {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let mut options = session::SessionOptions::new(temp.path().to_path_buf(), "size-notice");
+        options.persist_transparent = true;
+        options.max_file_size_bytes = 1;
+        let measurer = crate::draw::TextMeasurer::default();
+        let mut input = crate::input::InputState::from_config(&Config::default());
+        input.on_mouse_press(crate::input::MouseButton::Left, 300, 300);
+        input.on_mouse_motion(400, 400);
+        input.on_mouse_release(crate::input::MouseButton::Left, 400, 400);
+        let snapshot = input
+            .snapshot_for_persistence_with(&measurer, &options)
+            .unwrap();
+        let autosave =
+            session::save_snapshot_autosave_with_report(&snapshot, &options).unwrap_err();
+        let notice = session_failure_text(&autosave, false);
+        assert!(notice.contains("Max file size"));
+        assert!(!notice.contains("Save As"));
+        let shutdown = session::save_snapshot_with_report(&snapshot, &options).unwrap_err();
+        assert!(options.recovery_file_path().is_file());
+        let notice = session_failure_text(&shutdown, true);
+        assert!(notice.contains("preserved in the recovery file"));
+        assert!(!notice.contains("may not persist"));
+        assert!(!notice.contains("Save As"));
+        let expanded: anyhow::Error = session::SavePayloadTooLarge {
+            limit: session::SaveLimitExceeded::ExpandedSize {
+                raw_size: 200,
+                max_expanded_size: 100,
+            },
+            recovery_path: None,
+            raw_size: 200,
+            written_size: 10,
+            compressed: true,
+        }
+        .into();
+        let notice = session_failure_text(&expanded, false);
+        assert!(notice.contains("Reduce images or undo history"));
+        assert!(!notice.contains("Max file size"));
+        assert!(!notice.contains("Save As"));
+        let generic = anyhow::anyhow!("disk full");
+        assert!(session_failure_text(&generic, false).contains("Save As"));
+        assert!(!session_failure_text(&generic, true).contains("Save As"));
+    }
+}
diff --git a/src/backend/wayland/backend/event_loop/session_save/tests.rs b/src/backend/wayland/backend/event_loop/session_save/tests.rs
index 36930a73c..7caf529c0 100644
--- a/src/backend/wayland/backend/event_loop/session_save/tests.rs
+++ b/src/backend/wayland/backend/event_loop/session_save/tests.rs
@@ -6,6 +6,118 @@ use crate::input::state::{SpotlightWheelOutcome, test_support::make_test_input_s
 use crate::session::SaveSnapshotOutcome;
 use std::path::PathBuf;
 
+#[test]
+fn clean_failed_initial_load_exits_without_a_save_failure_or_a_source_write() {
+    use crate::backend::wayland::handlers::test_support::HandlerFixture;
+    let temp = crate::test_temp::tempdir().unwrap();
+    let mut options = session::SessionOptions::new(temp.path().to_path_buf(), "failed-startup");
+    options.persist_transparent = true;
+    options.set_named_file_target(temp.path().join("failed.wayscriber-session"));
+    std::fs::write(options.session_file_path(), b"unreadable").unwrap();
+    std::fs::write(
+        session::append_path_suffix(
+            &options.session_file_path(),
+            ".corrupt-18446744073709551615",
+        ),
+        b"occupied",
+    )
+    .unwrap();
+    let mut fixture = HandlerFixture::new(crate::config::Config::default());
+    fixture.state.session = SessionState::new(Some(options.clone()));
+    fixture
+        .state
+        .begin_session_output_transition(None, "initial load failure");
+    assert!(!fixture.state.session.is_loaded());
+    assert!(!fixture.state.session.is_dirty());
+    persist_session(&mut fixture.state).unwrap();
+    assert_eq!(
+        std::fs::read(options.session_file_path()).unwrap(),
+        b"unreadable"
+    );
+    assert!(!options.backup_file_path().exists());
+}
+
+#[test]
+fn drawings_a_never_loaded_session_refuses_are_saved_beside_it_at_exit() {
+    // With the worker and through the joined fallback after it died, for
+    // drawings that fit the size limit and for drawings that do not.
+    for worker_lost in [false, true] {
+        for oversized in [false, true] {
+            assert_refused_drawings_are_saved_beside_the_session(worker_lost, oversized);
+        }
+    }
+}
+
+fn assert_refused_drawings_are_saved_beside_the_session(worker_lost: bool, oversized: bool) {
+    use crate::backend::wayland::handlers::test_support::HandlerFixture;
+    let temp = crate::test_temp::tempdir().unwrap();
+    let mut options = session::SessionOptions::new(temp.path().to_path_buf(), "failed-startup");
+    options.persist_transparent = true;
+    options.set_named_file_target(temp.path().join("failed.wayscriber-session"));
+    options.compression = session::CompressionMode::Off;
+    options.max_file_size_bytes = 4096;
+    std::fs::write(options.session_file_path(), b"unreadable").unwrap();
+    std::fs::write(
+        session::append_path_suffix(
+            &options.session_file_path(),
+            ".corrupt-18446744073709551615",
+        ),
+        b"occupied",
+    )
+    .unwrap();
+    let mut fixture = HandlerFixture::new(crate::config::Config::default());
+    fixture.state.session = SessionState::new(Some(options.clone()));
+    fixture
+        .state
+        .begin_session_output_transition(None, "initial load failure");
+    assert!(!fixture.state.session.is_loaded());
+    let strokes = if oversized { 200 } else { 1 };
+    for stroke in 0..strokes {
+        let y = 100 + stroke;
+        let input = &mut fixture.state.input_state;
+        input.on_mouse_press(crate::input::MouseButton::Left, 600, y);
+        input.on_mouse_motion(620, y + 20);
+        input.on_mouse_release(crate::input::MouseButton::Left, 620, y + 20);
+    }
+    if worker_lost {
+        fixture
+            .state
+            .persistence
+            .try_submit(0, PersistenceOperation::PanicForTest)
+            .unwrap();
+        assert!(fixture.state.persistence.wait_for_completion().is_err());
+    }
+
+    let error = persist_session(&mut fixture.state).unwrap_err();
+
+    let saved = error
+        .downcast_ref::<final_save::RefusedDrawingsSaved>()
+        .unwrap_or_else(|| {
+            panic!("worker lost {worker_lost}, oversized {oversized}: drawings were not kept: {error:#}")
+        });
+    assert_eq!(saved.session, options.session_file_path());
+    let mut side = options.clone();
+    side.set_named_file_target(saved.saved_to.clone());
+    // Opened the way the Open command opens it.
+    let kept = match session::load_named_session_candidate(&side).unwrap() {
+        session::LoadSnapshotOutcome::Loaded(kept) if !oversized => kept,
+        session::LoadSnapshotOutcome::LoadedFromRecovery(kept) if oversized => kept,
+        other => panic!("oversized {oversized}: unexpected {other:?}"),
+    };
+    assert_eq!(kept.boards[0].pages.pages[0].shapes.len(), strokes as usize);
+    assert_eq!(saved.recovery, oversized.then(|| side.recovery_file_path()));
+    assert_eq!(
+        std::fs::read(options.session_file_path()).unwrap(),
+        b"unreadable",
+        "the session that never loaded is not written"
+    );
+    let notice = notifications::session_failure_text(&error, true);
+    assert!(
+        notice.contains(&saved.saved_to.display().to_string()),
+        "{notice}"
+    );
+}
+
 #[test]
 fn final_save_retries_after_failed_autosave_while_worker_is_healthy() {
     let error = anyhow::anyhow!("autosave failed");
@@ -60,6 +172,7 @@ fn a_due_autosave_is_deferred_while_spotlight_wheel_history_is_pending() {
     options.autosave_interval = Duration::from_millis(1);
     let started = Instant::now();
     let mut session = SessionState::new(Some(options.clone()));
+    session.commit_output_options(session.options().unwrap().clone(), true);
     session.record_input_dirty(started, true);
     let due_at = started + Duration::from_millis(2);
     assert!(session.autosave_due(due_at, &options));
@@ -129,6 +242,7 @@ fn unhealthy_worker_removes_dirty_session_from_automatic_schedule() {
     options.autosave_interval = Duration::from_millis(1);
     let now = Instant::now();
     let mut state = SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), true);
     state.record_input_dirty(now, true);
     let due = now + Duration::from_millis(2);
 
@@ -282,6 +396,7 @@ fn record_autosave_success_clears_dirty_state_when_saved() {
     options.autosave_interval = Duration::from_millis(1);
 
     let mut state = crate::backend::wayland::session::SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), true);
     let now = Instant::now();
     state.record_input_dirty(now, true);
     assert!(state.autosave_due(now + Duration::from_millis(2), &options));
@@ -316,6 +431,7 @@ fn record_autosave_success_without_saved_report_keeps_dirty_state() {
     options.autosave_interval = Duration::from_millis(1);
 
     let mut state = SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), true);
     let now = Instant::now();
     state.record_input_dirty(now, true);
     let due_at = now + Duration::from_millis(2);
@@ -336,6 +452,7 @@ fn autosave_failure_after_deferral_respects_backoff() {
     options.autosave_failure_backoff = Duration::from_millis(75);
 
     let mut state = SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), true);
     let now = Instant::now();
     state.record_input_dirty(now, true);
     let due_at = now + Duration::from_millis(2);
@@ -343,7 +460,7 @@ fn autosave_failure_after_deferral_respects_backoff() {
         &mut state, due_at, &options
     ));
 
-    let after_deferral = due_at + Duration::from_millis(AUTOSAVE_ACTIVE_INTERACTION_DEFER_MS);
+    let after_deferral = due_at + runtime_session::interaction_defer_interval();
     assert!(state.autosave_due(after_deferral, &options));
 
     assert!(record_autosave_failure(
@@ -368,12 +485,13 @@ fn interaction_deferral_refreshes_existing_autosave_deferral() {
     options.autosave_interval = Duration::from_millis(1);
 
     let mut state = SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), true);
     let now = Instant::now();
     state.record_input_dirty(now, true);
     let due_at = now + Duration::from_millis(2);
     assert!(state.autosave_due(due_at, &options));
 
-    let defer_for = Duration::from_millis(AUTOSAVE_ACTIVE_INTERACTION_DEFER_MS);
+    let defer_for = runtime_session::interaction_defer_interval();
     assert!(defer_pending_autosave_for_interaction(
         &mut state, due_at, &options
     ));
@@ -526,6 +644,7 @@ fn save_report(
     max_file_size_bytes: u64,
 ) -> SaveSnapshotReport {
     SaveSnapshotReport {
+        generation: None,
         path,
         outcome,
         raw_size: written_size,
diff --git a/src/backend/wayland/handlers/AGENTS.md b/src/backend/wayland/handlers/AGENTS.md
index a2bc72219..df74068d6 100644
--- a/src/backend/wayland/handlers/AGENTS.md
+++ b/src/backend/wayland/handlers/AGENTS.md
@@ -15,6 +15,7 @@
 - Keep pending chrome targets separate from device-owned release suppression; target cleanup preserves both latches, and touch cancellation clears only Touch suppression.
 - Route protocol surfaces through `SurfaceRouter`; do not add modality-specific canvas/toolbar classifiers.
 - Avoid blocking protocol callback paths.
+- Preserve press ownership across inline-strip crossings, toolbar visibility changes, unrelated releases, and tablet-frame coalescing. Consume matching pointer ownership before early release exits, and clear it on device detach.
 
 ## Coupled Changes
 - Input event changes may require `src/input/` state tests.
diff --git a/src/backend/wayland/handlers/mod.rs b/src/backend/wayland/handlers/mod.rs
index cb32def0b..27eabb0d9 100644
--- a/src/backend/wayland/handlers/mod.rs
+++ b/src/backend/wayland/handlers/mod.rs
@@ -42,3 +42,6 @@ mod tablet;
 mod text_input;
 mod touch;
 mod xdg;
+
+#[cfg(test)]
+pub(in crate::backend::wayland) mod test_support;
diff --git a/src/backend/wayland/handlers/pointer/axis.rs b/src/backend/wayland/handlers/pointer/axis.rs
index 4f39ab593..e76f09913 100644
--- a/src/backend/wayland/handlers/pointer/axis.rs
+++ b/src/backend/wayland/handlers/pointer/axis.rs
@@ -128,6 +128,12 @@ impl WaylandState {
         vertical: AxisScroll,
         source: Option<wl_pointer::AxisSource>,
     ) {
+        self.pointer.reconcile_contacts(
+            &self.input_state,
+            self.zoom.panning,
+            self.toolbar_drag.is_moving() || self.toolbar_drag.item_dragging(),
+        );
+
         let stopped = vertical.stop;
         self.handle_pointer_axis_inner(event, routed, vertical, source);
         // A finished scroll leaves no half notch waiting on a meter.
@@ -360,8 +366,7 @@ impl WaylandState {
         if !eraser_active
             && (self.input_state.style.current_thickness - prev_thickness).abs() > f64::EPSILON
         {
-            self.tablet.base_thickness = Some(self.input_state.style.current_thickness);
-            if self.tablet.tip_down {
+            if self.tablet.is_canvas_gesture() {
                 self.tablet.pressure_thickness = Some(self.input_state.style.current_thickness);
                 self.record_stylus_peak(self.input_state.style.current_thickness);
             } else {
diff --git a/src/backend/wayland/handlers/pointer/enter_leave.rs b/src/backend/wayland/handlers/pointer/enter_leave.rs
index fc6e86593..0a868b80c 100644
--- a/src/backend/wayland/handlers/pointer/enter_leave.rs
+++ b/src/backend/wayland/handlers/pointer/enter_leave.rs
@@ -13,6 +13,11 @@ impl WaylandState {
         event: &PointerEvent,
         routed: RoutedInput,
     ) {
+        self.pointer.reconcile_contacts(
+            &self.input_state,
+            self.zoom.panning,
+            self.toolbar_drag.is_moving() || self.toolbar_drag.item_dragging(),
+        );
         let on_toolbar = routed.surface == InputSurface::Toolbar;
         let preview_was_eligible = self.mouse_tool_preview_eligible();
         debug!(
@@ -59,7 +64,10 @@ impl WaylandState {
             self.input_state.clear_chrome_hover();
         }
         self.update_pointer_cursor(on_toolbar, conn);
-        if routed.inline_toolbars && routed.surface == InputSurface::Canvas {
+        if routed.inline_toolbars
+            && routed.surface == InputSurface::Canvas
+            && !self.pointer.contact_motion().skips_inline_strip()
+        {
             self.inline_toolbar_motion(event.position);
         }
         if preview_was_eligible != self.mouse_tool_preview_eligible() {
diff --git a/src/backend/wayland/handlers/pointer/mod.rs b/src/backend/wayland/handlers/pointer/mod.rs
index dbe5a9b65..6a7b92059 100644
--- a/src/backend/wayland/handlers/pointer/mod.rs
+++ b/src/backend/wayland/handlers/pointer/mod.rs
@@ -16,6 +16,9 @@ mod motion;
 mod press;
 mod release;
 
+#[cfg(test)]
+mod tests;
+
 impl PointerHandler for WaylandState {
     fn pointer_frame(
         &mut self,
@@ -59,7 +62,7 @@ impl PointerHandler for WaylandState {
                 }
                 PointerEventKind::Release { button, .. } => {
                     let modal_before = self.input_state.screen_modal_is_active();
-                    self.handle_pointer_release(event, routed, button);
+                    self.handle_pointer_release(conn, event, routed, button);
                     self.refresh_screen_modal_cursor(modal_before, routed, conn);
                 }
                 PointerEventKind::Axis {
diff --git a/src/backend/wayland/handlers/pointer/motion.rs b/src/backend/wayland/handlers/pointer/motion.rs
index 8d51cf3f0..77a8b33f2 100644
--- a/src/backend/wayland/handlers/pointer/motion.rs
+++ b/src/backend/wayland/handlers/pointer/motion.rs
@@ -6,6 +6,7 @@ use crate::backend::wayland::state::{PerfInputSource, drag_log};
 use crate::backend::wayland::toolbar_intent::intent_to_event;
 
 use super::*;
+use crate::backend::wayland::state::ContactMotion;
 
 impl WaylandState {
     pub(super) fn handle_pointer_motion(
@@ -14,6 +15,11 @@ impl WaylandState {
         event: &PointerEvent,
         routed: RoutedInput,
     ) {
+        self.pointer.reconcile_contacts(
+            &self.input_state,
+            self.zoom.panning,
+            self.toolbar_drag.is_moving() || self.toolbar_drag.item_dragging(),
+        );
         if self.motion_owned_by_screen_modal(conn, routed)
             || self.motion_owned_by_move_drag(conn, event, routed)
             || self.motion_owned_by_radial_menu(conn, routed)
@@ -143,12 +149,17 @@ impl WaylandState {
         routed: RoutedInput,
     ) -> bool {
         self.forget_meter_wheel_off_meter(&event.surface, event.position);
-        if routed.surface == InputSurface::Canvas
-            && routed.inline_toolbars
-            && self.inline_toolbar_motion(event.position)
-        {
-            self.update_pointer_cursor(true, conn);
-            return true;
+        if routed.surface == InputSurface::Canvas && routed.inline_toolbars {
+            let held = self.pointer.contact_motion();
+            if held.skips_inline_strip() {
+                self.clear_inline_contact_hover();
+                return false;
+            }
+            let over_strip = self.inline_toolbar_motion(event.position);
+            if over_strip || held == ContactMotion::Toolbar {
+                self.update_pointer_cursor(over_strip, conn);
+                return true;
+            }
         }
         let toolbar_surface = routed.surface == InputSurface::Toolbar;
         if !toolbar_surface && !self.toolbar_chrome.pointer_over_toolbar() {
diff --git a/src/backend/wayland/handlers/pointer/press.rs b/src/backend/wayland/handlers/pointer/press.rs
index d77342792..5e1b4c9cb 100644
--- a/src/backend/wayland/handlers/pointer/press.rs
+++ b/src/backend/wayland/handlers/pointer/press.rs
@@ -2,7 +2,7 @@ use log::debug;
 use smithay_client_toolkit::seat::pointer::{BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, PointerEvent};
 use wayland_client::QueueHandle;
 
-use crate::backend::wayland::state::{RegionReviewPress, drag_log};
+use crate::backend::wayland::state::{ContactOwner, RegionReviewPress, drag_log};
 use crate::backend::wayland::toolbar_intent::intent_to_event;
 use crate::input::MouseButton;
 use crate::input::state::HelpOverlayPressSource;
@@ -24,6 +24,12 @@ impl WaylandState {
         routed: RoutedInput,
         button: u32,
     ) {
+        self.pointer.reconcile_contacts(
+            &self.input_state,
+            self.zoom.panning,
+            self.toolbar_drag.is_moving() || self.toolbar_drag.item_dragging(),
+        );
+
         let on_toolbar = routed.surface == InputSurface::Toolbar;
         let inline_active = routed.inline_toolbars;
         // Report the physical button to the input HUD before any modal or
@@ -47,6 +53,8 @@ impl WaylandState {
                 .clear_help_overlay_press_for(help_press_source);
         }
 
+        self.pointer.take_contact(button, &self.input_state);
+
         if routed.surface == InputSurface::Foreign {
             return;
         }
@@ -73,28 +81,7 @@ impl WaylandState {
             return;
         }
 
-        if debug_toolbar_drag_logging_enabled() {
-            debug!(
-                "pointer press: button={}, on_toolbar={}, inline_active={}, drag_active={}",
-                button,
-                on_toolbar,
-                inline_active,
-                self.toolbar_drag.is_moving()
-            );
-        }
-        if inline_active && self.handle_inline_pointer_press(conn, qh, event, button) {
-            return;
-        }
-        if on_toolbar {
-            self.handle_toolbar_pointer_press(conn, qh, event, button);
-            return;
-        } else if self.toolbar_chrome.pointer_over_toolbar() {
-            self.finish_toolbar_item_drag(false);
-            self.toolbar_drag.set_item_dragging(false);
-            return;
-        }
-
-        if button == BTN_LEFT && self.dismiss_top_toolbar_menus() {
+        if self.route_toolbar_pointer_press(conn, qh, event, button, on_toolbar, inline_active) {
             return;
         }
 
@@ -111,16 +98,7 @@ impl WaylandState {
             "Button {} pressed at ({}, {})",
             button, event.position.0, event.position.1
         );
-        if self.zoom.active && button == BTN_MIDDLE && !self.zoom.locked {
-            self.zoom.start_pan(event.position.0, event.position.1);
-            self.input_state.dirty_tracker.mark_full();
-            self.input_state.needs_redraw = true;
-            return;
-        }
-        if button == BTN_LEFT && self.pointer.board_pan_key_held() && self.can_start_board_pan() {
-            self.pointer
-                .start_board_pan((event.position.0, event.position.1));
-            self.input_state.needs_redraw = true;
+        if self.start_pointer_pan(event, button) {
             return;
         }
 
@@ -131,23 +109,51 @@ impl WaylandState {
             _ => return,
         };
 
+        if inline_active {
+            self.clear_inline_contact_hover();
+        }
+
         let screen_x = event.position.0.round() as i32;
         let screen_y = event.position.1.round() as i32;
         let (wx, wy) = self.zoomed_world_coords(event.position.0, event.position.1);
-        self.input_state.on_mouse_press_with_canvas_and_resources(
+        self.pointer.route_canvas_press(
+            &mut self.input_state,
             crate::input::state::InputTextResources {
                 measurer: self.render.text_measurer(),
                 ui_engine: self.render.ui_text(),
             },
+            button,
             mb,
-            screen_x,
-            screen_y,
-            wx,
-            wy,
+            [screen_x, screen_y, wx, wy],
+        );
+        self.pointer.reconcile_contacts(
+            &self.input_state,
+            self.zoom.panning,
+            self.toolbar_drag.is_moving() || self.toolbar_drag.item_dragging(),
         );
         self.input_state.needs_redraw = true;
     }
 
+    /// A middle press pans an unlocked zoom, and a left press with the pan key
+    /// held pans the board.
+    fn start_pointer_pan(&mut self, event: &PointerEvent, button: u32) -> bool {
+        if self.zoom.active && button == BTN_MIDDLE && !self.zoom.locked {
+            self.zoom.start_pan(event.position.0, event.position.1);
+            self.pointer.bind_contact(button, ContactOwner::ZoomPan);
+            self.input_state.dirty_tracker.mark_full();
+            self.input_state.needs_redraw = true;
+            return true;
+        }
+        if button == BTN_LEFT && self.pointer.board_pan_key_held() && self.can_start_board_pan() {
+            self.pointer
+                .start_board_pan((event.position.0, event.position.1));
+            self.pointer.bind_contact(button, ContactOwner::BoardPan);
+            self.input_state.needs_redraw = true;
+            return true;
+        }
+        false
+    }
+
     fn handle_region_pointer_press(
         &mut self,
         event: &PointerEvent,
@@ -284,100 +290,6 @@ impl WaylandState {
         true
     }
 
-    fn handle_inline_pointer_press(
-        &mut self,
-        conn: &wayland_client::Connection,
-        qh: &QueueHandle<Self>,
-        event: &PointerEvent,
-        button: u32,
-    ) -> bool {
-        if button == BTN_RIGHT
-            && self.inline_toolbar_secondary_press(event.position, Some(conn), Some(qh))
-        {
-            self.refresh_keyboard_interactivity();
-            return true;
-        }
-        if button == BTN_LEFT && self.inline_toolbar_press(event.position, Some(conn), Some(qh)) {
-            drag_log(|| {
-                format!(
-                    "pointer press: inline handled, drag_active={}, pos=({:.3}, {:.3}), surface={}",
-                    self.toolbar_drag.item_dragging(),
-                    event.position.0,
-                    event.position.1,
-                    surface_id(&event.surface)
-                )
-            });
-            if self.toolbar_drag.is_moving() {
-                self.lock_pointer_for_drag(qh, &event.surface);
-            }
-            return true;
-        }
-        if !self.toolbar_chrome.pointer_over_toolbar() {
-            return false;
-        }
-        if button == BTN_LEFT {
-            self.dismiss_top_toolbar_menus();
-        }
-        true
-    }
-
-    fn handle_toolbar_pointer_press(
-        &mut self,
-        conn: &wayland_client::Connection,
-        qh: &QueueHandle<Self>,
-        event: &PointerEvent,
-        button: u32,
-    ) {
-        if button == BTN_RIGHT
-            && let Some(index) = self
-                .toolbar
-                .quick_color_slot_at(&event.surface, event.position)
-        {
-            self.handle_toolbar_event(ToolbarEvent::EditQuickColor { index }, Some(conn), Some(qh));
-            self.toolbar.mark_dirty();
-            self.input_state.needs_redraw = true;
-            self.refresh_keyboard_interactivity();
-            return;
-        }
-        let handled = if button == BTN_LEFT {
-            self.handle_primary_toolbar_pointer_press(conn, qh, event)
-        } else {
-            false
-        };
-        if button == BTN_LEFT && !handled {
-            self.dismiss_top_toolbar_menus();
-        }
-    }
-
-    fn handle_primary_toolbar_pointer_press(
-        &mut self,
-        conn: &wayland_client::Connection,
-        qh: &QueueHandle<Self>,
-        event: &PointerEvent,
-    ) -> bool {
-        let Some((intent, drag)) = self.toolbar.pointer_press(&event.surface, event.position)
-        else {
-            return false;
-        };
-        let toolbar_event = intent_to_event(intent, self.toolbar.last_snapshot());
-        if matches!(toolbar_event, ToolbarEvent::MoveTopToolbar { .. }) && drag {
-            self.lock_pointer_for_drag(qh, &event.surface);
-        }
-        log::info!(
-            "toolbar press: drag_start={}, surface={}, seat={:?}, inline_active={}",
-            drag,
-            surface_id(&event.surface),
-            self.focus.current_seat_id(),
-            self.toolbar_chrome.inline_toolbars()
-        );
-        self.toolbar_drag.set_item_dragging(drag);
-        self.handle_toolbar_event(toolbar_event, Some(conn), Some(qh));
-        self.toolbar.mark_dirty();
-        self.input_state.needs_redraw = true;
-        self.refresh_keyboard_interactivity();
-        true
-    }
-
     pub(in crate::backend::wayland) fn press_overlay_chrome(
         &mut self,
         screen_x: i32,
@@ -453,29 +365,6 @@ impl WaylandState {
         self.dispatch_input_action(action);
         true
     }
-
-    /// Click-away dismissal for the top-strip menus/popovers. Defers to the
-    /// canonical [`InputState::close_top_toolbar_menus`] so the click-away set
-    /// stays in lockstep with the keyboard Escape route and the apply-action
-    /// callers — the Canvas popover in particular must dismiss here exactly
-    /// like the Session/Settings popovers, else a canvas click would leak
-    /// through and start a stray stroke. Returns whether a menu was open so the
-    /// press handler early-returns instead of drawing.
-    ///
-    /// Shared with the touch-down and tablet pen-down paths so every canvas
-    /// down modality dismisses the Canvas (and Session/Settings) popover and
-    /// swallows the interaction identically.
-    pub(in crate::backend::wayland) fn dismiss_top_toolbar_menus(&mut self) -> bool {
-        let changed = self.input_state.close_top_toolbar_menus();
-        if changed {
-            if self.toolbar_chrome.inline_toolbars() {
-                self.mark_inline_toolbar_full_damage();
-            } else {
-                self.toolbar.mark_dirty();
-            }
-        }
-        changed
-    }
 }
 
 /// Input HUD label for a raw pointer button code. The three primary buttons
@@ -492,23 +381,7 @@ fn input_hud_button_label(button: u32) -> String {
     }
 }
 
+mod toolbar;
+
 #[cfg(test)]
-mod tests {
-    use super::review_action_suppresses_next_release;
-    use crate::ui::RegionAction;
-
-    #[test]
-    fn retained_review_toggle_does_not_arm_the_post_modal_release_latch() {
-        assert!(!review_action_suppresses_next_release(
-            RegionAction::ToggleIncludeDrawings
-        ));
-        for terminal in [
-            RegionAction::Copy,
-            RegionAction::Save,
-            RegionAction::Both,
-            RegionAction::Board,
-        ] {
-            assert!(review_action_suppresses_next_release(terminal));
-        }
-    }
-}
+mod tests;
diff --git a/src/backend/wayland/handlers/pointer/press/tests.rs b/src/backend/wayland/handlers/pointer/press/tests.rs
new file mode 100644
index 000000000..98525a1ff
--- /dev/null
+++ b/src/backend/wayland/handlers/pointer/press/tests.rs
@@ -0,0 +1,17 @@
+use super::review_action_suppresses_next_release;
+use crate::ui::RegionAction;
+
+#[test]
+fn retained_review_toggle_does_not_arm_the_post_modal_release_latch() {
+    assert!(!review_action_suppresses_next_release(
+        RegionAction::ToggleIncludeDrawings
+    ));
+    for terminal in [
+        RegionAction::Copy,
+        RegionAction::Save,
+        RegionAction::Both,
+        RegionAction::Board,
+    ] {
+        assert!(review_action_suppresses_next_release(terminal));
+    }
+}
diff --git a/src/backend/wayland/handlers/pointer/press/toolbar.rs b/src/backend/wayland/handlers/pointer/press/toolbar.rs
new file mode 100644
index 000000000..d197a4ff4
--- /dev/null
+++ b/src/backend/wayland/handlers/pointer/press/toolbar.rs
@@ -0,0 +1,162 @@
+//! Presses taken by the inline strip, toolbar surfaces, and toolbar menus.
+use super::*;
+
+impl WaylandState {
+    /// The inline strip, a toolbar surface, and open toolbar menus take a press
+    /// before the canvas. Returns true when one of them did.
+    pub(super) fn route_toolbar_pointer_press(
+        &mut self,
+        conn: &wayland_client::Connection,
+        qh: &QueueHandle<Self>,
+        event: &PointerEvent,
+        button: u32,
+        on_toolbar: bool,
+        inline_active: bool,
+    ) -> bool {
+        if debug_toolbar_drag_logging_enabled() {
+            debug!(
+                "pointer press: button={}, on_toolbar={}, inline_active={}, drag_active={}",
+                button,
+                on_toolbar,
+                inline_active,
+                self.toolbar_drag.is_moving()
+            );
+        }
+        if inline_active {
+            self.inline_toolbar_motion(event.position);
+        }
+        if inline_active && self.handle_inline_pointer_press(conn, qh, event, button) {
+            self.pointer
+                .bind_contact(button, ContactOwner::InlineToolbar);
+            return true;
+        }
+        if on_toolbar {
+            self.handle_toolbar_pointer_press(conn, qh, event, button);
+            return true;
+        }
+        if self.toolbar_chrome.pointer_over_toolbar() {
+            self.finish_toolbar_item_drag(false);
+            self.toolbar_drag.set_item_dragging(false);
+            return true;
+        }
+
+        button == BTN_LEFT && self.dismiss_top_toolbar_menus()
+    }
+
+    fn handle_inline_pointer_press(
+        &mut self,
+        conn: &wayland_client::Connection,
+        qh: &QueueHandle<Self>,
+        event: &PointerEvent,
+        button: u32,
+    ) -> bool {
+        if button == BTN_RIGHT
+            && self.inline_toolbar_secondary_press(event.position, Some(conn), Some(qh))
+        {
+            self.refresh_keyboard_interactivity();
+            return true;
+        }
+        if button == BTN_LEFT && self.inline_toolbar_press(event.position, Some(conn), Some(qh)) {
+            drag_log(|| {
+                format!(
+                    "pointer press: inline handled, drag_active={}, pos=({:.3}, {:.3}), surface={}",
+                    self.toolbar_drag.item_dragging(),
+                    event.position.0,
+                    event.position.1,
+                    surface_id(&event.surface)
+                )
+            });
+            if self.toolbar_drag.is_moving() {
+                self.lock_pointer_for_drag(qh, &event.surface);
+            }
+            return true;
+        }
+        if !self.toolbar_chrome.pointer_over_toolbar() {
+            return false;
+        }
+        if button == BTN_LEFT {
+            self.dismiss_top_toolbar_menus();
+        }
+        true
+    }
+
+    fn handle_toolbar_pointer_press(
+        &mut self,
+        conn: &wayland_client::Connection,
+        qh: &QueueHandle<Self>,
+        event: &PointerEvent,
+        button: u32,
+    ) {
+        if button == BTN_RIGHT
+            && let Some(index) = self
+                .toolbar
+                .quick_color_slot_at(&event.surface, event.position)
+        {
+            self.handle_toolbar_event(ToolbarEvent::EditQuickColor { index }, Some(conn), Some(qh));
+            self.toolbar.mark_dirty();
+            self.input_state.needs_redraw = true;
+            self.refresh_keyboard_interactivity();
+            return;
+        }
+        let handled = if button == BTN_LEFT {
+            self.handle_primary_toolbar_pointer_press(conn, qh, event)
+        } else {
+            false
+        };
+        if button == BTN_LEFT && !handled {
+            self.dismiss_top_toolbar_menus();
+        }
+    }
+
+    fn handle_primary_toolbar_pointer_press(
+        &mut self,
+        conn: &wayland_client::Connection,
+        qh: &QueueHandle<Self>,
+        event: &PointerEvent,
+    ) -> bool {
+        let Some((intent, drag)) = self.toolbar.pointer_press(&event.surface, event.position)
+        else {
+            return false;
+        };
+        let toolbar_event = intent_to_event(intent, self.toolbar.last_snapshot());
+        if matches!(toolbar_event, ToolbarEvent::MoveTopToolbar { .. }) && drag {
+            self.lock_pointer_for_drag(qh, &event.surface);
+        }
+        log::info!(
+            "toolbar press: drag_start={}, surface={}, seat={:?}, inline_active={}",
+            drag,
+            surface_id(&event.surface),
+            self.focus.current_seat_id(),
+            self.toolbar_chrome.inline_toolbars()
+        );
+        self.toolbar_drag.set_item_dragging(drag);
+        self.handle_toolbar_event(toolbar_event, Some(conn), Some(qh));
+        self.toolbar.mark_dirty();
+        self.input_state.needs_redraw = true;
+        self.refresh_keyboard_interactivity();
+        true
+    }
+
+    /// Click-away dismissal for the top-strip menus/popovers. Defers to the
+    /// canonical [`InputState::close_top_toolbar_menus`] so the click-away set
+    /// stays in lockstep with the keyboard Escape route and the apply-action
+    /// callers — the Canvas popover in particular must dismiss here exactly
+    /// like the Session/Settings popovers, else a canvas click would leak
+    /// through and start a stray stroke. Returns whether a menu was open so the
+    /// press handler early-returns instead of drawing.
+    ///
+    /// Shared with the touch-down and tablet pen-down paths so every canvas
+    /// down modality dismisses the Canvas (and Session/Settings) popover and
+    /// swallows the interaction identically.
+    pub(in crate::backend::wayland) fn dismiss_top_toolbar_menus(&mut self) -> bool {
+        let changed = self.input_state.close_top_toolbar_menus();
+        if changed {
+            if self.toolbar_chrome.inline_toolbars() {
+                self.mark_inline_toolbar_full_damage();
+            } else {
+                self.toolbar.mark_dirty();
+            }
+        }
+        changed
+    }
+}
diff --git a/src/backend/wayland/handlers/pointer/release.rs b/src/backend/wayland/handlers/pointer/release.rs
index c16b7016d..5a1928e15 100644
--- a/src/backend/wayland/handlers/pointer/release.rs
+++ b/src/backend/wayland/handlers/pointer/release.rs
@@ -1,5 +1,7 @@
+use crate::backend::wayland::state::{ReleaseRoute, release_route};
 use log::debug;
 use smithay_client_toolkit::seat::pointer::{BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, PointerEvent};
+use wayland_client::Connection;
 
 use crate::backend::wayland::state::drag_log;
 use crate::input::state::HelpOverlayPressSource;
@@ -11,10 +13,16 @@ use super::*;
 impl WaylandState {
     pub(super) fn handle_pointer_release(
         &mut self,
+        conn: &Connection,
         event: &PointerEvent,
         routed: RoutedInput,
         button: u32,
     ) {
+        let owner = match self.pointer.take_contact(button, &self.input_state) {
+            Some((_, false)) => return,
+            Some((owner, true)) => Some(owner),
+            None => None,
+        };
         let on_toolbar = routed.surface == InputSurface::Toolbar;
         let inline_active = routed.inline_toolbars;
         if self
@@ -83,6 +91,34 @@ impl WaylandState {
         if self.handle_radial_pointer_release(routed, button) {
             return;
         }
+        match release_route(owner, inline_active) {
+            ReleaseRoute::InlineToolbar => {
+                if !inline_active || !self.handle_inline_pointer_release(event, button) {
+                    self.handle_toolbar_pointer_release(event, button);
+                }
+            }
+            ReleaseRoute::CanvasSurface => {
+                self.finish_canvas_surface_release(event, button);
+                if routed.surface == InputSurface::Canvas
+                    && !self.pointer.contact_motion().skips_inline_strip()
+                {
+                    let over_strip = self.inline_toolbar_motion(event.position);
+                    self.update_pointer_cursor(over_strip, conn);
+                }
+            }
+            ReleaseRoute::Unowned => {
+                self.release_by_toolbar_state(event, on_toolbar, inline_active, button)
+            }
+        }
+    }
+
+    fn release_by_toolbar_state(
+        &mut self,
+        event: &PointerEvent,
+        on_toolbar: bool,
+        inline_active: bool,
+        button: u32,
+    ) {
         if inline_active && self.handle_inline_pointer_release(event, button) {
             return;
         }
@@ -90,6 +126,10 @@ impl WaylandState {
             self.handle_toolbar_pointer_release(event, button);
             return;
         }
+        self.finish_canvas_surface_release(event, button);
+    }
+
+    fn finish_canvas_surface_release(&mut self, event: &PointerEvent, button: u32) {
         // End move drag if released on the main surface
         if button == BTN_LEFT && self.toolbar_drag.is_moving() {
             self.finish_main_surface_drag(event);
diff --git a/src/backend/wayland/handlers/pointer/tests.rs b/src/backend/wayland/handlers/pointer/tests.rs
new file mode 100644
index 000000000..5b4c5714a
--- /dev/null
+++ b/src/backend/wayland/handlers/pointer/tests.rs
@@ -0,0 +1,251 @@
+use super::*;
+use crate::backend::wayland::handlers::test_support::HandlerFixture;
+use crate::input::DrawingState;
+use smithay_client_toolkit::seat::pointer::BTN_LEFT;
+use wayland_client::{Proxy, protocol::wl_pointer::WlPointer};
+
+#[test]
+fn unresolved_dirty_source_has_one_backoff_instead_of_an_idle_redraw_loop() {
+    use crate::backend::wayland::session::SessionState;
+    let temp = crate::test_temp::tempdir().unwrap();
+    let mut options =
+        crate::session::SessionOptions::new(temp.path().to_path_buf(), "failed-launch");
+    options.persist_transparent = true;
+    options.set_named_file_target(temp.path().join("failed.wayscriber-session"));
+    std::fs::write(options.session_file_path(), b"unreadable").unwrap();
+    std::fs::write(
+        crate::session::append_path_suffix(
+            &options.session_file_path(),
+            ".corrupt-18446744073709551615",
+        ),
+        b"occupied",
+    )
+    .unwrap();
+    let mut fixture = HandlerFixture::new(crate::config::Config::default());
+    fixture.state.session = SessionState::new(Some(options));
+    fixture
+        .state
+        .begin_session_output_transition(None, "failed first load");
+    assert!(!fixture.state.session.is_loaded());
+    fixture
+        .state
+        .input_state
+        .on_mouse_press(crate::input::MouseButton::Left, 600, 400);
+    fixture.state.input_state.on_mouse_motion(620, 420);
+    fixture
+        .state
+        .input_state
+        .on_mouse_release(crate::input::MouseButton::Left, 620, 420);
+    fixture
+        .state
+        .session
+        .cancel_output_transition_for_live_source();
+    fixture.state.input_state.needs_redraw = false;
+    for _ in 0..20 {
+        assert!(
+            !fixture
+                .state
+                .reconcile_live_source_interaction_if_idle("idle tick")
+        );
+        assert!(!fixture.state.input_state.needs_redraw);
+    }
+    assert!(
+        fixture
+            .state
+            .session
+            .pending_output_transition()
+            .unwrap()
+            .retry_at
+            > std::time::Instant::now()
+    );
+}
+
+fn draw_line(fixture: &mut HandlerFixture) -> Vec<crate::draw::Shape> {
+    fixture
+        .state
+        .input_state
+        .on_mouse_press(crate::input::MouseButton::Left, 600, 400);
+    fixture.state.input_state.on_mouse_motion(620, 420);
+    fixture
+        .state
+        .input_state
+        .on_mouse_release(crate::input::MouseButton::Left, 620, 420);
+    let shapes = fixture
+        .state
+        .input_state
+        .boards
+        .active_frame()
+        .shapes
+        .iter()
+        .map(|shape| shape.shape.clone())
+        .collect::<Vec<_>>();
+    assert!(!shapes.is_empty());
+    shapes
+}
+
+#[test]
+fn leaving_the_per_output_placeholder_keeps_early_ink_and_finishes_before_input() {
+    use crate::backend::wayland::session::SessionState;
+    let temp = crate::test_temp::tempdir().unwrap();
+    let mut placeholder = crate::session::SessionOptions::new(temp.path().to_path_buf(), "startup");
+    placeholder.persist_transparent = true;
+    placeholder.per_output = true;
+    let mut fixture = HandlerFixture::new(crate::config::Config::default());
+    fixture.state.session = SessionState::new(Some(placeholder.clone()));
+    fixture
+        .state
+        .begin_session_output_transition(None, "initial no-output");
+    assert!(fixture.state.session.is_loaded());
+    let early = draw_line(&mut fixture);
+
+    fixture
+        .state
+        .begin_session_output_transition(Some("monitor-a".to_string()), "first monitor");
+
+    // The switch ran to completion inside the callback: nothing is pending
+    // that further input could abort, and the output's own session is active.
+    assert!(fixture.state.session_transaction.is_none());
+    let active = fixture.state.session_options().unwrap().clone();
+    assert_eq!(active.output_identity(), Some("monitor_a"));
+    assert!(!fixture.state.session.is_dirty());
+    // The early ink went to the placeholder's own file, as on main, rather
+    // than being held unsaveable on screen.
+    let saved = crate::session::load_snapshot(&placeholder)
+        .unwrap()
+        .expect("early ink saved");
+    let points = |shape: &crate::draw::Shape| match shape {
+        crate::draw::Shape::Freehand { points, .. } => points.clone(),
+        other => panic!("expected the early stroke, got {other:?}"),
+    };
+    let saved_points = saved.boards[0].pages.pages[0]
+        .shapes
+        .iter()
+        .map(|shape| points(&shape.shape))
+        .collect::<Vec<_>>();
+    assert_eq!(saved_points, early.iter().map(points).collect::<Vec<_>>());
+    // Nothing is left that autosave would retry without pause.
+    assert_eq!(
+        fixture
+            .state
+            .session
+            .autosave_timeout(std::time::Instant::now(), &active),
+        None
+    );
+}
+
+#[test]
+fn early_ink_on_an_unloaded_per_output_session_is_kept_and_its_retry_backs_off() {
+    use crate::backend::wayland::session::SessionState;
+    let temp = crate::test_temp::tempdir().unwrap();
+    let mut options = crate::session::SessionOptions::new(temp.path().to_path_buf(), "startup");
+    options.persist_transparent = true;
+    options.per_output = true;
+    let mut fixture = HandlerFixture::new(crate::config::Config::default());
+    fixture.state.session = SessionState::new(Some(options.clone()));
+    let shapes = draw_line(&mut fixture);
+    fixture
+        .state
+        .begin_session_output_transition(Some("monitor-a".to_string()), "first monitor");
+    crate::backend::wayland::session::driver::finish_pending_session_command(&mut fixture.state)
+        .unwrap();
+    assert_eq!(
+        fixture
+            .state
+            .input_state
+            .boards
+            .active_frame()
+            .shapes
+            .iter()
+            .map(|shape| shape.shape.clone())
+            .collect::<Vec<_>>(),
+        shapes
+    );
+    assert!(
+        !options.session_file_path().exists(),
+        "ink drawn before any load must not enter a file it never loaded"
+    );
+    assert!(fixture.state.input_state.active_toast().is_some());
+    fixture
+        .state
+        .session
+        .cancel_output_transition_for_live_source();
+    fixture.state.input_state.needs_redraw = false;
+    for _ in 0..20 {
+        assert!(
+            !fixture
+                .state
+                .reconcile_live_source_interaction_if_idle("test tick")
+        );
+        assert!(!fixture.state.input_state.needs_redraw);
+    }
+    let retry = fixture.state.session.pending_output_transition().unwrap();
+    assert!(retry.retry_at > std::time::Instant::now());
+}
+
+#[test]
+fn alt_text_drag_ends_through_the_real_pointer_release_handler() {
+    let mut config = crate::config::Config::default();
+    config.ui.show_onboarding_hints = false;
+    let mut fixture = HandlerFixture::new(config);
+    fixture.state.input_state.state = DrawingState::text_input(100, 100, "hello".to_string());
+    fixture.state.input_state.modifiers.alt = true;
+    let pointer = WlPointer::inert(fixture.conn.backend().downgrade());
+    let surface = fixture.state.surface.wl_surface().unwrap().clone();
+    let qh = fixture.queue.handle();
+
+    for (start, end, expected) in [
+        ((110.0, 100.0), (130.0, 115.0), (120, 115)),
+        ((130.0, 115.0), (150.0, 130.0), (140, 130)),
+    ] {
+        let events = [
+            PointerEvent {
+                surface: surface.clone(),
+                position: start,
+                kind: PointerEventKind::Press {
+                    time: 1,
+                    button: BTN_LEFT,
+                    serial: 1,
+                },
+            },
+            PointerEvent {
+                surface: surface.clone(),
+                position: end,
+                kind: PointerEventKind::Motion { time: 2 },
+            },
+            PointerEvent {
+                surface: surface.clone(),
+                position: end,
+                kind: PointerEventKind::Release {
+                    time: 3,
+                    button: BTN_LEFT,
+                    serial: 2,
+                },
+            },
+        ];
+        fixture
+            .state
+            .pointer_frame(&fixture.conn, &qh, &pointer, &events);
+        assert!(
+            !fixture.state.input_state.pointer_drag_active(),
+            "the actual release must end the block move"
+        );
+        assert!(!fixture.state.input_state.has_active_pointer_interaction());
+        fixture.state.pointer_frame(
+            &fixture.conn,
+            &qh,
+            &pointer,
+            &[PointerEvent {
+                surface: surface.clone(),
+                position: (180.0, 160.0),
+                kind: PointerEventKind::Motion { time: 4 },
+            }],
+        );
+        match &fixture.state.input_state.state {
+            DrawingState::TextInput { x, y, buffer, .. } => {
+                assert_eq!((*x, *y), expected);
+                assert_eq!(buffer, "hello");
+            }
+            other => panic!("text draft changed: {other:?}"),
+        }
+    }
+}
diff --git a/src/backend/wayland/handlers/tablet/frame.rs b/src/backend/wayland/handlers/tablet/frame.rs
index 708a93cbc..d4d675840 100644
--- a/src/backend/wayland/handlers/tablet/frame.rs
+++ b/src/backend/wayland/handlers/tablet/frame.rs
@@ -1,9 +1,11 @@
 use log::{debug, info};
 
-use crate::backend::wayland::state::{PerfInputSource, WaylandState};
+use crate::backend::wayland::state::{
+    ContactOwner, PerfInputSource, StylusDownAdmission, WaylandState,
+};
 use crate::config::keybindings::{StylusButton, linux};
-use crate::input::MouseButton;
 use crate::input::state::HelpOverlayPressSource;
+use crate::input::{DrawingState, MouseButton};
 
 fn modal_blocks_stylus_barrel_actions(input_state: &crate::input::InputState) -> bool {
     input_state.modal_owns_pointer_shortcuts()
@@ -53,8 +55,8 @@ impl WaylandState {
 
     /// Commit coalesced tablet tool state.
     ///
-    /// Invariant: drawing samples are appended only after applying the pressure
-    /// update from the same committed tablet frame.
+    /// The real press router admits a contact before pressure mutates it. The
+    /// first drawing sample is then replaced with this frame's pressure.
     pub(super) fn commit_pending_stylus_frame(&mut self) {
         let pending = std::mem::take(&mut self.tablet.pending_frame);
         if pending.is_empty() {
@@ -65,22 +67,46 @@ impl WaylandState {
         // help was visible must still not dispatch behind it.
         let modal_blocks_barrel_actions = modal_blocks_stylus_barrel_actions(&self.input_state);
 
-        if let Some(pressure) = pending.pressure {
-            self.apply_committed_stylus_pressure(pressure);
+        if pending.down
+            && let Some((x, y)) = pending.motion
+        {
+            self.tablet.last_pos = Some((x, y));
+            self.pointer
+                .set_position((x.round() as i32, y.round() as i32));
         }
+        let canvas_down = pending.down && self.prepare_stylus_down();
 
-        if let Some((x, y)) = pending.motion {
+        if let Some(pressure) = pending.pressure
+            && !pending.down
+        {
+            self.tablet.apply_canvas_pressure(
+                self.render.text_measurer(),
+                &mut self.input_state,
+                pressure,
+            );
+        }
+
+        if let Some((x, y)) = pending.motion
+            && (!pending.down || canvas_down)
+        {
             self.commit_stylus_motion_sample(x, y, pending.pressure.is_some());
         }
 
-        if pending.down {
-            self.commit_stylus_down();
+        if canvas_down {
+            self.commit_stylus_canvas_down();
+            if let Some(pressure) = pending.pressure {
+                self.tablet.apply_canvas_pressure(
+                    self.render.text_measurer(),
+                    &mut self.input_state,
+                    pressure,
+                );
+            }
         }
 
         if pending.pressure.is_some()
             && pending.motion.is_none()
             && !pending.down
-            && self.tablet.tip_down
+            && self.tablet.is_canvas_gesture()
         {
             self.commit_stylus_motion_sample_at_current_position(true);
         }
@@ -100,41 +126,7 @@ impl WaylandState {
 
     pub(super) fn current_or_pending_stylus_position(&self) -> (f64, f64) {
         self.tablet
-            .pending_frame
-            .motion
-            .or(self.tablet.last_pos)
-            .unwrap_or_else(|| {
-                let (x, y) = self.pointer.position();
-                (x as f64, y as f64)
-            })
-    }
-
-    fn apply_committed_stylus_pressure(&mut self, pressure: u32) {
-        if pressure == 0 {
-            debug!("Stylus pressure reported 0; deferring to peak/base");
-            return;
-        }
-
-        let first_pressure_sample =
-            self.tablet.tip_down && self.tablet.pressure_thickness.is_none();
-        let p01 = (pressure as f64) / 65535.0;
-        if !crate::input::tablet::try_apply_pressure_to_state_with(
-            self.render.text_measurer(),
-            p01,
-            &mut self.input_state,
-            self.tablet.settings,
-        ) {
-            return;
-        }
-        if first_pressure_sample {
-            self.input_state
-                .replace_active_drawing_pressure_samples_with(
-                    self.render.text_measurer(),
-                    self.input_state.style.current_thickness,
-                );
-        }
-        self.tablet.pressure_thickness = Some(self.input_state.style.current_thickness);
-        self.record_stylus_peak(self.input_state.style.current_thickness);
+            .current_or_pending_position(self.pointer.position())
     }
 
     fn commit_stylus_motion_sample(&mut self, x: f64, y: f64, pressure_sample: bool) {
@@ -162,7 +154,7 @@ impl WaylandState {
         );
         let next_hover_cursor_pos = self.stylus_hover_cursor_position();
         self.mark_stylus_hover_cursor_dirty(previous_hover_cursor_pos, next_hover_cursor_pos);
-        if self.tablet.tip_down {
+        if self.tablet.is_canvas_gesture() {
             self.record_stylus_motion_thickness();
         }
     }
@@ -172,9 +164,9 @@ impl WaylandState {
         self.commit_stylus_motion_sample(x, y, pressure_sample);
     }
 
-    fn commit_stylus_down(&mut self) {
+    fn prepare_stylus_down(&mut self) -> bool {
         if !self.tablet.on_overlay {
-            return;
+            return false;
         }
 
         if !self.input_state.help_overlay.is_visible() {
@@ -187,13 +179,13 @@ impl WaylandState {
         if self.input_state.region_is_active() {
             let (x, y) = self.current_stylus_position();
             self.begin_region_selection(crate::input::state::RegionInputSource::Stylus, x, y);
-            return;
+            return false;
         }
 
         if self.input_state.eyedropper_is_active() {
             let (x, y) = self.current_stylus_position();
             self.sample_eyedropper(x, y);
-            return;
+            return false;
         }
 
         // Help owns stylus tip input just as it owns mouse and touch input.
@@ -207,28 +199,33 @@ impl WaylandState {
                 x.round() as i32,
                 y.round() as i32,
             );
-            return;
-        }
-
-        // The onboarding card owns a pen tap on it just as it owns a click:
-        // no stroke starts, so none can tick off its "Draw a stroke" step.
-        let (x, y) = self.current_stylus_position();
-        if let Some(press) = self.onboarding_card_press_at(x, y) {
-            self.pointer
-                .set_position((x.round() as i32, y.round() as i32));
-            self.onboarding_card.set_stylus_press(press);
-            return;
+            return false;
         }
 
-        // Canvas click-away: a pen-down on the canvas with a top popover open
-        // (Canvas/Session/Settings) dismisses it and swallows the pen-down,
-        // matching the mouse and touch paths — otherwise the pen-down would
-        // start a stray stroke instead of closing the popover.
-        if self.dismiss_top_toolbar_menus() {
-            self.input_state.needs_redraw = true;
-            return;
+        let position = self.current_stylus_position();
+        let card_visible = self.first_run_onboarding_card_visible();
+        match self.tablet.prepare_chrome_down(
+            &mut self.input_state,
+            &mut self.onboarding_card,
+            position,
+            card_visible,
+        ) {
+            StylusDownAdmission::Canvas => {}
+            StylusDownAdmission::Onboarding | StylusDownAdmission::Toast => return false,
+            StylusDownAdmission::Popover => {
+                if self.toolbar_chrome.inline_toolbars() {
+                    self.mark_inline_toolbar_full_damage();
+                } else {
+                    self.toolbar.mark_dirty();
+                }
+                self.input_state.needs_redraw = true;
+                return false;
+            }
         }
+        true
+    }
 
+    fn commit_stylus_canvas_down(&mut self) {
         // Report the pen tip to the input HUD alongside the mouse buttons; the
         // pen is a pointer device, so it gets the same pill chrome.
         self.input_state
@@ -237,7 +234,7 @@ impl WaylandState {
         let hover_cursor_pos = self.stylus_hover_cursor_position();
         let (x, y) = self.current_stylus_position();
         self.pointer.set_position((x as i32, y as i32));
-        self.tablet.tip_down = true;
+        self.tablet.bind_tip(ContactOwner::Canvas);
         self.mark_stylus_hover_cursor_dirty(hover_cursor_pos, None);
         info!(
             "Stylus DOWN at ({}, {})",
@@ -258,8 +255,6 @@ impl WaylandState {
             wx,
             wy,
         );
-        let base_thickness = self.input_state.style.current_thickness;
-        self.tablet.base_thickness = Some(base_thickness);
         self.record_stylus_motion_thickness();
         self.input_state.needs_redraw = true;
     }
@@ -272,25 +267,45 @@ impl WaylandState {
         if let Some(press) = self.onboarding_card.take_stylus_press() {
             // The tap never became a contact, so there is no stroke to end
             // and no pressure thickness to commit.
-            self.tablet.tip_down = false;
+            self.tablet.lift_tip();
             self.tablet.pressure_thickness = None;
             self.tablet.peak_thickness = None;
             let (x, y) = self.current_stylus_position();
+            self.tablet
+                .set_over_inline_strip(self.inline_toolbar_contains((x, y)));
             self.release_onboarding_card_press(press, x, y);
             self.input_state.needs_redraw = true;
             return;
         }
 
-        self.tablet.tip_down = false;
+        if let Some(pressed) = self.tablet.toast_press.take() {
+            // Like a card tap, a toast tap never became a stroke.
+            self.tablet.lift_tip();
+            self.tablet.pressure_thickness = None;
+            self.tablet.peak_thickness = None;
+
+            let (x, y) = self.current_stylus_position();
+            let (hit, action) =
+                self.input_state
+                    .resolve_toast_release(pressed, x.round() as i32, y.round() as i32);
+            if hit && let Some(command) = action {
+                self.handle_toast_command(command);
+            }
+            return;
+        }
+
+        self.tablet.lift_tip();
+        // Only a stroke keeps the thickness its pressure reached. A contact
+        // that did not draw, such as a size-ring drag or a tap that closed a
+        // menu, leaves the thickness as that contact set it.
+        let drawing = matches!(self.input_state.state, DrawingState::Drawing { .. });
         let final_thick = self
             .tablet
             .peak_thickness
-            .or(self.tablet.pressure_thickness)
-            .or(self.tablet.base_thickness);
-        if let Some(thick) = final_thick {
+            .or(self.tablet.pressure_thickness);
+        if let Some(thick) = final_thick.filter(|_| drawing) {
             self.input_state
                 .set_pressure_thickness_for_active_tool_with(self.render.text_measurer(), thick);
-            self.tablet.base_thickness = Some(thick);
         }
         self.tablet.pressure_thickness = None;
         self.tablet.peak_thickness = None;
@@ -301,6 +316,8 @@ impl WaylandState {
         );
         let (x, y) = self.current_stylus_position();
         self.pointer.set_position((x as i32, y as i32));
+        self.tablet
+            .set_over_inline_strip(self.inline_toolbar_contains((x, y)));
         let screen_x = self.pointer.position().0;
         let screen_y = self.pointer.position().1;
         if self.handle_help_overlay_release(HelpOverlayPressSource::Stylus, screen_x, screen_y) {
@@ -355,92 +372,4 @@ impl WaylandState {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::{modal_blocks_stylus_barrel_actions, stylus_barrel_action};
-    use crate::input::state::test_support::make_test_input_state;
-
-    #[test]
-    fn help_blocks_stylus_barrel_actions() {
-        let mut state = make_test_input_state();
-        assert!(!modal_blocks_stylus_barrel_actions(&state));
-
-        state.toggle_help_overlay();
-        assert!(modal_blocks_stylus_barrel_actions(&state));
-    }
-
-    /// Both screen-region modals swallow pointer and keyboard input, so a
-    /// barrel button must not run its bound action on the canvas behind them —
-    /// including while they are still waiting on a capture.
-    #[test]
-    fn screen_region_modals_block_stylus_barrel_actions() {
-        use crate::input::state::{EyedropperCaptureSource, RegionPurposeTag, ScreenCaptureSource};
-
-        let mut state = make_test_input_state();
-        assert!(!modal_blocks_stylus_barrel_actions(&state));
-
-        state.set_region_pending_capture(RegionPurposeTag::Ocr, 1, ScreenCaptureSource::Frozen);
-        assert!(modal_blocks_stylus_barrel_actions(&state));
-        state.activate_region_with(
-            &crate::draw::TextMeasurer::default(),
-            RegionPurposeTag::Ocr,
-            1,
-        );
-        assert!(modal_blocks_stylus_barrel_actions(&state));
-        state.cancel_region_ui_only();
-        assert!(!modal_blocks_stylus_barrel_actions(&state));
-
-        state.set_eyedropper_pending_capture(EyedropperCaptureSource::Frozen);
-        assert!(modal_blocks_stylus_barrel_actions(&state));
-        state.activate_eyedropper_with(&crate::draw::TextMeasurer::default(), Some(1));
-        assert!(modal_blocks_stylus_barrel_actions(&state));
-        state.cancel_eyedropper();
-        assert!(!modal_blocks_stylus_barrel_actions(&state));
-    }
-
-    #[test]
-    fn canonical_stylus_shortcut_wins_over_legacy_tablet_binding() {
-        use crate::config::keybindings::linux;
-        use crate::config::{Action, KeybindingsConfig};
-
-        let mut keybindings = KeybindingsConfig::default();
-        keybindings.core.undo = vec!["StylusPrimary".to_string()];
-        let action_map = keybindings.build_action_map().expect("map");
-        let action_bindings = keybindings.build_action_bindings().expect("bindings");
-        let mut state = crate::input::state::test_support::make_test_input_state();
-        state.set_keybinding_maps(action_map, action_bindings);
-
-        let mut tablet = crate::config::TabletInputConfig::default();
-        tablet.stylus_button.action = Some(Action::ToggleRadialMenu);
-
-        assert_eq!(
-            stylus_barrel_action(&state, linux::BTN_STYLUS, &tablet),
-            Some(Action::Undo)
-        );
-        tablet.stylus_button2.action = Some(Action::Redo);
-        assert_eq!(
-            stylus_barrel_action(&state, linux::BTN_STYLUS2, &tablet),
-            Some(Action::Redo)
-        );
-    }
-
-    #[test]
-    fn unbound_stylus_falls_back_to_legacy_tablet_action() {
-        use crate::config::Action;
-        use crate::config::keybindings::linux;
-
-        let state = crate::input::state::test_support::make_test_input_state();
-        let mut tablet = crate::config::TabletInputConfig::default();
-        tablet.stylus_button.action = Some(Action::ToggleRadialMenu);
-        tablet.stylus_button2.action = None;
-
-        assert_eq!(
-            stylus_barrel_action(&state, linux::BTN_STYLUS, &tablet),
-            Some(Action::ToggleRadialMenu)
-        );
-        assert_eq!(
-            stylus_barrel_action(&state, linux::BTN_STYLUS2, &tablet),
-            None
-        );
-        assert_eq!(stylus_barrel_action(&state, 0, &tablet), None);
-    }
-}
+mod tests;
diff --git a/src/backend/wayland/handlers/tablet/frame/tests.rs b/src/backend/wayland/handlers/tablet/frame/tests.rs
new file mode 100644
index 000000000..3ac842530
--- /dev/null
+++ b/src/backend/wayland/handlers/tablet/frame/tests.rs
@@ -0,0 +1,390 @@
+use super::{DrawingState, WaylandState, modal_blocks_stylus_barrel_actions, stylus_barrel_action};
+use crate::input::state::test_support::make_test_input_state;
+
+#[test]
+fn hard_popup_taps_through_the_pen_frame_handler_do_not_resize_the_next_stroke() {
+    use crate::backend::wayland::handlers::test_support::HandlerFixture;
+    use wayland_client::{Dispatch, Proxy};
+    use wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::{Event, ZwpTabletToolV2};
+    for chrome in ["card", "popover", "color button", "color slider", "radial"] {
+        let mut config = crate::config::Config::default();
+        config.ui.show_onboarding_hints = chrome == "card";
+        config.tablet.enabled = true;
+        config.tablet.pressure_enabled = true;
+        config.tablet.min_thickness = 1.0;
+        config.tablet.max_thickness = 20.0;
+        let mut fixture = HandlerFixture::new(config);
+        let tool = ZwpTabletToolV2::inert(fixture.conn.backend().downgrade());
+        let qh = fixture.queue.handle();
+        let state = &mut fixture.state;
+        state.tablet.on_overlay = true;
+        let initial = state.input_state.style.current_thickness;
+        let position = match chrome {
+            "card" => {
+                state
+                    .onboarding_card
+                    .set_layout(Some(crate::ui::OnboardingCardLayout {
+                        x: 100.0,
+                        y: 50.0,
+                        width: 200.0,
+                        height: 120.0,
+                        buttons: Vec::new(),
+                    }));
+                (110.0, 60.0)
+            }
+            "popover" => {
+                state.input_state.apply_toolbar_event(
+                    crate::ui::toolbar::ToolbarEvent::ToggleSessionPopover(true),
+                );
+                (600.0, 400.0)
+            }
+            "radial" => {
+                state.input_state.open_radial_menu(400.0, 300.0);
+                state.input_state.update_radial_menu_layout(1000, 800);
+                (400.0, 300.0)
+            }
+            _ => {
+                state.input_state.open_color_picker_popup();
+                state
+                    .input_state
+                    .update_color_picker_popup_layout(1000, 800);
+                let layout = state.input_state.color_picker_popup_layout().unwrap();
+                if chrome == "color slider" {
+                    (layout.hue_x + 2.0, layout.hue_y + 2.0)
+                } else {
+                    (layout.ok_btn_x + 2.0, layout.ok_btn_y + 2.0)
+                }
+            }
+        };
+        for event in [
+            Event::Motion {
+                x: position.0,
+                y: position.1,
+            },
+            Event::Pressure { pressure: 65535 },
+            Event::Down { serial: 1 },
+            Event::Frame { time: 1 },
+        ] {
+            <WaylandState as Dispatch<ZwpTabletToolV2, ()>>::event(
+                state,
+                &tool,
+                event,
+                &(),
+                &fixture.conn,
+                &qh,
+            );
+        }
+        assert_eq!(
+            state.input_state.style.current_thickness, initial,
+            "{chrome}"
+        );
+        assert_eq!(state.tablet.peak_thickness, None, "{chrome}");
+        for event in [Event::Up, Event::Frame { time: 2 }] {
+            <WaylandState as Dispatch<ZwpTabletToolV2, ()>>::event(
+                state,
+                &tool,
+                event,
+                &(),
+                &fixture.conn,
+                &qh,
+            );
+        }
+        state.input_state.close_color_picker_popup(true);
+        state.input_state.close_radial_menu();
+        state.onboarding_card.set_layout(None);
+        for event in [
+            Event::Motion { x: 700.0, y: 500.0 },
+            Event::Pressure { pressure: 4096 },
+            Event::Down { serial: 2 },
+            Event::Frame { time: 3 },
+        ] {
+            <WaylandState as Dispatch<ZwpTabletToolV2, ()>>::event(
+                state,
+                &tool,
+                event,
+                &(),
+                &fixture.conn,
+                &qh,
+            );
+        }
+        let DrawingState::Drawing {
+            point_thicknesses, ..
+        } = &state.input_state.state
+        else {
+            panic!("expected canvas stroke after {chrome}");
+        };
+        assert_eq!(
+            point_thicknesses,
+            &[state.input_state.style.current_thickness as f32]
+        );
+        assert!(state.input_state.style.current_thickness < 3.0, "{chrome}");
+    }
+}
+
+fn pen_fixture(
+    pressure_enabled: bool,
+) -> (
+    crate::backend::wayland::handlers::test_support::HandlerFixture,
+    wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::ZwpTabletToolV2,
+) {
+    use wayland_client::Proxy;
+    let mut config = crate::config::Config::default();
+    config.ui.show_onboarding_hints = false;
+    config.tablet.enabled = true;
+    config.tablet.pressure_enabled = pressure_enabled;
+    config.tablet.min_thickness = 1.0;
+    config.tablet.max_thickness = 20.0;
+    let mut fixture = crate::backend::wayland::handlers::test_support::HandlerFixture::new(config);
+    fixture.state.tablet.on_overlay = true;
+    let tool =
+        wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::ZwpTabletToolV2::inert(
+            fixture.conn.backend().downgrade(),
+        );
+    (fixture, tool)
+}
+
+fn send_pen(
+    fixture: &mut crate::backend::wayland::handlers::test_support::HandlerFixture,
+    tool: &wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::ZwpTabletToolV2,
+    events: impl IntoIterator<
+        Item = wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::Event,
+    >,
+) {
+    use wayland_client::Dispatch;
+    use wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::ZwpTabletToolV2;
+    let qh = fixture.queue.handle();
+    for event in events {
+        <WaylandState as Dispatch<ZwpTabletToolV2, ()>>::event(
+            &mut fixture.state,
+            tool,
+            event,
+            &(),
+            &fixture.conn,
+            &qh,
+        );
+    }
+}
+
+#[test]
+fn a_pen_drag_on_the_size_ring_keeps_its_value_after_the_pen_lifts() {
+    use crate::input::state::size_ring_angle_for_value;
+    use wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::Event;
+    let ring = |value: f64| {
+        let angle = size_ring_angle_for_value(value);
+        (400.0 + 183.0 * angle.cos(), 300.0 + 183.0 * angle.sin())
+    };
+    for pressure_enabled in [true, false] {
+        let (mut fixture, tool) = pen_fixture(pressure_enabled);
+        fixture.state.input_state.open_radial_menu(400.0, 300.0);
+        fixture
+            .state
+            .input_state
+            .update_radial_menu_layout(1000, 800);
+        let (start, end) = (ring(30.0), ring(12.0));
+        let pressure = || Event::Pressure { pressure: 40000 };
+        send_pen(
+            &mut fixture,
+            &tool,
+            [
+                Event::Motion {
+                    x: start.0,
+                    y: start.1,
+                },
+                pressure(),
+                Event::Down { serial: 1 },
+                Event::Frame { time: 1 },
+            ],
+        );
+        assert!(fixture.state.input_state.radial_menu_is_size_dragging());
+        send_pen(
+            &mut fixture,
+            &tool,
+            [
+                Event::Motion { x: end.0, y: end.1 },
+                pressure(),
+                Event::Frame { time: 2 },
+            ],
+        );
+        let dragged = fixture.state.input_state.style.current_thickness;
+        assert!(
+            (dragged - 12.0).abs() < 0.5,
+            "pressure {pressure_enabled}: {dragged}"
+        );
+        send_pen(&mut fixture, &tool, [Event::Up, Event::Frame { time: 3 }]);
+        assert_eq!(
+            fixture.state.input_state.style.current_thickness, dragged,
+            "pressure {pressure_enabled}"
+        );
+    }
+}
+
+#[test]
+fn a_pen_tap_on_a_toast_acts_on_the_toast_instead_of_drawing() {
+    use wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::Event;
+    let (mut fixture, tool) = pen_fixture(true);
+    let initial = fixture.state.input_state.style.current_thickness;
+    fixture.state.input_state.push_toast(
+        crate::input::state::ToastPriority::Info,
+        "test",
+        crate::input::state::Toast::info("Saved"),
+    );
+    fixture
+        .state
+        .input_state
+        .set_toast_geometry(Some((550.0, 350.0, 200.0, 80.0)), [None, None]);
+
+    send_pen(
+        &mut fixture,
+        &tool,
+        [
+            Event::Motion { x: 600.0, y: 400.0 },
+            Event::Pressure { pressure: 65535 },
+            Event::Down { serial: 1 },
+            Event::Frame { time: 1 },
+        ],
+    );
+    assert!(!matches!(
+        fixture.state.input_state.state,
+        DrawingState::Drawing { .. }
+    ));
+    send_pen(&mut fixture, &tool, [Event::Up, Event::Frame { time: 2 }]);
+
+    assert!(
+        fixture
+            .state
+            .input_state
+            .boards
+            .active_frame()
+            .shapes
+            .is_empty()
+    );
+    assert_eq!(fixture.state.input_state.style.current_thickness, initial);
+    assert_eq!(fixture.state.tablet.toast_press, None);
+}
+
+#[test]
+fn a_pen_tap_that_closes_a_menu_keeps_a_thickness_set_since_the_last_stroke() {
+    use wayland_protocols::wp::tablet::zv2::client::zwp_tablet_tool_v2::Event;
+    let (mut fixture, tool) = pen_fixture(true);
+    send_pen(
+        &mut fixture,
+        &tool,
+        [
+            Event::Motion { x: 700.0, y: 500.0 },
+            Event::Pressure { pressure: 4096 },
+            Event::Down { serial: 1 },
+            Event::Frame { time: 1 },
+            Event::Up,
+            Event::Frame { time: 2 },
+        ],
+    );
+    assert!(fixture.state.input_state.style.current_thickness < 3.0);
+    // A mouse or keyboard change after the stroke, which the pen never saw.
+    let measurer = crate::draw::TextMeasurer::default();
+    let _ = fixture
+        .state
+        .input_state
+        .set_thickness_for_active_tool_with(&measurer, 9.0);
+    fixture
+        .state
+        .input_state
+        .apply_toolbar_event(crate::ui::toolbar::ToolbarEvent::ToggleSessionPopover(true));
+    send_pen(
+        &mut fixture,
+        &tool,
+        [
+            Event::Motion { x: 600.0, y: 400.0 },
+            Event::Pressure { pressure: 65535 },
+            Event::Down { serial: 2 },
+            Event::Frame { time: 3 },
+            Event::Up,
+            Event::Frame { time: 4 },
+        ],
+    );
+    assert_eq!(fixture.state.input_state.style.current_thickness, 9.0);
+}
+
+#[test]
+fn help_blocks_stylus_barrel_actions() {
+    let mut state = make_test_input_state();
+    assert!(!modal_blocks_stylus_barrel_actions(&state));
+
+    state.toggle_help_overlay();
+    assert!(modal_blocks_stylus_barrel_actions(&state));
+}
+
+/// Both screen-region modals swallow pointer and keyboard input, so a
+/// barrel button must not run its bound action on the canvas behind them —
+/// including while they are still waiting on a capture.
+#[test]
+fn screen_region_modals_block_stylus_barrel_actions() {
+    use crate::input::state::{EyedropperCaptureSource, RegionPurposeTag, ScreenCaptureSource};
+
+    let mut state = make_test_input_state();
+    assert!(!modal_blocks_stylus_barrel_actions(&state));
+
+    state.set_region_pending_capture(RegionPurposeTag::Ocr, 1, ScreenCaptureSource::Frozen);
+    assert!(modal_blocks_stylus_barrel_actions(&state));
+    state.activate_region_with(
+        &crate::draw::TextMeasurer::default(),
+        RegionPurposeTag::Ocr,
+        1,
+    );
+    assert!(modal_blocks_stylus_barrel_actions(&state));
+    state.cancel_region_ui_only();
+    assert!(!modal_blocks_stylus_barrel_actions(&state));
+
+    state.set_eyedropper_pending_capture(EyedropperCaptureSource::Frozen);
+    assert!(modal_blocks_stylus_barrel_actions(&state));
+    state.activate_eyedropper_with(&crate::draw::TextMeasurer::default(), Some(1));
+    assert!(modal_blocks_stylus_barrel_actions(&state));
+    state.cancel_eyedropper();
+    assert!(!modal_blocks_stylus_barrel_actions(&state));
+}
+
+#[test]
+fn canonical_stylus_shortcut_wins_over_legacy_tablet_binding() {
+    use crate::config::keybindings::linux;
+    use crate::config::{Action, KeybindingsConfig};
+
+    let mut keybindings = KeybindingsConfig::default();
+    keybindings.core.undo = vec!["StylusPrimary".to_string()];
+    let action_map = keybindings.build_action_map().expect("map");
+    let action_bindings = keybindings.build_action_bindings().expect("bindings");
+    let mut state = crate::input::state::test_support::make_test_input_state();
+    state.set_keybinding_maps(action_map, action_bindings);
+
+    let mut tablet = crate::config::TabletInputConfig::default();
+    tablet.stylus_button.action = Some(Action::ToggleRadialMenu);
+
+    assert_eq!(
+        stylus_barrel_action(&state, linux::BTN_STYLUS, &tablet),
+        Some(Action::Undo)
+    );
+    tablet.stylus_button2.action = Some(Action::Redo);
+    assert_eq!(
+        stylus_barrel_action(&state, linux::BTN_STYLUS2, &tablet),
+        Some(Action::Redo)
+    );
+}
+
+#[test]
+fn unbound_stylus_falls_back_to_legacy_tablet_action() {
+    use crate::config::Action;
+    use crate::config::keybindings::linux;
+
+    let state = crate::input::state::test_support::make_test_input_state();
+    let mut tablet = crate::config::TabletInputConfig::default();
+    tablet.stylus_button.action = Some(Action::ToggleRadialMenu);
+    tablet.stylus_button2.action = None;
+
+    assert_eq!(
+        stylus_barrel_action(&state, linux::BTN_STYLUS, &tablet),
+        Some(Action::ToggleRadialMenu)
+    );
+    assert_eq!(
+        stylus_barrel_action(&state, linux::BTN_STYLUS2, &tablet),
+        None
+    );
+    assert_eq!(stylus_barrel_action(&state, 0, &tablet), None);
+}
diff --git a/src/backend/wayland/handlers/tablet/tool.rs b/src/backend/wayland/handlers/tablet/tool.rs
index 6641709d4..1b910f1b5 100644
--- a/src/backend/wayland/handlers/tablet/tool.rs
+++ b/src/backend/wayland/handlers/tablet/tool.rs
@@ -10,7 +10,7 @@ use crate::{
 
 use crate::backend::wayland::{
     handlers::route::InputSurface,
-    state::{RegionReviewPress, WaylandState},
+    state::{ContactOwner, RegionReviewPress, ReleaseRoute, StylusMotionRoute, WaylandState},
 };
 use crate::input::state::RegionInputSource;
 
@@ -143,8 +143,7 @@ impl WaylandState {
         self.finish_toolbar_item_drag(false);
         self.toolbar_drag.set_item_dragging(false);
         self.cancel_toolbar_move_drag();
-        self.tablet.tip_down = false;
-        self.tablet.base_thickness = Some(self.input_state.style.current_thickness);
+        self.tablet.reset_contact();
         self.tablet.pressure_thickness = None;
         self.tablet.last_pos = None;
         self.tablet.pending_frame = Default::default();
@@ -190,7 +189,11 @@ impl WaylandState {
         self.cancel_region_selection_from(RegionInputSource::Stylus);
         self.take_retired_stylus_contact();
         let hover_cursor_pos = self.stylus_hover_cursor_pos();
-        self.tablet.tip_down = false;
+        let left_strip = self.tablet.on_inline_strip();
+        self.tablet.reset_contact();
+        if left_strip {
+            self.inline_toolbar_leave();
+        }
         self.tablet.on_overlay = false;
         self.tablet.on_toolbar = false;
         self.finish_toolbar_item_drag(false);
@@ -228,12 +231,30 @@ impl WaylandState {
         if self.tablet.contact_retired {
             return;
         }
+        if self.input_state.command_palette_is_engaged() {
+            let position = self.current_or_pending_stylus_position();
+            self.input_state
+                .handle_command_palette_click_with_resources(
+                    crate::input::state::InputTextResources {
+                        measurer: self.render.text_measurer(),
+                        ui_engine: self.render.ui_text(),
+                    },
+                    position.0 as i32,
+                    position.1 as i32,
+                    self.surface.width(),
+                    self.surface.height(),
+                );
+            self.tablet.consume_contact();
+            self.input_state.needs_redraw = true;
+            return;
+        }
         self.input_state.dismiss_ocr_scan_result();
         if self.handle_stylus_region_down() || self.handle_stylus_eyedropper_down() {
             return;
         }
         if self.toolbar_chrome.inline_toolbars()
             && self.toolbar.is_visible()
+            && !self.input_state.help_overlay.is_visible()
             && self.handle_inline_stylus_down(conn, qh)
         {
             return;
@@ -248,14 +269,14 @@ impl WaylandState {
         if !self.input_state.region_is_active() {
             return false;
         }
-        if self.tablet.on_toolbar {
+        let (x, y) = self.current_or_pending_stylus_position();
+        if self.tablet.on_toolbar || self.inline_toolbar_contains((x, y)) {
             self.cancel_region_for_toolbar_interaction();
             return false;
         }
         if !self.tablet.on_overlay {
             return false;
         }
-        let (x, y) = self.current_or_pending_stylus_position();
         match self.consume_region_review_press(RegionInputSource::Stylus, (x, y)) {
             RegionReviewPress::NotReview | RegionReviewPress::Fallthrough => {
                 self.begin_region_selection(RegionInputSource::Stylus, x, y);
@@ -271,26 +292,24 @@ impl WaylandState {
         if !self.input_state.eyedropper_is_active() {
             return false;
         }
-        if self.tablet.on_toolbar {
+        let (x, y) = self.current_or_pending_stylus_position();
+        if self.tablet.on_toolbar || self.inline_toolbar_contains((x, y)) {
             self.cancel_eyedropper();
             return false;
         }
         if !self.tablet.on_overlay {
             return false;
         }
-        let (x, y) = self.current_or_pending_stylus_position();
         self.sample_eyedropper(x, y);
         true
     }
 
     fn handle_inline_stylus_down(&mut self, conn: &Connection, qh: &QueueHandle<Self>) -> bool {
         let position = self.current_or_pending_stylus_position();
-        if !self.inline_toolbar_press(position, Some(conn), Some(qh)) {
+        if !self.inline_toolbar_primary_press_or_strip(position, Some(conn), Some(qh)) {
             return false;
         }
-        self.tablet.on_toolbar = true;
-        self.toolbar_drag
-            .set_item_dragging(self.toolbar_drag.item_dragging());
+        self.tablet.bind_tip(ContactOwner::InlineToolbar);
         true
     }
 
@@ -315,6 +334,26 @@ impl WaylandState {
 
     fn handle_stylus_up(&mut self) {
         let retired_contact = self.take_retired_stylus_contact();
+        if retired_contact {
+            return;
+        }
+        let inline_active = self.toolbar_chrome.inline_toolbars() && self.toolbar.is_visible();
+        let previous_hover = self.stylus_hover_cursor_pos();
+        let route = self.tablet.take_up_route(inline_active);
+        // A strip contact must clean up even if a modal opened during its drag.
+        if route == ReleaseRoute::InlineToolbar {
+            let position = self.current_or_pending_stylus_position();
+            if inline_active {
+                self.inline_toolbar_release(position);
+            }
+            self.finish_toolbar_item_drag(true);
+            self.toolbar_drag.set_item_dragging(false);
+            self.end_toolbar_move_drag();
+            self.tablet
+                .set_over_inline_strip(self.inline_toolbar_contains(position));
+            self.mark_stylus_hover_cursor_dirty(previous_hover, self.stylus_hover_cursor_pos());
+            return;
+        }
         if self.input_state.region_is_active() {
             if self.tablet.on_overlay {
                 let (x, y) = self.current_or_pending_stylus_position();
@@ -324,15 +363,6 @@ impl WaylandState {
             }
             return;
         }
-        let inline_active = self.toolbar_chrome.inline_toolbars() && self.toolbar.is_visible();
-        if inline_active && self.tablet.on_toolbar {
-            let (x, y) = self.pointer.position();
-            self.inline_toolbar_release((x as f64, y as f64));
-            self.tablet.on_toolbar = false;
-            self.toolbar_drag.set_item_dragging(false);
-            self.end_toolbar_move_drag();
-            return;
-        }
         if self.tablet.on_toolbar {
             self.finish_toolbar_item_drag(true);
             self.toolbar_drag.set_item_dragging(false);
@@ -345,39 +375,68 @@ impl WaylandState {
     }
 
     fn handle_stylus_motion(&mut self, conn: &Connection, qh: &QueueHandle<Self>, x: f64, y: f64) {
+        self.pointer.reconcile_contacts(
+            &self.input_state,
+            self.zoom.panning,
+            self.toolbar_drag.is_moving() || self.toolbar_drag.item_dragging(),
+        );
         if self.handle_modal_stylus_motion(x, y) || self.handle_stylus_move_drag(x, y) {
             return;
         }
         let previous_hover = self.stylus_hover_cursor_pos();
-        if self.handle_toolbar_stylus_motion(conn, qh, x, y) {
-            return;
-        }
-        if self.toolbar_chrome.inline_toolbars() && self.toolbar.is_visible() {
-            self.tablet.last_pos = Some((x, y));
-            if self.inline_toolbar_motion((x, y)) {
-                self.commit_pending_stylus_frame();
-                self.tablet.last_pos = Some((x, y));
-                self.tablet.on_toolbar = true;
-                self.mark_stylus_hover_cursor_dirty(previous_hover, None);
-                return;
+        let inline_active = self.toolbar_chrome.inline_toolbars() && self.toolbar.is_visible();
+        match self.tablet.motion_route(inline_active) {
+            StylusMotionRoute::LayerShellToolbar => {
+                self.handle_toolbar_stylus_motion(conn, qh, x, y);
+            }
+            StylusMotionRoute::InlineStrip => {
+                self.tablet.record_immediate_motion((x, y));
+                let over_strip = self.inline_toolbar_motion((x, y));
+                self.tablet.set_over_inline_strip(over_strip);
+            }
+            StylusMotionRoute::InlineHover
+                if self.pointer.contact_motion().skips_inline_strip() =>
+            {
+                // Hover from another device cannot replace the mouse's held canvas contact.
+                self.tablet.record_immediate_motion((x, y));
+                self.tablet
+                    .set_over_inline_strip(self.inline_toolbar_contains((x, y)));
+                self.clear_inline_contact_hover();
+            }
+            StylusMotionRoute::InlineHover => {
+                self.tablet.record_immediate_motion((x, y));
+                let over_strip = self.inline_toolbar_motion((x, y));
+                self.tablet.set_over_inline_strip(over_strip);
+                if over_strip {
+                    self.commit_pending_stylus_frame();
+                    self.tablet.record_immediate_motion((x, y));
+                    self.mark_stylus_hover_cursor_dirty(previous_hover, None);
+                } else if self.tablet.on_overlay {
+                    self.queue_stylus_motion(x, y);
+                }
+            }
+            StylusMotionRoute::Canvas => {
+                self.tablet.set_over_inline_strip(false);
+                if inline_active {
+                    self.clear_inline_contact_hover();
+                }
+                if self.tablet.on_overlay {
+                    self.queue_stylus_motion(x, y);
+                }
             }
-            self.tablet.on_toolbar = false;
-        }
-        if self.tablet.on_overlay {
-            self.queue_stylus_motion(x, y);
         }
     }
 
     fn handle_modal_stylus_motion(&mut self, x: f64, y: f64) -> bool {
         if self.input_state.region_is_active() && self.tablet.on_overlay {
-            self.tablet.last_pos = Some((x, y));
+            self.tablet.record_immediate_motion((x, y));
             self.pointer
                 .set_position((x.round() as i32, y.round() as i32));
             self.update_region_selection(RegionInputSource::Stylus, x, y);
             return true;
         }
         if self.input_state.eyedropper_is_active() && self.tablet.on_overlay {
-            self.tablet.last_pos = Some((x, y));
+            self.tablet.record_immediate_motion((x, y));
             self.pointer
                 .set_position((x.round() as i32, y.round() as i32));
             self.update_eyedropper_hover(x, y);
@@ -387,12 +446,10 @@ impl WaylandState {
     }
 
     fn handle_stylus_move_drag(&mut self, x: f64, y: f64) -> bool {
-        if !self.toolbar_drag.is_moving() {
-            return false;
-        }
         let Some(kind) = self.toolbar_drag.kind() else {
             return false;
         };
+        self.tablet.record_immediate_motion((x, y));
         if self.tablet.on_toolbar {
             self.handle_toolbar_move(kind, (x, y));
         } else {
@@ -414,7 +471,7 @@ impl WaylandState {
         if !self.tablet.on_toolbar {
             return false;
         }
-        self.tablet.last_pos = Some((x, y));
+        self.tablet.record_immediate_motion((x, y));
         if let Some(surface) = self.tablet.surface.as_ref() {
             let event = self.toolbar.pointer_motion(surface, (x, y));
             if self.toolbar_drag.item_dragging() {
@@ -508,101 +565,4 @@ impl Dispatch<ZwpTabletToolV2, ()> for WaylandState {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The modal term stops exactly where the tip and motion guards stop: once
-    /// the selector is on screen. While a capture is still pending the canvas
-    /// keeps the pen, so a stroke drawn then must keep its pressure — otherwise
-    /// a capture that fails would leave a silently flat stroke behind.
-    #[test]
-    fn stylus_pressure_stops_at_the_selector_not_at_the_request() {
-        use crate::input::state::test_support::make_test_input_state;
-        use crate::input::state::{EyedropperCaptureSource, RegionPurposeTag, ScreenCaptureSource};
-
-        let fresh_contact = |state: &_| drop_stylus_pressure(true, false, state);
-
-        let mut state = make_test_input_state();
-        assert!(!fresh_contact(&state));
-
-        state.set_region_pending_capture(RegionPurposeTag::Ocr, 1, ScreenCaptureSource::Frozen);
-        assert!(
-            !fresh_contact(&state),
-            "a stroke drawn while the capture is pending is still a real stroke"
-        );
-        state.activate_region_with(
-            &crate::draw::TextMeasurer::default(),
-            RegionPurposeTag::Ocr,
-            1,
-        );
-        assert!(fresh_contact(&state));
-        state.start_region_selection(RegionInputSource::Stylus, (10.0, 10.0));
-        assert!(fresh_contact(&state));
-        state.cancel_region_ui_only();
-        assert!(!fresh_contact(&state));
-
-        state.set_eyedropper_pending_capture(EyedropperCaptureSource::Frozen);
-        assert!(!fresh_contact(&state));
-        state.activate_eyedropper_with(&crate::draw::TextMeasurer::default(), Some(1));
-        assert!(fresh_contact(&state));
-        state.cancel_eyedropper();
-        assert!(!fresh_contact(&state));
-    }
-
-    /// A contact disowned by a modal keeps arriving until the pen lifts, and the
-    /// pending-capture allowance above must not readmit it: the canvas holds the
-    /// pen again during the wait, but this contact is not the user drawing.
-    #[test]
-    fn a_retired_contact_never_reaches_the_tool_whatever_the_modal_is_doing() {
-        use crate::input::state::test_support::make_test_input_state;
-        use crate::input::state::{RegionPurposeTag, ScreenCaptureSource};
-
-        let mut state = make_test_input_state();
-
-        // The window the previous test allows, and the one that matters here.
-        state.set_region_pending_capture(RegionPurposeTag::Ocr, 1, ScreenCaptureSource::Frozen);
-        assert!(!drop_stylus_pressure(true, false, &state));
-        assert!(drop_stylus_pressure(true, true, &state));
-
-        // And it outlives the modal: cancelling before activation leaves the pen
-        // physically down with no modal to blame.
-        state.cancel_region_ui_only();
-        assert!(!drop_stylus_pressure(true, false, &state));
-        assert!(drop_stylus_pressure(true, true, &state));
-
-        // Off the overlay nothing is ours either way.
-        assert!(drop_stylus_pressure(false, false, &state));
-    }
-
-    #[test]
-    fn stylus_cursor_damage_rect_covers_cursor_area() {
-        let rect = stylus_cursor_damage_rect((100.2, 80.7), 400, 300).expect("rect");
-
-        assert_eq!(
-            rect,
-            Rect::new(
-                100 - STYLUS_CURSOR_DAMAGE_RADIUS,
-                81 - STYLUS_CURSOR_DAMAGE_RADIUS,
-                STYLUS_CURSOR_DAMAGE_RADIUS * 2,
-                STYLUS_CURSOR_DAMAGE_RADIUS * 2,
-            )
-            .unwrap()
-        );
-    }
-
-    #[test]
-    fn stylus_cursor_damage_rect_clamps_to_surface() {
-        let rect = stylus_cursor_damage_rect((4.0, 3.0), 400, 300).expect("rect");
-
-        assert_eq!(rect.x, 0);
-        assert_eq!(rect.y, 0);
-        assert_eq!(rect.width, 68);
-        assert_eq!(rect.height, 67);
-    }
-
-    #[test]
-    fn stylus_cursor_damage_rect_ignores_empty_surface() {
-        assert_eq!(stylus_cursor_damage_rect((10.0, 10.0), 0, 300), None);
-        assert_eq!(stylus_cursor_damage_rect((10.0, 10.0), 400, 0), None);
-    }
-}
+mod tests;
diff --git a/src/backend/wayland/handlers/tablet/tool/tests.rs b/src/backend/wayland/handlers/tablet/tool/tests.rs
new file mode 100644
index 000000000..376e489dd
--- /dev/null
+++ b/src/backend/wayland/handlers/tablet/tool/tests.rs
@@ -0,0 +1,96 @@
+use super::*;
+
+/// The modal term stops exactly where the tip and motion guards stop: once
+/// the selector is on screen. While a capture is still pending the canvas
+/// keeps the pen, so a stroke drawn then must keep its pressure — otherwise
+/// a capture that fails would leave a silently flat stroke behind.
+#[test]
+fn stylus_pressure_stops_at_the_selector_not_at_the_request() {
+    use crate::input::state::test_support::make_test_input_state;
+    use crate::input::state::{EyedropperCaptureSource, RegionPurposeTag, ScreenCaptureSource};
+
+    let fresh_contact = |state: &_| drop_stylus_pressure(true, false, state);
+
+    let mut state = make_test_input_state();
+    assert!(!fresh_contact(&state));
+
+    state.set_region_pending_capture(RegionPurposeTag::Ocr, 1, ScreenCaptureSource::Frozen);
+    assert!(
+        !fresh_contact(&state),
+        "a stroke drawn while the capture is pending is still a real stroke"
+    );
+    state.activate_region_with(
+        &crate::draw::TextMeasurer::default(),
+        RegionPurposeTag::Ocr,
+        1,
+    );
+    assert!(fresh_contact(&state));
+    state.start_region_selection(RegionInputSource::Stylus, (10.0, 10.0));
+    assert!(fresh_contact(&state));
+    state.cancel_region_ui_only();
+    assert!(!fresh_contact(&state));
+
+    state.set_eyedropper_pending_capture(EyedropperCaptureSource::Frozen);
+    assert!(!fresh_contact(&state));
+    state.activate_eyedropper_with(&crate::draw::TextMeasurer::default(), Some(1));
+    assert!(fresh_contact(&state));
+    state.cancel_eyedropper();
+    assert!(!fresh_contact(&state));
+}
+
+/// A contact disowned by a modal keeps arriving until the pen lifts, and the
+/// pending-capture allowance above must not readmit it: the canvas holds the
+/// pen again during the wait, but this contact is not the user drawing.
+#[test]
+fn a_retired_contact_never_reaches_the_tool_whatever_the_modal_is_doing() {
+    use crate::input::state::test_support::make_test_input_state;
+    use crate::input::state::{RegionPurposeTag, ScreenCaptureSource};
+
+    let mut state = make_test_input_state();
+
+    // The window the previous test allows, and the one that matters here.
+    state.set_region_pending_capture(RegionPurposeTag::Ocr, 1, ScreenCaptureSource::Frozen);
+    assert!(!drop_stylus_pressure(true, false, &state));
+    assert!(drop_stylus_pressure(true, true, &state));
+
+    // And it outlives the modal: cancelling before activation leaves the pen
+    // physically down with no modal to blame.
+    state.cancel_region_ui_only();
+    assert!(!drop_stylus_pressure(true, false, &state));
+    assert!(drop_stylus_pressure(true, true, &state));
+
+    // Off the overlay nothing is ours either way.
+    assert!(drop_stylus_pressure(false, false, &state));
+}
+
+#[test]
+fn stylus_cursor_damage_rect_covers_cursor_area() {
+    let rect = stylus_cursor_damage_rect((100.2, 80.7), 400, 300).expect("rect");
+
+    assert_eq!(
+        rect,
+        Rect::new(
+            100 - STYLUS_CURSOR_DAMAGE_RADIUS,
+            81 - STYLUS_CURSOR_DAMAGE_RADIUS,
+            STYLUS_CURSOR_DAMAGE_RADIUS * 2,
+            STYLUS_CURSOR_DAMAGE_RADIUS * 2,
+        )
+        .unwrap()
+    );
+}
+
+#[test]
+fn stylus_cursor_damage_rect_clamps_to_surface() {
+    let rect = stylus_cursor_damage_rect((4.0, 3.0), 400, 300).expect("rect");
+
+    assert_eq!(rect.x, 0);
+    assert_eq!(rect.y, 0);
+    assert_eq!(rect.width, 68);
+    assert_eq!(rect.height, 67);
+}
+
+#[test]
+fn stylus_cursor_damage_rect_ignores_empty_surface() {
+    assert_eq!(stylus_cursor_damage_rect((10.0, 10.0), 0, 300), None);
+    assert_eq!(stylus_cursor_damage_rect((10.0, 10.0), 400, 0), None);
+}
diff --git a/src/backend/wayland/handlers/test_support.rs b/src/backend/wayland/handlers/test_support.rs
new file mode 100644
index 000000000..9a57933a5
--- /dev/null
+++ b/src/backend/wayland/handlers/test_support.rs
@@ -0,0 +1,172 @@
+//! Private protocol peer for exercising real handlers without a desktop connection.
+use std::io::{Read, Write};
+use std::os::unix::net::UnixStream;
+
+use smithay_client_toolkit::{
+    compositor::CompositorState,
+    output::OutputState,
+    registry::RegistryState,
+    seat::{
+        SeatState, pointer_constraints::PointerConstraintsState,
+        relative_pointer::RelativePointerState,
+    },
+    shell::xdg::{XdgShell, window::WindowDecorations},
+    shm::Shm,
+};
+use wayland_client::{Connection, EventQueue, globals::registry_queue_init};
+
+use crate::backend::wayland::{
+    backend::runtime_wake::RuntimeWakeSource,
+    session::{HomeSession, PersistenceController, SessionHome, SessionLaunch, session_target},
+    state::{ProtocolGlobals, ProtocolGlobalsSeed, WaylandState, WaylandStateInit},
+};
+
+pub(in crate::backend::wayland) struct HandlerFixture {
+    pub state: WaylandState,
+    pub conn: Connection,
+    pub queue: EventQueue<WaylandState>,
+    _peer: UnixStream,
+    _wake: RuntimeWakeSource,
+    _runtime: tokio::runtime::Runtime,
+    _data: crate::test_temp::TempDir,
+}
+
+impl HandlerFixture {
+    pub fn new(config: crate::config::Config) -> Self {
+        let (client, mut peer) = UnixStream::pair().unwrap();
+        peer.set_read_timeout(Some(std::time::Duration::from_secs(5)))
+            .unwrap();
+        let bootstrap = std::thread::spawn(move || {
+            loop {
+                let mut header = [0u8; 8];
+                peer.read_exact(&mut header).unwrap();
+                let object = u32::from_ne_bytes(header[..4].try_into().unwrap());
+                let size_opcode = u32::from_ne_bytes(header[4..].try_into().unwrap());
+                let mut payload = vec![0; (size_opcode >> 16) as usize - 8];
+                peer.read_exact(&mut payload).unwrap();
+                assert_eq!(object, 1);
+                let id = u32::from_ne_bytes(payload[..4].try_into().unwrap());
+                match size_opcode & 0xffff {
+                    1 => {
+                        for (name, interface, version) in [
+                            (1, "wl_compositor", 6),
+                            (2, "wl_shm", 1),
+                            (3, "xdg_wm_base", 1),
+                        ] {
+                            let mut body = Vec::new();
+                            body.extend_from_slice(&u32::to_ne_bytes(name));
+                            body.extend_from_slice(&((interface.len() + 1) as u32).to_ne_bytes());
+                            body.extend_from_slice(interface.as_bytes());
+                            body.push(0);
+                            while body.len() % 4 != 0 {
+                                body.push(0);
+                            }
+                            body.extend_from_slice(&u32::to_ne_bytes(version));
+                            send(&mut peer, id, 0, &body);
+                        }
+                    }
+                    0 => {
+                        send(&mut peer, id, 0, &0u32.to_ne_bytes());
+                        send(&mut peer, 1, 1, &id.to_ne_bytes());
+                        return peer;
+                    }
+                    opcode => panic!("unexpected display request {opcode}"),
+                }
+            }
+        });
+        let conn = Connection::from_socket(client).unwrap();
+        let (globals, queue) = registry_queue_init::<WaylandState>(&conn).unwrap();
+        let peer = bootstrap.join().unwrap();
+        let qh = queue.handle();
+        let protocol = ProtocolGlobals::from_seed(ProtocolGlobalsSeed {
+            registry: RegistryState::new(&globals),
+            compositor: CompositorState::bind(&globals, &qh).unwrap(),
+            shm: Shm::bind(&globals, &qh).unwrap(),
+            xdg_shell: Some(XdgShell::bind(&globals, &qh).unwrap()),
+            layer_shell: None,
+            activation: None,
+            pointer_constraints: PointerConstraintsState::bind(&globals, &qh),
+            relative_pointer: RelativePointerState::bind(&globals, &qh),
+            output: OutputState::new(&globals, &qh),
+            seat: SeatState::new(&globals, &qh),
+        });
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap();
+        let wake = RuntimeWakeSource::new().unwrap();
+        // Private store files keep tests away from the developer's own data
+        // folder without changing the environment other tests read.
+        let data = crate::test_temp::tempdir().unwrap();
+        let onboarding =
+            crate::onboarding::OnboardingStore::load_from_path(data.path().join("onboarding.toml"));
+        let palette_recents = crate::palette_recents::PaletteRecentsStore::load_from_path(
+            data.path().join("palette_recents.toml"),
+        );
+        let mut state = WaylandState::new(WaylandStateInit {
+            ui_text: crate::ui_text::UiTextEngine::default(),
+            text_measurer: crate::draw::TextMeasurer::default(),
+            globals: protocol,
+            input_state: crate::input::InputState::from_config(&config),
+            config,
+            startup_activation_token: None,
+            onboarding,
+            palette_recents: crate::palette_recents::PaletteRecentsWriter::new(palette_recents),
+            capture_manager: crate::capture::CaptureManager::new(runtime.handle()),
+            session_options: None,
+            session_home: SessionHome::new(
+                SessionLaunch {
+                    home: HomeSession::Default,
+                    preferred: None,
+                    from_daemon: false,
+                },
+                None,
+                session_target(None),
+            ),
+            session_config_failed: false,
+            persistence: PersistenceController::start(wake.handle()).unwrap(),
+            runtime_ui: None,
+            runtime_ui_unavailable: None,
+            runtime_wake: wake.handle(),
+            tokio_handle: runtime.handle().clone(),
+            exit_after_capture_mode: crate::backend::ExitAfterCaptureMode::Never,
+            frozen_enabled: false,
+            preferred_output_identity: None,
+            xdg_fullscreen: false,
+            main_surface_uses_overlay_layer: false,
+            pending_freeze_on_start: false,
+            screencopy_manager: None,
+            ext_image_copy_managers: None,
+            portal_freeze_supported: false,
+            text_input_manager: None,
+            #[cfg(feature = "tablet-input")]
+            tablet_manager: None,
+        });
+        let surface = state.protocol.compositor().create_surface(&qh);
+        let window = state.protocol.xdg_shell().unwrap().create_window(
+            surface,
+            WindowDecorations::None,
+            &qh,
+        );
+        state.surface.set_xdg_window(window);
+        state.surface.update_dimensions(1000, 800);
+        state.surface.set_configured(true);
+        state.input_state.update_screen_dimensions(1000, 800);
+        Self {
+            state,
+            conn,
+            queue,
+            _peer: peer,
+            _wake: wake,
+            _runtime: runtime,
+            _data: data,
+        }
+    }
+}
+
+fn send(peer: &mut UnixStream, object: u32, opcode: u32, payload: &[u8]) {
+    peer.write_all(&object.to_ne_bytes()).unwrap();
+    peer.write_all(&(((payload.len() + 8) as u32) << 16 | opcode).to_ne_bytes())
+        .unwrap();
+    peer.write_all(payload).unwrap();
+}
diff --git a/src/backend/wayland/handlers/touch.rs b/src/backend/wayland/handlers/touch.rs
index 7a556b296..1b9ac2c1f 100644
--- a/src/backend/wayland/handlers/touch.rs
+++ b/src/backend/wayland/handlers/touch.rs
@@ -281,7 +281,7 @@ impl WaylandState {
     ) -> Option<TouchTarget> {
         if routed.surface == InputSurface::Canvas
             && routed.inline_toolbars
-            && self.inline_toolbar_press(routed.screen?, Some(conn), Some(qh))
+            && self.inline_toolbar_primary_press_or_strip(routed.screen?, Some(conn), Some(qh))
         {
             return Some(TouchTarget::InlineToolbar);
         }
diff --git a/src/backend/wayland/session.rs b/src/backend/wayland/session.rs
index fe3cf229a..d696d037f 100644
--- a/src/backend/wayland/session.rs
+++ b/src/backend/wayland/session.rs
@@ -27,6 +27,7 @@ struct InFlightAutosave {
 #[derive(Debug, Clone)]
 pub(in crate::backend::wayland) struct PendingOutputTransition {
     pub(in crate::backend::wayland) source_epoch: u64,
+    pub(in crate::backend::wayland) revision: u64,
     pub(in crate::backend::wayland) staged_options: SessionOptions,
     pub(in crate::backend::wayland) physical_output_identity: Option<String>,
     pub(in crate::backend::wayland) retry_at: Instant,
@@ -37,6 +38,7 @@ pub(in crate::backend::wayland) struct PendingOutputTransition {
 pub struct SessionState {
     options: Option<SessionOptions>,
     loaded: bool,
+    initial_load_attempted: bool,
     loaded_board_data: bool,
     target_epoch: u64,
     edit_generation: u64,
@@ -48,6 +50,7 @@ pub struct SessionState {
     autosave_deferred_until: Option<Instant>,
     in_flight_autosave: Option<InFlightAutosave>,
     pending_output_transition: Option<PendingOutputTransition>,
+    output_transition_revision: u64,
     live_source_resolution_pending: bool,
     notified_failure: bool,
     notified_worker_failure: bool,
@@ -55,6 +58,7 @@ pub struct SessionState {
     notified_trimmed_history: bool,
     notified_visible_only: bool,
     protected_session_paths: HashSet<PathBuf>,
+    blocked_session_paths: HashSet<PathBuf>,
     notified_expanded_load_paths: HashSet<PathBuf>,
     launch_restore_notice_settled: bool,
 }
@@ -65,6 +69,7 @@ impl SessionState {
         Self {
             options,
             loaded: false,
+            initial_load_attempted: false,
             loaded_board_data: false,
             target_epoch: 0,
             edit_generation: 0,
@@ -76,6 +81,7 @@ impl SessionState {
             autosave_deferred_until: None,
             in_flight_autosave: None,
             pending_output_transition: None,
+            output_transition_revision: 0,
             live_source_resolution_pending: false,
             notified_failure: false,
             notified_worker_failure: false,
@@ -83,6 +89,7 @@ impl SessionState {
             notified_trimmed_history: false,
             notified_visible_only: false,
             protected_session_paths: HashSet::new(),
+            blocked_session_paths: HashSet::new(),
             notified_expanded_load_paths: HashSet::new(),
             launch_restore_notice_settled: false,
         }
@@ -93,37 +100,17 @@ impl SessionState {
         self.options.as_ref()
     }
 
-    /// Starts this run in `options` instead, before any session was loaded.
-    pub(in crate::backend::wayland) fn replace_options_before_load(
-        &mut self,
-        options: Option<SessionOptions>,
-    ) {
-        debug_assert!(
-            !self.loaded,
-            "a loaded session changes target through a commit"
-        );
-        self.options = options;
-    }
-
-    /// Returns mutable access to the session options, if present.
-    #[allow(dead_code)]
-    pub fn options_mut(&mut self) -> Option<&mut SessionOptions> {
-        self.options.as_mut()
+    /// Allow one synchronous initial load from the surface callback. Drawing
+    /// may already exist; the caller must retain it instead of replacing it.
+    pub(in crate::backend::wayland) fn begin_initial_load(&mut self) -> bool {
+        !std::mem::replace(&mut self.initial_load_attempted, true)
     }
 
-    /// Returns true if the active logical session source has been resolved this run.
+    /// Whether the active logical session source has been resolved this run.
     pub fn is_loaded(&self) -> bool {
         self.loaded
     }
 
-    /// Marks the session as loaded and records whether board data is now on disk.
-    #[allow(dead_code)]
-    pub fn mark_loaded(&mut self, loaded_board_data: bool) {
-        self.loaded = true;
-        self.loaded_board_data = loaded_board_data;
-        self.live_source_resolution_pending = false;
-    }
-
     pub fn has_loaded_board_data(&self) -> bool {
         self.loaded_board_data
     }
@@ -154,10 +141,6 @@ impl SessionState {
         if !input_dirty {
             return;
         }
-        if self.live_source_resolution_pending {
-            self.loaded = true;
-            self.live_source_resolution_pending = false;
-        }
         self.edit_generation = self.edit_generation.wrapping_add(1);
         if !self.dirty {
             self.dirty_since = Some(now);
@@ -193,6 +176,7 @@ impl SessionState {
         options: SessionOptions,
         loaded_board_data: bool,
     ) {
+        self.confirm_successful_load(&options.session_file_path());
         self.advance_target_epoch();
         self.options = Some(options);
         self.loaded = true;
@@ -213,6 +197,7 @@ impl SessionState {
         now: Instant,
         saved_board_data: bool,
     ) {
+        self.confirm_successful_load(&options.session_file_path());
         self.advance_target_epoch();
         self.options = Some(options);
         self.loaded = true;
@@ -238,6 +223,11 @@ impl SessionState {
     }
 
     pub(in crate::backend::wayland) fn commit_runtime_clear(&mut self, now: Instant) {
+        if let Some(options) = &self.options {
+            self.blocked_session_paths
+                .remove(&options.session_file_path());
+        }
+
         self.loaded = true;
         self.loaded_board_data = false;
         self.dirty = false;
@@ -309,11 +299,17 @@ impl SessionState {
     }
 
     pub fn should_skip_save_for_protected_path(&self, path: &Path, input_dirty: bool) -> bool {
-        self.protected_session_paths.contains(path) && !self.dirty && !input_dirty
+        self.refuses_source_write(path)
+            || (self.protected_session_paths.contains(path) && !self.dirty && !input_dirty)
     }
 
     pub fn autosave_due(&self, now: Instant, options: &SessionOptions) -> bool {
-        if !autosave_active(options) || !self.dirty || self.in_flight_autosave.is_some() {
+        if !self.loaded
+            || self.refuses_source_write(&options.session_file_path())
+            || !autosave_active(options)
+            || !self.dirty
+            || self.in_flight_autosave.is_some()
+        {
             return false;
         }
         if let Some(retry_at) = self.autosave_retry_at
@@ -340,7 +336,12 @@ impl SessionState {
     }
 
     pub fn autosave_timeout(&self, now: Instant, options: &SessionOptions) -> Option<Duration> {
-        if !autosave_active(options) || !self.dirty || self.in_flight_autosave.is_some() {
+        if !self.loaded
+            || self.refuses_source_write(&options.session_file_path())
+            || !autosave_active(options)
+            || !self.dirty
+            || self.in_flight_autosave.is_some()
+        {
             return None;
         }
         let last_dirty_at = self.last_dirty_at?;
@@ -458,10 +459,13 @@ impl SessionState {
             .pending_output_transition
             .as_ref()
             .is_some_and(|pending| {
-                pending.source_epoch == self.target_epoch
+                pending.failure_notified
+                    && pending.source_epoch == self.target_epoch
                     && pending.physical_output_identity == physical_output_identity
             });
+        self.output_transition_revision = self.output_transition_revision.wrapping_add(1);
         self.pending_output_transition = Some(PendingOutputTransition {
+            revision: self.output_transition_revision,
             source_epoch: self.target_epoch,
             staged_options,
             physical_output_identity,
@@ -476,12 +480,6 @@ impl SessionState {
         self.pending_output_transition.as_ref()
     }
 
-    pub(in crate::backend::wayland) fn take_pending_output_transition(
-        &mut self,
-    ) -> Option<PendingOutputTransition> {
-        self.pending_output_transition.take()
-    }
-
     pub(in crate::backend::wayland) fn cancel_pending_output_transition(
         &mut self,
     ) -> Option<PendingOutputTransition> {
@@ -492,33 +490,18 @@ impl SessionState {
         self.live_source_resolution_pending
     }
 
-    /// Cancels a superseded destination while retaining dirty live source data.
-    ///
-    /// A dirty source becomes authoritative for this run so a later configure
-    /// fallback cannot reload over it. A clean unloaded source remains pending
-    /// until the controller can perform its initial load. The dirty window and
-    /// target epoch remain unchanged.
+    /// Cancel the destination without making an unresolved source writable.
     pub(in crate::backend::wayland) fn cancel_output_transition_for_live_source(
         &mut self,
-        input_dirty: bool,
     ) -> Option<PendingOutputTransition> {
         let pending = self.pending_output_transition.take();
         if pending.is_some() {
-            if self.is_dirty() || input_dirty {
-                self.loaded = true;
-                self.live_source_resolution_pending = false;
-            } else {
-                self.live_source_resolution_pending = !self.loaded;
-            }
+            self.live_source_resolution_pending = !self.loaded;
         }
         pending
     }
 
-    /// Resolves provisional protection after an output transition was canceled.
-    ///
-    /// Returns true while an interaction still blocks resolution. A committed
-    /// mutation makes the live source authoritative; a clean idle source remains
-    /// unloaded so the controller can perform the configured initial load.
+    /// Protect early ink from replacement while the source is still unresolved.
     pub(in crate::backend::wayland) fn resolve_live_source_resolution(
         &mut self,
         input_dirty: bool,
@@ -527,12 +510,7 @@ impl SessionState {
         if !self.live_source_resolution_pending {
             return false;
         }
-        if self.is_dirty() || input_dirty {
-            self.loaded = true;
-            self.live_source_resolution_pending = false;
-            return false;
-        }
-        if interaction_active {
+        if !self.loaded && (self.is_dirty() || input_dirty || interaction_active) {
             return true;
         }
         self.live_source_resolution_pending = false;
@@ -600,20 +578,24 @@ fn autosave_active(options: &SessionOptions) -> bool {
         && (options.any_enabled() || options.restore_tool_state || options.persist_history)
 }
 
+pub(in crate::backend::wayland) fn interaction_defer_interval() -> Duration {
+    Duration::from_millis(500)
+}
+
 pub(in crate::backend::wayland) mod driver;
 mod home;
 mod load_outcome;
 mod persistence;
 mod runtime;
+mod write_policy;
 
 #[cfg(test)]
 pub(in crate::backend::wayland) use home::HomeSession;
 pub(in crate::backend::wayland) use home::{
-    OutputSessionLoad, SessionHome, SessionLaunch, load_output_session,
-    may_save_before_output_load, session_target,
+    OutputSessionLoad, SessionHome, SessionLaunch, load_output_session, session_target,
 };
 pub(in crate::backend::wayland) use load_outcome::{
-    ExpandedTooLarge, apply_load_outcome, replace_output_session_snapshot,
+    ExpandedTooLarge, apply_load_outcome, commit_output_load, replace_output_session_snapshot,
 };
 pub(in crate::backend::wayland) use persistence::{
     PersistenceCompletion, PersistenceController, PersistenceOperation, PersistenceOutcome,
@@ -621,8 +603,8 @@ pub(in crate::backend::wayland) use persistence::{
 };
 
 pub(in crate::backend::wayland) use runtime::{
-    ExplicitSessionTransaction, SessionCommand, SessionCommandReport, SessionTransaction,
-    TransactionStep,
+    QueuedSessionCommand, SessionCommand, SessionCommandAborted, SessionCommandReport,
+    SessionCommandTransaction, SessionTransaction, TransactionStep,
 };
 #[cfg(test)]
 pub(in crate::backend::wayland) use runtime::{
@@ -630,6 +612,7 @@ pub(in crate::backend::wayland) use runtime::{
     RuntimeSaveAsSessionReport,
 };
 pub(super) use runtime::{has_session_artifact, should_skip_unloaded_contentless_save};
+pub(in crate::backend::wayland) use write_policy::SourceWriteRefused;
 
 #[cfg(test)]
 mod tests;
diff --git a/src/backend/wayland/session/AGENTS.md b/src/backend/wayland/session/AGENTS.md
index 62e66295a..603ce3dd2 100644
--- a/src/backend/wayland/session/AGENTS.md
+++ b/src/backend/wayland/session/AGENTS.md
@@ -12,6 +12,7 @@
 - Preserve save-before-open behavior, target validation, user prompt boundaries, rollback behavior, and catalog updates.
 - Do not replace active board state until a runtime open has validated and loaded successfully.
 - Keep named-session safety aligned with `src/session/` and `src/paths/`.
+- A queued Clear or tool reset runs only on the epoch and edit generation it was requested over. Queued commands that will not run are reported together through `fail_queued_commands`.
 
 ## Coupled Changes
 - Runtime session changes may affect `src/session/`, `src/input/state/core/session_preflight*`, daemon named-session switching, and configurator session catalog code.
diff --git a/src/backend/wayland/session/driver.rs b/src/backend/wayland/session/driver.rs
index ab1a55b51..37ef489f1 100644
--- a/src/backend/wayland/session/driver.rs
+++ b/src/backend/wayland/session/driver.rs
@@ -1,29 +1,61 @@
-//! Live explicit-command orchestration, shared by Wayland and headless runtime tests.
+//! Live session-command orchestration, shared by Wayland and headless runtime tests.
 use anyhow::{Result, anyhow};
 use std::time::{Duration, Instant};
 
 use super::{
-    ExplicitSessionTransaction, PersistenceCompletion, PersistenceController, PersistenceOutcome,
-    SaveCompletion, SessionCommand, SessionCommandReport, SessionTransaction, TransactionStep,
+    PersistenceCompletion, PersistenceController, PersistenceOutcome, QueuedSessionCommand,
+    SaveCompletion, SessionCommand, SessionCommandReport, SessionCommandTransaction,
+    SessionTransaction, TransactionStep,
 };
 
 /// The driver owns ordering and identity; adapters own UI publication and autosave feedback.
 pub(in crate::backend::wayland) trait SessionCommandRuntime {
     fn session_context(&mut self) -> SessionTransaction<'_>;
-    fn pending_command(&mut self) -> &mut Option<ExplicitSessionTransaction>;
+    fn pending_command(&mut self) -> &mut Option<SessionCommandTransaction>;
     fn persistence(&mut self) -> &mut PersistenceController;
     fn session_config_failed(&self) -> bool;
     fn refresh_session_ui_seeds(&mut self);
     /// An explicit command committed its target, or finished without changing
     /// it. Called before the command's terminal report.
     fn session_target_committed(&mut self);
+    fn session_command_queued(&mut self);
     fn finish_session_command(&mut self, report: SessionCommandReport);
     fn fail_session_command(&mut self, command: &SessionCommand, error: &anyhow::Error);
+    /// Queued commands that will not run, reported together so that one
+    /// refusal does not hide another. `closing` says Wayscriber is exiting.
+    fn fail_queued_commands(
+        &mut self,
+        failures: Vec<(SessionCommand, anyhow::Error)>,
+        _closing: bool,
+    ) {
+        for (command, error) in &failures {
+            self.fail_session_command(command, error);
+        }
+    }
     fn autosave_succeeded(&mut self, save: SaveCompletion, execution_time: Duration);
     fn autosave_failed(&mut self, error: &anyhow::Error);
     fn session_transport_failed(&mut self, error: &anyhow::Error);
 }
 
+/// Guard aborts retain the latest destination without treating normal input as an I/O failure.
+pub(in crate::backend::wayland) fn defer_failed_output(
+    session: &mut super::SessionState,
+    error: &anyhow::Error,
+    now: Instant,
+    failure_backoff: Duration,
+) -> bool {
+    let guard_abort = error
+        .downcast_ref::<super::SessionCommandAborted>()
+        .is_some();
+    let delay = if guard_abort {
+        super::interaction_defer_interval()
+    } else {
+        failure_backoff
+    };
+    session.defer_output_transition(now, delay);
+    !guard_abort
+}
+
 pub(in crate::backend::wayland) fn observe_input_dirty(
     runtime: &mut impl SessionCommandRuntime,
     now: Instant,
@@ -37,9 +69,6 @@ pub(in crate::backend::wayland) fn start_session_command(
     runtime: &mut impl SessionCommandRuntime,
     command: SessionCommand,
 ) -> Result<()> {
-    if runtime.pending_command().is_some() {
-        return Err(anyhow!("another session command is already pending"));
-    }
     if matches!(
         command,
         SessionCommand::Clear | SessionCommand::ClearTools(_)
@@ -49,12 +78,44 @@ pub(in crate::backend::wayland) fn start_session_command(
             "config.toml [session] could not be read; refusing to modify saved session data that default settings may mistarget - fix the section and retry"
         ));
     }
+
+    // Edits made before the request are part of what it was asked over.
+    observe_input_dirty(runtime, Instant::now());
+    let context = runtime.session_context();
+    let epoch = context.session.target_epoch();
+    let generation = context.session.edit_generation();
+
+    if let Some(pending) = runtime.pending_command().as_mut() {
+        if matches!(pending.command(), SessionCommand::Output { .. })
+            && !matches!(command, SessionCommand::Output { .. })
+        {
+            if !pending
+                .queued_commands
+                .iter()
+                .any(|queued| queued.epoch == epoch && queued.command.matches_request(&command))
+            {
+                if pending.queued_commands.len() >= 8 {
+                    return Err(anyhow!(
+                        "session command queue is full; wait for the output load and retry"
+                    ));
+                }
+                pending.queued_commands.push_back(QueuedSessionCommand {
+                    command,
+                    epoch,
+                    generation,
+                });
+            }
+            runtime.session_command_queued();
+            return Ok(());
+        }
+        return Err(anyhow!("another session command is already pending"));
+    }
     if !runtime.persistence().is_healthy() {
         return Err(anyhow!("session persistence worker is unhealthy"));
     }
 
     let context = runtime.session_context();
-    let transaction = ExplicitSessionTransaction::new(
+    let transaction = SessionCommandTransaction::new(
         command,
         context.session.target_epoch(),
         context.input_state.session_interaction_state(),
@@ -82,7 +143,7 @@ pub(in crate::backend::wayland) fn complete_session_command(
     runtime: &mut impl SessionCommandRuntime,
     completion: PersistenceCompletion,
 ) {
-    let Some(transaction) = runtime.pending_command().take() else {
+    let Some(mut transaction) = runtime.pending_command().take() else {
         return;
     };
     if transaction.request_id != Some(completion.id) {
@@ -90,6 +151,7 @@ pub(in crate::backend::wayland) fn complete_session_command(
             transaction.command(),
             &anyhow!("explicit session completion identity mismatch"),
         );
+        start_queued_commands(runtime, std::mem::take(&mut transaction.queued_commands));
         return;
     }
 
@@ -98,10 +160,16 @@ pub(in crate::backend::wayland) fn complete_session_command(
 
 fn advance_session_command(
     runtime: &mut impl SessionCommandRuntime,
-    mut transaction: ExplicitSessionTransaction,
+    mut transaction: SessionCommandTransaction,
     result: Option<Result<PersistenceOutcome>>,
 ) {
     observe_input_dirty(runtime, Instant::now());
+    if let Some(result) = &result {
+        runtime
+            .session_context()
+            .session
+            .observe_load_failure(result);
+    }
 
     // A submitted board or tool-state clear can change disk before its receipt fails.
     let clear_attempted = matches!(
@@ -138,6 +206,10 @@ fn advance_session_command(
                     } else {
                         runtime.fail_session_command(transaction.command(), &error);
                     }
+                    start_queued_commands(
+                        runtime,
+                        std::mem::take(&mut transaction.queued_commands),
+                    );
                 }
             }
         }
@@ -145,6 +217,7 @@ fn advance_session_command(
             if matches!(
                 *report,
                 SessionCommandReport::Open(_)
+                    | SessionCommandReport::Output { .. }
                     | SessionCommandReport::Home
                     | SessionCommandReport::Clear(_)
             ) {
@@ -153,6 +226,7 @@ fn advance_session_command(
 
             runtime.session_target_committed();
             runtime.finish_session_command(*report);
+            start_queued_commands(runtime, std::mem::take(&mut transaction.queued_commands));
         }
         Err(error) => {
             // Resave retained state if a clear may have changed disk, without postponing
@@ -164,6 +238,91 @@ fn advance_session_command(
                 .record_input_dirty(Instant::now(), needs_recovery);
 
             runtime.fail_session_command(transaction.command(), &error);
+            start_queued_commands(runtime, std::mem::take(&mut transaction.queued_commands));
+        }
+    }
+}
+
+fn start_queued_commands(
+    runtime: &mut impl SessionCommandRuntime,
+    mut commands: std::collections::VecDeque<QueuedSessionCommand>,
+) {
+    if let Some(pending) = runtime.pending_command().as_mut() {
+        pending.queued_commands.extend(commands);
+        return;
+    }
+
+    let mut refused = Vec::new();
+    while let Some(queued) = commands.pop_front() {
+        if let Some(refusal) = queued_command_refusal(runtime, &queued) {
+            refused.push((queued.command, refusal));
+            continue;
+        }
+
+        let context = runtime.session_context();
+        let mut transaction = SessionCommandTransaction::new(
+            queued.command,
+            context.session.target_epoch(),
+            context.input_state.session_interaction_state(),
+        );
+        transaction.queued_commands = commands;
+        *runtime.pending_command() = Some(transaction);
+
+        if !refused.is_empty() {
+            runtime.fail_queued_commands(refused, false);
+        }
+        poll_pending_session_command(runtime);
+        return;
+    }
+
+    if !refused.is_empty() {
+        runtime.fail_queued_commands(refused, false);
+    }
+}
+
+fn queued_command_refusal(
+    runtime: &mut impl SessionCommandRuntime,
+    queued: &QueuedSessionCommand,
+) -> Option<anyhow::Error> {
+    if queued.epoch != runtime.session_context().session.target_epoch() {
+        return Some(anyhow!(
+            "the visible session changed while this command was queued; no queued edit was performed; retry on the intended session"
+        ));
+    }
+
+    if matches!(
+        queued.command,
+        SessionCommand::Clear | SessionCommand::ClearTools(_)
+    ) {
+        observe_input_dirty(runtime, Instant::now());
+        if runtime.session_context().session.edit_generation() != queued.generation {
+            return Some(anyhow!(
+                "the session changed while this command was queued; nothing was cleared; run it again to include the newer changes"
+            ));
+        }
+    }
+
+    if !runtime.persistence().is_healthy() {
+        return Some(anyhow!("session persistence worker is unhealthy"));
+    }
+
+    None
+}
+
+pub(in crate::backend::wayland) fn fail_pending_commands(
+    runtime: &mut impl SessionCommandRuntime,
+    error: &anyhow::Error,
+) {
+    if let Some(mut transaction) = runtime.pending_command().take() {
+        runtime.fail_session_command(transaction.command(), error);
+
+        let queued = transaction
+            .queued_commands
+            .drain(..)
+            .map(|queued| (queued.command, anyhow!("{error:#}")))
+            .collect::<Vec<_>>();
+        if !queued.is_empty() {
+            runtime.fail_queued_commands(queued, false);
         }
     }
 }
@@ -223,7 +382,8 @@ pub(in crate::backend::wayland) fn apply_session_completion(
     Ok(())
 }
 
-/// Deliberate durability barrier, never called from normal dispatch.
+/// Deliberate durability barrier for startup and shutdown; event-loop output
+/// switches and explicit commands advance through nonblocking transactions.
 pub(in crate::backend::wayland) fn persistence_barrier(
     runtime: &mut impl SessionCommandRuntime,
 ) -> Result<()> {
@@ -264,13 +424,33 @@ pub(in crate::backend::wayland) fn persist_after_pending_commands<R: SessionComm
     runtime: &mut R,
     persist: impl FnOnce(&mut R) -> Result<T>,
 ) -> Result<T> {
-    if let Err(error) = finish_pending_session_command(runtime) {
-        if let Some(transaction) = runtime.pending_command().take() {
-            runtime.fail_session_command(transaction.command(), &error);
+    if let Some(transaction) = runtime.pending_command().as_mut() {
+        let canceled = std::mem::take(&mut transaction.queued_commands)
+            .into_iter()
+            .map(|queued| {
+                (
+                    queued.command,
+                    anyhow!("queued session command canceled because Wayscriber is shutting down"),
+                )
+            })
+            .collect::<Vec<_>>();
+        if !canceled.is_empty() {
+            runtime.fail_queued_commands(canceled, true);
         }
+    }
+
+    if let Err(error) = finish_pending_session_command(runtime) {
+        fail_pending_commands(runtime, &error);
         log::warn!("Explicit session command failed during shutdown: {error:#}");
     }
 
+    // A running remembered-home fallback must finish and publish its target
+    // before cancellation, or the final save could recreate the old file.
+    runtime
+        .session_context()
+        .session
+        .cancel_pending_output_transition();
+
     persist(runtime)
 }
 
diff --git a/src/backend/wayland/session/driver/tests.rs b/src/backend/wayland/session/driver/tests.rs
index 2667f323d..0c58b371c 100644
--- a/src/backend/wayland/session/driver/tests.rs
+++ b/src/backend/wayland/session/driver/tests.rs
@@ -2,6 +2,7 @@ use super::*;
 use crate::backend::wayland::backend::runtime_wake::RuntimeWakeSource;
 
 mod lifecycle_regressions;
+mod output;
 use crate::backend::wayland::session::{
     PersistenceOperation, RequestId, SaveStrategy, SessionState,
     persistence::SubmitError,
@@ -23,11 +24,14 @@ pub(in crate::backend::wayland::session) struct CommandRuntime<'a> {
     measurer: &'a TextMeasurer,
     pub session: &'a mut SessionState,
     pub persistence: PersistenceController,
-    pending: Option<ExplicitSessionTransaction>,
+    pending: Option<SessionCommandTransaction>,
     config: Config,
     config_failed: bool,
     reports: Vec<SessionCommandReport>,
     errors: Vec<anyhow::Error>,
+    /// Size of each batch of queued commands that did not run, and whether
+    /// Wayscriber was closing.
+    pub queued_failures: Vec<(usize, bool)>,
     /// The target at each commit notice, in order, with the number of
     /// terminal reports published before it.
     pub committed_targets: Vec<(Option<stored_session::SessionTarget>, usize)>,
@@ -57,6 +61,7 @@ impl<'a> CommandRuntime<'a> {
             config_failed: false,
             reports: Vec::new(),
             errors: Vec::new(),
+            queued_failures: Vec::new(),
             committed_targets: Vec::new(),
             ui: None,
             ui_engine: crate::ui_text::UiTextEngine::default(),
@@ -149,7 +154,7 @@ impl SessionCommandRuntime for CommandRuntime<'_> {
         }
     }
 
-    fn pending_command(&mut self) -> &mut Option<ExplicitSessionTransaction> {
+    fn pending_command(&mut self) -> &mut Option<SessionCommandTransaction> {
         &mut self.pending
     }
 
@@ -165,6 +170,8 @@ impl SessionCommandRuntime for CommandRuntime<'_> {
         refresh_runtime_ui_config_seeds(self);
     }
 
+    fn session_command_queued(&mut self) {}
+
     fn session_target_committed(&mut self) {
         self.committed_targets.push((
             self.session.options().map(|options| options.target.clone()),
@@ -176,10 +183,24 @@ impl SessionCommandRuntime for CommandRuntime<'_> {
         self.reports.push(report);
     }
 
-    fn fail_session_command(&mut self, _: &SessionCommand, error: &anyhow::Error) {
+    fn fail_session_command(&mut self, command: &SessionCommand, error: &anyhow::Error) {
+        if matches!(command, SessionCommand::Output { .. }) {
+            defer_failed_output(self.session, error, Instant::now(), Duration::from_secs(5));
+        }
         self.errors.push(anyhow!("{error:#}"));
     }
 
+    fn fail_queued_commands(
+        &mut self,
+        failures: Vec<(SessionCommand, anyhow::Error)>,
+        closing: bool,
+    ) {
+        self.queued_failures.push((failures.len(), closing));
+        for (command, error) in &failures {
+            self.fail_session_command(command, error);
+        }
+    }
+
     fn session_transport_failed(&mut self, _: &anyhow::Error) {
         self.session.restore_in_flight_autosave();
     }
@@ -723,6 +744,7 @@ fn returning_home_saves_the_current_session_then_loads_home_like_a_launch() {
     add_line(&mut input, 51);
     input.mark_session_dirty();
     let mut session = SessionState::new(Some(current.clone()));
+    session.commit_output_options(session.options().unwrap().clone(), true);
     let measurer = TextMeasurer::default();
     let (persistence, worker) = PersistenceController::controlled_for_test();
     let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
@@ -789,6 +811,20 @@ fn unsaveable_home(
                 .unwrap();
             (configured, "is a symlink")
         }
+        "expanded primary" => {
+            use std::io::Read;
+            std::fs::create_dir_all(&configured.base_dir).unwrap();
+            let file = std::fs::File::create(configured.session_file_path()).unwrap();
+            let mut encoder = flate2::write::GzEncoder::new(file, flate2::Compression::fast());
+            std::io::copy(
+                &mut std::io::repeat(b' ')
+                    .take(stored_session::DEFAULT_MAX_EXPANDED_SESSION_BYTES + 1),
+                &mut encoder,
+            )
+            .unwrap();
+            encoder.finish().unwrap();
+            (configured, "expands beyond")
+        }
         "named directory" => {
             let named = named_options(base, "named-home");
             std::fs::create_dir(named.session_file_path()).unwrap();
@@ -805,6 +841,7 @@ fn a_home_that_cannot_be_loaded_leaves_the_current_session() {
         "configured directory beside a recovery copy",
         "configured symlink",
         "named directory",
+        "expanded primary",
     ] {
         let temp = crate::test_temp::tempdir().unwrap();
         let current = named_options(temp.path(), "current");
@@ -813,6 +850,7 @@ fn a_home_that_cannot_be_loaded_leaves_the_current_session() {
         add_line(&mut input, 51);
         input.mark_session_dirty();
         let mut session = SessionState::new(Some(current.clone()));
+        session.commit_output_options(session.options().unwrap().clone(), true);
         let measurer = TextMeasurer::default();
         let (persistence, worker) = PersistenceController::controlled_for_test();
         let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
@@ -878,6 +916,7 @@ fn returning_to_a_home_without_persistence_leaves_an_unsaved_empty_canvas() {
     add_line(&mut input, 51);
     input.mark_session_dirty();
     let mut session = SessionState::new(Some(current.clone()));
+    session.commit_output_options(session.options().unwrap().clone(), true);
     let measurer = TextMeasurer::default();
     let (persistence, worker) = PersistenceController::controlled_for_test();
     let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
@@ -961,6 +1000,7 @@ fn shutdown_drains_save_as_and_open_at_every_disk_phase_before_final_save() {
             add_line(&mut input, 51);
             input.mark_session_dirty();
             let mut session = SessionState::new(Some(current.clone()));
+            session.commit_output_options(session.options().unwrap().clone(), true);
             let measurer = TextMeasurer::default();
             let (persistence, worker) = PersistenceController::controlled_for_test();
             let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
@@ -1102,6 +1142,7 @@ fn shutdown_reports_open_and_save_as_phase_failures_before_final_persistence() {
             add_line(&mut input, 51);
             input.mark_session_dirty();
             let mut session = SessionState::new(Some(current.clone()));
+            session.commit_output_options(session.options().unwrap().clone(), true);
             let measurer = TextMeasurer::default();
             let (persistence, worker) = PersistenceController::controlled_for_test();
             let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
diff --git a/src/backend/wayland/session/driver/tests/lifecycle_regressions.rs b/src/backend/wayland/session/driver/tests/lifecycle_regressions.rs
index 1b8da484c..5526b92b5 100644
--- a/src/backend/wayland/session/driver/tests/lifecycle_regressions.rs
+++ b/src/backend/wayland/session/driver/tests/lifecycle_regressions.rs
@@ -163,7 +163,7 @@ fn assert_rejected_disk_clear_recovers_after_canceled_gesture(command: SessionCo
     stored_session::save_snapshot(&snapshot, &options).unwrap();
     input.clear_session_dirty();
     let mut session = SessionState::new(Some(options.clone()));
-    session.mark_loaded(true);
+    session.commit_output_options(session.options().unwrap().clone(), true);
     session.mark_saved(Instant::now(), true);
     let (persistence, worker) = PersistenceController::controlled_for_test();
     let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
@@ -275,6 +275,7 @@ fn autosave_ownership_errors_do_not_publish_failures_or_delay_retry() {
         let started = Instant::now();
         let mut input = test_input_state();
         let mut session = SessionState::new(Some(options.clone()));
+        session.commit_output_options(session.options().unwrap().clone(), false);
         session.record_input_dirty(started, true);
         let measurer = TextMeasurer::default();
         let (persistence, worker) = PersistenceController::controlled_for_test();
diff --git a/src/backend/wayland/session/driver/tests/output.rs b/src/backend/wayland/session/driver/tests/output.rs
new file mode 100644
index 000000000..9364bf836
--- /dev/null
+++ b/src/backend/wayland/session/driver/tests/output.rs
@@ -0,0 +1,978 @@
+use super::*;
+
+fn add_line(input: &mut InputState, x2: i32) -> crate::draw::ShapeId {
+    let id = super::add_line(input, x2);
+    input.mark_session_dirty();
+    id
+}
+
+fn output_command(
+    session: &mut SessionState,
+    target: &stored_session::SessionOptions,
+) -> SessionCommand {
+    session.stage_output_transition(target.clone(), Some("next-output".into()), Instant::now());
+    SessionCommand::Output {
+        transition: Box::new(session.pending_output_transition().unwrap().clone()),
+        remembered: None,
+        home: None,
+    }
+}
+
+#[test]
+fn output_switch_returns_with_save_and_load_held_then_commits_in_order() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let current = named_options(temp.path(), "current");
+    let target = named_options(temp.path(), "destination");
+    stored_session::save_snapshot(&sample_snapshot(), &target).unwrap();
+    let mut input = test_input_state();
+    add_line(&mut input, 51);
+    let measurer = TextMeasurer::default();
+    let mut session = SessionState::new(Some(current.clone()));
+    session.commit_output_options(session.options().unwrap().clone(), true);
+    let (persistence, worker) = PersistenceController::controlled_for_test();
+    let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+    let command = output_command(runtime.session, &target);
+
+    start_session_command(&mut runtime, command).unwrap();
+    assert!(runtime.pending.is_some());
+    assert!(!current.session_file_path().exists());
+    assert_eq!(runtime.session.options().unwrap().target, current.target);
+    worker.complete_next(); // source saved without replacing the canvas
+    runtime.receive();
+    assert_eq!(loaded_line_x2(&current), 51);
+    assert_eq!(runtime.session.options().unwrap().target, current.target);
+    assert!(runtime.reports.is_empty());
+    worker.complete_next();
+    runtime.receive();
+
+    assert!(runtime.errors.is_empty(), "{:?}", runtime.errors);
+    assert!(matches!(
+        runtime.reports.as_slice(),
+        [SessionCommandReport::Output { .. }]
+    ));
+    assert_eq!(runtime.session.options().unwrap().target, target.target);
+    assert!(runtime.session.pending_output_transition().is_none());
+    assert!(matches!(
+        runtime.input.boards.active_frame().shapes[0].shape,
+        crate::draw::Shape::Line { x2: 42, .. }
+    ));
+}
+
+#[test]
+fn output_load_cannot_replace_a_newer_destination_or_live_edits() {
+    for change in ["destination", "return to source", "edit", "interaction"] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let current = named_options(temp.path(), "current");
+        let target = named_options(temp.path(), "destination");
+        stored_session::save_snapshot(&sample_snapshot(), &target).unwrap();
+        let mut input = test_input_state();
+        add_line(&mut input, 51);
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(current.clone()));
+        session.commit_output_options(session.options().unwrap().clone(), true);
+        let (persistence, worker) = PersistenceController::controlled_for_test();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let command = output_command(runtime.session, &target);
+        start_session_command(&mut runtime, command).unwrap();
+        worker.complete_next();
+        runtime.receive();
+
+        match change {
+            "destination" => {
+                let newer = named_options(temp.path(), "newer");
+                runtime.session.stage_output_transition(
+                    newer,
+                    Some("third-output".into()),
+                    Instant::now(),
+                );
+            }
+            "return to source" => {
+                runtime.session.cancel_pending_output_transition();
+            }
+            "edit" => {
+                add_line(runtime.input, 77);
+                runtime.input.mark_session_dirty();
+            }
+            "interaction" => {
+                runtime.input.on_mouse_press_with_canvas_and_resources(
+                    crate::input::state::InputTextResources {
+                        measurer: &measurer,
+                        ui_engine: &crate::ui_text::UiTextEngine::default(),
+                    },
+                    crate::input::MouseButton::Left,
+                    500,
+                    400,
+                    500,
+                    400,
+                );
+            }
+            _ => unreachable!(),
+        }
+        worker.complete_next();
+        runtime.receive();
+        assert_eq!(runtime.session.options().unwrap().target, current.target);
+        assert!(runtime.reports.is_empty());
+        assert_eq!(runtime.errors.len(), 1, "{change}");
+        if change != "return to source" {
+            let remaining = runtime
+                .session
+                .output_transition_timeout(Instant::now())
+                .unwrap();
+            assert!(
+                remaining <= Duration::from_millis(500),
+                "{change}: {remaining:?}"
+            );
+        }
+        assert!(matches!(
+            runtime.input.boards.active_frame().shapes[0].shape,
+            crate::draw::Shape::Line { x2: 51, .. }
+        ));
+        if change == "edit" {
+            assert!(runtime.session.is_dirty());
+        }
+        if change == "interaction" {
+            runtime.input.cancel_active_interaction_with(&measurer);
+        }
+        if let Some(transition) = runtime.session.pending_output_transition().cloned() {
+            let expected = transition.staged_options.target.clone();
+            start_session_command(
+                &mut runtime,
+                SessionCommand::Output {
+                    transition: Box::new(transition),
+                    remembered: None,
+                    home: None,
+                },
+            )
+            .unwrap();
+            for _ in 0..10 {
+                if runtime.pending.is_none() {
+                    break;
+                }
+                worker.complete_next();
+                runtime.receive();
+            }
+            assert!(runtime.pending.is_none(), "retry: {change}");
+            assert_eq!(runtime.errors.len(), 1, "retry: {change}");
+            assert_eq!(runtime.reports.len(), 1, "retry: {change}");
+            assert_eq!(runtime.session.options().unwrap().target, expected);
+        }
+    }
+}
+
+#[test]
+fn output_switch_does_not_recreate_missing_remembered_primary_or_restore_its_backup() {
+    for home_enabled in [false, true] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let remembered = named_options(temp.path(), "remembered");
+        let home = configured_home(temp.path());
+        stored_session::save_snapshot(&sample_snapshot(), &remembered).unwrap();
+        std::fs::rename(
+            remembered.session_file_path(),
+            remembered.backup_file_path(),
+        )
+        .unwrap();
+        if home_enabled {
+            stored_session::save_snapshot(&sample_snapshot(), &home).unwrap();
+        }
+        let mut input = test_input_state();
+        add_line(&mut input, 51);
+        input.clear_session_dirty(); // Existing fixture ink; no edit happened after the missing-file load.
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(remembered.clone()));
+        let (persistence, worker) = PersistenceController::controlled_for_test();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let command = output_command(runtime.session, &remembered);
+        let SessionCommand::Output { transition, .. } = command else {
+            unreachable!()
+        };
+        start_session_command(
+            &mut runtime,
+            SessionCommand::Output {
+                transition,
+                remembered: Some(remembered.session_file_path()),
+                home: home_enabled.then(|| Box::new(home.clone())),
+            },
+        )
+        .unwrap();
+        worker.complete_next(); // check primary before a save could recreate it
+        runtime.receive();
+        worker.complete_next(); // remembered load refuses backup fallback
+        runtime.receive();
+        if home_enabled {
+            worker.complete_next();
+            runtime.receive();
+        }
+
+        assert!(!remembered.session_file_path().exists());
+        assert!(remembered.backup_file_path().exists());
+        assert!(runtime.errors.is_empty(), "{:?}", runtime.errors);
+        assert!(matches!(
+            runtime.reports.as_slice(),
+            [SessionCommandReport::Output {
+                abandoned: Some(_),
+                ..
+            }]
+        ));
+        if home_enabled {
+            assert_eq!(runtime.session.options().unwrap().target, home.target);
+        } else {
+            assert!(runtime.session.options().is_none());
+            assert!(matches!(
+                runtime.input.boards.active_frame().shapes[0].shape,
+                crate::draw::Shape::Line { x2: 51, .. }
+            ));
+        }
+    }
+}
+
+#[test]
+fn clean_output_loads_the_destination_without_rotating_existing_source_bytes() {
+    for protected in [false, true] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let current = named_options(temp.path(), "current");
+        let target = named_options(temp.path(), "destination");
+        stored_session::save_snapshot(&sample_snapshot(), &current).unwrap();
+        stored_session::save_snapshot(&sample_snapshot(), &target).unwrap();
+        let before = std::fs::read(current.session_file_path()).unwrap();
+        let mut input = test_input_state();
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(current.clone()));
+        session.commit_output_options(session.options().unwrap().clone(), false);
+        if protected {
+            session.protect_session_path(current.session_file_path());
+        }
+        let (persistence, worker) = PersistenceController::controlled_for_test();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let command = output_command(runtime.session, &target);
+        start_session_command(&mut runtime, command).unwrap();
+        assert!(runtime.pending.is_some());
+        worker.complete_next();
+        runtime.receive();
+        assert!(runtime.errors.is_empty(), "{:?}", runtime.errors);
+        assert_eq!(runtime.session.options().unwrap().target, target.target);
+        assert_eq!(std::fs::read(current.session_file_path()).unwrap(), before);
+        assert!(!current.backup_file_path().exists());
+    }
+}
+
+#[test]
+fn failed_output_save_keeps_the_source_canvas_and_pending_destination() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let current = named_options(temp.path(), "current");
+    let target = named_options(temp.path(), "destination");
+    stored_session::save_snapshot(&sample_snapshot(), &target).unwrap();
+    // A forbidden primary is an actual save error, independent of worker control.
+    std::fs::create_dir(current.session_file_path()).unwrap();
+    let mut input = test_input_state();
+    add_line(&mut input, 51);
+    let measurer = TextMeasurer::default();
+    let mut session = SessionState::new(Some(current.clone()));
+    session.commit_output_options(session.options().unwrap().clone(), true);
+    let (persistence, worker) = PersistenceController::controlled_for_test();
+    let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+    let command = output_command(runtime.session, &target);
+    start_session_command(&mut runtime, command).unwrap();
+    worker.complete_next();
+    runtime.receive();
+    assert_eq!(runtime.errors.len(), 1);
+    assert!(runtime.pending.is_none());
+    assert!(runtime.reports.is_empty());
+    assert!(runtime.session.pending_output_transition().is_some());
+    let remaining = runtime
+        .session
+        .output_transition_timeout(Instant::now())
+        .unwrap();
+    assert!(
+        remaining > Duration::from_secs(4),
+        "I/O failure: {remaining:?}"
+    );
+    assert_eq!(runtime.session.options().unwrap().target, current.target);
+    assert!(matches!(
+        runtime.input.boards.active_frame().shapes[0].shape,
+        crate::draw::Shape::Line { x2: 51, .. }
+    ));
+}
+
+#[test]
+fn queued_target_commands_refuse_a_changed_session_instead_of_using_its_canvas() {
+    for action in ["open", "save as", "home"] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let current = named_options(temp.path(), "current");
+        let target = named_options(temp.path(), "destination");
+        let explicit = named_options(temp.path(), "explicit");
+        stored_session::save_snapshot(&sample_snapshot(), &target).unwrap();
+        if action == "open" || action == "home" {
+            stored_session::save_snapshot(&sample_snapshot(), &explicit).unwrap();
+        }
+        let mut input = test_input_state();
+        add_line(&mut input, 51);
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(current.clone()));
+        session.commit_output_options(session.options().unwrap().clone(), true);
+        let (persistence, worker) = PersistenceController::controlled_for_test();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let output = output_command(runtime.session, &target);
+        start_session_command(&mut runtime, output).unwrap();
+        let command = match action {
+            "open" => SessionCommand::Open(explicit.session_file_path()),
+            "save as" => SessionCommand::SaveAs(
+                explicit.session_file_path(),
+                stored_session::SaveAsOverwrite::Deny,
+            ),
+            "home" => SessionCommand::OpenHome(Some(Box::new(explicit.clone()))),
+            _ => unreachable!(),
+        };
+        start_session_command(&mut runtime, command).unwrap();
+        assert!(runtime.reports.is_empty());
+        assert_eq!(runtime.session.options().unwrap().target, current.target);
+        for _ in 0..10 {
+            if runtime.pending.is_none() {
+                break;
+            }
+            worker.complete_next();
+            runtime.receive();
+        }
+        assert!(runtime.pending.is_none(), "{action}");
+        assert_eq!(runtime.errors.len(), 1, "{action}: {:?}", runtime.errors);
+        assert_eq!(runtime.reports.len(), 1, "{action}");
+        assert!(matches!(
+            runtime.reports[0],
+            SessionCommandReport::Output { .. }
+        ));
+        assert_eq!(
+            runtime.session.options().unwrap().session_file_path(),
+            target.session_file_path()
+        );
+        assert_eq!(loaded_line_x2(&current), 51);
+        if action == "save as" {
+            assert!(!explicit.session_file_path().exists());
+        } else {
+            assert_eq!(loaded_line_x2(&explicit), 42);
+        }
+    }
+}
+
+#[test]
+fn shutdown_finishes_remembered_home_fallback_before_final_persistence() {
+    for home_enabled in [false, true] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let remembered = named_options(temp.path(), "remembered");
+        let home = configured_home(temp.path());
+        stored_session::save_snapshot(&sample_snapshot(), &remembered).unwrap();
+        std::fs::rename(
+            remembered.session_file_path(),
+            remembered.backup_file_path(),
+        )
+        .unwrap();
+        if home_enabled {
+            stored_session::save_snapshot(&sample_snapshot(), &home).unwrap();
+        }
+        let mut input = test_input_state();
+        add_line(&mut input, 51);
+        input.clear_session_dirty(); // Existing fixture ink; no edit happened after the missing-file load.
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(remembered.clone()));
+        let persistence = PersistenceController::start_for_test().unwrap();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let SessionCommand::Output { transition, .. } =
+            output_command(runtime.session, &remembered)
+        else {
+            unreachable!()
+        };
+        start_session_command(
+            &mut runtime,
+            SessionCommand::Output {
+                transition,
+                remembered: Some(remembered.session_file_path()),
+                home: home_enabled.then(|| Box::new(home.clone())),
+            },
+        )
+        .unwrap();
+        persist_after_pending_commands(&mut runtime, |runtime| {
+            assert!(matches!(
+                runtime.reports.as_slice(),
+                [SessionCommandReport::Output {
+                    abandoned: Some(_),
+                    ..
+                }]
+            ));
+            assert!(runtime.session.pending_output_transition().is_none());
+            if let Some(options) = runtime.session.options() {
+                assert_eq!(options.target, home.target);
+                let snapshot = runtime
+                    .input
+                    .snapshot_for_persistence_with(&measurer, options)
+                    .unwrap();
+                stored_session::save_snapshot(&snapshot, options)?;
+            } else {
+                assert!(!home_enabled);
+                assert!(matches!(
+                    runtime.input.boards.active_frame().shapes[0].shape,
+                    crate::draw::Shape::Line { x2: 51, .. }
+                ));
+            }
+            Ok(())
+        })
+        .unwrap();
+        assert!(runtime.errors.is_empty(), "{:?}", runtime.errors);
+        assert!(!remembered.session_file_path().exists());
+        assert_eq!(
+            loaded_line_x2(&stored_session::SessionOptions {
+                target: stored_session::SessionTarget::NamedFile(remembered.backup_file_path()),
+                ..remembered.clone()
+            }),
+            42
+        );
+    }
+}
+
+#[test]
+fn quarantine_failure_blocks_dirty_autosave_and_save_before_open() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let current = named_options(temp.path(), "current");
+    let other = named_options(temp.path(), "other");
+    stored_session::save_snapshot(&sample_snapshot(), &current).unwrap();
+    std::fs::rename(current.session_file_path(), current.backup_file_path()).unwrap();
+    let backup = std::fs::read(current.backup_file_path()).unwrap();
+    std::fs::write(current.session_file_path(), b"broken primary").unwrap();
+    std::fs::write(
+        stored_session::append_path_suffix(
+            &current.session_file_path(),
+            ".corrupt-18446744073709551615",
+        ),
+        b"occupied",
+    )
+    .unwrap();
+    stored_session::save_snapshot(&sample_snapshot(), &other).unwrap();
+    let mut input = test_input_state();
+    let measurer = TextMeasurer::default();
+    let mut session = SessionState::new(Some(current.clone()));
+    let (persistence, worker) = PersistenceController::controlled_for_test();
+    let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+    let output = output_command(runtime.session, &current);
+    start_session_command(&mut runtime, output).unwrap();
+    for _ in 0..10 {
+        if runtime.pending.is_none() {
+            break;
+        }
+        worker.complete_next();
+        runtime.receive();
+    }
+    assert!(
+        runtime
+            .session
+            .refuses_source_write(&current.session_file_path())
+    );
+    add_line(runtime.input, 77);
+    runtime.input.mark_session_dirty();
+    observe_input_dirty(&mut runtime, Instant::now());
+    assert!(
+        !runtime
+            .session
+            .autosave_due(Instant::now() + Duration::from_secs(60), &current)
+    );
+    start_session_command(
+        &mut runtime,
+        SessionCommand::Open(other.session_file_path()),
+    )
+    .unwrap();
+    worker.complete_next();
+    runtime.receive(); // preflight; source save is then refused
+    assert!(runtime.pending.is_none());
+    assert_eq!(runtime.errors.len(), 2);
+    assert_eq!(
+        std::fs::read(current.session_file_path()).unwrap(),
+        b"broken primary"
+    );
+    assert_eq!(std::fs::read(current.backup_file_path()).unwrap(), backup);
+}
+
+fn drain_output_worker(runtime: &mut CommandRuntime<'_>, mut complete: impl FnMut()) {
+    for _ in 0..12 {
+        if runtime.pending.is_none() {
+            return;
+        }
+        complete();
+        runtime.receive();
+    }
+    panic!("session command did not finish");
+}
+
+#[test]
+fn unloaded_edits_cannot_overwrite_primary_on_retry_or_return_to_source() {
+    for source in ["named", "remembered", "configured", "per-output"] {
+        for cancel in [false, true] {
+            let temp = crate::test_temp::tempdir().unwrap();
+            let options = if source == "named" || source == "remembered" {
+                named_options(temp.path(), "current")
+            } else {
+                let mut options =
+                    stored_session::SessionOptions::new(temp.path().to_path_buf(), "configured");
+                options.persist_transparent = true;
+                options.per_output = source == "per-output";
+                options
+            };
+            let mut target = options.clone();
+            if source == "per-output" {
+                target.set_output_identity(Some("new-output"));
+            }
+            stored_session::save_snapshot(&sample_snapshot(), &options).unwrap();
+            let original = std::fs::read(options.session_file_path()).unwrap();
+            let mut input = test_input_state();
+            let measurer = TextMeasurer::default();
+            let mut session = SessionState::new(Some(options.clone()));
+            let (persistence, worker) = PersistenceController::controlled_for_test();
+            let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+            let mut output = output_command(runtime.session, &target);
+            if source == "remembered"
+                && let SessionCommand::Output { remembered, .. } = &mut output
+            {
+                *remembered = Some(options.session_file_path());
+            }
+            start_session_command(&mut runtime, output).unwrap();
+            add_line(runtime.input, 77);
+            runtime.input.mark_session_dirty();
+            drain_output_worker(&mut runtime, || worker.complete_next());
+            assert!(!runtime.session.is_loaded());
+            if cancel {
+                runtime.session.cancel_output_transition_for_live_source();
+                assert!(
+                    !runtime.session.is_loaded(),
+                    "cancel must not bless an unloaded canvas"
+                );
+            } else {
+                let retry = output_command(runtime.session, &target);
+                start_session_command(&mut runtime, retry).unwrap();
+                drain_output_worker(&mut runtime, || worker.complete_next());
+            }
+            if source == "per-output" {
+                assert!(!target.session_file_path().exists());
+            }
+            assert!(
+                std::fs::read(options.session_file_path()).unwrap() == original,
+                "the unloaded source must retain its saved ink"
+            );
+            assert!(!options.backup_file_path().exists());
+            assert!(matches!(
+                runtime.input.boards.active_frame().shapes[0].shape,
+                crate::draw::Shape::Line { x2: 77, .. }
+            ));
+            assert!(
+                !runtime
+                    .session
+                    .autosave_due(Instant::now() + Duration::from_secs(60), &options)
+            );
+        }
+    }
+}
+#[test]
+fn corrupt_remembered_backup_continues_and_recreates_primary_on_final_save() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let options = named_options(temp.path(), "remembered");
+    stored_session::save_snapshot(&sample_snapshot(), &options).unwrap();
+    std::fs::rename(options.session_file_path(), options.backup_file_path()).unwrap();
+    let backup = std::fs::read(options.backup_file_path()).unwrap();
+    std::fs::write(options.session_file_path(), b"corrupt remembered").unwrap();
+    let mut input = test_input_state();
+    let measurer = TextMeasurer::default();
+    let mut session = SessionState::new(Some(options.clone()));
+    let persistence = PersistenceController::start_for_test().unwrap();
+    let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+    let SessionCommand::Output { transition, .. } = output_command(runtime.session, &options)
+    else {
+        unreachable!()
+    };
+    start_session_command(
+        &mut runtime,
+        SessionCommand::Output {
+            transition,
+            remembered: Some(options.session_file_path()),
+            home: None,
+        },
+    )
+    .unwrap();
+    persist_after_pending_commands(&mut runtime, |runtime| {
+        assert_eq!(runtime.session.options().unwrap().target, options.target);
+        assert!(runtime.session.is_loaded());
+        assert_eq!(
+            loaded_line_x2(&options),
+            42,
+            "restoration must be durable before any final save"
+        );
+        let snapshot = runtime
+            .input
+            .snapshot_for_persistence_with(&measurer, &options)
+            .unwrap();
+        stored_session::save_snapshot(&snapshot, &options)?;
+        Ok(())
+    })
+    .unwrap();
+    assert_eq!(loaded_line_x2(&options), 42);
+    assert_eq!(std::fs::read(options.backup_file_path()).unwrap(), backup);
+    assert!(
+        runtime
+            .input
+            .active_toast()
+            .unwrap()
+            .message
+            .contains("Recent changes may be missing")
+    );
+}
+
+#[test]
+fn repaired_reload_unblocks_writes_and_dirty_blocked_sources_cannot_switch() {
+    for repair in [false, true] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let current = named_options(temp.path(), "current");
+        let destination = named_options(temp.path(), "destination");
+        stored_session::save_snapshot(&sample_snapshot(), &current).unwrap();
+        std::fs::rename(current.session_file_path(), current.backup_file_path()).unwrap();
+        let backup = std::fs::read(current.backup_file_path()).unwrap();
+        std::fs::write(current.session_file_path(), b"corrupt primary").unwrap();
+        std::fs::write(
+            stored_session::append_path_suffix(
+                &current.session_file_path(),
+                ".corrupt-18446744073709551615",
+            ),
+            b"occupied",
+        )
+        .unwrap();
+        let mut input = test_input_state();
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(current.clone()));
+        let (persistence, worker) = PersistenceController::controlled_for_test();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let output = output_command(runtime.session, &current);
+        start_session_command(&mut runtime, output).unwrap();
+        drain_output_worker(&mut runtime, || worker.complete_next());
+        assert!(
+            runtime
+                .session
+                .refuses_source_write(&current.session_file_path())
+        );
+        if repair {
+            std::fs::copy(current.backup_file_path(), current.session_file_path()).unwrap();
+            let retry = output_command(runtime.session, &current);
+            start_session_command(&mut runtime, retry).unwrap();
+            drain_output_worker(&mut runtime, || worker.complete_next());
+            assert!(
+                !runtime
+                    .session
+                    .refuses_source_write(&current.session_file_path())
+            );
+        }
+        add_line(runtime.input, 77);
+        runtime.input.mark_session_dirty();
+        observe_input_dirty(&mut runtime, Instant::now());
+        assert_eq!(
+            runtime
+                .session
+                .autosave_due(Instant::now() + Duration::from_secs(60), &current),
+            repair
+        );
+        let output = output_command(runtime.session, &destination);
+        start_session_command(&mut runtime, output).unwrap();
+        drain_output_worker(&mut runtime, || worker.complete_next());
+        if repair {
+            assert_eq!(
+                runtime.session.options().unwrap().target,
+                destination.target
+            );
+            let saved = stored_session::load_snapshot(&current).unwrap().unwrap();
+            assert!(
+                saved.boards[0].pages.pages[0]
+                    .shapes
+                    .iter()
+                    .any(|shape| matches!(shape.shape, crate::draw::Shape::Line { x2: 77, .. }))
+            );
+        } else {
+            assert_eq!(runtime.session.options().unwrap().target, current.target);
+            assert!(
+                runtime
+                    .input
+                    .boards
+                    .active_frame()
+                    .shapes
+                    .iter()
+                    .any(|shape| matches!(shape.shape, crate::draw::Shape::Line { x2: 77, .. }))
+            );
+            assert_eq!(
+                std::fs::read(current.session_file_path()).unwrap(),
+                b"corrupt primary"
+            );
+            assert_eq!(std::fs::read(current.backup_file_path()).unwrap(), backup);
+            assert!(!destination.session_file_path().exists());
+        }
+    }
+}
+
+#[test]
+fn queued_commands_remain_bound_to_the_visible_source_and_report_failures() {
+    for fail_transport in [false, true] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let current = named_options(temp.path(), "current");
+        let target = named_options(temp.path(), "destination");
+        stored_session::save_snapshot(&sample_snapshot(), &target).unwrap();
+        let mut input = test_input_state();
+        add_line(&mut input, 51);
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(current.clone()));
+        session.commit_output_options(session.options().unwrap().clone(), true);
+        let (persistence, worker) = PersistenceController::controlled_for_test();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let output = output_command(runtime.session, &target);
+        start_session_command(&mut runtime, output).unwrap();
+        for command in [
+            SessionCommand::Clear,
+            SessionCommand::ClearTools(Box::new(stored_session::ToolStateSnapshot::from_config(
+                &Config::default(),
+            ))),
+            SessionCommand::Inspect,
+            SessionCommand::SaveAs(
+                temp.path().join("queued-copy.wayscriber-session"),
+                stored_session::SaveAsOverwrite::Deny,
+            ),
+        ] {
+            start_session_command(&mut runtime, command).unwrap();
+        }
+        if fail_transport {
+            drop(worker);
+            persist_after_pending_commands(&mut runtime, |runtime| {
+                assert_eq!(runtime.errors.len(), 5);
+                assert_eq!(runtime.queued_failures, [(4, true)]);
+                assert!(runtime.pending.is_none());
+                assert_eq!(runtime.session.options().unwrap().target, current.target);
+                assert!(!current.session_file_path().exists());
+                Ok(())
+            })
+            .unwrap();
+        } else {
+            drain_output_worker(&mut runtime, || worker.complete_next());
+            assert_eq!(runtime.errors.len(), 4, "{:?}", runtime.errors);
+            assert_eq!(runtime.queued_failures, [(4, false)]);
+            assert!(matches!(
+                runtime.reports.as_slice(),
+                [SessionCommandReport::Output { .. }]
+            ));
+            assert!(!runtime.input.boards.active_frame().shapes.is_empty());
+            assert_eq!(loaded_line_x2(&current), 51);
+            assert_eq!(loaded_line_x2(&target), 42);
+            assert!(!temp.path().join("queued-copy.wayscriber-session").exists());
+        }
+    }
+}
+
+#[test]
+fn output_queue_coalesces_duplicates_limits_growth_and_cancels_edits_at_shutdown() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let current = named_options(temp.path(), "current");
+    let target = named_options(temp.path(), "destination");
+    stored_session::save_snapshot(&sample_snapshot(), &target).unwrap();
+    let mut input = test_input_state();
+    add_line(&mut input, 51);
+    let measurer = TextMeasurer::default();
+    let mut session = SessionState::new(Some(current.clone()));
+    session.commit_output_options(current.clone(), true);
+    let persistence = PersistenceController::start_for_test().unwrap();
+    let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+    let command = output_command(runtime.session, &target);
+    start_session_command(&mut runtime, command).unwrap();
+
+    for _ in 0..20 {
+        start_session_command(&mut runtime, SessionCommand::Clear).unwrap();
+    }
+    for index in 0..7 {
+        start_session_command(
+            &mut runtime,
+            SessionCommand::SaveAs(
+                temp.path()
+                    .join(format!("queued-{index}.wayscriber-session")),
+                stored_session::SaveAsOverwrite::Deny,
+            ),
+        )
+        .unwrap();
+    }
+    let error = start_session_command(&mut runtime, SessionCommand::Inspect).unwrap_err();
+    assert!(error.to_string().contains("queue is full"));
+
+    persist_after_pending_commands(&mut runtime, |runtime| {
+        assert_eq!(runtime.errors.len(), 8);
+        assert_eq!(runtime.queued_failures, [(8, true)]);
+        assert!(
+            runtime
+                .errors
+                .iter()
+                .all(|error| error.to_string().contains("shutting down"))
+        );
+        assert_eq!(runtime.session.options().unwrap().target, target.target);
+        assert!(matches!(
+            runtime.reports.as_slice(),
+            [SessionCommandReport::Output { .. }]
+        ));
+        assert!(!runtime.input.boards.active_frame().shapes.is_empty());
+        Ok(())
+    })
+    .unwrap();
+    assert_eq!(loaded_line_x2(&current), 51);
+    assert_eq!(loaded_line_x2(&target), 42);
+    for index in 0..7 {
+        assert!(
+            !temp
+                .path()
+                .join(format!("queued-{index}.wayscriber-session"))
+                .exists()
+        );
+    }
+}
+
+#[test]
+fn a_queued_clear_clears_what_it_was_requested_over_and_nothing_drawn_after() {
+    for drawn_after_request in [false, true] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let current = named_options(temp.path(), "current");
+        let target = named_options(temp.path(), "destination");
+        stored_session::save_snapshot(&sample_snapshot(), &target).unwrap();
+        let mut input = test_input_state();
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(current.clone()));
+        session.commit_output_options(current.clone(), true);
+        let (persistence, worker) = PersistenceController::controlled_for_test();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let output = output_command(runtime.session, &target);
+        start_session_command(&mut runtime, output).unwrap();
+        if !drawn_after_request {
+            // Not yet seen by any tick when Clear is pressed.
+            add_line(runtime.input, 51);
+        }
+        start_session_command(&mut runtime, SessionCommand::Clear).unwrap();
+        if drawn_after_request {
+            add_line(runtime.input, 77);
+        }
+
+        // The output load fails, so the Clear starts on the session it was
+        // requested for.
+        worker.respond_with(|_| Err(anyhow!("controlled output load failure")));
+        runtime.receive();
+        drain_output_worker(&mut runtime, || worker.complete_next());
+
+        assert_eq!(runtime.session.options().unwrap().target, current.target);
+        let refused = runtime
+            .errors
+            .iter()
+            .any(|error| error.to_string().contains("nothing was cleared"));
+        assert_eq!(refused, drawn_after_request, "{:?}", runtime.errors);
+        let shapes = &runtime.input.boards.active_frame().shapes;
+        if drawn_after_request {
+            assert!(matches!(
+                shapes[0].shape,
+                crate::draw::Shape::Line { x2: 77, .. }
+            ));
+        } else {
+            assert!(shapes.is_empty());
+        }
+    }
+}
+
+#[test]
+fn repeated_failed_output_loads_do_not_rotate_a_clean_sources_backup() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let current = named_options(temp.path(), "current");
+    let target = named_options(temp.path(), "destination");
+    stored_session::save_snapshot(&sample_snapshot(), &current).unwrap();
+    let mut input = test_input_state();
+    add_line(&mut input, 51);
+    let measurer = TextMeasurer::default();
+    stored_session::save_snapshot(
+        &input
+            .snapshot_for_persistence_with(&measurer, &current)
+            .unwrap(),
+        &current,
+    )
+    .unwrap();
+    input.clear_session_dirty();
+    let primary = std::fs::read(current.session_file_path()).unwrap();
+    let backup = std::fs::read(current.backup_file_path()).unwrap();
+    std::fs::write(target.session_file_path(), b"corrupt destination").unwrap();
+    std::fs::write(
+        stored_session::append_path_suffix(
+            &target.session_file_path(),
+            ".corrupt-18446744073709551615",
+        ),
+        b"occupied",
+    )
+    .unwrap();
+    let mut session = SessionState::new(Some(current.clone()));
+    session.commit_output_options(current.clone(), true);
+    let persistence = PersistenceController::start_for_test().unwrap();
+    let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+
+    for _ in 0..3 {
+        let command = output_command(runtime.session, &target);
+        start_session_command(&mut runtime, command).unwrap();
+        finish_pending_session_command(&mut runtime).unwrap();
+        assert_eq!(runtime.session.options().unwrap().target, current.target);
+        assert_eq!(std::fs::read(current.session_file_path()).unwrap(), primary);
+        assert_eq!(std::fs::read(current.backup_file_path()).unwrap(), backup);
+    }
+    assert_eq!(runtime.errors.len(), 3);
+    assert!(runtime.reports.is_empty());
+}
+
+#[test]
+fn remembered_preservation_failure_goes_home_without_retrying_the_unreadable_source() {
+    for home_enabled in [false, true] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let current = named_options(temp.path(), "remembered");
+        let home = named_options(temp.path(), "home");
+        stored_session::save_snapshot(&sample_snapshot(), &current).unwrap();
+        std::fs::rename(current.session_file_path(), current.backup_file_path()).unwrap();
+        let backup = std::fs::read(current.backup_file_path()).unwrap();
+        std::fs::write(current.session_file_path(), b"corrupt remembered").unwrap();
+        std::fs::write(
+            stored_session::append_path_suffix(
+                &current.session_file_path(),
+                ".corrupt-18446744073709551615",
+            ),
+            b"occupied",
+        )
+        .unwrap();
+        let mut input = test_input_state();
+        let measurer = TextMeasurer::default();
+        let mut session = SessionState::new(Some(current.clone()));
+        let (persistence, worker) = PersistenceController::controlled_for_test();
+        let mut runtime = CommandRuntime::new(&mut input, &measurer, &mut session, persistence);
+        let SessionCommand::Output { transition, .. } = output_command(runtime.session, &current)
+        else {
+            unreachable!()
+        };
+        start_session_command(
+            &mut runtime,
+            SessionCommand::Output {
+                transition,
+                remembered: Some(current.session_file_path()),
+                home: home_enabled.then(|| Box::new(home.clone())),
+            },
+        )
+        .unwrap();
+        drain_output_worker(&mut runtime, || worker.complete_next());
+        assert!(runtime.errors.is_empty(), "{:?}", runtime.errors);
+        assert!(runtime.session.is_loaded());
+        assert!(runtime.session.pending_output_transition().is_none());
+        assert_eq!(
+            runtime.session.options().map(|options| &options.target),
+            home_enabled.then_some(&home.target)
+        );
+        assert!(matches!(
+            runtime.reports.as_slice(),
+            [SessionCommandReport::Output {
+                abandoned: Some(_),
+                ..
+            }]
+        ));
+        assert_eq!(
+            std::fs::read(current.session_file_path()).unwrap(),
+            b"corrupt remembered"
+        );
+        assert_eq!(std::fs::read(current.backup_file_path()).unwrap(), backup);
+    }
+}
diff --git a/src/backend/wayland/session/home.rs b/src/backend/wayland/session/home.rs
index b32215f03..353df00b7 100644
--- a/src/backend/wayland/session/home.rs
+++ b/src/backend/wayland/session/home.rs
@@ -209,28 +209,6 @@ fn is_remembered(options: &SessionOptions, remembered: Option<&Path>) -> bool {
     remembered.is_some_and(|path| options.target == SessionTarget::NamedFile(path.into()))
 }
 
-/// Whether `current` may be saved before an output's session loads. A
-/// remembered session that has not loaded and can no longer be used may not:
-/// the save would recreate it, and the load would then continue it in place
-/// of home.
-pub(in crate::backend::wayland) fn may_save_before_output_load(
-    current: &SessionOptions,
-    remembered: Option<&Path>,
-    mut run: impl FnMut(PersistenceOperation) -> Result<PersistenceOutcome>,
-) -> Result<bool> {
-    if !is_remembered(current, remembered) {
-        return Ok(true);
-    }
-
-    match run(PersistenceOperation::CheckRemembered {
-        path: current.session_file_path(),
-    })? {
-        PersistenceOutcome::Unit => Ok(true),
-        PersistenceOutcome::RememberedUnavailable(_) => Ok(false),
-        other => bail!("unexpected remembered session check outcome: {other:?}"),
-    }
-}
-
 /// What an output's session load found.
 #[derive(Debug)]
 pub(in crate::backend::wayland) enum OutputSessionLoad {
diff --git a/src/backend/wayland/session/home/tests.rs b/src/backend/wayland/session/home/tests.rs
index d8024c41e..f061e86c6 100644
--- a/src/backend/wayland/session/home/tests.rs
+++ b/src/backend/wayland/session/home/tests.rs
@@ -240,6 +240,20 @@ mod load {
     }
 
     /// A saved remembered session and a saved configured home.
+    /// A session file as this build writes one with tool settings and no ink.
+    fn blank_session_bytes(dir: &std::path::Path) -> Vec<u8> {
+        let scratch = named_options(dir, "blank");
+        let snapshot = stored_session::SessionSnapshot {
+            active_board_id: "transparent".to_string(),
+            boards: Vec::new(),
+            tool_state: Some(stored_session::ToolStateSnapshot::from_config(
+                &crate::config::Config::default(),
+            )),
+        };
+        stored_session::save_snapshot(&snapshot, &scratch).unwrap();
+        std::fs::read(scratch.session_file_path()).unwrap()
+    }
+
     fn sessions() -> Sessions {
         let temp = crate::test_temp::tempdir().unwrap();
         let remembered = named_options(temp.path(), "remembered");
@@ -354,54 +368,6 @@ mod load {
         }
     }
 
-    #[test]
-    fn a_session_deleted_before_a_retry_is_checked_again() {
-        let mut sessions = sessions();
-        let path = sessions.remembered.session_file_path();
-        let home = sessions.home.clone();
-        // The first attempt fails as an I/O error would, before the file goes.
-        let failed = load_output_session(
-            sessions.remembered.clone(),
-            Some(&path),
-            Some(home.clone()),
-            |_| Err(anyhow::anyhow!("session load failed")),
-        );
-        assert!(failed.is_err());
-        std::fs::remove_file(&path).unwrap();
-
-        // The retry first saves the current session, as an output transition
-        // does; a save into the remembered session would recreate it.
-        let remembered = sessions.remembered.clone();
-        let may_save = may_save_before_output_load(&remembered, Some(&path), |operation| {
-            sessions.persistence.run(0, operation)
-        })
-        .unwrap();
-        if may_save {
-            stored_session::save_snapshot(&sample_snapshot(), &remembered).unwrap();
-        }
-        let load = sessions.load(Some(home)).unwrap();
-
-        assert!(!may_save);
-        sessions.assert_went_home(load);
-    }
-
-    #[test]
-    fn only_an_unusable_remembered_session_holds_back_the_save() {
-        let mut sessions = sessions();
-        let path = sessions.remembered.session_file_path();
-        let remembered = sessions.remembered.clone();
-        let mut run = |operation| sessions.persistence.run(0, operation);
-
-        assert!(may_save_before_output_load(&remembered, Some(&path), &mut run).unwrap());
-        // Another session is saved as before, without a check.
-        assert!(
-            may_save_before_output_load(&remembered, None, |_| {
-                panic!("no check runs for a session that is not remembered")
-            })
-            .unwrap()
-        );
-    }
-
     #[test]
     fn without_persistence_home_has_nothing_to_load() {
         let mut sessions = sessions();
@@ -434,4 +400,266 @@ mod load {
         assert_eq!(options.target, remembered.target);
         assert!(matches!(outcome, LoadSnapshotOutcome::Empty));
     }
+
+    #[test]
+    fn a_cleared_remembered_primary_cannot_revive_ink_or_quarantine_suppressed_bytes() {
+        for primary_kind in ["ink", "corrupt", "blank"] {
+            let mut sessions = sessions();
+            let options = sessions.remembered.clone();
+            let primary = options.session_file_path();
+            let ink = std::fs::read(&primary).unwrap();
+            let blank = blank_session_bytes(sessions.temp.path());
+            let bytes = match primary_kind {
+                "ink" => ink.as_slice(),
+                "corrupt" => b"suppressed corrupt primary".as_slice(),
+                "blank" => blank.as_slice(),
+                _ => unreachable!(),
+            };
+            std::fs::write(&primary, bytes).unwrap();
+            std::fs::write(options.backup_file_path(), &ink).unwrap();
+            std::fs::write(options.recovery_file_path(), &ink).unwrap();
+            let clear = options.clear_marker_file_path();
+            std::fs::write(&clear, b"cleared").unwrap();
+            let modified = |seconds| {
+                std::fs::FileTimes::new().set_modified(
+                    std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(seconds),
+                )
+            };
+            std::fs::File::open(&primary)
+                .unwrap()
+                .set_times(modified(10))
+                .unwrap();
+            std::fs::File::open(&clear)
+                .unwrap()
+                .set_times(modified(20))
+                .unwrap();
+            for sidecar in [options.backup_file_path(), options.recovery_file_path()] {
+                std::fs::File::open(sidecar)
+                    .unwrap()
+                    .set_times(modified(10))
+                    .unwrap();
+            }
+            let home = sessions.home.clone();
+
+            let load = sessions.load(Some(home)).unwrap();
+
+            let OutputSessionLoad::Loaded(_, outcome) = load else {
+                panic!("cleared {primary_kind} must stay on the remembered target: {load:?}");
+            };
+            assert!(
+                !outcome.has_board_data(),
+                "cleared {primary_kind}: {outcome:?}"
+            );
+            if primary_kind == "blank" {
+                assert!(matches!(outcome, LoadSnapshotOutcome::Loaded(_)));
+            } else {
+                assert!(matches!(outcome, LoadSnapshotOutcome::Empty));
+            }
+            assert_eq!(std::fs::read(&primary).unwrap(), bytes);
+            assert_eq!(std::fs::read(options.backup_file_path()).unwrap(), ink);
+            assert_eq!(std::fs::read(options.recovery_file_path()).unwrap(), ink);
+            assert!(!stored_session::append_path_suffix(&primary, ".corrupt-1").exists());
+        }
+    }
+
+    #[test]
+    fn a_corrupt_remembered_primary_restores_its_backup_and_keeps_diagnostics() {
+        let mut sessions = sessions();
+        let options = &sessions.remembered;
+        let primary = options.session_file_path();
+        let saved = std::fs::read(&primary).unwrap();
+        std::fs::write(options.backup_file_path(), &saved).unwrap();
+        std::fs::write(options.recovery_file_path(), &saved).unwrap();
+        std::fs::write(options.backup_recovery_marker_file_path(), b"recoverable").unwrap();
+        std::fs::write(
+            options.recovery_recoverable_marker_file_path(),
+            b"recoverable",
+        )
+        .unwrap();
+        let bytes = b"broken primary".as_slice();
+        std::fs::write(&primary, bytes).unwrap();
+        let modified = |seconds| {
+            std::fs::FileTimes::new().set_modified(
+                std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(seconds),
+            )
+        };
+        std::fs::File::open(options.recovery_file_path())
+            .unwrap()
+            .set_times(modified(10))
+            .unwrap();
+        std::fs::File::open(&primary)
+            .unwrap()
+            .set_times(modified(20))
+            .unwrap();
+        let home = sessions.home.clone();
+
+        let load = sessions.load(Some(home)).unwrap();
+        let OutputSessionLoad::Loaded(
+            loaded_options,
+            LoadSnapshotOutcome::RestoredAfterCorruption { snapshot, .. },
+        ) = load
+        else {
+            panic!("expected restored remembered session");
+        };
+        assert_eq!(loaded_options.target, sessions.remembered.target);
+        assert!(snapshot.has_board_data());
+        assert_eq!(
+            std::fs::read(stored_session::append_path_suffix(&primary, ".corrupt-1")).unwrap(),
+            bytes
+        );
+        let options = &sessions.remembered;
+        assert_eq!(std::fs::read(options.session_file_path()).unwrap(), saved);
+        assert_eq!(std::fs::read(options.backup_file_path()).unwrap(), saved);
+        assert_eq!(std::fs::read(options.recovery_file_path()).unwrap(), saved);
+    }
+
+    #[test]
+    fn a_remembered_session_goes_home_when_oversized_corruption_restore_leaves_no_primary() {
+        let mut sessions = sessions();
+        let mut snapshot = sample_snapshot();
+        snapshot.boards[0].pages.pages[0].add_shape(crate::draw::Shape::Freehand {
+            points: (0..40_000)
+                .map(|index| (index % 1000, (index * 17) % 800))
+                .collect(),
+            color: crate::draw::WHITE,
+            thick: 2.0,
+        });
+        let mut scratch = named_options(sessions.temp.path(), "large-recovery");
+        scratch.compression = stored_session::CompressionMode::Off;
+        stored_session::save_snapshot(&snapshot, &scratch).unwrap();
+        let saved = std::fs::read(scratch.session_file_path()).unwrap();
+
+        // This valid filename leaves room for the sidecars, but not the atomic
+        // diagnostic copy's temporary name. Its failed copy moves the corrupt
+        // primary aside, exercising the real fallback without filling the disk.
+        let long_name = format!("{}.wayscriber-session", "a".repeat(203));
+        sessions
+            .remembered
+            .set_named_file_target(sessions.temp.path().join(long_name));
+        sessions.remembered.max_file_size_bytes = 1024 * 1024;
+        assert!(saved.len() as u64 > sessions.remembered.max_file_size_bytes);
+        let primary = sessions.remembered.session_file_path();
+        let recovery = sessions.remembered.recovery_file_path();
+        let corrupt_bytes = b"broken primary";
+        std::fs::write(&primary, corrupt_bytes).unwrap();
+        std::fs::write(&recovery, &saved).unwrap();
+        std::fs::write(
+            sessions.remembered.recovery_recoverable_marker_file_path(),
+            b"recoverable",
+        )
+        .unwrap();
+        // Older marked recovery forces the corrupt-primary restoration path,
+        // rather than loading a newer recovery before examining the primary.
+        for (path, seconds) in [(&primary, 20), (&recovery, 10)] {
+            std::fs::File::open(path)
+                .unwrap()
+                .set_times(std::fs::FileTimes::new().set_modified(
+                    std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(seconds),
+                ))
+                .unwrap();
+        }
+        let home = sessions.home.clone();
+
+        let load = sessions.load(Some(home)).unwrap();
+
+        let error = sessions.assert_went_home(load);
+        assert!(
+            error
+                .downcast_ref::<stored_session::MissingNamedSessionFile>()
+                .is_some(),
+            "{error:#}"
+        );
+        assert!(!primary.exists());
+        assert_eq!(std::fs::read(&recovery).unwrap(), saved);
+        assert_eq!(
+            std::fs::read(stored_session::append_path_suffix(&primary, ".corrupt-1")).unwrap(),
+            corrupt_bytes
+        );
+    }
+
+    #[test]
+    fn remembered_recovery_and_marked_backup_survive_the_next_fitting_save() {
+        for source in ["newer recovery", "marked backup"] {
+            let mut sessions = sessions();
+            let mut options = sessions.remembered.clone();
+            let mut newest = sample_snapshot();
+            newest.boards[0].pages.pages[0].add_shape(crate::draw::Shape::Line {
+                x1: 10,
+                y1: 10,
+                x2: 71,
+                y2: 20,
+                color: crate::draw::Color {
+                    r: 1.0,
+                    g: 0.0,
+                    b: 0.0,
+                    a: 1.0,
+                },
+                thick: 2.0,
+            });
+            if source == "newer recovery" {
+                options.max_file_size_bytes = 64;
+                stored_session::save_snapshot(&newest, &options).unwrap_err();
+                let modified = |seconds| {
+                    std::fs::FileTimes::new().set_modified(
+                        std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(seconds),
+                    )
+                };
+                std::fs::File::open(options.session_file_path())
+                    .unwrap()
+                    .set_times(modified(10))
+                    .unwrap();
+                std::fs::File::open(options.recovery_file_path())
+                    .unwrap()
+                    .set_times(modified(20))
+                    .unwrap();
+                options.max_file_size_bytes = sessions.remembered.max_file_size_bytes;
+            } else {
+                stored_session::save_snapshot(&newest, &options).unwrap();
+                let blank = stored_session::SessionSnapshot {
+                    active_board_id: "transparent".into(),
+                    boards: Vec::new(),
+                    tool_state: None,
+                };
+                // Tool-state-only blank retains a live accidental-blank marker.
+                let mut blank = blank;
+                blank.tool_state = Some(stored_session::ToolStateSnapshot::from_config(
+                    &crate::config::Config::default(),
+                ));
+                stored_session::save_snapshot(&blank, &options).unwrap();
+            }
+            let home = sessions.home.clone();
+
+            let load = sessions.load(Some(home)).unwrap();
+
+            let OutputSessionLoad::Loaded(_, outcome) = load else {
+                panic!("{source} must continue the remembered session: {load:?}");
+            };
+            let snapshot = match outcome {
+                LoadSnapshotOutcome::LoadedFromRecovery(snapshot) if source == "newer recovery" => {
+                    snapshot
+                }
+                LoadSnapshotOutcome::LoadedFromBackup(snapshot) if source == "marked backup" => {
+                    snapshot
+                }
+                other => panic!("{source} must be restored, got {other:?}"),
+            };
+            assert_eq!(
+                snapshot.boards[0].pages.pages[0].shapes.len(),
+                2,
+                "{source}"
+            );
+            stored_session::save_snapshot(&snapshot, &options).unwrap();
+            let OutputSessionLoad::Loaded(_, outcome) = sessions.load(None).unwrap() else {
+                panic!("the fitting save must still continue the remembered file");
+            };
+            let LoadSnapshotOutcome::Loaded(snapshot) = outcome else {
+                panic!("{outcome:?}");
+            };
+            assert_eq!(
+                snapshot.boards[0].pages.pages[0].shapes.len(),
+                2,
+                "{source} ink survived recovery cleanup"
+            );
+        }
+    }
 }
diff --git a/src/backend/wayland/session/load_outcome.rs b/src/backend/wayland/session/load_outcome.rs
index 7f3a3fbb9..bcb810be0 100644
--- a/src/backend/wayland/session/load_outcome.rs
+++ b/src/backend/wayland/session/load_outcome.rs
@@ -1,7 +1,7 @@
 //! What a launch-style load found, put on the canvas. A launch, an output's
 //! session load and a return to the home session share these rules.
 
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
 use anyhow::Result;
 use log::{debug, warn};
@@ -19,6 +19,34 @@ pub(in crate::backend::wayland) struct ExpandedTooLarge {
     pub(in crate::backend::wayland) max_expanded_size: u64,
 }
 
+/// Publish one loaded output through the same canvas and write-protection rules.
+pub(in crate::backend::wayland) fn commit_output_load(
+    input: &mut InputState,
+    measurer: &crate::draw::TextMeasurer,
+    session: &mut super::SessionState,
+    options: SessionOptions,
+    outcome: LoadSnapshotOutcome,
+    context: &str,
+) -> Result<Option<ExpandedTooLarge>> {
+    let board_data = outcome.has_board_data();
+    let writable = !matches!(
+        outcome,
+        LoadSnapshotOutcome::ExpandedTooLarge { .. }
+            | LoadSnapshotOutcome::NonRegularArtifact { .. }
+    );
+    let too_large = apply_load_outcome(input, measurer, outcome, &options, context)?;
+    if let Some(ref refusal) = too_large {
+        session.protect_session_path(refusal.path.clone());
+    }
+    if writable {
+        session.confirm_successful_load(&options.session_file_path());
+    }
+    input.set_session_preflight_options(Some(options.clone()));
+    input.clear_session_dirty();
+    session.commit_output_options(options, board_data);
+    Ok(too_large)
+}
+
 /// Replaces every board with what loading `options` found, and gives the
 /// notices a launch gives for a backup, recovery or unreadable session. A
 /// session too large to restore is returned for the caller to protect and
@@ -57,6 +85,14 @@ pub(in crate::backend::wayland) fn apply_load_outcome(
             replace_output_session_snapshot(input_state, measurer, Some(*snapshot), options)?;
             input_state.push_toast(ToastPriority::Info, "output", Toast::warning("Restored session from recovery file; normal save previously exceeded the size limit."));
         }
+        LoadSnapshotOutcome::RestoredAfterCorruption {
+            snapshot,
+            source,
+            corrupt_copy,
+        } => {
+            replace_output_session_snapshot(input_state, measurer, Some(*snapshot), options)?;
+            notify_unreadable_session(input_state, Some(source), &corrupt_copy);
+        }
         LoadSnapshotOutcome::Empty => {
             debug!(
                 "No session data found for {} ({})",
@@ -65,7 +101,7 @@ pub(in crate::backend::wayland) fn apply_load_outcome(
             );
             replace_output_session_snapshot(input_state, measurer, None, options)?;
         }
-        LoadSnapshotOutcome::EmptyAfterCorruption { backup_path } => {
+        LoadSnapshotOutcome::EmptyAfterCorruption { corrupt_copy } => {
             // An empty canvas here is indistinguishable from "no session
             // yet", so without this the user's drawings appear to have
             // vanished and only the log says the bytes were kept.
@@ -73,18 +109,10 @@ pub(in crate::backend::wayland) fn apply_load_outcome(
                 "Session {} could not be read for {}; its bytes were preserved at {}",
                 options.session_file_path().display(),
                 context,
-                backup_path.display()
+                corrupt_copy.display()
             );
             replace_output_session_snapshot(input_state, measurer, None, options)?;
-            input_state.push_toast(
-                ToastPriority::Critical,
-                "session.corrupt",
-                Toast::error(format!(
-                    "Previous session could not be read; a copy was saved to {}",
-                    backup_path.display()
-                ))
-                .duration_ms(20_000),
-            );
+            notify_unreadable_session(input_state, None, &corrupt_copy);
         }
         LoadSnapshotOutcome::NonRegularArtifact { path } => {
             debug!(
@@ -109,6 +137,36 @@ pub(in crate::backend::wayland) fn apply_load_outcome(
     Ok(None)
 }
 
+/// Says the session could not be read, where its bytes were kept, and what
+/// was restored instead, if anything.
+fn notify_unreadable_session(
+    input_state: &mut InputState,
+    restored_from: Option<stored_session::RestoredArtifact>,
+    corrupt_copy: &Path,
+) {
+    let toast = match restored_from {
+        Some(source) => {
+            let source = match source {
+                stored_session::RestoredArtifact::Backup => "backup. Recent changes may be missing",
+                stored_session::RestoredArtifact::Recovery => "recovery file",
+            };
+            Toast::warning(format!(
+                "Previous session could not be read; restored drawings from the {source}. A copy of the unreadable file was saved to {}",
+                corrupt_copy.display()
+            ))
+        }
+        None => Toast::error(format!(
+            "Previous session could not be read and no backup could be restored; a copy was saved to {}",
+            corrupt_copy.display()
+        )),
+    };
+    input_state.push_toast(
+        ToastPriority::Critical,
+        "session.corrupt",
+        toast.duration_ms(20_000),
+    );
+}
+
 /// Replaces every board with `snapshot`, or with empty boards without one.
 pub(in crate::backend::wayland) fn replace_output_session_snapshot(
     input_state: &mut InputState,
diff --git a/src/backend/wayland/session/persistence/worker.rs b/src/backend/wayland/session/persistence/worker.rs
index 102c78075..c19a45405 100644
--- a/src/backend/wayland/session/persistence/worker.rs
+++ b/src/backend/wayland/session/persistence/worker.rs
@@ -231,16 +231,39 @@ fn require_replaceable_session_file(path: &Path) -> Result<()> {
 }
 
 /// Loads a remembered session with the startup rules of a session file, but
-/// only from that file itself. A file moved or deleted since it was remembered
-/// is not continued from a backup or recovery copy left beside it, and neither
-/// is one that went away while it loaded.
+/// only while its primary still exists. Its own newer recovery and marked
+/// backup use normal startup precedence. Sidecars cannot continue a file that
+/// was moved, deleted, or became non-regular before or during the load.
 fn load_remembered(options: &SessionOptions) -> Result<PersistenceOutcome> {
     let path = options.session_file_path();
     if let Err(error) = session::validate_named_session_file_for_open(&path) {
         return Ok(PersistenceOutcome::RememberedUnavailable(error));
     }
-    let outcome = session::load_snapshot_with_outcome(options)?;
+    let outcome = match session::load_snapshot_with_outcome(options) {
+        Ok(outcome) => outcome,
+        Err(error) => {
+            if error
+                .downcast_ref::<session::CorruptArtifactPreservationFailed>()
+                .is_some()
+            {
+                return Ok(PersistenceOutcome::RememberedUnavailable(error));
+            }
+            return match session::validate_named_session_file_for_open(&path) {
+                Ok(()) => Err(error),
+                Err(unavailable) => Ok(PersistenceOutcome::RememberedUnavailable(unavailable)),
+            };
+        }
+    };
+    if let LoadSnapshotOutcome::EmptyAfterCorruption { corrupt_copy } = outcome {
+        return Ok(PersistenceOutcome::RememberedUnavailable(anyhow!(
+            "remembered session {} is corrupt; its bytes are preserved at {}",
+            path.display(),
+            corrupt_copy.display()
+        )));
+    }
 
+    // A corruption restore can leave the primary absent when quarantine moved
+    // it aside and recovered bytes exceed the size limit for primary repair.
     Ok(match session::validate_named_session_file_for_open(&path) {
         Ok(()) => PersistenceOutcome::Load(outcome),
         Err(error) => PersistenceOutcome::RememberedUnavailable(error),
diff --git a/src/backend/wayland/session/runtime.rs b/src/backend/wayland/session/runtime.rs
index 5a2f2bb2e..e68f3f55c 100644
--- a/src/backend/wayland/session/runtime.rs
+++ b/src/backend/wayland/session/runtime.rs
@@ -45,7 +45,8 @@ pub(in crate::backend::wayland) struct SessionTransaction<'a> {
 
 mod transaction;
 pub(in crate::backend::wayland) use transaction::{
-    ExplicitSessionTransaction, SessionCommand, SessionCommandReport, TransactionStep,
+    QueuedSessionCommand, SessionCommand, SessionCommandAborted, SessionCommandReport,
+    SessionCommandTransaction, TransactionStep,
 };
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -111,15 +112,16 @@ fn named_candidate_snapshot(
     match outcome {
         LoadSnapshotOutcome::Loaded(snapshot)
         | LoadSnapshotOutcome::LoadedFromBackup(snapshot)
+        | LoadSnapshotOutcome::RestoredAfterCorruption { snapshot, .. }
         | LoadSnapshotOutcome::LoadedFromRecovery(snapshot) => Ok(*snapshot),
         LoadSnapshotOutcome::Empty => Err(anyhow!(
             "named session file contains no usable session data: {}",
             options.session_file_path().display()
         )),
-        LoadSnapshotOutcome::EmptyAfterCorruption { backup_path } => Err(anyhow!(
+        LoadSnapshotOutcome::EmptyAfterCorruption { corrupt_copy } => Err(anyhow!(
             "named session file could not be read: {}; a copy of it was saved to {}",
             options.session_file_path().display(),
-            backup_path.display()
+            corrupt_copy.display()
         )),
         LoadSnapshotOutcome::NonRegularArtifact { path } => Err(anyhow!(
             "named session file is not a regular file: {}",
diff --git a/src/backend/wayland/session/runtime/transaction.rs b/src/backend/wayland/session/runtime/transaction.rs
index 1c3652070..d4cf5f73f 100644
--- a/src/backend/wayland/session/runtime/transaction.rs
+++ b/src/backend/wayland/session/runtime/transaction.rs
@@ -1,11 +1,28 @@
-//! Explicit session commands advance only when their disk phase completes.
+//! Session commands advance only when their disk phase completes.
 use super::*;
 
+mod output;
 mod phases;
 
+#[derive(Debug)]
+pub(in crate::backend::wayland) struct SessionCommandAborted(&'static str);
+
+impl std::fmt::Display for SessionCommandAborted {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(self.0)
+    }
+}
+
+impl std::error::Error for SessionCommandAborted {}
+
 #[derive(Debug)]
 pub(in crate::backend::wayland) enum SessionCommand {
     Open(PathBuf),
+    Output {
+        transition: Box<super::super::PendingOutputTransition>,
+        remembered: Option<PathBuf>,
+        home: Option<Box<SessionOptions>>,
+    },
     /// Return to the home session, whose options for the current output this
     /// carries; `None` when home has persistence disabled.
     OpenHome(Option<Box<SessionOptions>>),
@@ -21,6 +38,11 @@ pub(in crate::backend::wayland) enum SessionCommandReport {
     Open(RuntimeOpenSessionReport),
     /// The overlay is back in its home session.
     Home,
+    Output {
+        abandoned: Option<(PathBuf, anyhow::Error)>,
+        too_large: Option<super::super::ExpandedTooLarge>,
+        first_output_resolved: bool,
+    },
     SaveAs(RuntimeSaveAsSessionReport),
     Overwrite(PathBuf, bool),
     Clear(RuntimeClearSessionReport),
@@ -37,6 +59,10 @@ pub(in crate::backend::wayland) enum TransactionStep {
 #[derive(Debug, Clone, Copy)]
 enum Phase {
     Start,
+    OutputCheckSource,
+    OutputArtifacts,
+    OutputLoad,
+    OutputHome,
     OpenPreflight,
     SaveCurrent,
     Load,
@@ -50,8 +76,35 @@ enum Phase {
     Forget,
 }
 
-pub(in crate::backend::wayland) struct ExplicitSessionTransaction {
+pub(in crate::backend::wayland) struct QueuedSessionCommand {
+    pub command: SessionCommand,
+    pub epoch: u64,
+    /// The edit generation the command was requested over.
+    pub generation: u64,
+}
+
+impl SessionCommand {
+    pub(in crate::backend::wayland::session) fn matches_request(&self, other: &Self) -> bool {
+        match (self, other) {
+            (Self::Open(a), Self::Open(b))
+            | (Self::CheckOverwrite(a), Self::CheckOverwrite(b))
+            | (Self::Forget(a), Self::Forget(b)) => a == b,
+            (Self::SaveAs(a, policy), Self::SaveAs(b, other_policy)) => {
+                a == b && policy == other_policy
+            }
+            (Self::OpenHome(_), Self::OpenHome(_))
+            | (Self::Clear, Self::Clear)
+            | (Self::ClearTools(_), Self::ClearTools(_))
+            | (Self::Inspect, Self::Inspect) => true,
+            _ => false,
+        }
+    }
+}
+
+pub(in crate::backend::wayland) struct SessionCommandTransaction {
     command: SessionCommand,
+    pub(in crate::backend::wayland::session) queued_commands:
+        std::collections::VecDeque<QueuedSessionCommand>,
     phase: Phase,
     current: Option<SessionOptions>,
     target: Option<SessionOptions>,
@@ -60,13 +113,16 @@ pub(in crate::backend::wayland) struct ExplicitSessionTransaction {
     interaction: Option<(u64, bool)>,
     saved_current: bool,
     loaded_board_data: bool,
+    output_snapshot: Option<SessionSnapshot>,
+    abandoned: Option<(PathBuf, anyhow::Error)>,
     pub request_id: Option<RequestId>,
 }
 
-impl ExplicitSessionTransaction {
+impl SessionCommandTransaction {
     pub fn new(command: SessionCommand, epoch: u64, interaction: (u64, bool)) -> Self {
         Self {
             command,
+            queued_commands: std::collections::VecDeque::new(),
             phase: Phase::Start,
             current: None,
             target: None,
@@ -75,6 +131,8 @@ impl ExplicitSessionTransaction {
             interaction: Some(interaction),
             saved_current: false,
             loaded_board_data: false,
+            output_snapshot: None,
+            abandoned: None,
             request_id: None,
         }
     }
@@ -93,31 +151,47 @@ impl ExplicitSessionTransaction {
         result: Option<Result<PersistenceOutcome>>,
     ) -> Result<TransactionStep> {
         if self.epoch != context.session.target_epoch() {
-            return Err(anyhow!(
-                "session target changed while the command was pending"
-            ));
+            return Err(SessionCommandAborted(
+                "session target changed while the command was pending",
+            )
+            .into());
+        }
+        if let SessionCommand::Output { transition, .. } = &self.command
+            && !context
+                .session
+                .pending_output_transition()
+                .is_some_and(|pending| {
+                    pending.revision == transition.revision && pending.source_epoch == self.epoch
+                })
+        {
+            return Err(SessionCommandAborted(
+                "output destination changed while persistence was pending",
+            )
+            .into());
         }
         let outcome = result.transpose()?;
         if self
             .generation
             .is_some_and(|generation| generation != context.session.edit_generation())
         {
-            return Err(anyhow!(
-                "session was edited while the command was pending; retry the command"
-            ));
+            return Err(SessionCommandAborted(
+                "session was edited while the command was pending; retry the command",
+            )
+            .into());
         }
 
         if let Some((revision, active)) = self.interaction {
             let (current_revision, current_active) =
                 context.input_state.session_interaction_state();
             if revision != current_revision || (!active && current_active) {
-                return Err(anyhow!(
-                    "input interaction changed while the session command was pending; retry the command"
-                ));
+                return Err(SessionCommandAborted("input interaction changed while the session command was pending; retry the command").into());
             }
         }
 
         match self.phase {
+            Phase::OutputCheckSource => self.complete_output_check_source(context, outcome),
+            Phase::OutputArtifacts => self.complete_output_artifacts(context, outcome),
+            Phase::OutputLoad | Phase::OutputHome => self.complete_output_load(context, outcome),
             Phase::Start => self.complete_start(context, outcome),
             Phase::OpenPreflight => self.complete_open_preflight(context, outcome),
             Phase::SaveCurrent => self.complete_save_current(context, outcome),
@@ -163,6 +237,12 @@ impl ExplicitSessionTransaction {
             .as_ref()
             .expect("target change has current options")
             .clone();
+        if !context
+            .session
+            .validate_source_write(context.input_state.is_session_dirty())?
+        {
+            return self.after_current_save(context);
+        }
         let snapshot = context
             .input_state
             .with_active_interaction_canceled_for_capture_with(context.measurer, |input| {
@@ -194,6 +274,7 @@ impl ExplicitSessionTransaction {
         context: &mut SessionTransaction<'_>,
     ) -> Result<TransactionStep> {
         match &self.command {
+            SessionCommand::Output { .. } => self.load_output_target(),
             SessionCommand::Open(_) => {
                 self.capture_input_generation(context);
                 self.work(
diff --git a/src/backend/wayland/session/runtime/transaction/output.rs b/src/backend/wayland/session/runtime/transaction/output.rs
new file mode 100644
index 000000000..30f14e3f5
--- /dev/null
+++ b/src/backend/wayland/session/runtime/transaction/output.rs
@@ -0,0 +1,215 @@
+//! Output switches use the same ordered, nonblocking disk phases as session commands.
+use super::*;
+
+impl SessionCommandTransaction {
+    pub(super) fn start_output(
+        &mut self,
+        context: &mut SessionTransaction<'_>,
+    ) -> Result<TransactionStep> {
+        let SessionCommand::Output {
+            transition,
+            remembered,
+            ..
+        } = &self.command
+        else {
+            unreachable!()
+        };
+        self.target = Some(transition.staged_options.clone());
+
+        let current = self.current.as_ref().expect("output switch has source");
+        let check_remembered = remembered
+            .as_ref()
+            .is_some_and(|path| current.session_file_path() == *path);
+        let current_path = current.session_file_path();
+        self.capture_input_generation(context);
+        if check_remembered {
+            // An unavailable remembered source goes straight to the target
+            // without a save, so a refused write must stop the switch first.
+            context
+                .session
+                .validate_source_write(context.input_state.is_session_dirty())?;
+            return self.work(
+                Phase::OutputCheckSource,
+                PersistenceOperation::CheckRemembered { path: current_path },
+            );
+        }
+        self.prepare_output_save(context)
+    }
+
+    pub(super) fn complete_output_check_source(
+        &mut self,
+        context: &mut SessionTransaction<'_>,
+        outcome: Option<PersistenceOutcome>,
+    ) -> Result<TransactionStep> {
+        match required_outcome(outcome)? {
+            PersistenceOutcome::Unit => self.prepare_output_save(context),
+            PersistenceOutcome::RememberedUnavailable(_) => self.load_output_target(),
+            other => Err(anyhow!("unexpected remembered source check: {other:?}")),
+        }
+    }
+
+    fn prepare_output_save(
+        &mut self,
+        context: &mut SessionTransaction<'_>,
+    ) -> Result<TransactionStep> {
+        let options = self
+            .current
+            .as_ref()
+            .expect("output switch has source")
+            .clone();
+        let dirty = context.session.is_dirty() || context.input_state.is_session_dirty();
+        if !context
+            .session
+            .validate_source_write(context.input_state.is_session_dirty())?
+            || !dirty
+        {
+            return self.load_output_target();
+        }
+        if context.session.should_skip_save_for_protected_path(
+            &options.session_file_path(),
+            context.input_state.is_session_dirty(),
+        ) {
+            return self.load_output_target();
+        }
+        self.output_snapshot = context
+            .input_state
+            .snapshot_for_persistence_with(context.measurer, &options);
+        if !self
+            .output_snapshot
+            .as_ref()
+            .is_some_and(SessionSnapshot::has_board_data)
+            && !context.session.has_loaded_board_data()
+            && !context.session.is_dirty()
+            && !context.input_state.is_session_dirty()
+        {
+            return self.work(
+                Phase::OutputArtifacts,
+                PersistenceOperation::HasArtifacts { options },
+            );
+        }
+        self.submit_output_save(context)
+    }
+
+    pub(super) fn complete_output_artifacts(
+        &mut self,
+        context: &mut SessionTransaction<'_>,
+        outcome: Option<PersistenceOutcome>,
+    ) -> Result<TransactionStep> {
+        let PersistenceOutcome::HasArtifacts(has_artifacts) = required_outcome(outcome)? else {
+            return Err(anyhow!("unexpected output artifact inspection"));
+        };
+        if has_artifacts {
+            self.load_output_target()
+        } else {
+            self.submit_output_save(context)
+        }
+    }
+
+    fn submit_output_save(
+        &mut self,
+        context: &mut SessionTransaction<'_>,
+    ) -> Result<TransactionStep> {
+        let options = self
+            .current
+            .as_ref()
+            .expect("output switch has source")
+            .clone();
+        let snapshot = match self.output_snapshot.take() {
+            Some(snapshot) => snapshot,
+            None if session_persistence_enabled(&options) => empty_snapshot(context.input_state),
+            None => return self.load_output_target(),
+        };
+        self.work(
+            Phase::SaveCurrent,
+            PersistenceOperation::Save {
+                snapshot,
+                options,
+                strategy: SaveStrategy::Normal,
+                contentless_clear_boundary: context.session.has_loaded_board_data(),
+            },
+        )
+    }
+
+    pub(super) fn load_output_target(&mut self) -> Result<TransactionStep> {
+        let options = self
+            .target
+            .as_ref()
+            .expect("output switch has target")
+            .clone();
+        let SessionCommand::Output { remembered, .. } = &self.command else {
+            unreachable!()
+        };
+        let operation = if remembered
+            .as_ref()
+            .is_some_and(|path| options.session_file_path() == *path)
+        {
+            PersistenceOperation::LoadRemembered { options }
+        } else {
+            PersistenceOperation::LoadConfigured { options }
+        };
+        self.work(Phase::OutputLoad, operation)
+    }
+
+    pub(super) fn complete_output_load(
+        &mut self,
+        context: &mut SessionTransaction<'_>,
+        outcome: Option<PersistenceOutcome>,
+    ) -> Result<TransactionStep> {
+        let outcome = match required_outcome(outcome)? {
+            PersistenceOutcome::Load(outcome) => outcome,
+            PersistenceOutcome::RememberedUnavailable(reason)
+                if matches!(self.phase, Phase::OutputLoad) =>
+            {
+                self.abandoned = Some((
+                    self.target
+                        .as_ref()
+                        .expect("remembered target")
+                        .session_file_path(),
+                    reason,
+                ));
+                let SessionCommand::Output { home, .. } = &self.command else {
+                    unreachable!()
+                };
+                if let Some(home) = home {
+                    let options = (**home).clone();
+                    self.target = Some(options.clone());
+                    return self.work(
+                        Phase::OutputHome,
+                        PersistenceOperation::LoadConfigured { options },
+                    );
+                }
+                context.input_state.set_session_preflight_options(None);
+                context.session.commit_without_persistence();
+                return Ok(TransactionStep::Complete(Box::new(
+                    SessionCommandReport::Output {
+                        abandoned: self.abandoned.take(),
+                        too_large: None,
+                        first_output_resolved: true,
+                    },
+                )));
+            }
+            other => return Err(anyhow!("unexpected output load outcome: {other:?}")),
+        };
+        let target = self
+            .target
+            .as_ref()
+            .expect("output load has target")
+            .clone();
+        let first_output_resolved = !target.per_output || target.output_identity().is_some();
+        let too_large = super::super::super::commit_output_load(
+            context.input_state,
+            context.measurer,
+            context.session,
+            target,
+            outcome,
+            "output load",
+        )?;
+        Ok(TransactionStep::Complete(Box::new(
+            SessionCommandReport::Output {
+                abandoned: self.abandoned.take(),
+                too_large,
+                first_output_resolved,
+            },
+        )))
+    }
+}
diff --git a/src/backend/wayland/session/runtime/transaction/phases.rs b/src/backend/wayland/session/runtime/transaction/phases.rs
index 253564753..800ac72f4 100644
--- a/src/backend/wayland/session/runtime/transaction/phases.rs
+++ b/src/backend/wayland/session/runtime/transaction/phases.rs
@@ -1,6 +1,6 @@
 use super::*;
 
-impl ExplicitSessionTransaction {
+impl SessionCommandTransaction {
     pub(super) fn complete_start(
         &mut self,
         context: &mut SessionTransaction<'_>,
@@ -33,6 +33,7 @@ impl ExplicitSessionTransaction {
                     .clone()
                     .ok_or_else(|| anyhow!("no active persisted session target"))?;
                 match &self.command {
+                    SessionCommand::Output { .. } => self.start_output(context),
                     SessionCommand::Open(path) => {
                         let mut target = options;
                         target.set_named_file_target(path.clone());
@@ -219,6 +220,9 @@ impl ExplicitSessionTransaction {
             .input_state
             .set_session_preflight_options(Some(options.clone()));
         context.input_state.clear_session_dirty();
+        context
+            .session
+            .confirm_successful_load(&options.session_file_path());
         context
             .session
             .commit_output_options(options, loaded_board_data);
diff --git a/src/backend/wayland/session/tests.rs b/src/backend/wayland/session/tests.rs
index 6544b5132..a3528f159 100644
--- a/src/backend/wayland/session/tests.rs
+++ b/src/backend/wayland/session/tests.rs
@@ -562,7 +562,7 @@ fn runtime_clear_persists_boundary_then_clears_live_session() {
     add_line(&mut input, 77);
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
-    session_state.mark_loaded(true);
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
     session_state.record_input_dirty(Instant::now(), true);
 
     let report = clear_current_session_runtime(
@@ -603,7 +603,7 @@ fn runtime_clear_primary_cleanup_failure_after_marker_still_clears_live_session(
     add_line(&mut input, 83);
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
-    session_state.mark_loaded(true);
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
     session_state.record_input_dirty(Instant::now(), true);
 
     let report = clear_current_session_runtime(
@@ -639,7 +639,7 @@ fn runtime_clear_persistence_failure_leaves_live_session_unchanged() {
     add_line(&mut input, 91);
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
-    session_state.mark_loaded(true);
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
     session_state.record_input_dirty(Instant::now(), true);
 
     let err = clear_current_session_runtime(
@@ -674,7 +674,7 @@ fn runtime_clear_saved_tool_state_resets_live_tools_and_preserves_saved_boards()
     input.style.arrow_head_at_end = false;
     input.ui_visibility.show_status_bar = false;
     let mut session_state = SessionState::new(Some(current_options.clone()));
-    session_state.mark_loaded(true);
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     let mut config = Config::default();
     config.drawing.default_thickness = 7.0;
@@ -894,6 +894,7 @@ fn runtime_open_replaces_boards_missing_from_candidate_snapshot() {
     add_line(&mut input, 77);
     assert_eq!(board_shape_count(&input, BOARD_ID_WHITEBOARD), 1);
     let mut session_state = SessionState::new(Some(current_options));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     open_named_session_runtime(
         &mut input,
@@ -927,6 +928,7 @@ fn runtime_open_resyncs_canvas_pointer_after_same_active_board_view_offset() {
     input.update_pointer_position(30, 40);
     assert_eq!(input.canvas_pointer_position(), (30, 40));
     let mut session_state = SessionState::new(Some(current_options));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     open_named_session_runtime(
         &mut input,
@@ -1109,6 +1111,7 @@ fn runtime_open_clears_deleted_page_restore_state_from_previous_session() {
     assert_eq!(input.page_delete(), PageDeleteOutcome::Removed);
     assert_eq!(input.boards.page_count(), 1);
     let mut session_state = SessionState::new(Some(current_options));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     open_named_session_runtime(
         &mut input,
@@ -1245,6 +1248,7 @@ fn runtime_open_saves_current_after_canceling_active_selection_move() {
     };
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     open_named_session_runtime(
         &mut input,
@@ -1309,6 +1313,7 @@ fn runtime_open_saves_current_after_canceling_active_text_edit() {
     buffer.push_str(" unsaved edit");
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     open_named_session_runtime(
         &mut input,
@@ -1353,6 +1358,7 @@ fn runtime_open_saves_current_after_canceling_color_picker_preview() {
     assert_ne!(input.color_for_tool(Tool::Pen), original);
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     open_named_session_runtime(
         &mut input,
@@ -1403,6 +1409,7 @@ fn runtime_open_current_save_failure_preserves_active_selection_move() {
     };
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     let err = open_named_session_runtime(
         &mut input,
@@ -1473,6 +1480,7 @@ fn runtime_open_current_save_failure_preserves_spatial_index_for_active_selectio
     };
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     let err = open_named_session_runtime(
         &mut input,
@@ -1551,6 +1559,7 @@ fn runtime_open_candidate_failure_after_current_save_keeps_current_active() {
     add_line(&mut input, 7);
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     let err = open_named_session_runtime(
         &mut input,
@@ -1651,6 +1660,7 @@ fn runtime_open_current_save_failure_aborts_before_candidate_load() {
     add_line(&mut input, 9);
     input.mark_session_dirty();
     let mut session_state = SessionState::new(Some(current_options.clone()));
+    session_state.commit_output_options(session_state.options().unwrap().clone(), true);
 
     let err = open_named_session_runtime(
         &mut input,
@@ -1685,6 +1695,7 @@ fn autosave_failure_backoff_delays_retry() {
     options.autosave_failure_backoff = Duration::from_millis(50);
 
     let mut state = SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), false);
     let now = Instant::now();
     state.record_input_dirty(now, true);
     state.mark_autosave_failure(now, options.autosave_failure_backoff);
@@ -1712,6 +1723,7 @@ fn autosave_deferral_delays_due_without_clearing_dirty() {
     options.autosave_interval = Duration::from_millis(1);
 
     let mut state = SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), false);
     let now = Instant::now();
     state.record_input_dirty(now, true);
     let due_at = now + Duration::from_millis(2);
@@ -1909,6 +1921,7 @@ fn autosave_completion_does_not_clear_newer_generation() {
     options.autosave_idle = Duration::from_millis(1);
     options.autosave_interval = Duration::from_millis(1);
     let mut state = SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), false);
     let started = Instant::now();
     state.record_input_dirty(started, true);
     let request_id = RequestId {
@@ -1922,6 +1935,7 @@ fn autosave_completion_does_not_clear_newer_generation() {
     state.record_input_dirty(newer_edit, true);
     let result = Ok(SaveCompletion {
         report: Some(crate::session::SaveSnapshotReport {
+            generation: None,
             path: PathBuf::from("/tmp/generation-test.json"),
             outcome: crate::session::SaveSnapshotOutcome::Full,
             raw_size: 1,
@@ -1948,6 +1962,7 @@ fn failed_autosave_restores_original_dirty_window() {
     options.autosave_idle = Duration::from_millis(1);
     options.autosave_interval = Duration::from_millis(1);
     let mut state = SessionState::new(Some(options.clone()));
+    state.commit_output_options(state.options().unwrap().clone(), false);
     let started = Instant::now();
     state.record_input_dirty(started, true);
     let request_id = RequestId {
@@ -2124,7 +2139,7 @@ fn explicit_clear_keeps_dispatch_available_and_preserves_edits_during_blocked_di
     let measurer = crate::draw::TextMeasurer::default();
     let mut session = SessionState::new(Some(options.clone()));
     let mut persistence = PersistenceController::start_for_test().unwrap();
-    let mut transaction = ExplicitSessionTransaction::new(
+    let mut transaction = SessionCommandTransaction::new(
         SessionCommand::Clear,
         session.target_epoch(),
         input.session_interaction_state(),
@@ -2205,7 +2220,7 @@ fn explicit_open_rejects_a_completion_after_target_epoch_changes() {
     let measurer = crate::draw::TextMeasurer::default();
     let mut session = SessionState::new(Some(options));
     let mut persistence = PersistenceController::start_for_test().unwrap();
-    let mut transaction = ExplicitSessionTransaction::new(
+    let mut transaction = SessionCommandTransaction::new(
         SessionCommand::Open(target.session_file_path()),
         session.target_epoch(),
         input.session_interaction_state(),
@@ -2337,7 +2352,7 @@ fn pending_session_handoffs_preserve_new_unfinished_pointer_and_text_drafts() {
                     stored_session::SaveAsOverwrite::Deny,
                 ),
             };
-            let mut transaction = ExplicitSessionTransaction::new(
+            let mut transaction = SessionCommandTransaction::new(
                 command,
                 session.target_epoch(),
                 input.session_interaction_state(),
@@ -2418,3 +2433,58 @@ fn pending_session_handoffs_preserve_new_unfinished_pointer_and_text_drafts() {
         }
     }
 }
+
+#[test]
+fn actual_corrupt_load_outcomes_publish_critical_preservation_notices() {
+    for restore in [false, true] {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let mut options =
+            stored_session::SessionOptions::new(temp.path().to_path_buf(), "corrupt-toast");
+        options.persist_transparent = true;
+        if restore {
+            stored_session::save_snapshot(&sample_snapshot(), &options).unwrap();
+            std::fs::rename(options.session_file_path(), options.backup_file_path()).unwrap();
+        }
+        std::fs::write(options.session_file_path(), b"unreadable primary").unwrap();
+        let outcome = stored_session::load_snapshot_with_outcome(&options).unwrap();
+        if restore {
+            assert!(matches!(
+                outcome,
+                stored_session::LoadSnapshotOutcome::RestoredAfterCorruption { .. }
+            ));
+        } else {
+            assert!(matches!(
+                outcome,
+                stored_session::LoadSnapshotOutcome::EmptyAfterCorruption { .. }
+            ));
+        }
+        let mut input = test_input_state();
+        apply_load_outcome(
+            &mut input,
+            &crate::draw::TextMeasurer::default(),
+            outcome,
+            &options,
+            "regression",
+        )
+        .unwrap();
+        let toast = input.active_toast().unwrap();
+        assert_eq!(toast.priority, crate::input::state::ToastPriority::Critical);
+        assert_eq!(toast.duration_ms, 20_000);
+        assert!(
+            toast.message.contains(
+                &stored_session::append_path_suffix(&options.session_file_path(), ".corrupt-1")
+                    .display()
+                    .to_string()
+            )
+        );
+        assert_eq!(
+            input.boards.active_frame().shapes.len(),
+            usize::from(restore)
+        );
+        if restore {
+            assert!(toast.message.contains("Recent changes may be missing"));
+        } else {
+            assert!(toast.message.contains("no backup could be restored"));
+        }
+    }
+}
diff --git a/src/backend/wayland/session/write_policy.rs b/src/backend/wayland/session/write_policy.rs
new file mode 100644
index 000000000..fc316501a
--- /dev/null
+++ b/src/backend/wayland/session/write_policy.rs
@@ -0,0 +1,87 @@
+//! Which drawings may be written to the source session file.
+
+use anyhow::Result;
+use std::path::Path;
+
+use super::{PersistenceOutcome, SessionState, stored_session};
+
+impl SessionState {
+    pub(in crate::backend::wayland) fn observe_load_failure(
+        &mut self,
+        result: &Result<PersistenceOutcome>,
+    ) {
+        match result {
+            Err(error) | Ok(PersistenceOutcome::RememberedUnavailable(error)) => {
+                self.block_unpreserved_corruption(error)
+            }
+            _ => {}
+        }
+    }
+
+    pub(in crate::backend::wayland) fn block_unpreserved_corruption(
+        &mut self,
+        error: &anyhow::Error,
+    ) {
+        if let Some(failure) =
+            error.downcast_ref::<stored_session::CorruptArtifactPreservationFailed>()
+        {
+            self.blocked_session_paths
+                .insert(failure.session_path.clone());
+        }
+    }
+
+    /// A clean unresolved source needs no write. Dirty unresolved or blocked
+    /// ink stays on screen until an explicit recovery action resolves its target.
+    pub(in crate::backend::wayland) fn validate_source_write(
+        &self,
+        input_dirty: bool,
+    ) -> Result<bool> {
+        let dirty = self.is_dirty() || input_dirty;
+        let blocked = self
+            .options
+            .as_ref()
+            .is_some_and(|options| self.refuses_source_write(&options.session_file_path()));
+        if (!self.loaded || blocked) && dirty {
+            let refusal = if !self.loaded {
+                SourceWriteRefused::NotLoaded
+            } else {
+                SourceWriteRefused::NotPreserved
+            };
+            return Err(refusal.into());
+        }
+        Ok(self.loaded && !blocked)
+    }
+
+    pub(in crate::backend::wayland) fn refuses_source_write(&self, path: &Path) -> bool {
+        self.blocked_session_paths.contains(path)
+    }
+
+    pub(in crate::backend::wayland) fn confirm_successful_load(&mut self, path: &Path) {
+        self.blocked_session_paths.remove(path);
+        self.protected_session_paths.remove(path);
+    }
+}
+
+/// Why drawings may not be written to the source session file.
+#[derive(Debug, Clone, Copy)]
+pub(in crate::backend::wayland) enum SourceWriteRefused {
+    /// The session never loaded, so its file still holds what it held.
+    NotLoaded,
+    /// Its unreadable bytes could not be copied aside before a replacement.
+    NotPreserved,
+}
+
+impl std::fmt::Display for SourceWriteRefused {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(match self {
+            Self::NotLoaded => {
+                "the source session has not loaded; new drawings are kept on screen and saved drawings are untouched; use Save As to keep new drawings elsewhere, or Clear before reloading"
+            }
+            Self::NotPreserved => {
+                "unreadable session data was not preserved; repair and reload its files or use Save As before replacing these drawings"
+            }
+        })
+    }
+}
+
+impl std::error::Error for SourceWriteRefused {}
diff --git a/src/backend/wayland/state.rs b/src/backend/wayland/state.rs
index e3023dd6a..9e8efdaaf 100644
--- a/src/backend/wayland/state.rs
+++ b/src/backend/wayland/state.rs
@@ -67,6 +67,10 @@ pub(in crate::backend::wayland) use clipboard_runtime::{
     HexCopyOutcome, TextCopyOutcome, TextPasteOutcome,
 };
 mod color_picker;
+mod contact_owner;
+pub(in crate::backend::wayland) use contact_owner::{
+    ContactMotion, ContactOwner, ReleaseRoute, release_route,
+};
 mod core;
 mod desktop_open;
 mod eyedropper;
@@ -101,6 +105,8 @@ mod screen_image;
 mod spotlight_runtime;
 #[cfg(feature = "tablet-input")]
 mod tablet_runtime;
+#[cfg(feature = "tablet-input")]
+pub(in crate::backend::wayland) use tablet_runtime::{StylusDownAdmission, StylusMotionRoute};
 mod text_clipboard;
 mod text_input;
 mod toolbar;
@@ -239,7 +245,7 @@ pub(super) struct WaylandState {
     pub(super) session_home: crate::backend::wayland::session::SessionHome,
     pub(super) persistence: crate::backend::wayland::session::PersistenceController,
     pub(super) session_transaction:
-        Option<crate::backend::wayland::session::ExplicitSessionTransaction>,
+        Option<crate::backend::wayland::session::SessionCommandTransaction>,
     session_dialog: self::toolbar::SessionFileDialogController,
     pub(super) durable_action_finish: Option<crate::daemon::protocol_v2::ClaimedAction>,
     pub(super) durable_action_retry_at: Option<Instant>,
diff --git a/src/backend/wayland/state/AGENTS.md b/src/backend/wayland/state/AGENTS.md
index 0ee19956e..f0890bda7 100644
--- a/src/backend/wayland/state/AGENTS.md
+++ b/src/backend/wayland/state/AGENTS.md
@@ -15,6 +15,8 @@
 - Preserve snapshot boundaries for export and session actions.
 - Keep render order, damage assumptions, buffer lifecycle, output identity, and toolbar visibility behavior explicit.
 - State helpers may coordinate subsystems, but durable config, drawing, capture, session, and input rules should remain with their owning modules.
+- `contact_owner.rs`, pointer contacts, tablet tip ownership, and `TouchTarget` bind motion/release to the press owner. Inline-strip hover never steals a held canvas contact; tablet `on_toolbar` describes layer-shell proximity only.
+- Output switches retain their pending revision until the shared session driver commits. Dispatch paths must not wait for persistence receipts; stale output revisions, source epochs, and live edits reject late receipts.
 
 ## Coupled Changes
 - Render changes may affect `src/draw/`, `src/ui/`, `src/input/state/render.rs`, backend toolbar rendering, and visual tests.
diff --git a/src/backend/wayland/state/clipboard.rs b/src/backend/wayland/state/clipboard.rs
index 78cf3fd50..21b12a622 100644
--- a/src/backend/wayland/state/clipboard.rs
+++ b/src/backend/wayland/state/clipboard.rs
@@ -9,11 +9,14 @@ use crate::backend::wayland::{
         transfer,
     },
 };
-use crate::input::state::ClipboardPasteRequest;
+use crate::input::InputState;
+use crate::input::state::{ClipboardFingerprint, ClipboardPasteRequest};
 use crate::input::state::{Toast, ToastPriority};
 use std::time::{Duration, Instant};
 
 mod fallback_save;
+#[cfg(test)]
+mod probe_tests;
 mod session_paste;
 
 use session_paste::{PastePersistenceDecision, SessionPasteWarning};
@@ -161,16 +164,7 @@ impl WaylandState {
         self.focus
             .suppress_exit_for(Instant::now(), Duration::from_millis(1500));
 
-        let local_selection = self.input_state.selection_clipboard_snapshot();
-        let pending_shapes =
-            local_selection.shapes_for_pending_publish(request.local_selection_fallback_generation);
-        let failed_probe = local_selection
-            .failed_probe(request.local_selection_fallback_generation)
-            .map(|(generation, expected)| FailedLocalSelectionProbe {
-                generation,
-                expected,
-            });
-        let plan = transfer::plan_paste_start(request, pending_shapes, failed_probe);
+        let plan = plan_clipboard_paste_start(&self.input_state, request);
         self.apply_paste_plan(plan);
     }
 
@@ -183,9 +177,8 @@ impl WaylandState {
             active_request_id,
             completion.result.summary()
         );
-        // A fingerprint probe continues the paste decision here, where the
-        // local fallback shapes live — they must be fetched fresh, not
-        // captured before the probe ran.
+        // A fingerprint probe continues the paste decision with the local
+        // fallback as it is now.
         if let ClipboardPasteResult::SystemFingerprintProbe {
             generation,
             expected,
@@ -199,15 +192,14 @@ impl WaylandState {
                 );
                 return;
             }
-            let local_shapes = local_selection.shapes_for_fallback(generation);
-            let plan = transfer::plan_after_fingerprint_probe(
+            let action = continue_after_fingerprint_probe(
+                &mut self.input_state,
                 completion.request,
                 generation,
                 expected,
                 current,
-                local_shapes,
             );
-            self.apply_paste_plan(plan);
+            self.apply_paste_action(action);
             return;
         }
         let private_payload = match &completion.result {
@@ -232,11 +224,12 @@ impl WaylandState {
     }
 
     fn apply_paste_plan(&mut self, plan: TransferPlan<PasteAction>) {
-        for effect in plan.effects {
-            self.apply_transfer_effect(effect);
-        }
+        apply_transfer_effects(&mut self.input_state, plan.effects);
+        self.apply_paste_action(plan.action);
+    }
 
-        match plan.action {
+    fn apply_paste_action(&mut self, action: PasteAction) {
+        match action {
             PasteAction::UseLocalShapes {
                 request,
                 shapes,
@@ -437,14 +430,6 @@ impl WaylandState {
         }
     }
 
-    fn apply_transfer_effect(&mut self, effect: TransferEffect) {
-        match effect {
-            TransferEffect::SupersedeLocalGeneration { generation } => self
-                .input_state
-                .mark_selection_clipboard_superseded_for_generation(Some(generation)),
-        }
-    }
-
     fn paste_fresh_local_fallback_or_warn(
         &mut self,
         request: &ClipboardPasteRequest,
@@ -593,6 +578,61 @@ fn failed_clipboard_paste_completion(
     }
 }
 
+/// The first step of a paste: shapes still being published are pasted
+/// directly, a failed publish is probed first, and anything else reads the
+/// system clipboard.
+fn plan_clipboard_paste_start(
+    input_state: &InputState,
+    request: ClipboardPasteRequest,
+) -> TransferPlan<PasteAction> {
+    let local_selection = input_state.selection_clipboard_snapshot();
+    let pending_shapes =
+        local_selection.shapes_for_pending_publish(request.local_selection_fallback_generation);
+    let failed_probe = local_selection
+        .failed_probe(request.local_selection_fallback_generation)
+        .map(|(generation, expected)| FailedLocalSelectionProbe {
+            generation,
+            expected,
+        });
+
+    transfer::plan_paste_start(request, pending_shapes, failed_probe)
+}
+
+/// Finishes the paste decision after a fingerprint probe, with the local
+/// fallback shapes as they are now; they must not be captured before the
+/// probe ran. A changed clipboard supersedes that fallback.
+fn continue_after_fingerprint_probe(
+    input_state: &mut InputState,
+    request: ClipboardPasteRequest,
+    generation: u64,
+    expected: Option<ClipboardFingerprint>,
+    current: Option<ClipboardFingerprint>,
+) -> PasteAction {
+    let local_shapes = input_state
+        .selection_clipboard_snapshot()
+        .shapes_for_fallback(generation);
+    let plan = transfer::plan_after_fingerprint_probe(
+        request,
+        generation,
+        expected,
+        current,
+        local_shapes,
+    );
+
+    apply_transfer_effects(input_state, plan.effects);
+    plan.action
+}
+
+fn apply_transfer_effects(input_state: &mut InputState, effects: Vec<TransferEffect>) {
+    for effect in effects {
+        match effect {
+            TransferEffect::SupersedeLocalGeneration { generation } => {
+                input_state.mark_selection_clipboard_superseded_for_generation(Some(generation))
+            }
+        }
+    }
+}
+
 fn take_pending_clipboard_paste_if_idle(
     input_state: &mut crate::input::InputState,
     clipboard_paste_active: bool,
diff --git a/src/backend/wayland/state/clipboard/probe_tests.rs b/src/backend/wayland/state/clipboard/probe_tests.rs
new file mode 100644
index 000000000..35456b2ef
--- /dev/null
+++ b/src/backend/wayland/state/clipboard/probe_tests.rs
@@ -0,0 +1,170 @@
+//! The paste decision after a failed private publish, through the same start
+//! and probe-continuation steps a paste completion uses.
+use super::*;
+use crate::config::Action;
+use crate::draw::Shape;
+use crate::input::state::test_support::make_test_input_state;
+
+fn fingerprint(hash: u64) -> ClipboardFingerprint {
+    ClipboardFingerprint {
+        offered_mime_types: vec!["image/png".to_string()],
+        selected_mime_type: Some("image/png".to_string()),
+        bounded_content_hash: Some(hash),
+        bounded_content_len: Some(4096),
+        bounded_content_truncated: true,
+    }
+}
+
+/// Copies one rectangle and records its private publish as failed, with the
+/// system clipboard fingerprint seen at the failure.
+fn copy_with_failed_publish(
+    input_state: &mut InputState,
+    x: i32,
+    at_failure: Option<ClipboardFingerprint>,
+) -> u64 {
+    let measurer = crate::draw::TextMeasurer::default();
+    let ui_engine = crate::ui_text::UiTextEngine::default();
+    let id = input_state
+        .boards
+        .active_frame_mut()
+        .add_shape(Shape::Rect {
+            x,
+            y: 20,
+            w: 100,
+            h: 80,
+            fill: false,
+            fill_color: None,
+            color: input_state.style.current_color,
+            thick: input_state.style.current_thickness,
+        });
+    input_state.set_selection(vec![id]);
+    input_state.handle_action_with_resources(
+        crate::input::state::InputTextResources {
+            measurer: &measurer,
+            ui_engine: &ui_engine,
+        },
+        Action::CopySelection,
+    );
+
+    let publish = input_state
+        .take_pending_selection_clipboard_publish()
+        .expect("pending private clipboard publish");
+    input_state.complete_selection_clipboard_publish(publish.generation, at_failure, false);
+    publish.generation
+}
+
+/// Starts a paste, which probes the system clipboard because the publish failed.
+fn start_probe(
+    input_state: &mut InputState,
+) -> (ClipboardPasteRequest, u64, Option<ClipboardFingerprint>) {
+    let request = input_state.request_clipboard_paste();
+    match plan_clipboard_paste_start(input_state, request).action {
+        PasteAction::ProbeSystemFingerprint {
+            request,
+            generation,
+            expected,
+        } => (request, generation, expected),
+        other => panic!("expected a fingerprint probe, got {other:?}"),
+    }
+}
+
+#[test]
+fn a_failed_publish_is_pasted_locally_only_while_the_system_clipboard_is_unchanged() {
+    let mut input_state = make_test_input_state();
+    copy_with_failed_publish(&mut input_state, 10, Some(fingerprint(1)));
+
+    let (request, generation, expected) = start_probe(&mut input_state);
+    let action = continue_after_fingerprint_probe(
+        &mut input_state,
+        request,
+        generation,
+        expected,
+        Some(fingerprint(1)),
+    );
+    assert!(matches!(action, PasteAction::UseLocalShapes { .. }));
+
+    let (request, generation, expected) = start_probe(&mut input_state);
+    let action = continue_after_fingerprint_probe(
+        &mut input_state,
+        request,
+        generation,
+        expected,
+        Some(fingerprint(2)),
+    );
+    assert!(matches!(action, PasteAction::ReadSystemClipboard { .. }));
+    let local = input_state.selection_clipboard_snapshot();
+    assert!(!local.fallback_allowed());
+    assert_eq!(local.fallback_generation(), None);
+}
+
+#[test]
+fn a_failed_publish_without_a_fingerprint_is_superseded_by_a_readable_clipboard() {
+    let mut input_state = make_test_input_state();
+    copy_with_failed_publish(&mut input_state, 10, None);
+
+    let (request, generation, expected) = start_probe(&mut input_state);
+    assert_eq!(expected, None);
+    let action = continue_after_fingerprint_probe(
+        &mut input_state,
+        request,
+        generation,
+        expected,
+        Some(fingerprint(1)),
+    );
+
+    assert!(matches!(action, PasteAction::ReadSystemClipboard { .. }));
+    assert!(
+        !input_state
+            .selection_clipboard_snapshot()
+            .fallback_allowed()
+    );
+}
+
+#[test]
+fn an_unreadable_clipboard_reads_the_system_clipboard_and_keeps_the_fallback() {
+    let mut input_state = make_test_input_state();
+    copy_with_failed_publish(&mut input_state, 10, None);
+
+    let (request, generation, expected) = start_probe(&mut input_state);
+    let action =
+        continue_after_fingerprint_probe(&mut input_state, request, generation, expected, None);
+
+    assert!(matches!(action, PasteAction::ReadSystemClipboard { .. }));
+    assert!(
+        input_state
+            .selection_clipboard_snapshot()
+            .fallback_allowed(),
+        "a transport failure can still fall back after the normal read"
+    );
+}
+
+#[test]
+fn a_probe_for_an_older_copy_neither_pastes_nor_supersedes_a_newer_one() {
+    let mut input_state = make_test_input_state();
+    let first = copy_with_failed_publish(&mut input_state, 10, Some(fingerprint(1)));
+    let (request, generation, expected) = start_probe(&mut input_state);
+    assert_eq!(generation, first);
+
+    let second = copy_with_failed_publish(&mut input_state, 200, Some(fingerprint(1)));
+
+    // A paste requested for the first copy no longer probes it.
+    assert!(matches!(
+        plan_clipboard_paste_start(&input_state, request.clone()).action,
+        PasteAction::ReadSystemClipboard { .. }
+    ));
+    // A probe already running for it finds nothing to paste.
+    let action = continue_after_fingerprint_probe(
+        &mut input_state,
+        request,
+        generation,
+        expected,
+        Some(fingerprint(1)),
+    );
+    assert!(matches!(action, PasteAction::ReadSystemClipboard { .. }));
+    assert_eq!(
+        input_state
+            .selection_clipboard_snapshot()
+            .fallback_generation(),
+        Some(second)
+    );
+}
diff --git a/src/backend/wayland/state/contact_owner.rs b/src/backend/wayland/state/contact_owner.rs
new file mode 100644
index 000000000..8fc11093c
--- /dev/null
+++ b/src/backend/wayland/state/contact_owner.rs
@@ -0,0 +1,142 @@
+//! The owner a held contact was bound to when its press ran.
+//!
+//! Whoever owns a press owns its motion and release, whatever is under the
+//! device later. Pointer buttons and the stylus tip record an owner for the
+//! canvas, the pans and the inline strip. A contact with no record keeps its
+//! handler's state-based path. Touch binds its sequence with `TouchTarget`.
+
+/// Who owns a held contact after its press ran.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::backend::wayland) enum ContactOwner {
+    /// The `InputState` canvas router: tools, selection, and the popups it routes.
+    Canvas,
+    /// A zoom-view pan started with the middle button.
+    ZoomPan,
+    /// A board pan started with the board-pan key held.
+    BoardPan,
+    /// The built-in strip painted on the canvas surface.
+    InlineToolbar,
+}
+
+/// Where motion goes while a contact is held.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::backend::wayland) enum ContactMotion {
+    /// Nothing recorded: the device's hover path decides.
+    Hover,
+    /// Inline-strip motion only. The canvas never sees it.
+    Toolbar,
+    ZoomPan,
+    BoardPan,
+    /// Canvas motion, also where the inline strip is painted.
+    Canvas,
+}
+
+impl ContactOwner {
+    pub(in crate::backend::wayland) fn motion(self) -> ContactMotion {
+        match self {
+            Self::Canvas => ContactMotion::Canvas,
+            Self::ZoomPan => ContactMotion::ZoomPan,
+            Self::BoardPan => ContactMotion::BoardPan,
+            Self::InlineToolbar => ContactMotion::Toolbar,
+        }
+    }
+}
+
+impl ContactMotion {
+    /// A canvas-surface gesture keeps its motion where the inline strip is
+    /// painted, and the strip shows no hover for it.
+    pub(in crate::backend::wayland) fn skips_inline_strip(self) -> bool {
+        matches!(self, Self::Canvas | Self::ZoomPan | Self::BoardPan)
+    }
+}
+
+pub(in crate::backend::wayland) fn held_motion(owner: Option<ContactOwner>) -> ContactMotion {
+    owner.map_or(ContactMotion::Hover, ContactOwner::motion)
+}
+
+/// Where a release goes once the modal, chrome and radial gates have passed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::backend::wayland) enum ReleaseRoute {
+    /// End the inline-strip interaction. The canvas never sees the release.
+    InlineToolbar,
+    /// Skip the toolbar gates: the pan or canvas handlers finish the gesture.
+    CanvasSurface,
+    /// The state-based toolbar gates decide, as before.
+    Unowned,
+}
+
+/// Layer-shell and GTK sessions pass `inline_toolbars = false`, so their
+/// canvas releases keep the state-based gates.
+pub(in crate::backend::wayland) fn release_route(
+    owner: Option<ContactOwner>,
+    inline_toolbars: bool,
+) -> ReleaseRoute {
+    match owner {
+        Some(ContactOwner::InlineToolbar) => ReleaseRoute::InlineToolbar,
+        Some(owner) if inline_toolbars && owner.motion().skips_inline_strip() => {
+            ReleaseRoute::CanvasSurface
+        }
+        _ => ReleaseRoute::Unowned,
+    }
+}
+/// What a primary press (touch, pen tip) on the canvas surface hits on the
+/// inline strip.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::backend::wayland) enum InlinePress {
+    Control,
+    /// Between controls. The strip owns it, so it never draws under the strip.
+    Strip,
+}
+
+/// `control` implies `over_strip`. The onboarding card paints above the strip
+/// body and keeps presses there. A strip control still wins, as before.
+pub(in crate::backend::wayland) fn inline_primary_press(
+    control: bool,
+    over_strip: bool,
+    onboarding_card: bool,
+) -> Option<InlinePress> {
+    if control {
+        return Some(InlinePress::Control);
+    }
+
+    (over_strip && !onboarding_card).then_some(InlinePress::Strip)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn inline_release_follows_the_press_owner() {
+        for (owner, expected) in [
+            (ContactOwner::Canvas, ReleaseRoute::CanvasSurface),
+            (ContactOwner::ZoomPan, ReleaseRoute::CanvasSurface),
+            (ContactOwner::BoardPan, ReleaseRoute::CanvasSurface),
+            (ContactOwner::InlineToolbar, ReleaseRoute::InlineToolbar),
+        ] {
+            assert_eq!(release_route(Some(owner), true), expected);
+        }
+        assert_eq!(release_route(None, true), ReleaseRoute::Unowned);
+        assert_eq!(
+            release_route(Some(ContactOwner::Canvas), false),
+            ReleaseRoute::Unowned
+        );
+        assert_eq!(
+            release_route(Some(ContactOwner::InlineToolbar), false),
+            ReleaseRoute::InlineToolbar
+        );
+    }
+
+    #[test]
+    fn primary_press_claims_strip_gaps_and_respects_the_onboarding_card() {
+        for (control, strip, card, expected) in [
+            (true, true, false, Some(InlinePress::Control)),
+            (true, true, true, Some(InlinePress::Control)),
+            (false, true, false, Some(InlinePress::Strip)),
+            (false, true, true, None),
+            (false, false, false, None),
+        ] {
+            assert_eq!(inline_primary_press(control, strip, card), expected);
+        }
+    }
+}
diff --git a/src/backend/wayland/state/core/accessors.rs b/src/backend/wayland/state/core/accessors.rs
index 8cfd13292..25a29fec1 100644
--- a/src/backend/wayland/state/core/accessors.rs
+++ b/src/backend/wayland/state/core/accessors.rs
@@ -25,7 +25,7 @@ impl WaylandState {
     ///
     /// A screen-region modal cancels the gesture the pen was making, and then
     /// consumes the tip-up the compositor still owes us — so nothing else
-    /// retires the contact. Left set, `tablet.tip_down` hides the hover cursor
+    /// retires the contact. Left held, the canvas tip owner hides the hover cursor
     /// and defers session saving until some unrelated release or proximity-out
     /// happens to clear it. The stroke was cancelled rather than finished, so
     /// its peak pressure is dropped instead of being committed to the tool.
diff --git a/src/backend/wayland/state/core/output.rs b/src/backend/wayland/state/core/output.rs
index 97ac8756f..3d39a105e 100644
--- a/src/backend/wayland/state/core/output.rs
+++ b/src/backend/wayland/state/core/output.rs
@@ -5,15 +5,8 @@ use std::time::{Duration, Instant};
 
 use super::super::*;
 use crate::{
-    backend::wayland::{
-        backend::event_loop::session_save,
-        session::{
-            self as runtime_session, PersistenceOperation, PersistenceOutcome, SaveStrategy,
-        },
-    },
-    input::state::OutputFocusAction,
-    notification,
-    session::{self, SessionSnapshot},
+    backend::wayland::backend::event_loop::session_save, input::state::OutputFocusAction,
+    notification, session,
 };
 
 mod focus;
diff --git a/src/backend/wayland/state/core/output/session_ops.rs b/src/backend/wayland/state/core/output/session_ops.rs
index b61836537..2d7681a04 100644
--- a/src/backend/wayland/state/core/output/session_ops.rs
+++ b/src/backend/wayland/state/core/output/session_ops.rs
@@ -1,7 +1,6 @@
 use super::*;
 use crate::backend::wayland::session::{
-    ExpandedTooLarge, OutputSessionLoad, apply_load_outcome, load_output_session,
-    may_save_before_output_load,
+    ExpandedTooLarge, OutputSessionLoad, commit_output_load, load_output_session,
 };
 
 impl WaylandState {
@@ -41,7 +40,7 @@ impl WaylandState {
                             .set_session_preflight_options(Some(options));
                     }
                     None => {
-                        self.session.replace_options_before_load(None);
+                        self.session.commit_without_persistence();
                         self.input_state.set_session_preflight_options(None);
                     }
                 }
@@ -59,40 +58,40 @@ impl WaylandState {
         outcome: session::LoadSnapshotOutcome,
         context: &str,
     ) -> anyhow::Result<()> {
-        let loaded_board_data = outcome.has_board_data();
-        self.handle_session_load_outcome_for_options(outcome, &options, context)?;
-        self.session
-            .commit_output_options(options, loaded_board_data);
+        if let Some(too_large) = commit_output_load(
+            &mut self.input_state,
+            self.render.text_measurer(),
+            &mut self.session,
+            options,
+            outcome,
+            context,
+        )? {
+            self.protect_too_large_session(too_large);
+        }
+        self.refresh_runtime_ui_config_seeds();
         Ok(())
     }
 
     /// The remembered session this run continues, while no session has loaded.
-    fn unloaded_remembered_session(&self) -> Option<std::path::PathBuf> {
+    pub(in crate::backend::wayland) fn unloaded_remembered_session(
+        &self,
+    ) -> Option<std::path::PathBuf> {
         self.session_home
             .remembered()
             .filter(|_| !self.session.is_loaded())
             .map(std::path::Path::to_path_buf)
     }
 
-    /// Whether `current` may be saved before an output's session loads: see
-    /// [`may_save_before_output_load`].
-    pub(super) fn may_save_before_output_load(
-        &mut self,
-        current: &session::SessionOptions,
-    ) -> anyhow::Result<bool> {
-        let remembered = self.unloaded_remembered_session();
-        may_save_before_output_load(current, remembered.as_deref(), |operation| {
-            session_save::run_persistence_operation(self, operation)
-        })
-    }
-
     /// After a launch-time session load, announce ink restored onto the
     /// transparent overlay board, once per launch. With per-output sessions
     /// the ink arrives with the first output transition rather than the
     /// initial load, so both report here; later output or named-session
     /// switches stay quiet. Overlays the daemon reopens on a toggle show what
     /// the user just had on screen, so they stay quiet too.
-    pub(super) fn announce_launch_restore(&mut self, first_output_resolved: bool) {
+    pub(in crate::backend::wayland::state) fn announce_launch_restore(
+        &mut self,
+        first_output_resolved: bool,
+    ) {
         if self.session.launch_restore_notice_settled() {
             return;
         }
@@ -113,7 +112,16 @@ impl WaylandState {
         }
     }
 
-    pub(super) fn notify_output_transition_deferred(&mut self) {
+    pub(in crate::backend::wayland) fn notify_session_load_failure(
+        &mut self,
+        error: &anyhow::Error,
+    ) {
+        if self.session.mark_output_transition_notified() {
+            self.input_state.push_toast(ToastPriority::Critical, "session.load", Toast::error(format!("Session could not be loaded: {error:#}. Repair the session files or use Save As to keep new drawings elsewhere.")).duration_ms(20_000));
+        }
+    }
+
+    pub(in crate::backend::wayland::state) fn notify_output_transition_deferred(&mut self) {
         if !self.session.mark_output_transition_notified() {
             return;
         }
@@ -121,34 +129,17 @@ impl WaylandState {
         self.input_state.needs_redraw = true;
     }
 
-    pub(super) fn output_transition_failure_backoff(&self) -> Duration {
+    pub(in crate::backend::wayland::state) fn output_transition_failure_backoff(&self) -> Duration {
         self.session_options()
             .map_or(Duration::from_secs(1), |options| {
                 options.autosave_failure_backoff
             })
     }
 
-    pub(in crate::backend::wayland::state) fn handle_session_load_outcome_for_options(
+    pub(in crate::backend::wayland::state) fn protect_too_large_session(
         &mut self,
-        outcome: session::LoadSnapshotOutcome,
-        options: &session::SessionOptions,
-        context: &str,
-    ) -> anyhow::Result<()> {
-        if let Some(too_large) = apply_load_outcome(
-            &mut self.input_state,
-            self.render.text_measurer(),
-            outcome,
-            options,
-            context,
-        )? {
-            self.protect_too_large_session(too_large);
-        }
-        self.refresh_runtime_ui_config_seeds();
-        self.mark_clean_after_session_load();
-        Ok(())
-    }
-
-    fn protect_too_large_session(&mut self, too_large: ExpandedTooLarge) {
+        too_large: ExpandedTooLarge,
+    ) {
         let ExpandedTooLarge {
             path,
             max_expanded_size,
@@ -167,71 +158,6 @@ impl WaylandState {
             );
         }
     }
-
-    fn mark_clean_after_session_load(&mut self) {
-        self.input_state.clear_session_dirty();
-        self.session.mark_clean_after_load();
-    }
-
-    pub(super) fn should_skip_protected_session_save(
-        &self,
-        options: &session::SessionOptions,
-    ) -> bool {
-        let session_path = options.session_file_path();
-        let skip = self.session.should_skip_save_for_protected_path(
-            &session_path,
-            self.input_state.is_session_dirty(),
-        );
-        if skip {
-            info!(
-                "Skipping session save to {} because a previous oversized compressed session was left protected and no session changes have been made",
-                session_path.display()
-            );
-        }
-        skip
-    }
-
-    pub(super) fn should_skip_unloaded_contentless_session_save(
-        &mut self,
-        options: &session::SessionOptions,
-        snapshot: Option<&SessionSnapshot>,
-    ) -> anyhow::Result<bool> {
-        let has_board_data = snapshot.is_some_and(SessionSnapshot::has_board_data);
-        if has_board_data
-            || self.session.has_loaded_board_data()
-            || self.session.is_dirty()
-            || self.input_state.is_session_dirty()
-        {
-            return Ok(false);
-        }
-        let outcome = session_save::run_persistence_operation(
-            self,
-            PersistenceOperation::HasArtifacts {
-                options: options.clone(),
-            },
-        )?;
-        let PersistenceOutcome::HasArtifacts(has_artifacts) = outcome else {
-            return Err(anyhow::anyhow!("unexpected artifact-inspection outcome"));
-        };
-        let skip = runtime_session::should_skip_unloaded_contentless_save(
-            self.session.has_loaded_board_data(),
-            self.session.is_dirty(),
-            self.input_state.is_session_dirty(),
-            has_board_data,
-            has_artifacts,
-        );
-        if skip {
-            info!(
-                "Skipping session save to {} because no session was loaded, no session changes were recorded, and the current snapshot has no board data",
-                options.session_file_path().display()
-            );
-        }
-        Ok(skip)
-    }
-
-    pub(super) fn session_persistence_enabled(options: &session::SessionOptions) -> bool {
-        options.any_enabled() || options.restore_tool_state || options.persist_history
-    }
 }
 
 /// What one launch-time load does about the restored-ink notice.
diff --git a/src/backend/wayland/state/core/output/tests.rs b/src/backend/wayland/state/core/output/tests.rs
index d933b05f9..fcddf2f7c 100644
--- a/src/backend/wayland/state/core/output/tests.rs
+++ b/src/backend/wayland/state/core/output/tests.rs
@@ -182,74 +182,7 @@ fn unloaded_dirty_source_with_nonmatching_pending_transition_resolves_before_loa
 }
 
 #[test]
-fn unloaded_dirty_return_to_current_target_blocks_followup_configure_load() {
-    let mut options = SessionOptions::new(PathBuf::from("/tmp"), "source-output");
-    options.per_output = true;
-    let mut destination = options.clone();
-    destination.set_output_identity(Some("output-a"));
-    let mut session = SessionState::new(Some(options.clone()));
-    session.stage_output_transition(destination, Some("output-a".to_string()), Instant::now());
-    session.record_input_dirty(Instant::now(), true);
-    let source_epoch = session.target_epoch();
-    let edit_generation = session.edit_generation();
-
-    let incoming_identity = None;
-    let mut incoming = options.clone();
-    let changed = incoming.set_output_identity(incoming_identity);
-    let same_epoch_pending = session
-        .pending_output_transition()
-        .is_some_and(|pending| pending.source_epoch == source_epoch);
-    let matching_pending = same_epoch_pending
-        && session
-            .pending_output_transition()
-            .is_some_and(|pending| pending.physical_output_identity.is_none());
-    let start = output_transition_start(
-        session.is_loaded(),
-        changed,
-        matching_pending,
-        same_epoch_pending,
-        false,
-        false,
-    );
-
-    assert!(!session.is_loaded());
-    assert!(!changed);
-    assert!(!matching_pending);
-    assert_eq!(start, OutputTransitionStart::IgnoreCurrentTarget);
-    assert!(
-        session
-            .cancel_output_transition_for_live_source(false)
-            .is_some()
-    );
-    assert!(session.pending_output_transition().is_none());
-    assert!(session.is_loaded());
-    assert!(session.is_dirty());
-    assert!(session.prepare_autosave_submission().is_ok());
-    assert_eq!(session.target_epoch(), source_epoch);
-    assert_eq!(session.edit_generation(), edit_generation);
-
-    let mut configure_options = options;
-    let configure_changed = configure_options.set_output_identity(None);
-    let followup = output_transition_start(
-        session.is_loaded(),
-        configure_changed,
-        false,
-        false,
-        false,
-        false,
-    );
-
-    assert!(!configure_changed);
-    assert_eq!(followup, OutputTransitionStart::IgnoreCurrentTarget);
-    assert_ne!(followup, OutputTransitionStart::LoadInitial);
-    assert!(session.is_dirty());
-    assert!(session.prepare_autosave_submission().is_ok());
-    assert_eq!(session.target_epoch(), source_epoch);
-    assert_eq!(session.edit_generation(), edit_generation);
-}
-
-#[test]
-fn active_stroke_return_resolves_to_dirty_live_source_or_clean_initial_load() {
+fn active_stroke_return_keeps_an_unloaded_dirty_source_protected() {
     let mut options = SessionOptions::new(PathBuf::from("/tmp"), "source-output");
     options.per_output = true;
     let mut destination = options.clone();
@@ -268,7 +201,7 @@ fn active_stroke_return_resolves_to_dirty_live_source_or_clean_initial_load() {
     );
     assert!(
         committed
-            .cancel_output_transition_for_live_source(false)
+            .cancel_output_transition_for_live_source()
             .is_some()
     );
     assert!(!committed.is_loaded());
@@ -279,9 +212,9 @@ fn active_stroke_return_resolves_to_dirty_live_source_or_clean_initial_load() {
     );
 
     committed.record_input_dirty(Instant::now(), true);
-    assert!(committed.is_loaded());
+    assert!(!committed.is_loaded());
     assert!(committed.is_dirty());
-    assert!(!committed.resolve_live_source_resolution(false, false));
+    assert!(committed.resolve_live_source_resolution(false, false));
     assert_eq!(committed.target_epoch(), committed_epoch);
     assert_eq!(
         output_transition_start(true, false, false, false, false, false),
@@ -296,18 +229,18 @@ fn active_stroke_return_resolves_to_dirty_live_source_or_clean_initial_load() {
     );
     assert!(
         configure_first
-            .cancel_output_transition_for_live_source(false)
+            .cancel_output_transition_for_live_source()
             .is_some()
     );
-    assert!(!configure_first.resolve_live_source_resolution(true, false));
-    assert!(configure_first.is_loaded());
+    assert!(configure_first.resolve_live_source_resolution(true, false));
+    assert!(!configure_first.is_loaded());
 
     let mut canceled = SessionState::new(Some(options));
     canceled.stage_output_transition(destination, Some("output-a".to_string()), Instant::now());
     let canceled_epoch = canceled.target_epoch();
     assert!(
         canceled
-            .cancel_output_transition_for_live_source(false)
+            .cancel_output_transition_for_live_source()
             .is_some()
     );
     assert!(!canceled.resolve_live_source_resolution(false, false));
@@ -335,11 +268,7 @@ fn clean_unloaded_cancellation_arms_immediate_source_resolution() {
     let mut session = SessionState::new(Some(options.clone()));
     session.stage_output_transition(options, Some("output-a".to_string()), Instant::now());
 
-    assert!(
-        session
-            .cancel_output_transition_for_live_source(false)
-            .is_some()
-    );
+    assert!(session.cancel_output_transition_for_live_source().is_some());
     assert!(session.has_pending_live_source_resolution());
     assert!(live_source_reconciliation_ready(true, false, false, true));
     assert!(!session.resolve_live_source_resolution(false, false));
@@ -354,18 +283,14 @@ fn clean_unloaded_cancellation_arms_immediate_source_resolution() {
 #[test]
 fn loaded_source_cancellation_does_not_arm_provisional_resolution() {
     let mut session = SessionState::new(None);
-    session.mark_loaded(false);
+    session.commit_without_persistence();
     session.stage_output_transition(
         SessionOptions::new(PathBuf::from("/tmp"), "loaded-destination"),
         Some("output-a".to_string()),
         Instant::now(),
     );
 
-    assert!(
-        session
-            .cancel_output_transition_for_live_source(false)
-            .is_some()
-    );
+    assert!(session.cancel_output_transition_for_live_source().is_some());
     assert!(session.is_loaded());
     assert!(!session.has_pending_live_source_resolution());
 }
diff --git a/src/backend/wayland/state/core/output/transition.rs b/src/backend/wayland/state/core/output/transition.rs
index e7253f6ef..8e427420b 100644
--- a/src/backend/wayland/state/core/output/transition.rs
+++ b/src/backend/wayland/state/core/output/transition.rs
@@ -1,4 +1,7 @@
 use super::*;
+use crate::backend::wayland::session::{
+    SessionCommand, SourceWriteRefused, interaction_defer_interval,
+};
 
 impl WaylandState {
     pub(in crate::backend::wayland) fn begin_session_output_transition(
@@ -36,12 +39,12 @@ impl WaylandState {
             interaction_active,
         );
 
-        let retry_at = Instant::now() + session_save::interaction_defer_interval();
+        let retry_at = Instant::now() + interaction_defer_interval();
         match start {
             OutputTransitionStart::IgnoreCurrentTarget => {
                 if self
                     .session
-                    .cancel_output_transition_for_live_source(input_dirty)
+                    .cancel_output_transition_for_live_source()
                     .is_some()
                 {
                     log::info!(
@@ -61,31 +64,48 @@ impl WaylandState {
                     physical_output_identity,
                     retry_at,
                 );
-                self.notify_output_transition_deferred();
+                if self.session.is_loaded() {
+                    self.notify_output_transition_deferred();
+                }
             }
-            OutputTransitionStart::LoadInitial => {
-                match self.load_configured_session_for_options(
+            OutputTransitionStart::LoadInitial if self.session.begin_initial_load() => {
+                // This callback blocks one initial load, but earlier callbacks
+                // may have delivered ink. Keep that ink instead of replacing it.
+                if self.session.is_dirty() || self.input_state.is_session_dirty() {
+                    self.session.stage_output_transition(
+                        staged_options,
+                        physical_output_identity,
+                        output_transition_retry_at(self.output_transition_failure_backoff()),
+                    );
+                    self.input_state.push_toast(
+                        ToastPriority::Critical,
+                        "session.load",
+                        Toast::warning(format!(
+                            "Drawings kept on screen: {}",
+                            SourceWriteRefused::NotLoaded
+                        )),
+                    );
+                    return;
+                }
+                let first_output_resolved =
+                    !staged_options.per_output || staged_options.output_identity().is_some();
+                if let Err(err) = self.load_configured_session_for_options(
                     staged_options.clone(),
                     physical_output_identity.as_deref(),
                     "initial output load",
                 ) {
-                    // A load that already knows its output is the output's
-                    // own session, so it settles the launch notice as well.
-                    Ok(()) => {
-                        self.announce_launch_restore(staged_options.output_identity().is_some())
-                    }
-                    Err(err) => {
-                        warn!("Failed to load initial output session: {err:#}");
-                        self.session.stage_output_transition(
-                            staged_options,
-                            physical_output_identity,
-                            output_transition_retry_at(self.output_transition_failure_backoff()),
-                        );
-                        self.notify_output_transition_deferred();
-                    }
+                    warn!("Initial session load failed: {err:#}");
+                    self.session.stage_output_transition(
+                        staged_options,
+                        physical_output_identity,
+                        output_transition_retry_at(self.output_transition_failure_backoff()),
+                    );
+                    self.notify_session_load_failure(&err);
+                } else {
+                    self.announce_launch_restore(first_output_resolved);
                 }
             }
-            OutputTransitionStart::ResolveTransition => {
+            OutputTransitionStart::LoadInitial | OutputTransitionStart::ResolveTransition => {
                 if let Err(err) = self.run_output_transition(
                     staged_options.clone(),
                     physical_output_identity.clone(),
@@ -126,12 +146,12 @@ impl WaylandState {
         }
         if self.session_transaction.is_some() || session_save::should_defer_for_interaction(self) {
             self.session
-                .defer_output_transition(now, session_save::interaction_defer_interval());
+                .defer_output_transition(now, interaction_defer_interval());
             log::debug!("Deferring pending output transition while interaction is active");
             return Ok(true);
         }
 
-        let Some(pending) = self.session.take_pending_output_transition() else {
+        let Some(pending) = self.session.pending_output_transition().cloned() else {
             return Ok(false);
         };
         if let Err(err) = self.run_output_transition(
@@ -192,6 +212,23 @@ impl WaylandState {
             return false;
         }
 
+        if self.session.is_dirty() || self.input_state.is_session_dirty() {
+            if let Some(mut options) = self.session.options().cloned() {
+                let identity = self
+                    .surface
+                    .current_output()
+                    .as_ref()
+                    .and_then(|output| self.output_identity_for(output));
+                options.set_output_identity(identity.as_deref());
+                self.session.stage_output_transition(
+                    options,
+                    identity,
+                    Instant::now() + self.output_transition_failure_backoff(),
+                );
+            }
+            return false;
+        }
+
         log::info!(
             "Resolving live source after output-transition cancellation ({reason}, epoch={})",
             self.session.target_epoch()
@@ -221,75 +258,54 @@ impl WaylandState {
         // instead of being dropped with the frame it belonged to.
         self.input_state.flush_spotlight_magnification_gesture();
         self.spotlight.clear_wheel_idle_deadline();
-        session_save::persistence_barrier(self)?;
-        let current_options = self
-            .session_options()
-            .cloned()
-            .ok_or_else(|| anyhow::anyhow!("output transition has no active session options"))?;
-        if self.may_save_before_output_load(&current_options)? {
-            self.persist_current_session_for_transition(&current_options, reason)?;
-        }
-
-        self.load_configured_session_for_options(
-            staged_options,
-            physical_output_identity.as_deref(),
-            "output load",
-        )?;
-        info!(
-            "Committed logical session output transition after {} (physical_output_identity={:?}, epoch={})",
-            reason,
-            physical_output_identity,
-            self.session.target_epoch()
-        );
-        self.announce_launch_restore(true);
-        Ok(())
-    }
-
-    fn persist_current_session_for_transition(
-        &mut self,
-        options: &session::SessionOptions,
-        reason: &str,
-    ) -> anyhow::Result<()> {
-        if self.should_skip_protected_session_save(options) {
-            return Ok(());
+        if !self
+            .session
+            .pending_output_transition()
+            .is_some_and(|pending| {
+                pending.physical_output_identity == physical_output_identity
+                    && pending.staged_options.session_file_path()
+                        == staged_options.session_file_path()
+            })
+        {
+            self.session.stage_output_transition(
+                staged_options,
+                physical_output_identity.clone(),
+                Instant::now(),
+            );
         }
-        let snapshot = self
-            .input_state
-            .snapshot_for_persistence_with(self.render.text_measurer(), options);
-        if self.should_skip_unloaded_contentless_session_save(options, snapshot.as_ref())? {
+        let transition = self
+            .session
+            .pending_output_transition()
+            .expect("staged output transition")
+            .clone();
+        let remembered = self.unloaded_remembered_session();
+        let home = self
+            .session_home
+            .options_for_output(physical_output_identity.as_deref())
+            .map(Box::new);
+        let leaves_placeholder = physical_output_identity.is_some()
+            && self.session_options().is_some_and(|current| {
+                current.per_output
+                    && current.output_identity().is_none()
+                    && !current.is_named_file()
+            });
+        self.start_session_command(SessionCommand::Output {
+            transition: Box::new(transition),
+            remembered,
+            home,
+        })?;
+        if self.session_transaction.is_none() {
             return Ok(());
         }
-        let snapshot = if let Some(snapshot) = snapshot {
-            snapshot
-        } else if Self::session_persistence_enabled(options) {
-            SessionSnapshot {
-                active_board_id: self.input_state.board_id().to_string(),
-                boards: Vec::new(),
-                tool_state: None,
-            }
-        } else {
-            return Ok(());
-        };
-        let outcome = session_save::run_persistence_operation(
-            self,
-            PersistenceOperation::Save {
-                snapshot,
-                options: options.clone(),
-                strategy: SaveStrategy::Normal,
-                contentless_clear_boundary: self.session.has_loaded_board_data(),
-            },
-        )?;
-        let PersistenceOutcome::Save(save) = outcome else {
-            return Err(anyhow::anyhow!("unexpected output-save worker outcome"));
-        };
-        if !save.committed() {
-            return Err(anyhow::anyhow!(
-                "required session save before {reason} produced no committed write"
-            ));
+        if leaves_placeholder {
+            // A per-output session loads a placeholder without an output name
+            // until the surface enters one. Leaving it is part of startup, so
+            // it runs to completion as the first load does: the user never
+            // draws into a placeholder whose output session is still loading.
+            info!("Resolving the first output session after {reason}");
+            return self.finish_session_command_blocking();
         }
-        self.session
-            .mark_saved(Instant::now(), save.committed_board_data);
-        info!("Persisted active logical target before {reason}");
+        info!("Started nonblocking output transition after {reason}");
         Ok(())
     }
 }
diff --git a/src/backend/wayland/state/core/session.rs b/src/backend/wayland/state/core/session.rs
index a1d0a025c..6770aba16 100644
--- a/src/backend/wayland/state/core/session.rs
+++ b/src/backend/wayland/state/core/session.rs
@@ -5,8 +5,8 @@ use crate::backend::wayland::backend::event_loop::session_save::{
     handle_autosave_failure, handle_persistence_transport_failure, report_autosave_success,
 };
 use crate::backend::wayland::session::{
-    ExplicitSessionTransaction, PersistenceController, SaveCompletion, SessionCommand,
-    SessionCommandReport, SessionTransaction,
+    PersistenceController, SaveCompletion, SessionCommand, SessionCommandReport,
+    SessionCommandTransaction, SessionTransaction,
     driver::{self, SessionCommandRuntime},
 };
 use crate::session::ToolStateSnapshot;
@@ -21,7 +21,7 @@ impl SessionCommandRuntime for WaylandState {
         }
     }
 
-    fn pending_command(&mut self) -> &mut Option<ExplicitSessionTransaction> {
+    fn pending_command(&mut self) -> &mut Option<SessionCommandTransaction> {
         &mut self.session_transaction
     }
 
@@ -37,6 +37,10 @@ impl SessionCommandRuntime for WaylandState {
         self.refresh_runtime_ui_config_seeds();
     }
 
+    fn session_command_queued(&mut self) {
+        self.input_state.push_toast(crate::input::state::ToastPriority::Action, "session.command", crate::input::state::Toast::info("Session command queued for the visible session. If the session changes, retry it on the intended session."));
+    }
+
     fn session_target_committed(&mut self) {
         self.report_session_to_daemon();
     }
@@ -49,6 +53,14 @@ impl SessionCommandRuntime for WaylandState {
         WaylandState::fail_session_command(self, command, error);
     }
 
+    fn fail_queued_commands(
+        &mut self,
+        failures: Vec<(SessionCommand, anyhow::Error)>,
+        closing: bool,
+    ) {
+        WaylandState::fail_queued_session_commands(self, failures, closing);
+    }
+
     fn session_transport_failed(&mut self, error: &anyhow::Error) {
         handle_persistence_transport_failure(self, Instant::now(), error);
     }
@@ -75,6 +87,16 @@ impl WaylandState {
         driver::poll_pending_session_command(self);
     }
 
+    /// Runs the pending command and any queued behind it to completion,
+    /// blocking dispatch, as startup and shutdown do.
+    pub(in crate::backend::wayland) fn finish_session_command_blocking(&mut self) -> Result<()> {
+        let finished = driver::finish_pending_session_command(self);
+        if let Err(error) = &finished {
+            driver::fail_pending_commands(self, error);
+        }
+        finished
+    }
+
     pub(in crate::backend::wayland) fn handle_clear_saved_tool_state_action(&mut self) {
         let command =
             SessionCommand::ClearTools(Box::new(ToolStateSnapshot::from_config(&self.config)));
diff --git a/src/backend/wayland/state/input_actions.rs b/src/backend/wayland/state/input_actions.rs
index 65fc49ef2..9ae81e08c 100644
--- a/src/backend/wayland/state/input_actions.rs
+++ b/src/backend/wayland/state/input_actions.rs
@@ -128,7 +128,7 @@ impl WaylandState {
             return;
         }
 
-        if self.tablet.tip_down {
+        if self.tablet.is_canvas_gesture() {
             self.record_stylus_peak(self.input_state.style.current_thickness);
         } else {
             self.tablet.peak_thickness = None;
diff --git a/src/backend/wayland/state/onboarding/card.rs b/src/backend/wayland/state/onboarding/card.rs
index d4c641b9b..616bcb80a 100644
--- a/src/backend/wayland/state/onboarding/card.rs
+++ b/src/backend/wayland/state/onboarding/card.rs
@@ -67,8 +67,16 @@ impl OnboardingCardChrome {
     }
 
     #[cfg(feature = "tablet-input")]
-    pub(in crate::backend::wayland) fn set_stylus_press(&mut self, press: OnboardingCardPress) {
+    pub(in crate::backend::wayland) fn accept_stylus_press(
+        &mut self,
+        visible: bool,
+        position: (f64, f64),
+    ) -> bool {
+        let Some(press) = self.press_at(visible, position.0, position.1) else {
+            return false;
+        };
         self.stylus_press = Some(press);
+        true
     }
 
     #[cfg(feature = "tablet-input")]
@@ -259,7 +267,7 @@ mod tests {
     #[test]
     fn the_stylus_press_is_taken_once() {
         let mut chrome = chrome_with_card();
-        chrome.set_stylus_press(OnboardingCardPress::Body);
+        assert!(chrome.accept_stylus_press(true, (110.0, 60.0)));
 
         assert_eq!(chrome.take_stylus_press(), Some(OnboardingCardPress::Body));
         assert_eq!(chrome.take_stylus_press(), None);
diff --git a/src/backend/wayland/state/onboarding/first_run.rs b/src/backend/wayland/state/onboarding/first_run.rs
index b2eb4cc12..1643ab2b8 100644
--- a/src/backend/wayland/state/onboarding/first_run.rs
+++ b/src/backend/wayland/state/onboarding/first_run.rs
@@ -195,7 +195,7 @@ impl WaylandState {
             && self.first_run_onboarding_card_visible()
     }
 
-    pub(super) fn first_run_onboarding_card_visible(&self) -> bool {
+    pub(in crate::backend::wayland) fn first_run_onboarding_card_visible(&self) -> bool {
         if !self.first_run_guidance_allowed()
             || !self.surface.is_configured()
             || self.suppression.suppressed()
diff --git a/src/backend/wayland/state/pointer_runtime.rs b/src/backend/wayland/state/pointer_runtime.rs
index 73d735371..270634f0d 100644
--- a/src/backend/wayland/state/pointer_runtime.rs
+++ b/src/backend/wayland/state/pointer_runtime.rs
@@ -1,3 +1,5 @@
+use super::contact_owner::{ContactMotion, ContactOwner, held_motion};
+use contacts::PointerContacts;
 use log::warn;
 use smithay_client_toolkit::seat::pointer::{CursorIcon, PointerData, ThemedPointer};
 use wayland_client::{
@@ -15,6 +17,12 @@ use crate::{
     ui::{OnboardingCardPress, ZoomChipPress},
 };
 
+mod chrome;
+mod contacts;
+mod touch;
+use chrome::PendingChromePress;
+use touch::TouchState;
+
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub(in crate::backend::wayland) enum TouchTarget {
     #[default]
@@ -31,58 +39,6 @@ pub(in crate::backend::wayland) struct TouchEnd {
     pub(in crate::backend::wayland) target: TouchTarget,
 }
 
-#[derive(Clone, Copy, Debug, Default)]
-struct TouchState {
-    active_id: Option<i32>,
-    target: TouchTarget,
-    last_position: Option<(f64, f64)>,
-}
-
-impl TouchState {
-    fn begin(&mut self, id: i32, position: (f64, f64), target: TouchTarget) -> bool {
-        if self.active_id.is_some() {
-            return false;
-        }
-        self.active_id = Some(id);
-        self.target = target;
-        self.last_position = Some(position);
-        true
-    }
-
-    fn update_position(&mut self, id: i32, position: (f64, f64)) -> bool {
-        if self.active_id != Some(id) {
-            return false;
-        }
-        self.last_position = Some(position);
-        true
-    }
-
-    fn end(&mut self, id: i32) -> Option<((f64, f64), TouchTarget)> {
-        if self.active_id != Some(id) {
-            return None;
-        }
-        self.cancel()
-    }
-
-    fn cancel(&mut self) -> Option<((f64, f64), TouchTarget)> {
-        let end = self.last_position.map(|position| (position, self.target));
-        self.clear();
-        end
-    }
-
-    fn set_target(&mut self, target: TouchTarget) {
-        if self.active_id.is_some() {
-            self.target = target;
-        }
-    }
-
-    fn clear(&mut self) {
-        self.active_id = None;
-        self.target = TouchTarget::None;
-        self.last_position = None;
-    }
-}
-
 #[derive(Debug, Clone, Copy, Default)]
 struct BoardPanGesture {
     panning: bool,
@@ -139,78 +95,6 @@ impl ReleaseSuppression {
     }
 }
 
-#[derive(Debug, Clone, Copy, Default)]
-struct PendingChromePress {
-    toast: Option<ToastPress>,
-    status_hud: bool,
-    zoom_chip: ZoomChipPress,
-    onboarding_card: Option<OnboardingCardPress>,
-}
-
-impl PendingChromePress {
-    fn occupied(&self) -> bool {
-        self.toast.is_some()
-            || self.status_hud
-            || self.zoom_chip.is_pending()
-            || self.onboarding_card.is_some()
-    }
-
-    fn clear(&mut self) {
-        self.toast = None;
-        self.status_hud = false;
-        self.zoom_chip = ZoomChipPress::None;
-        self.onboarding_card = None;
-    }
-
-    fn arm_toast(&mut self, press: ToastPress) -> bool {
-        if self.occupied() {
-            return false;
-        }
-        self.toast = Some(press);
-        true
-    }
-
-    fn take_toast(&mut self) -> Option<ToastPress> {
-        self.toast.take()
-    }
-
-    fn arm_status_hud(&mut self) -> bool {
-        if self.occupied() {
-            return false;
-        }
-        self.status_hud = true;
-        true
-    }
-
-    fn take_status_hud(&mut self) -> bool {
-        std::mem::take(&mut self.status_hud)
-    }
-
-    fn arm_zoom_chip(&mut self, press: ZoomChipPress) -> bool {
-        if self.occupied() || !press.is_pending() {
-            return false;
-        }
-        self.zoom_chip = press;
-        true
-    }
-
-    fn take_zoom_chip(&mut self) -> ZoomChipPress {
-        std::mem::replace(&mut self.zoom_chip, ZoomChipPress::None)
-    }
-
-    fn arm_onboarding_card(&mut self, press: OnboardingCardPress) -> bool {
-        if self.occupied() {
-            return false;
-        }
-        self.onboarding_card = Some(press);
-        true
-    }
-
-    fn take_onboarding_card(&mut self) -> Option<OnboardingCardPress> {
-        self.onboarding_card.take()
-    }
-}
-
 /// Pointer, cursor, pointer-lock, and single-contact touch protocol runtime.
 pub(in crate::backend::wayland) struct PointerRuntime {
     themed_pointer: Option<ThemedPointer<PointerData>>,
@@ -224,6 +108,7 @@ pub(in crate::backend::wayland) struct PointerRuntime {
     cursor_hidden: bool,
     position: (i32, i32),
     board_pan: BoardPanGesture,
+    contacts: PointerContacts,
     chrome_press: PendingChromePress,
     release_suppression: ReleaseSuppression,
 }
@@ -241,11 +126,51 @@ impl PointerRuntime {
             cursor_hidden: false,
             position: (0, 0),
             board_pan: BoardPanGesture::default(),
+            contacts: PointerContacts::default(),
             chrome_press: PendingChromePress::default(),
             release_suppression: ReleaseSuppression::default(),
         }
     }
 
+    pub(in crate::backend::wayland) fn bind_contact(&mut self, button: u32, owner: ContactOwner) {
+        self.contacts.bind(button, owner);
+    }
+
+    pub(in crate::backend::wayland) fn route_canvas_press(
+        &mut self,
+        input: &mut crate::input::InputState,
+        resources: crate::input::state::InputTextResources<'_>,
+        button: u32,
+        mouse_button: crate::input::MouseButton,
+        [sx, sy, wx, wy]: [i32; 4],
+    ) {
+        let outcome =
+            input.on_mouse_press_with_canvas_and_resources(resources, mouse_button, sx, sy, wx, wy);
+        self.contacts.bind_canvas(button, outcome, input);
+    }
+
+    pub(in crate::backend::wayland) fn take_contact(
+        &mut self,
+        button: u32,
+        input: &crate::input::InputState,
+    ) -> Option<(ContactOwner, bool)> {
+        self.contacts.take(button, input)
+    }
+
+    pub(in crate::backend::wayland) fn reconcile_contacts(
+        &mut self,
+        input: &crate::input::InputState,
+        zoom_pan: bool,
+        toolbar_drag: bool,
+    ) {
+        self.contacts
+            .reconcile(input, zoom_pan, self.board_pan.panning, toolbar_drag);
+    }
+
+    pub(in crate::backend::wayland) fn contact_motion(&self) -> ContactMotion {
+        held_motion(self.contacts.motion_owner())
+    }
+
     pub(in crate::backend::wayland) fn attach_pointer(
         &mut self,
         pointer: ThemedPointer<PointerData>,
@@ -256,6 +181,7 @@ impl PointerRuntime {
 
     pub(in crate::backend::wayland) fn detach_pointer(&mut self) {
         self.themed_pointer = None;
+        self.contacts.clear();
         self.reset_cursor_cache();
     }
 
@@ -538,252 +464,4 @@ impl PointerRuntime {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::{PendingChromePress, PointerRuntime, TouchState, TouchTarget};
-    use crate::{
-        input::state::{RegionInputSource, ToastPress},
-        ui::{OnboardingCardPress, ZoomChipPress},
-    };
-    use smithay_client_toolkit::seat::pointer::CursorIcon;
-
-    #[test]
-    fn pointer_attachment_reset_clears_shape_and_hidden_state() {
-        let mut runtime = PointerRuntime::new();
-        runtime.current_pointer_shape = Some(CursorIcon::Crosshair);
-        runtime.cursor_hidden = true;
-
-        runtime.reset_cursor_cache();
-
-        assert_eq!(runtime.current_pointer_shape, None);
-        assert!(!runtime.cursor_hidden);
-    }
-
-    #[test]
-    fn hide_and_show_transitions_are_idempotent() {
-        let mut runtime = PointerRuntime::new();
-
-        assert!(runtime.mark_cursor_hidden());
-        assert!(!runtime.mark_cursor_hidden());
-        assert!(runtime.show_cursor());
-        assert!(!runtime.show_cursor());
-    }
-
-    #[test]
-    fn active_touch_rejects_a_second_contact_and_foreign_end() {
-        let mut touch = TouchState::default();
-        assert!(touch.begin(7, (10.0, 20.0), TouchTarget::Canvas));
-        assert!(!touch.begin(8, (30.0, 40.0), TouchTarget::Toolbar));
-        assert_eq!(touch.end(8), None);
-        assert_eq!(touch.end(7), Some(((10.0, 20.0), TouchTarget::Canvas)));
-        assert_eq!(touch.end(7), None);
-    }
-
-    #[test]
-    fn active_touch_updates_only_the_owned_contact() {
-        let mut touch = TouchState::default();
-        assert!(touch.begin(7, (10.0, 20.0), TouchTarget::Canvas));
-
-        assert!(!touch.update_position(8, (30.0, 40.0)));
-        assert!(touch.update_position(7, (50.0, 60.0)));
-        assert_eq!(touch.end(7), Some(((50.0, 60.0), TouchTarget::Canvas)));
-    }
-
-    #[test]
-    fn chrome_press_priority_keeps_the_first_target() {
-        let mut press = PendingChromePress::default();
-        let toast = ToastPress::body(7);
-
-        assert!(press.arm_toast(toast));
-        assert!(!press.arm_status_hud());
-        assert!(!press.arm_zoom_chip(ZoomChipPress::Passive));
-        assert_eq!(press.take_toast(), Some(toast));
-        assert_eq!(press.take_toast(), None);
-    }
-
-    #[test]
-    fn an_onboarding_card_press_is_owned_until_its_release_takes_it() {
-        let mut runtime = PointerRuntime::new();
-
-        assert!(runtime.arm_onboarding_card_press(OnboardingCardPress::Body));
-        assert!(!runtime.arm_toast_press(ToastPress::body(7)));
-        assert_eq!(
-            runtime.take_onboarding_card_press(),
-            Some(OnboardingCardPress::Body)
-        );
-        assert_eq!(runtime.take_onboarding_card_press(), None);
-
-        assert!(runtime.arm_onboarding_card_press(OnboardingCardPress::Body));
-        runtime.clear_chrome_press();
-        assert_eq!(runtime.take_onboarding_card_press(), None);
-    }
-
-    #[test]
-    fn clearing_chrome_press_preserves_both_release_latches() {
-        let mut runtime = PointerRuntime::new();
-        assert!(runtime.arm_status_hud_press());
-        runtime.suppress_release(RegionInputSource::Pointer);
-        runtime.suppress_release(RegionInputSource::Touch);
-
-        runtime.clear_chrome_press();
-        assert!(!runtime.take_status_hud_press());
-
-        assert!(runtime.arm_toast_press(ToastPress::body(7)));
-        runtime.clear_chrome_press();
-        assert_eq!(runtime.take_toast_press(), None);
-
-        assert!(runtime.arm_zoom_chip_press(ZoomChipPress::Passive));
-        runtime.clear_chrome_press();
-        assert_eq!(runtime.take_zoom_chip_press(), ZoomChipPress::None);
-        assert!(runtime.take_suppressed_release(RegionInputSource::Pointer));
-        assert!(runtime.take_suppressed_release(RegionInputSource::Touch));
-    }
-
-    #[test]
-    fn release_suppression_is_owned_by_its_source() {
-        let mut runtime = PointerRuntime::new();
-        runtime.suppress_release(RegionInputSource::Pointer);
-        runtime.suppress_release(RegionInputSource::Touch);
-        runtime.clear_suppressed_release(RegionInputSource::Touch);
-
-        assert!(!runtime.take_suppressed_release(RegionInputSource::Touch));
-        assert!(runtime.take_suppressed_release(RegionInputSource::Pointer));
-        assert!(!runtime.take_suppressed_release(RegionInputSource::Pointer));
-        assert!(!runtime.take_suppressed_release(RegionInputSource::Stylus));
-    }
-
-    #[test]
-    fn pointer_cleanup_preserves_a_pending_touch_release() {
-        let mut runtime = PointerRuntime::new();
-        runtime.suppress_release(RegionInputSource::Pointer);
-        runtime.suppress_release(RegionInputSource::Touch);
-
-        assert!(runtime.take_suppressed_release(RegionInputSource::Pointer));
-        runtime.clear_chrome_press();
-
-        assert!(!runtime.take_suppressed_release(RegionInputSource::Pointer));
-        assert!(runtime.take_suppressed_release(RegionInputSource::Touch));
-        assert!(!runtime.take_suppressed_release(RegionInputSource::Touch));
-    }
-
-    #[test]
-    fn touch_cancellation_cleanup_preserves_a_pending_pointer_release() {
-        let mut runtime = PointerRuntime::new();
-        runtime.suppress_release(RegionInputSource::Pointer);
-        runtime.suppress_release(RegionInputSource::Touch);
-
-        runtime.clear_chrome_press();
-        runtime.clear_suppressed_release(RegionInputSource::Touch);
-
-        assert!(!runtime.take_suppressed_release(RegionInputSource::Touch));
-        assert!(runtime.take_suppressed_release(RegionInputSource::Pointer));
-    }
-
-    #[test]
-    fn held_eyedropper_pointer_release_does_not_finish_a_new_touch_stroke() {
-        assert_interleaved_release_keeps_stroke(
-            RegionInputSource::Pointer,
-            RegionInputSource::Touch,
-        );
-    }
-
-    #[test]
-    fn held_region_touch_release_does_not_finish_a_new_pointer_stroke() {
-        assert_interleaved_release_keeps_stroke(
-            RegionInputSource::Touch,
-            RegionInputSource::Pointer,
-        );
-    }
-
-    fn assert_interleaved_release_keeps_stroke(
-        consumed_source: RegionInputSource,
-        drawing_source: RegionInputSource,
-    ) {
-        use crate::input::{MouseButton, state::DrawingState};
-
-        let measurer = crate::draw::TextMeasurer::default();
-        let ui_engine = crate::ui_text::UiTextEngine::default();
-        let resources = crate::input::state::InputTextResources {
-            measurer: &measurer,
-            ui_engine: &ui_engine,
-        };
-        let mut runtime = PointerRuntime::new();
-        let mut input = crate::input::state::test_support::make_test_input_state();
-
-        // The modal press was consumed, but that device remains held while the
-        // other device starts drawing. Both canvas press handlers reset chrome.
-        runtime.suppress_release(consumed_source);
-        runtime.clear_chrome_press();
-        input.on_mouse_press_with_canvas_and_resources(
-            resources,
-            MouseButton::Left,
-            10,
-            20,
-            10,
-            20,
-        );
-        input.on_mouse_motion_with_canvas_and_resources(resources, 30, 40, 30, 40);
-        assert!(matches!(input.state, DrawingState::Drawing { .. }));
-
-        // Exercise the release gate shared by the pointer and touch handlers.
-        // Falling through here would commit the other device's unfinished stroke.
-        if runtime.take_suppressed_release(consumed_source) {
-            runtime.clear_chrome_press();
-        } else {
-            input.on_mouse_release_with_canvas_and_resources(
-                resources,
-                MouseButton::Left,
-                30,
-                40,
-                30,
-                40,
-            );
-        }
-        assert!(matches!(input.state, DrawingState::Drawing { .. }));
-        assert!(input.boards.active_frame().shapes.is_empty());
-
-        assert!(!runtime.take_suppressed_release(drawing_source));
-        input.on_mouse_release_with_canvas_and_resources(
-            resources,
-            MouseButton::Left,
-            50,
-            60,
-            50,
-            60,
-        );
-        assert!(matches!(input.state, DrawingState::Idle));
-        assert_eq!(input.boards.active_frame().shapes.len(), 1);
-    }
-
-    #[test]
-    fn chrome_press_targets_are_taken_once() {
-        let mut runtime = PointerRuntime::new();
-        assert!(runtime.arm_zoom_chip_press(ZoomChipPress::Passive));
-
-        assert_eq!(runtime.take_zoom_chip_press(), ZoomChipPress::Passive);
-        assert_eq!(runtime.take_zoom_chip_press(), ZoomChipPress::None);
-    }
-
-    #[test]
-    fn board_pan_advance_uses_and_updates_the_previous_sample() {
-        let mut runtime = PointerRuntime::new();
-        runtime.start_board_pan((10.0, 20.0));
-
-        assert_eq!(runtime.advance_board_pan((13.5, 18.0)), (3.5, -2.0));
-        assert_eq!(runtime.advance_board_pan((15.0, 22.0)), (1.5, 4.0));
-    }
-
-    #[test]
-    fn pointer_position_round_trips() {
-        let mut runtime = PointerRuntime::new();
-        runtime.set_position((17, 23));
-
-        assert_eq!(runtime.position(), (17, 23));
-    }
-
-    #[test]
-    fn unlocking_an_empty_runtime_reports_no_transition() {
-        let mut runtime = PointerRuntime::new();
-
-        assert!(!runtime.unlock());
-    }
-}
+mod tests;
diff --git a/src/backend/wayland/state/pointer_runtime/chrome.rs b/src/backend/wayland/state/pointer_runtime/chrome.rs
new file mode 100644
index 000000000..4509ae432
--- /dev/null
+++ b/src/backend/wayland/state/pointer_runtime/chrome.rs
@@ -0,0 +1,73 @@
+use super::*;
+
+#[derive(Debug, Clone, Copy, Default)]
+pub(super) struct PendingChromePress {
+    toast: Option<ToastPress>,
+    status_hud: bool,
+    zoom_chip: ZoomChipPress,
+    onboarding_card: Option<OnboardingCardPress>,
+}
+
+impl PendingChromePress {
+    pub(super) fn occupied(&self) -> bool {
+        self.toast.is_some()
+            || self.status_hud
+            || self.zoom_chip.is_pending()
+            || self.onboarding_card.is_some()
+    }
+
+    pub(super) fn clear(&mut self) {
+        self.toast = None;
+        self.status_hud = false;
+        self.zoom_chip = ZoomChipPress::None;
+        self.onboarding_card = None;
+    }
+
+    pub(super) fn arm_toast(&mut self, press: ToastPress) -> bool {
+        if self.occupied() {
+            return false;
+        }
+        self.toast = Some(press);
+        true
+    }
+
+    pub(super) fn take_toast(&mut self) -> Option<ToastPress> {
+        self.toast.take()
+    }
+
+    pub(super) fn arm_status_hud(&mut self) -> bool {
+        if self.occupied() {
+            return false;
+        }
+        self.status_hud = true;
+        true
+    }
+
+    pub(super) fn take_status_hud(&mut self) -> bool {
+        std::mem::take(&mut self.status_hud)
+    }
+
+    pub(super) fn arm_zoom_chip(&mut self, press: ZoomChipPress) -> bool {
+        if self.occupied() || !press.is_pending() {
+            return false;
+        }
+        self.zoom_chip = press;
+        true
+    }
+
+    pub(super) fn take_zoom_chip(&mut self) -> ZoomChipPress {
+        std::mem::replace(&mut self.zoom_chip, ZoomChipPress::None)
+    }
+
+    pub(super) fn arm_onboarding_card(&mut self, press: OnboardingCardPress) -> bool {
+        if self.occupied() {
+            return false;
+        }
+        self.onboarding_card = Some(press);
+        true
+    }
+
+    pub(super) fn take_onboarding_card(&mut self) -> Option<OnboardingCardPress> {
+        self.onboarding_card.take()
+    }
+}
diff --git a/src/backend/wayland/state/pointer_runtime/contacts.rs b/src/backend/wayland/state/pointer_runtime/contacts.rs
new file mode 100644
index 000000000..c71ddc58a
--- /dev/null
+++ b/src/backend/wayland/state/pointer_runtime/contacts.rs
@@ -0,0 +1,307 @@
+//! Motion and release ownership are independent and bound by the real press route.
+use crate::backend::wayland::state::ContactOwner;
+use crate::input::{InputState, state::interaction::RoutingOutcome};
+
+#[derive(Debug)]
+struct HeldContact {
+    button: u32,
+    owner: ContactOwner,
+    motion_active: bool,
+    release_active: bool,
+    canvas_press: Option<RoutingOutcome>,
+}
+
+#[derive(Debug, Default)]
+pub(super) struct PointerContacts {
+    held: Vec<HeldContact>,
+}
+
+impl PointerContacts {
+    pub(super) fn bind(&mut self, button: u32, owner: ContactOwner) {
+        self.held.retain(|contact| contact.button != button);
+        self.held.push(HeldContact {
+            button,
+            owner,
+            motion_active: true,
+            release_active: true,
+            canvas_press: None,
+        });
+    }
+
+    pub(super) fn bind_canvas(&mut self, button: u32, outcome: RoutingOutcome, input: &InputState) {
+        self.bind(button, ContactOwner::Canvas);
+        let contact = self.held.last_mut().expect("bound contact");
+        contact.canvas_press = Some(outcome);
+        contact.motion_active = outcome.owns_pointer_motion(input);
+        contact.release_active = outcome.owns_pointer_release(input);
+    }
+
+    pub(super) fn take(&mut self, button: u32, input: &InputState) -> Option<(ContactOwner, bool)> {
+        let index = self
+            .held
+            .iter()
+            .position(|contact| contact.button == button)?;
+        let contact = self.held.remove(index);
+        let release = contact.release_active
+            && contact
+                .canvas_press
+                .is_none_or(|outcome| outcome.owns_pointer_release(input));
+        Some((contact.owner, release))
+    }
+
+    pub(super) fn motion_owner(&self) -> Option<ContactOwner> {
+        self.held
+            .iter()
+            .find(|contact| contact.motion_active)
+            .map(|contact| contact.owner)
+    }
+
+    pub(super) fn reconcile(
+        &mut self,
+        input: &InputState,
+        zoom_pan: bool,
+        board_pan: bool,
+        toolbar_drag: bool,
+    ) {
+        for contact in &mut self.held {
+            if let Some(outcome) = contact.canvas_press {
+                contact.motion_active &= outcome.owns_pointer_motion(input);
+                contact.release_active &= outcome.owns_pointer_release(input);
+            } else {
+                let active = match contact.owner {
+                    ContactOwner::Canvas => input.has_active_pointer_interaction(),
+                    ContactOwner::ZoomPan => zoom_pan,
+                    ContactOwner::BoardPan => board_pan,
+                    ContactOwner::InlineToolbar => toolbar_drag,
+                };
+                contact.motion_active &= active;
+                contact.release_active &= active;
+            }
+        }
+    }
+
+    pub(super) fn clear(&mut self) {
+        self.held.clear();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn unrelated_releases_and_rebinds_preserve_the_first_held_contact() {
+        let mut contacts = PointerContacts::default();
+        let input = crate::input::state::test_support::make_test_input_state();
+        let canvas = ContactOwner::Canvas;
+        contacts.bind(1, canvas);
+        contacts.bind(2, ContactOwner::InlineToolbar);
+        assert_eq!(contacts.take(3, &input), None);
+        assert_eq!(contacts.motion_owner(), Some(canvas));
+        assert_eq!(
+            contacts.take(2, &input),
+            Some((ContactOwner::InlineToolbar, true))
+        );
+        assert_eq!(contacts.motion_owner(), Some(canvas));
+        contacts.bind(1, ContactOwner::BoardPan);
+        assert_eq!(contacts.motion_owner(), Some(ContactOwner::BoardPan));
+        assert_eq!(
+            contacts.take(1, &input),
+            Some((ContactOwner::BoardPan, true))
+        );
+        assert_eq!(contacts.motion_owner(), None);
+    }
+}
+
+#[cfg(test)]
+mod dispatch_regressions {
+    use crate::backend::wayland::state::pointer_runtime::PointerRuntime;
+    use crate::backend::wayland::state::{ContactMotion, ContactOwner};
+    use crate::draw::TextMeasurer;
+    use crate::input::{
+        MouseButton,
+        state::{InputTextResources, test_support::make_test_input_state},
+    };
+    use crate::ui_text::UiTextEngine;
+
+    #[test]
+    fn inert_canvas_presses_cannot_inherit_another_devices_canvas_gesture() {
+        for mouse_button in [MouseButton::Right, MouseButton::Middle] {
+            let mut pointer = PointerRuntime::new();
+            let mut config = crate::config::Config::default();
+            config.ui.radial_menu_mouse_binding = crate::config::RadialMenuMouseBinding::Disabled;
+            let mut input = crate::input::InputState::from_config(&config);
+            let measurer = TextMeasurer::default();
+            let engine = UiTextEngine::default();
+            let resources = || InputTextResources {
+                measurer: &measurer,
+                ui_engine: &engine,
+            };
+            pointer.route_canvas_press(
+                &mut input,
+                resources(),
+                1,
+                mouse_button,
+                [300, 300, 300, 300],
+            );
+            assert_eq!(pointer.contact_motion(), ContactMotion::Hover);
+            input.close_context_menu();
+            // A different device starts drawing after this inert/consumed press.
+            input.on_mouse_press_with_canvas_and_resources(
+                resources(),
+                MouseButton::Left,
+                600,
+                400,
+                600,
+                400,
+            );
+            assert!(input.has_active_pointer_interaction());
+            pointer.reconcile_contacts(&input, false, false);
+            assert_eq!(pointer.contact_motion(), ContactMotion::Hover);
+            assert_eq!(
+                pointer.take_contact(1, &input),
+                Some((ContactOwner::Canvas, false))
+            );
+            assert!(input.has_active_pointer_interaction());
+        }
+    }
+
+    #[test]
+    fn canceled_canvas_and_non_drag_strip_contacts_keep_only_their_release_ownership() {
+        let mut pointer = PointerRuntime::new();
+        let mut input = make_test_input_state();
+        let measurer = TextMeasurer::default();
+        let engine = UiTextEngine::default();
+        pointer.route_canvas_press(
+            &mut input,
+            InputTextResources {
+                measurer: &measurer,
+                ui_engine: &engine,
+            },
+            1,
+            MouseButton::Left,
+            [600, 400, 600, 400],
+        );
+        assert_eq!(pointer.contact_motion(), ContactMotion::Canvas);
+        input.cancel_active_interaction_with(&measurer);
+        pointer.reconcile_contacts(&input, false, false);
+        assert_eq!(pointer.contact_motion(), ContactMotion::Hover);
+        input.on_mouse_press_with_canvas_and_resources(
+            InputTextResources {
+                measurer: &measurer,
+                ui_engine: &engine,
+            },
+            MouseButton::Left,
+            700,
+            500,
+            700,
+            500,
+        );
+        assert!(input.has_active_pointer_interaction());
+        assert_eq!(
+            pointer.take_contact(1, &input),
+            Some((ContactOwner::Canvas, false))
+        );
+        pointer.bind_contact(2, ContactOwner::InlineToolbar);
+        pointer.reconcile_contacts(&input, false, false);
+        assert_eq!(pointer.contact_motion(), ContactMotion::Hover);
+        assert_eq!(
+            pointer.take_contact(2, &input),
+            Some((ContactOwner::InlineToolbar, false))
+        );
+        pointer.bind_contact(3, ContactOwner::InlineToolbar);
+        pointer.reconcile_contacts(&input, false, true);
+        assert_eq!(pointer.contact_motion(), ContactMotion::Toolbar);
+        assert_eq!(
+            pointer.take_contact(3, &input),
+            Some((ContactOwner::InlineToolbar, true))
+        );
+    }
+}
+
+#[cfg(test)]
+mod popup_dispatch_regressions {
+    use crate::backend::wayland::state::pointer_runtime::PointerRuntime;
+    use crate::backend::wayland::state::{ContactMotion, ContactOwner};
+    use crate::draw::TextMeasurer;
+    use crate::input::{
+        MouseButton,
+        state::{InputTextResources, test_support::make_test_input_state},
+    };
+    use crate::ui_text::UiTextEngine;
+
+    #[test]
+    fn popup_slider_motion_and_button_releases_keep_their_own_contact() {
+        for kind in ["button", "slider", "closed button"] {
+            let slider = kind == "slider";
+            let mut input = make_test_input_state();
+            let mut pointer = PointerRuntime::new();
+            let measurer = TextMeasurer::default();
+            let engine = UiTextEngine::default();
+            input.open_color_picker_popup();
+            input.update_color_picker_popup_layout(1280, 720);
+            let layout = input.color_picker_popup_layout().unwrap();
+            let (x, y) = if slider {
+                (layout.hue_x + 2.0, layout.hue_y + 2.0)
+            } else {
+                (layout.ok_btn_x + 2.0, layout.ok_btn_y + 2.0)
+            };
+            let coords = [x as i32, y as i32, x as i32, y as i32];
+            pointer.route_canvas_press(
+                &mut input,
+                InputTextResources {
+                    measurer: &measurer,
+                    ui_engine: &engine,
+                },
+                1,
+                MouseButton::Left,
+                coords,
+            );
+            assert_eq!(
+                pointer.contact_motion(),
+                if slider {
+                    ContactMotion::Canvas
+                } else {
+                    ContactMotion::Hover
+                }
+            );
+            if kind == "closed button" {
+                input.close_color_picker_popup(true);
+                input.on_mouse_press_with_canvas_and_resources(
+                    InputTextResources {
+                        measurer: &measurer,
+                        ui_engine: &engine,
+                    },
+                    MouseButton::Left,
+                    700,
+                    500,
+                    700,
+                    500,
+                );
+                assert!(input.has_active_pointer_interaction());
+                assert_eq!(
+                    pointer.take_contact(1, &input),
+                    Some((ContactOwner::Canvas, false))
+                );
+                assert!(input.has_active_pointer_interaction());
+                continue;
+            }
+            assert_eq!(
+                pointer.take_contact(1, &input),
+                Some((ContactOwner::Canvas, true))
+            );
+            input.on_mouse_release_with_canvas_and_resources(
+                InputTextResources {
+                    measurer: &measurer,
+                    ui_engine: &engine,
+                },
+                MouseButton::Left,
+                coords[0],
+                coords[1],
+                coords[2],
+                coords[3],
+            );
+            assert!(!input.color_picker_popup_is_dragging());
+            assert_eq!(input.is_color_picker_popup_open(), slider);
+        }
+    }
+}
diff --git a/src/backend/wayland/state/pointer_runtime/tests.rs b/src/backend/wayland/state/pointer_runtime/tests.rs
new file mode 100644
index 000000000..a565dac8c
--- /dev/null
+++ b/src/backend/wayland/state/pointer_runtime/tests.rs
@@ -0,0 +1,227 @@
+use super::{PendingChromePress, PointerRuntime, TouchState, TouchTarget};
+use crate::{
+    input::state::{RegionInputSource, ToastPress},
+    ui::{OnboardingCardPress, ZoomChipPress},
+};
+use smithay_client_toolkit::seat::pointer::CursorIcon;
+
+#[test]
+fn pointer_attachment_reset_clears_shape_and_hidden_state() {
+    let mut runtime = PointerRuntime::new();
+    runtime.current_pointer_shape = Some(CursorIcon::Crosshair);
+    runtime.cursor_hidden = true;
+
+    runtime.reset_cursor_cache();
+
+    assert_eq!(runtime.current_pointer_shape, None);
+    assert!(!runtime.cursor_hidden);
+}
+
+#[test]
+fn hide_and_show_transitions_are_idempotent() {
+    let mut runtime = PointerRuntime::new();
+
+    assert!(runtime.mark_cursor_hidden());
+    assert!(!runtime.mark_cursor_hidden());
+    assert!(runtime.show_cursor());
+    assert!(!runtime.show_cursor());
+}
+
+#[test]
+fn active_touch_rejects_a_second_contact_and_foreign_end() {
+    let mut touch = TouchState::default();
+    assert!(touch.begin(7, (10.0, 20.0), TouchTarget::Canvas));
+    assert!(!touch.begin(8, (30.0, 40.0), TouchTarget::Toolbar));
+    assert_eq!(touch.end(8), None);
+    assert_eq!(touch.end(7), Some(((10.0, 20.0), TouchTarget::Canvas)));
+    assert_eq!(touch.end(7), None);
+}
+
+#[test]
+fn active_touch_updates_only_the_owned_contact() {
+    let mut touch = TouchState::default();
+    assert!(touch.begin(7, (10.0, 20.0), TouchTarget::Canvas));
+
+    assert!(!touch.update_position(8, (30.0, 40.0)));
+    assert!(touch.update_position(7, (50.0, 60.0)));
+    assert_eq!(touch.end(7), Some(((50.0, 60.0), TouchTarget::Canvas)));
+}
+
+#[test]
+fn chrome_press_priority_keeps_the_first_target() {
+    let mut press = PendingChromePress::default();
+    let toast = ToastPress::body(7);
+
+    assert!(press.arm_toast(toast));
+    assert!(!press.arm_status_hud());
+    assert!(!press.arm_zoom_chip(ZoomChipPress::Passive));
+    assert_eq!(press.take_toast(), Some(toast));
+    assert_eq!(press.take_toast(), None);
+}
+
+#[test]
+fn an_onboarding_card_press_is_owned_until_its_release_takes_it() {
+    let mut runtime = PointerRuntime::new();
+
+    assert!(runtime.arm_onboarding_card_press(OnboardingCardPress::Body));
+    assert!(!runtime.arm_toast_press(ToastPress::body(7)));
+    assert_eq!(
+        runtime.take_onboarding_card_press(),
+        Some(OnboardingCardPress::Body)
+    );
+    assert_eq!(runtime.take_onboarding_card_press(), None);
+
+    assert!(runtime.arm_onboarding_card_press(OnboardingCardPress::Body));
+    runtime.clear_chrome_press();
+    assert_eq!(runtime.take_onboarding_card_press(), None);
+}
+
+#[test]
+fn clearing_chrome_press_preserves_both_release_latches() {
+    let mut runtime = PointerRuntime::new();
+    assert!(runtime.arm_status_hud_press());
+    runtime.suppress_release(RegionInputSource::Pointer);
+    runtime.suppress_release(RegionInputSource::Touch);
+
+    runtime.clear_chrome_press();
+    assert!(!runtime.take_status_hud_press());
+
+    assert!(runtime.arm_toast_press(ToastPress::body(7)));
+    runtime.clear_chrome_press();
+    assert_eq!(runtime.take_toast_press(), None);
+
+    assert!(runtime.arm_zoom_chip_press(ZoomChipPress::Passive));
+    runtime.clear_chrome_press();
+    assert_eq!(runtime.take_zoom_chip_press(), ZoomChipPress::None);
+    assert!(runtime.take_suppressed_release(RegionInputSource::Pointer));
+    assert!(runtime.take_suppressed_release(RegionInputSource::Touch));
+}
+
+#[test]
+fn release_suppression_is_owned_by_its_source() {
+    let mut runtime = PointerRuntime::new();
+    runtime.suppress_release(RegionInputSource::Pointer);
+    runtime.suppress_release(RegionInputSource::Touch);
+    runtime.clear_suppressed_release(RegionInputSource::Touch);
+
+    assert!(!runtime.take_suppressed_release(RegionInputSource::Touch));
+    assert!(runtime.take_suppressed_release(RegionInputSource::Pointer));
+    assert!(!runtime.take_suppressed_release(RegionInputSource::Pointer));
+    assert!(!runtime.take_suppressed_release(RegionInputSource::Stylus));
+}
+
+#[test]
+fn pointer_cleanup_preserves_a_pending_touch_release() {
+    let mut runtime = PointerRuntime::new();
+    runtime.suppress_release(RegionInputSource::Pointer);
+    runtime.suppress_release(RegionInputSource::Touch);
+
+    assert!(runtime.take_suppressed_release(RegionInputSource::Pointer));
+    runtime.clear_chrome_press();
+
+    assert!(!runtime.take_suppressed_release(RegionInputSource::Pointer));
+    assert!(runtime.take_suppressed_release(RegionInputSource::Touch));
+    assert!(!runtime.take_suppressed_release(RegionInputSource::Touch));
+}
+
+#[test]
+fn touch_cancellation_cleanup_preserves_a_pending_pointer_release() {
+    let mut runtime = PointerRuntime::new();
+    runtime.suppress_release(RegionInputSource::Pointer);
+    runtime.suppress_release(RegionInputSource::Touch);
+
+    runtime.clear_chrome_press();
+    runtime.clear_suppressed_release(RegionInputSource::Touch);
+
+    assert!(!runtime.take_suppressed_release(RegionInputSource::Touch));
+    assert!(runtime.take_suppressed_release(RegionInputSource::Pointer));
+}
+
+#[test]
+fn held_eyedropper_pointer_release_does_not_finish_a_new_touch_stroke() {
+    assert_interleaved_release_keeps_stroke(RegionInputSource::Pointer, RegionInputSource::Touch);
+}
+
+#[test]
+fn held_region_touch_release_does_not_finish_a_new_pointer_stroke() {
+    assert_interleaved_release_keeps_stroke(RegionInputSource::Touch, RegionInputSource::Pointer);
+}
+
+fn assert_interleaved_release_keeps_stroke(
+    consumed_source: RegionInputSource,
+    drawing_source: RegionInputSource,
+) {
+    use crate::input::{MouseButton, state::DrawingState};
+
+    let measurer = crate::draw::TextMeasurer::default();
+    let ui_engine = crate::ui_text::UiTextEngine::default();
+    let resources = crate::input::state::InputTextResources {
+        measurer: &measurer,
+        ui_engine: &ui_engine,
+    };
+    let mut runtime = PointerRuntime::new();
+    let mut input = crate::input::state::test_support::make_test_input_state();
+
+    // The modal press was consumed, but that device remains held while the
+    // other device starts drawing. Both canvas press handlers reset chrome.
+    runtime.suppress_release(consumed_source);
+    runtime.clear_chrome_press();
+    input.on_mouse_press_with_canvas_and_resources(resources, MouseButton::Left, 10, 20, 10, 20);
+    input.on_mouse_motion_with_canvas_and_resources(resources, 30, 40, 30, 40);
+    assert!(matches!(input.state, DrawingState::Drawing { .. }));
+
+    // Exercise the release gate shared by the pointer and touch handlers.
+    // Falling through here would commit the other device's unfinished stroke.
+    if runtime.take_suppressed_release(consumed_source) {
+        runtime.clear_chrome_press();
+    } else {
+        input.on_mouse_release_with_canvas_and_resources(
+            resources,
+            MouseButton::Left,
+            30,
+            40,
+            30,
+            40,
+        );
+    }
+    assert!(matches!(input.state, DrawingState::Drawing { .. }));
+    assert!(input.boards.active_frame().shapes.is_empty());
+
+    assert!(!runtime.take_suppressed_release(drawing_source));
+    input.on_mouse_release_with_canvas_and_resources(resources, MouseButton::Left, 50, 60, 50, 60);
+    assert!(matches!(input.state, DrawingState::Idle));
+    assert_eq!(input.boards.active_frame().shapes.len(), 1);
+}
+
+#[test]
+fn chrome_press_targets_are_taken_once() {
+    let mut runtime = PointerRuntime::new();
+    assert!(runtime.arm_zoom_chip_press(ZoomChipPress::Passive));
+
+    assert_eq!(runtime.take_zoom_chip_press(), ZoomChipPress::Passive);
+    assert_eq!(runtime.take_zoom_chip_press(), ZoomChipPress::None);
+}
+
+#[test]
+fn board_pan_advance_uses_and_updates_the_previous_sample() {
+    let mut runtime = PointerRuntime::new();
+    runtime.start_board_pan((10.0, 20.0));
+
+    assert_eq!(runtime.advance_board_pan((13.5, 18.0)), (3.5, -2.0));
+    assert_eq!(runtime.advance_board_pan((15.0, 22.0)), (1.5, 4.0));
+}
+
+#[test]
+fn pointer_position_round_trips() {
+    let mut runtime = PointerRuntime::new();
+    runtime.set_position((17, 23));
+
+    assert_eq!(runtime.position(), (17, 23));
+}
+
+#[test]
+fn unlocking_an_empty_runtime_reports_no_transition() {
+    let mut runtime = PointerRuntime::new();
+
+    assert!(!runtime.unlock());
+}
diff --git a/src/backend/wayland/state/pointer_runtime/touch.rs b/src/backend/wayland/state/pointer_runtime/touch.rs
new file mode 100644
index 000000000..f80bd82c9
--- /dev/null
+++ b/src/backend/wayland/state/pointer_runtime/touch.rs
@@ -0,0 +1,53 @@
+use super::TouchTarget;
+
+#[derive(Clone, Copy, Debug, Default)]
+pub(super) struct TouchState {
+    active_id: Option<i32>,
+    pub(super) target: TouchTarget,
+    last_position: Option<(f64, f64)>,
+}
+
+impl TouchState {
+    pub(super) fn begin(&mut self, id: i32, position: (f64, f64), target: TouchTarget) -> bool {
+        if self.active_id.is_some() {
+            return false;
+        }
+        self.active_id = Some(id);
+        self.target = target;
+        self.last_position = Some(position);
+        true
+    }
+
+    pub(super) fn update_position(&mut self, id: i32, position: (f64, f64)) -> bool {
+        if self.active_id != Some(id) {
+            return false;
+        }
+        self.last_position = Some(position);
+        true
+    }
+
+    pub(super) fn end(&mut self, id: i32) -> Option<((f64, f64), TouchTarget)> {
+        if self.active_id != Some(id) {
+            return None;
+        }
+        self.cancel()
+    }
+
+    pub(super) fn cancel(&mut self) -> Option<((f64, f64), TouchTarget)> {
+        let end = self.last_position.map(|position| (position, self.target));
+        self.clear();
+        end
+    }
+
+    pub(super) fn set_target(&mut self, target: TouchTarget) {
+        if self.active_id.is_some() {
+            self.target = target;
+        }
+    }
+
+    pub(super) fn clear(&mut self) {
+        self.active_id = None;
+        self.target = TouchTarget::None;
+        self.last_position = None;
+    }
+}
diff --git a/src/backend/wayland/state/tablet_runtime.rs b/src/backend/wayland/state/tablet_runtime.rs
index 896877a13..9936ccde0 100644
--- a/src/backend/wayland/state/tablet_runtime.rs
+++ b/src/backend/wayland/state/tablet_runtime.rs
@@ -9,9 +9,14 @@ use wayland_protocols::wp::tablet::zv2::client::{
 };
 
 use super::PendingStylusFrame;
+
+use super::contact_owner::{ContactMotion, ContactOwner, ReleaseRoute, held_motion, release_route};
 use crate::backend::wayland::TabletToolType;
 use crate::input::{Tool, tablet::TabletSettings};
 
+mod pressure;
+pub(in crate::backend::wayland) use pressure::StylusDownAdmission;
+
 pub(in crate::backend::wayland) struct HoverTransition {
     pub(in crate::backend::wayland) previous: Option<(f64, f64)>,
     pub(in crate::backend::wayland) next: Option<(f64, f64)>,
@@ -29,37 +34,157 @@ pub(in crate::backend::wayland) struct TabletState {
     pub(in crate::backend::wayland) pad_strips: Vec<ZwpTabletPadStripV2>,
     pub(in crate::backend::wayland) settings: TabletSettings,
     pub(in crate::backend::wayland) found_logged: bool,
-    pub(in crate::backend::wayland) tip_down: bool,
+    tip_owner: Option<ContactOwner>,
+    over_inline_strip: bool,
     pub(in crate::backend::wayland) on_overlay: bool,
     pub(in crate::backend::wayland) on_toolbar: bool,
-    pub(in crate::backend::wayland) base_thickness: Option<f64>,
     pub(in crate::backend::wayland) pressure_thickness: Option<f64>,
     pub(in crate::backend::wayland) surface: Option<wl_surface::WlSurface>,
     pub(in crate::backend::wayland) last_pos: Option<(f64, f64)>,
     pub(in crate::backend::wayland) peak_thickness: Option<f64>,
     pub(in crate::backend::wayland) pending_frame: PendingStylusFrame,
     pub(in crate::backend::wayland) contact_retired: bool,
+    /// A tip-down on a toast, resolved when the tip lifts.
+    pub(in crate::backend::wayland) toast_press: Option<crate::input::state::ToastPress>,
     pub(in crate::backend::wayland) tool_types: HashMap<ObjectId, TabletToolType>,
     pub(in crate::backend::wayland) auto_switched_to_eraser: bool,
     pub(in crate::backend::wayland) pre_eraser_tool_override: Option<Tool>,
 }
 
+/// Where a stylus motion goes after screen modals and move drags.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::backend::wayland) enum StylusMotionRoute {
+    /// The proximity surface is the layer-shell toolbar (unchanged path).
+    LayerShellToolbar,
+    /// The strip owns the tip: strip motion only.
+    InlineStrip,
+    /// No recorded tip: strip hover first, then the canvas.
+    InlineHover,
+    /// Canvas motion, queued for the frame.
+    Canvas,
+}
+
 impl TabletState {
+    pub(in crate::backend::wayland) fn record_immediate_motion(&mut self, position: (f64, f64)) {
+        self.last_pos = Some(position);
+    }
+
+    pub(in crate::backend::wayland) fn current_or_pending_position(
+        &self,
+        fallback: (i32, i32),
+    ) -> (f64, f64) {
+        self.pending_frame
+            .motion
+            .or(self.last_pos)
+            .unwrap_or((fallback.0 as f64, fallback.1 as f64))
+    }
+
     pub(in crate::backend::wayland) fn hover_cursor_position(&self) -> Option<(f64, f64)> {
-        (self.on_overlay && !self.on_toolbar && !self.tip_down)
+        (self.tip_owner.is_none() && !self.pending_frame.down && self.hovers_canvas())
             .then_some(self.last_pos)
             .flatten()
     }
 
+    /// The pen over the canvas, tip up or down. The toolbar fade's reveal zone
+    /// reads it.
+    pub(in crate::backend::wayland) fn canvas_point(&self) -> Option<(f64, f64)> {
+        self.hovers_canvas().then_some(self.last_pos).flatten()
+    }
+
+    fn hovers_canvas(&self) -> bool {
+        self.on_overlay && !self.on_toolbar && !self.over_inline_strip
+    }
+
+    /// A canvas stroke or other canvas gesture holds the tip.
+    pub(in crate::backend::wayland) fn is_canvas_gesture(&self) -> bool {
+        matches!(self.tip_owner, Some(ContactOwner::Canvas))
+    }
+
+    /// The pen hovers the strip or the strip holds its tip.
+    pub(in crate::backend::wayland) fn on_inline_strip(&self) -> bool {
+        self.over_inline_strip || self.tip_owner == Some(ContactOwner::InlineToolbar)
+    }
+
+    pub(in crate::backend::wayland) fn set_over_inline_strip(&mut self, over: bool) {
+        self.over_inline_strip = over;
+    }
+
+    pub(in crate::backend::wayland) fn bind_tip(&mut self, owner: ContactOwner) {
+        if owner == ContactOwner::InlineToolbar {
+            self.clear_pressure();
+        }
+        self.tip_owner = Some(owner);
+    }
+
+    pub(in crate::backend::wayland) fn consume_contact(&mut self) {
+        self.pending_frame = PendingStylusFrame::default();
+        self.tip_owner = None;
+        self.contact_retired = true;
+        self.clear_pressure();
+    }
+
+    fn clear_pressure(&mut self) {
+        self.pending_frame.pressure = None;
+        self.pressure_thickness = None;
+        self.peak_thickness = None;
+    }
+
+    /// The frame committed the tip-up: the tip has no owner any more.
+    pub(in crate::backend::wayland) fn lift_tip(&mut self) {
+        self.tip_owner = None;
+    }
+
+    /// Proximity starts or ends: forget the tip and the strip hover.
+    pub(in crate::backend::wayland) fn reset_contact(&mut self) {
+        self.tip_owner = None;
+        self.over_inline_strip = false;
+        self.toast_press = None;
+    }
+
+    pub(in crate::backend::wayland) fn motion_route(
+        &self,
+        inline_active: bool,
+    ) -> StylusMotionRoute {
+        // A queued canvas down already owns routing even before its pressure frame.
+        if self.pending_frame.down {
+            return StylusMotionRoute::Canvas;
+        }
+        if self.on_toolbar {
+            return StylusMotionRoute::LayerShellToolbar;
+        }
+
+        match held_motion(self.tip_owner) {
+            ContactMotion::Toolbar => StylusMotionRoute::InlineStrip,
+            ContactMotion::Hover if inline_active => StylusMotionRoute::InlineHover,
+            _ => StylusMotionRoute::Canvas,
+        }
+    }
+
+    /// Routes a tip-up at the `up` event. A strip record ends here, before any
+    /// gate can consume the `up`. A canvas record ends when the frame commits
+    /// the up (`lift_tip`).
+    pub(in crate::backend::wayland) fn take_up_route(
+        &mut self,
+        inline_active: bool,
+    ) -> ReleaseRoute {
+        let route = release_route(self.tip_owner, inline_active);
+        if route == ReleaseRoute::InlineToolbar {
+            self.tip_owner = None;
+            self.clear_pressure();
+        }
+
+        route
+    }
+
     pub(in crate::backend::wayland) fn retire_contact(&mut self) -> HoverTransition {
-        let had_contact = self.tip_down || self.pending_frame.down;
+        let canvas_tip = self.is_canvas_gesture();
+        let had_contact = canvas_tip || self.pending_frame.down;
         self.pending_frame = PendingStylusFrame::default();
         self.contact_retired |= had_contact;
         let previous_hover = self.hover_cursor_position();
-        if self.tip_down {
-            self.tip_down = false;
-            self.pressure_thickness = None;
-            self.peak_thickness = None;
+        if canvas_tip {
+            self.tip_owner = None;
+            self.clear_pressure();
         }
         HoverTransition {
             previous: previous_hover,
@@ -83,16 +208,17 @@ impl TabletState {
             pad_strips: Vec::new(),
             settings,
             found_logged: false,
-            tip_down: false,
+            tip_owner: None,
+            over_inline_strip: false,
             on_overlay: false,
             on_toolbar: false,
-            base_thickness: None,
             pressure_thickness: None,
             surface: None,
             last_pos: None,
             peak_thickness: None,
             pending_frame: PendingStylusFrame::default(),
             contact_retired: false,
+            toast_press: None,
             tool_types: HashMap::new(),
             auto_switched_to_eraser: false,
             pre_eraser_tool_override: None,
@@ -105,10 +231,49 @@ mod tests {
     use super::TabletState;
     use crate::input::tablet::TabletSettings;
 
+    #[test]
+    fn inline_hover_does_not_change_the_proximity_surface_or_steal_canvas_contact() {
+        let mut state = TabletState::new(None, TabletSettings::default());
+        state.on_overlay = true;
+        state.last_pos = Some((10.0, 20.0));
+        state.set_over_inline_strip(true);
+        assert_eq!(state.hover_cursor_position(), None);
+        assert!(!state.on_toolbar);
+        state.set_over_inline_strip(false);
+        assert_eq!(state.hover_cursor_position(), Some((10.0, 20.0)));
+
+        state.pending_frame.down = true;
+        assert_eq!(state.motion_route(true), super::StylusMotionRoute::Canvas);
+        state.pending_frame.down = false;
+        state.bind_tip(super::ContactOwner::Canvas);
+        assert_eq!(state.motion_route(true), super::StylusMotionRoute::Canvas);
+        assert_eq!(
+            state.take_up_route(true),
+            super::ReleaseRoute::CanvasSurface
+        );
+        assert!(state.is_canvas_gesture());
+        state.lift_tip();
+        assert!(!state.is_canvas_gesture());
+
+        state.bind_tip(super::ContactOwner::InlineToolbar);
+        assert_eq!(
+            state.motion_route(false),
+            super::StylusMotionRoute::InlineStrip
+        );
+        assert_eq!(
+            state.take_up_route(false),
+            super::ReleaseRoute::InlineToolbar
+        );
+        assert!(!state.on_inline_strip());
+        state.set_over_inline_strip(true);
+        state.reset_contact();
+        assert!(!state.on_inline_strip());
+    }
+
     #[test]
     fn retiring_contact_drops_buffered_input_and_consumes_one_tip_up() {
         let mut state = TabletState::new(None, TabletSettings::default());
-        state.tip_down = true;
+        state.bind_tip(super::ContactOwner::Canvas);
         state.pressure_thickness = Some(7.0);
         state.peak_thickness = Some(9.0);
         state.pending_frame.down = true;
@@ -116,7 +281,7 @@ mod tests {
 
         state.retire_contact();
 
-        assert!(!state.tip_down);
+        assert!(!state.is_canvas_gesture());
         assert_eq!(state.pressure_thickness, None);
         assert_eq!(state.peak_thickness, None);
         assert!(!state.pending_frame.down);
@@ -124,4 +289,51 @@ mod tests {
         assert!(state.take_retired_contact());
         assert!(!state.take_retired_contact());
     }
+
+    #[test]
+    fn layer_shell_surface_keeps_its_motion_route_for_every_tip_owner() {
+        for inline in [false, true] {
+            for owner in [
+                super::ContactOwner::Canvas,
+                super::ContactOwner::InlineToolbar,
+            ] {
+                let mut state = TabletState::new(None, TabletSettings::default());
+                state.on_toolbar = true;
+                state.bind_tip(owner);
+                assert_eq!(
+                    state.motion_route(inline),
+                    super::StylusMotionRoute::LayerShellToolbar
+                );
+                state.retire_contact();
+                if matches!(owner, super::ContactOwner::Canvas) {
+                    assert_eq!(state.tip_owner, None);
+                    assert!(state.take_retired_contact());
+                } else {
+                    assert_eq!(state.tip_owner, Some(owner));
+                    assert!(!state.take_retired_contact());
+                    assert_eq!(
+                        state.take_up_route(inline),
+                        super::ReleaseRoute::InlineToolbar
+                    );
+                }
+                assert_eq!(
+                    state.motion_route(inline),
+                    super::StylusMotionRoute::LayerShellToolbar
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn palette_consumed_tip_drops_buffered_down_pressure_and_one_up() {
+        let mut state = TabletState::new(None, TabletSettings::default());
+        state.pending_frame.down = true;
+        state.pending_frame.pressure = Some(65_535);
+        state.consume_contact();
+        assert!(!state.pending_frame.down);
+        assert_eq!(state.pending_frame.pressure, None);
+        assert_eq!(state.tip_owner, None);
+        assert!(state.take_retired_contact());
+        assert!(!state.take_retired_contact());
+    }
 }
diff --git a/src/backend/wayland/state/tablet_runtime/pressure.rs b/src/backend/wayland/state/tablet_runtime/pressure.rs
new file mode 100644
index 000000000..a8826ab8a
--- /dev/null
+++ b/src/backend/wayland/state/tablet_runtime/pressure.rs
@@ -0,0 +1,135 @@
+use super::TabletState;
+use crate::draw::TextMeasurer;
+use crate::input::{InputState, tablet::try_apply_pressure_to_state_with};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(in crate::backend::wayland) enum StylusDownAdmission {
+    Canvas,
+    Onboarding,
+    Toast,
+    Popover,
+}
+
+impl TabletState {
+    /// Resolve opaque chrome before pressure can mutate the tool or its first sample.
+    pub(in crate::backend::wayland) fn prepare_chrome_down(
+        &mut self,
+        input: &mut InputState,
+        card: &mut super::super::onboarding::OnboardingCardChrome,
+        position: (f64, f64),
+        card_visible: bool,
+    ) -> StylusDownAdmission {
+        self.toast_press = None;
+
+        if card.accept_stylus_press(card_visible, position) {
+            return StylusDownAdmission::Onboarding;
+        }
+
+        // Toasts paint above the canvas and below the card, as for the mouse.
+        if let Some(press) =
+            input.toast_press_at(position.0.round() as i32, position.1.round() as i32)
+        {
+            self.toast_press = Some(press);
+            return StylusDownAdmission::Toast;
+        }
+
+        if input.close_top_toolbar_menus() {
+            return StylusDownAdmission::Popover;
+        }
+
+        StylusDownAdmission::Canvas
+    }
+
+    /// Apply pressure only after the press router admitted an actual drawing.
+    /// Hover and consumed popup contacts never mutate the drawing tool.
+    pub(in crate::backend::wayland) fn apply_canvas_pressure(
+        &mut self,
+        measurer: &TextMeasurer,
+        input: &mut InputState,
+        pressure: u32,
+    ) {
+        if !self.on_overlay
+            || self.on_toolbar
+            || self.contact_retired
+            || self.on_inline_strip()
+            || !self.is_canvas_gesture()
+            || input.screen_modal_is_active()
+            || input.command_palette_is_engaged()
+            || !matches!(input.state, crate::input::DrawingState::Drawing { .. })
+            || pressure == 0
+        {
+            return;
+        }
+
+        let first_sample = self.pressure_thickness.is_none();
+        if !try_apply_pressure_to_state_with(
+            measurer,
+            pressure as f64 / 65535.0,
+            input,
+            self.settings,
+        ) {
+            return;
+        }
+        let thickness = input.style.current_thickness;
+        if first_sample {
+            input.replace_active_drawing_pressure_samples_with(measurer, thickness);
+        }
+        self.pressure_thickness = Some(thickness);
+        self.peak_thickness = Some(
+            self.peak_thickness
+                .map_or(thickness, |peak| peak.max(thickness)),
+        );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::backend::wayland::state::contact_owner::ContactOwner;
+    use crate::input::{
+        MouseButton, state::test_support::make_test_input_state, tablet::TabletSettings,
+    };
+
+    #[test]
+    fn a_hard_strip_tap_cannot_change_tool_thickness_or_the_next_light_canvas_stroke() {
+        let measurer = TextMeasurer::default();
+        let mut input = make_test_input_state();
+        let initial = input.style.current_thickness;
+        let mut tablet = TabletState::new(
+            None,
+            TabletSettings {
+                enabled: true,
+                pressure_enabled: true,
+                min_thickness: 1.0,
+                max_thickness: 20.0,
+            },
+        );
+        tablet.on_overlay = true;
+
+        tablet.pending_frame.pressure = Some(65535);
+        tablet.bind_tip(ContactOwner::InlineToolbar);
+        assert_eq!(tablet.pending_frame.pressure, None);
+        tablet.apply_canvas_pressure(&measurer, &mut input, 65535);
+        tablet.pending_frame.pressure = Some(65535);
+        tablet.take_up_route(true);
+        assert_eq!(tablet.pending_frame.pressure, None);
+        tablet.apply_canvas_pressure(&measurer, &mut input, 65535);
+        assert_eq!(input.style.current_thickness, initial);
+        assert_eq!(tablet.pressure_thickness, None);
+        assert_eq!(tablet.peak_thickness, None);
+
+        // Pressure arrives before Down, then the caller takes the entire frame.
+        input.on_mouse_press(MouseButton::Left, 600, 400);
+        tablet.pending_frame.pressure = Some(4096);
+        tablet.pending_frame.down = true;
+        let pending = std::mem::take(&mut tablet.pending_frame);
+        tablet.bind_tip(ContactOwner::Canvas);
+        tablet.apply_canvas_pressure(&measurer, &mut input, pending.pressure.unwrap());
+        assert!(tablet.peak_thickness.unwrap() < 3.0);
+        assert_eq!(tablet.peak_thickness, tablet.pressure_thickness);
+        assert_eq!(
+            input.style.current_thickness,
+            tablet.peak_thickness.unwrap()
+        );
+    }
+}
diff --git a/src/backend/wayland/state/toolbar/drag/tests.rs b/src/backend/wayland/state/toolbar/drag/tests.rs
index 752af2e76..610c5b8c2 100644
--- a/src/backend/wayland/state/toolbar/drag/tests.rs
+++ b/src/backend/wayland/state/toolbar/drag/tests.rs
@@ -147,6 +147,42 @@ fn local_and_screen_events_remain_continuous_as_the_toolbar_moves() {
     );
 }
 
+#[cfg(feature = "tablet-input")]
+#[test]
+fn lifting_an_inline_pen_drag_does_not_replay_its_press_position() {
+    use crate::backend::wayland::state::contact_owner::{ContactOwner, ReleaseRoute};
+    use crate::backend::wayland::state::tablet_runtime::TabletState;
+    use crate::input::tablet::TabletSettings;
+
+    let start = (100.0, 20.0);
+    let moved = (140.0, 40.0);
+    let mut tablet = TabletState::new(None, TabletSettings::default());
+    tablet.on_overlay = true;
+    tablet.last_pos = Some(start);
+    tablet.bind_tip(ContactOwner::InlineToolbar);
+    let mut drag = ToolbarDrag::new();
+    drag.begin_move(MoveDragKind::Top, start, true, (24.0, 12.0));
+
+    let kind = drag.kind().unwrap();
+    tablet.record_immediate_motion(moved);
+    let delta = drag
+        .move_to(kind, MoveSample::Screen(moved), (0.0, 0.0))
+        .unwrap();
+    let mut offset = (24.0 + delta.0, 12.0 + delta.1);
+    assert_eq!(offset, (64.0, 32.0));
+
+    assert_eq!(tablet.take_up_route(true), ReleaseRoute::InlineToolbar);
+    let release = tablet.current_or_pending_position((140, 40));
+    let delta = drag
+        .move_to(kind, MoveSample::Screen(release), (0.0, 0.0))
+        .unwrap();
+    assert_eq!(delta, (0.0, 0.0), "lifting must preserve the moved toolbar");
+    offset = (offset.0 + delta.0, offset.1 + delta.1);
+    assert_eq!(offset, (64.0, 32.0));
+    assert!(drag.end_move().is_some());
+    assert!(!drag.is_moving());
+}
+
 #[test]
 fn local_motion_normalizes_the_initial_sample_before_applying_offsets() {
     let mut drag = moving(false);
diff --git a/src/backend/wayland/state/toolbar/events.rs b/src/backend/wayland/state/toolbar/events.rs
index f0bac09f5..d575ba966 100644
--- a/src/backend/wayland/state/toolbar/events.rs
+++ b/src/backend/wayland/state/toolbar/events.rs
@@ -293,7 +293,7 @@ impl WaylandState {
 
             #[cfg(feature = "tablet-input")]
             if thickness_event && self.sync_stylus_thickness_cache(prev_thickness) {
-                if self.tablet.tip_down {
+                if self.tablet.is_canvas_gesture() {
                     self.record_stylus_peak(self.input_state.style.current_thickness);
                 } else {
                     self.tablet.peak_thickness = None;
@@ -439,8 +439,7 @@ impl WaylandState {
             return false;
         }
 
-        self.tablet.base_thickness = Some(cur);
-        if self.tablet.tip_down {
+        if self.tablet.is_canvas_gesture() {
             self.tablet.pressure_thickness = Some(cur);
         } else {
             self.tablet.pressure_thickness = None;
diff --git a/src/backend/wayland/state/toolbar/events/session.rs b/src/backend/wayland/state/toolbar/events/session.rs
index 8b14a7b2a..795766c14 100644
--- a/src/backend/wayland/state/toolbar/events/session.rs
+++ b/src/backend/wayland/state/toolbar/events/session.rs
@@ -108,6 +108,7 @@ fn recent_session_snapshots(
 
 mod dialog;
 mod home;
+mod queued;
 
 pub(in crate::backend::wayland::state) use dialog::SessionFileDialogController;
 pub(super) use dialog::{SessionFileDialogMode, ensure_save_as_extension};
@@ -427,6 +428,19 @@ impl WaylandState {
                     self.set_session_toolbar_info(format!("Opened session {name}"));
                 }
             }
+            SessionCommandReport::Output {
+                abandoned,
+                too_large,
+                first_output_resolved,
+            } => {
+                if let Some(too_large) = too_large {
+                    self.protect_too_large_session(too_large);
+                }
+                if let Some((remembered, reason)) = abandoned {
+                    self.notify_remembered_session_abandoned(&remembered, &reason);
+                }
+                self.announce_launch_restore(first_output_resolved);
+            }
             SessionCommandReport::Home => self.finish_open_home_session(),
             SessionCommandReport::SaveAs(report) => {
                 self.clear_toolbar_save_as_overwrite_prompt();
@@ -511,6 +525,7 @@ impl WaylandState {
             return;
         }
         let prefix = match command {
+            SessionCommand::Output { .. } => return self.fail_output_session_command(error),
             SessionCommand::Open(_) => "Open session failed",
             SessionCommand::OpenHome(_) => "Return to the home session failed",
             SessionCommand::SaveAs(..) | SessionCommand::CheckOverwrite(_) => "Save session failed",
@@ -522,6 +537,39 @@ impl WaylandState {
         self.report_session_command_error(prefix, error);
     }
 
+    fn fail_output_session_command(&mut self, error: &AnyhowError) {
+        let preservation_failed = error
+            .downcast_ref::<crate::session::CorruptArtifactPreservationFailed>()
+            .is_some();
+        let source_unwritable = error
+            .downcast_ref::<crate::backend::wayland::session::SourceWriteRefused>()
+            .is_some();
+        let backoff = self.output_transition_failure_backoff();
+        if !crate::backend::wayland::session::driver::defer_failed_output(
+            &mut self.session,
+            error,
+            std::time::Instant::now(),
+            backoff,
+        ) {
+            log::debug!("Output session transition requeued after guard abort: {error:#}");
+            return;
+        }
+        log::warn!("Output session transition deferred after persistence failure: {error:#}");
+        if preservation_failed {
+            self.notify_session_load_failure(error);
+        } else if source_unwritable {
+            if self.session.mark_output_transition_notified() {
+                self.input_state.push_toast(
+                    ToastPriority::Critical,
+                    "session.save",
+                    Toast::error(format!("Drawings kept on screen: {error:#}")).duration_ms(20_000),
+                );
+            }
+        } else if self.session.is_loaded() {
+            self.notify_output_transition_deferred();
+        }
+    }
+
     pub(in crate::backend::wayland) fn report_session_command_error(
         &mut self,
         prefix: &str,
@@ -621,74 +669,4 @@ fn dialog_frame_accepted(phase: DialogFramePhase, outcome: RenderOutcome) -> boo
 }
 
 #[cfg(test)]
-mod tests {
-    use super::{DialogFramePhase, dialog_frame_accepted, populate_session_snapshot};
-    use crate::backend::wayland::session::{SessionHome, SessionLaunch};
-    use crate::backend::wayland::state::RenderOutcome;
-    use crate::backend::wayland::state::toolbar::ToolbarSnapshot;
-    use crate::session::SessionTarget;
-
-    #[test]
-    fn the_session_menu_learns_home_and_whether_it_is_active() {
-        let input = crate::input::state::test_support::make_test_input_state();
-        let mut snapshot = ToolbarSnapshot::from_input_with_bindings(&input, Default::default());
-        let home = std::path::PathBuf::from("/sessions/home.wayscriber-session");
-        let away = SessionHome::new(
-            SessionLaunch {
-                home: crate::backend::wayland::session::HomeSession::Named(home),
-                preferred: None,
-                from_daemon: true,
-            },
-            None,
-            SessionTarget::NamedFile("/sessions/b.wayscriber-session".into()),
-        );
-
-        populate_session_snapshot(&mut snapshot, None, &away);
-
-        assert_eq!(
-            snapshot.home_session_name.as_deref(),
-            Some("home.wayscriber-session")
-        );
-        assert!(!snapshot.at_home_session);
-    }
-
-    #[test]
-    fn dialog_entry_requires_a_committed_frame() {
-        assert!(dialog_frame_accepted(
-            DialogFramePhase::Entry,
-            RenderOutcome::Committed {
-                keep_rendering: false
-            }
-        ));
-        assert!(dialog_frame_accepted(
-            DialogFramePhase::Entry,
-            RenderOutcome::Committed {
-                keep_rendering: true
-            }
-        ));
-        assert!(!dialog_frame_accepted(
-            DialogFramePhase::Entry,
-            RenderOutcome::BuffersInFlight
-        ));
-    }
-
-    #[test]
-    fn dialog_restoration_accepts_a_deferred_frame() {
-        assert!(dialog_frame_accepted(
-            DialogFramePhase::Restoration,
-            RenderOutcome::Committed {
-                keep_rendering: false
-            }
-        ));
-        assert!(dialog_frame_accepted(
-            DialogFramePhase::Restoration,
-            RenderOutcome::Committed {
-                keep_rendering: true
-            }
-        ));
-        assert!(dialog_frame_accepted(
-            DialogFramePhase::Restoration,
-            RenderOutcome::BuffersInFlight
-        ));
-    }
-}
+mod tests;
diff --git a/src/backend/wayland/state/toolbar/events/session/queued.rs b/src/backend/wayland/state/toolbar/events/session/queued.rs
new file mode 100644
index 000000000..fffed9efa
--- /dev/null
+++ b/src/backend/wayland/state/toolbar/events/session/queued.rs
@@ -0,0 +1,67 @@
+use super::*;
+
+impl WaylandState {
+    /// One toast names every queued command that will not run, since each
+    /// session toast replaces the last. At exit the toast is never seen, so a
+    /// desktop notification names the commands that were requested but lost.
+    pub(in crate::backend::wayland) fn fail_queued_session_commands(
+        &mut self,
+        failures: Vec<(SessionCommand, AnyhowError)>,
+        closing: bool,
+    ) {
+        if closing {
+            // Reading info and forgetting a missing entry change nothing worth naming.
+            let lost = failures
+                .iter()
+                .filter(|(command, _)| {
+                    !matches!(command, SessionCommand::Inspect | SessionCommand::Forget(_))
+                })
+                .map(|(command, _)| queued_command_label(command))
+                .collect::<Vec<_>>();
+            if !lost.is_empty() {
+                crate::notification::send_notification_async(
+                    &self.tokio_handle,
+                    "Session Commands Not Run".to_string(),
+                    format!(
+                        "Wayscriber closed before it could run: {}. Run them again after restarting.",
+                        lost.join("; ")
+                    ),
+                    Some("dialog-warning".to_string()),
+                );
+            }
+        }
+
+        match failures.as_slice() {
+            [] => {}
+            [(command, error)] => self.fail_session_command(command, error),
+            _ => {
+                let summary = failures
+                    .iter()
+                    .map(|(command, error)| format!("{}: {error:#}", queued_command_label(command)))
+                    .collect::<Vec<_>>()
+                    .join("; ");
+                self.set_session_toolbar_error(format!(
+                    "Queued session commands did not run: {summary}"
+                ));
+            }
+        }
+    }
+}
+
+/// What a queued command would have done, for a report that it did not run.
+fn queued_command_label(command: &SessionCommand) -> String {
+    match command {
+        SessionCommand::Open(path) => format!("open {}", session_display_name(path)),
+        SessionCommand::OpenHome(_) => "return to the home session".to_string(),
+        SessionCommand::SaveAs(path, _) | SessionCommand::CheckOverwrite(path) => {
+            format!("save as {}", session_display_name(path))
+        }
+        SessionCommand::Clear => "clear the session".to_string(),
+        SessionCommand::ClearTools(_) => "reset tool defaults".to_string(),
+        SessionCommand::Output { .. } => "switch the output session".to_string(),
+        SessionCommand::Inspect => "show session info".to_string(),
+        SessionCommand::Forget(path) => {
+            format!("forget recent session {}", session_display_name(path))
+        }
+    }
+}
diff --git a/src/backend/wayland/state/toolbar/events/session/tests.rs b/src/backend/wayland/state/toolbar/events/session/tests.rs
new file mode 100644
index 000000000..72a156b19
--- /dev/null
+++ b/src/backend/wayland/state/toolbar/events/session/tests.rs
@@ -0,0 +1,98 @@
+use super::{DialogFramePhase, dialog_frame_accepted, populate_session_snapshot};
+use crate::backend::wayland::session::{SessionHome, SessionLaunch};
+use crate::backend::wayland::state::RenderOutcome;
+use crate::backend::wayland::state::toolbar::ToolbarSnapshot;
+use crate::session::SessionTarget;
+
+#[test]
+fn queued_commands_that_did_not_run_are_all_named_in_one_toast() {
+    use crate::backend::wayland::handlers::test_support::HandlerFixture;
+    use crate::backend::wayland::session::SessionCommand;
+    let mut fixture = HandlerFixture::new(crate::config::Config::default());
+    let reason = || anyhow::anyhow!("the visible session changed");
+
+    fixture.state.fail_queued_session_commands(
+        vec![
+            (
+                SessionCommand::SaveAs(
+                    "/sessions/copy.wayscriber-session".into(),
+                    crate::session::SaveAsOverwrite::Deny,
+                ),
+                reason(),
+            ),
+            (SessionCommand::Clear, reason()),
+        ],
+        false,
+    );
+
+    let message = &fixture.state.input_state.active_toast().unwrap().message;
+    assert!(
+        message.contains("save as copy.wayscriber-session")
+            && message.contains("clear the session"),
+        "{message}"
+    );
+}
+
+#[test]
+fn the_session_menu_learns_home_and_whether_it_is_active() {
+    let input = crate::input::state::test_support::make_test_input_state();
+    let mut snapshot = ToolbarSnapshot::from_input_with_bindings(&input, Default::default());
+    let home = std::path::PathBuf::from("/sessions/home.wayscriber-session");
+    let away = SessionHome::new(
+        SessionLaunch {
+            home: crate::backend::wayland::session::HomeSession::Named(home),
+            preferred: None,
+            from_daemon: true,
+        },
+        None,
+        SessionTarget::NamedFile("/sessions/b.wayscriber-session".into()),
+    );
+
+    populate_session_snapshot(&mut snapshot, None, &away);
+
+    assert_eq!(
+        snapshot.home_session_name.as_deref(),
+        Some("home.wayscriber-session")
+    );
+    assert!(!snapshot.at_home_session);
+}
+
+#[test]
+fn dialog_entry_requires_a_committed_frame() {
+    assert!(dialog_frame_accepted(
+        DialogFramePhase::Entry,
+        RenderOutcome::Committed {
+            keep_rendering: false
+        }
+    ));
+    assert!(dialog_frame_accepted(
+        DialogFramePhase::Entry,
+        RenderOutcome::Committed {
+            keep_rendering: true
+        }
+    ));
+    assert!(!dialog_frame_accepted(
+        DialogFramePhase::Entry,
+        RenderOutcome::BuffersInFlight
+    ));
+}
+
+#[test]
+fn dialog_restoration_accepts_a_deferred_frame() {
+    assert!(dialog_frame_accepted(
+        DialogFramePhase::Restoration,
+        RenderOutcome::Committed {
+            keep_rendering: false
+        }
+    ));
+    assert!(dialog_frame_accepted(
+        DialogFramePhase::Restoration,
+        RenderOutcome::Committed {
+            keep_rendering: true
+        }
+    ));
+    assert!(dialog_frame_accepted(
+        DialogFramePhase::Restoration,
+        RenderOutcome::BuffersInFlight
+    ));
+}
diff --git a/src/backend/wayland/state/toolbar/fade.rs b/src/backend/wayland/state/toolbar/fade.rs
index 7e7cd60a8..efa3caa9f 100644
--- a/src/backend/wayland/state/toolbar/fade.rs
+++ b/src/backend/wayland/state/toolbar/fade.rs
@@ -119,10 +119,7 @@ impl WaylandState {
     /// either does. The toolbar surfaces report their own hover.
     fn canvas_hover_point(&self) -> Option<(f64, f64)> {
         #[cfg(feature = "tablet-input")]
-        if self.tablet.on_overlay
-            && !self.tablet.on_toolbar
-            && let Some(point) = self.tablet.last_pos
-        {
+        if let Some(point) = self.tablet.canvas_point() {
             return Some(point);
         }
         if !self.focus.pointer_focused() || self.toolbar_chrome.pointer_over_toolbar() {
diff --git a/src/backend/wayland/state/toolbar/inline/input.rs b/src/backend/wayland/state/toolbar/inline/input.rs
index b9bae4708..dd5ed3e44 100644
--- a/src/backend/wayland/state/toolbar/inline/input.rs
+++ b/src/backend/wayland/state/toolbar/inline/input.rs
@@ -1,8 +1,47 @@
 use std::time::Instant;
 
 use super::*;
+use crate::backend::wayland::state::contact_owner::{InlinePress, inline_primary_press};
 
 impl WaylandState {
+    /// Clears hover while a canvas contact crosses the inline strip.
+    pub(in crate::backend::wayland) fn clear_inline_contact_hover(&mut self) {
+        let changed = self.toolbar_chrome.clear_inline_hover();
+        self.toolbar_chrome.set_pointer_over_toolbar(false);
+        if changed {
+            self.mark_inline_toolbar_full_damage();
+        }
+    }
+
+    pub(in crate::backend::wayland) fn inline_toolbar_contains(
+        &self,
+        position: (f64, f64),
+    ) -> bool {
+        self.toolbar_chrome.inline_toolbars()
+            && self.toolbar.is_visible()
+            && self.toolbar.is_top_visible()
+            && self.toolbar_chrome.inline_contains(position)
+    }
+
+    pub(in crate::backend::wayland) fn inline_toolbar_primary_press_or_strip(
+        &mut self,
+        position: (f64, f64),
+        conn: Option<&wayland_client::Connection>,
+        qh: Option<&wayland_client::QueueHandle<Self>>,
+    ) -> bool {
+        let control = self.inline_toolbar_press(position, conn, qh);
+        let over_strip = self.inline_toolbar_contains(position);
+        let card = self
+            .onboarding_card_press_at(position.0, position.1)
+            .is_some();
+        let press = inline_primary_press(control, over_strip, card);
+        if press == Some(InlinePress::Strip) {
+            self.toolbar_chrome.set_pointer_over_toolbar(true);
+            self.dismiss_top_toolbar_menus();
+        }
+        press.is_some()
+    }
+
     pub(in crate::backend::wayland) fn inline_toolbar_hit_at(
         &self,
         position: (f64, f64),
diff --git a/src/canvas_export/tests/board_grid.rs b/src/canvas_export/tests/board_grid.rs
index 051a6c6fb..c704ed7d2 100644
--- a/src/canvas_export/tests/board_grid.rs
+++ b/src/canvas_export/tests/board_grid.rs
@@ -160,9 +160,6 @@ fn board_grid_pdf_stays_vector_without_erasers_and_leaves_margins_plain() {
 
 fn check_pdf_pixels(pdf: &[u8], expected: &cairo::ImageSurface) {
     use std::process::Command;
-    if Command::new("pdftoppm").arg("-v").output().is_err() {
-        return;
-    }
     let folder = crate::test_temp::tempdir().unwrap();
     let path = folder.path().join("paper.pdf");
     let prefix = folder.path().join("paper");
@@ -172,7 +169,7 @@ fn check_pdf_pixels(pdf: &[u8], expected: &cairo::ImageSurface) {
         .arg(&path)
         .arg(&prefix)
         .output()
-        .unwrap();
+        .expect("pdftoppm is required for PDF raster assertions; install poppler and retry");
     assert!(
         output.status.success(),
         "{}",
diff --git a/src/canvas_export/tests/cache_tests.rs b/src/canvas_export/tests/cache_tests.rs
index 8c1a70b61..ab055c5f2 100644
--- a/src/canvas_export/tests/cache_tests.rs
+++ b/src/canvas_export/tests/cache_tests.rs
@@ -128,9 +128,6 @@ fn pdf_pages_keep_distinct_blurred_backdrops_when_rasterized() {
         resolve_pdf_page_layout,
     };
     use std::process::Command;
-    if Command::new("pdftoppm").arg("-v").output().is_err() {
-        return;
-    }
     let mut frame = Frame::new();
     frame.add_shape(Shape::BlurRect {
         x: 2,
@@ -204,7 +201,7 @@ fn pdf_pages_keep_distinct_blurred_backdrops_when_rasterized() {
         .arg(&path)
         .arg(&prefix)
         .output()
-        .unwrap();
+        .expect("pdftoppm is required for PDF raster assertions; install poppler and retry");
     assert!(
         result.status.success(),
         "{}",
diff --git a/src/config/AGENTS.md b/src/config/AGENTS.md
index fe199e79c..9b9def6be 100644
--- a/src/config/AGENTS.md
+++ b/src/config/AGENTS.md
@@ -15,6 +15,7 @@
 - Preserve serde compatibility, documented defaults, validation warning behavior, and feature-gated schema output.
 - Do not silently drop invalid user config; validation should make coercion or rejection explicit.
 - Keep action labels/categories aligned with help overlay, command palette, keybindings, configurator labels, and docs.
+- Config code must not import `draw` or `ui`; `tests/repository_guards/shared_dependencies.rs` enforces it. A few stable drawing values are allowed there by exact spelling until they move to `domain`; config tests may build runtime consumers.
 - **Exception (top-only toolbar retirement):** panel-era typed fields may leave the serde model when they are deliberately retired. Authored `config.toml` values for those exact paths stay in the raw document as `RetiredSetting` (see `RETIRED_SETTING_PATHS` in `document.rs`) rather than as inert typed fields. This is a documented Rust source-compatibility break; do not treat it as a silent unknown-key drop.
 
 ## Coupled Changes
diff --git a/src/config/io.rs b/src/config/io.rs
index 7ca5ba1d8..91cd3a247 100644
--- a/src/config/io.rs
+++ b/src/config/io.rs
@@ -6,7 +6,7 @@ use super::salvage::deserialize_salvaging;
 use super::types::{PRESET_SLOTS_MAX, ToolPresetConfig};
 use super::validate::ConfigValidationReport;
 use super::{Config, ConfigDocument};
-use crate::draw::Color;
+use crate::domain::Color;
 use crate::durable_io::{
     AtomicWriteOptions, DestinationExpectation, DurableIoError, FileIdentity, OverwriteMode,
     SymlinkPolicy,
diff --git a/src/config/tests/document.rs b/src/config/tests/document.rs
index a5c922855..e0dfd9c25 100644
--- a/src/config/tests/document.rs
+++ b/src/config/tests/document.rs
@@ -1758,7 +1758,11 @@ fn exact_revision_detects_same_timestamp_content_replacement() {
     let error = document
         .save_with_backup(document.config().clone())
         .expect_err("same-time content replacement must conflict");
-    assert!(error.to_string().contains("changed on disk"));
+    assert!(
+        error
+            .downcast_ref::<crate::config::ConfigSourceChanged>()
+            .is_some()
+    );
     assert!(fs::read_to_string(&temp.path).unwrap().contains("144"));
 }
 
@@ -1778,8 +1782,8 @@ fn exact_revision_detects_content_replacement_with_rolled_back_timestamp() {
         document
             .save_with_backup(document.config().clone())
             .expect_err("older timestamp must not hide changed content")
-            .to_string()
-            .contains("changed on disk")
+            .downcast_ref::<crate::config::ConfigSourceChanged>()
+            .is_some()
     );
 }
 
@@ -1810,8 +1814,8 @@ fn exact_revision_detects_deletion_creation_and_unsupported_replacement() {
         deleted_document
             .save_with_backup(deleted_document.config().clone())
             .expect_err("deletion must conflict")
-            .to_string()
-            .contains("changed on disk")
+            .downcast_ref::<crate::config::ConfigSourceChanged>()
+            .is_some()
     );
 
     let created = TempConfig::new("created");
@@ -1822,8 +1826,8 @@ fn exact_revision_detects_deletion_creation_and_unsupported_replacement() {
         created_document
             .save_with_backup(created_document.config().clone())
             .expect_err("creation must conflict")
-            .to_string()
-            .contains("changed on disk")
+            .downcast_ref::<crate::config::ConfigSourceChanged>()
+            .is_some()
     );
 
     let replaced = TempConfig::new("directory-replacement");
@@ -1860,8 +1864,8 @@ fn exact_revision_detects_changed_symlink_target_with_identical_content() {
         document
             .save_with_backup(document.config().clone())
             .expect_err("symlink target replacement must conflict")
-            .to_string()
-            .contains("changed on disk")
+            .downcast_ref::<crate::config::ConfigSourceChanged>()
+            .is_some()
     );
 }
 
diff --git a/src/config/tests/file_io.rs b/src/config/tests/file_io.rs
index f65042dfb..fe093dba0 100644
--- a/src/config/tests/file_io.rs
+++ b/src/config/tests/file_io.rs
@@ -403,7 +403,7 @@ color = "#00FF00"
         .unwrap();
 
         Config::update_file(|config| {
-            let crimson = crate::draw::Color {
+            let crimson = crate::domain::Color {
                 r: 220.0 / 255.0,
                 g: 20.0 / 255.0,
                 b: 60.0 / 255.0,
@@ -423,7 +423,7 @@ color = "#00FF00"
         let palette = QuickColorPalette::from_config(&reloaded.drawing.quick_colors);
         assert_eq!(
             palette.color_for_index(1),
-            Some(crate::draw::Color {
+            Some(crate::domain::Color {
                 r: 220.0 / 255.0,
                 g: 20.0 / 255.0,
                 b: 60.0 / 255.0,
@@ -438,7 +438,7 @@ color = "#00FF00"
         );
         assert_eq!(
             palette.color_for_index(0),
-            Some(crate::draw::Color {
+            Some(crate::domain::Color {
                 r: 1.0,
                 g: 0.0,
                 b: 0.0,
diff --git a/src/config/tests/load.rs b/src/config/tests/load.rs
index 4e9ecbf2c..2fdaeaf2e 100644
--- a/src/config/tests/load.rs
+++ b/src/config/tests/load.rs
@@ -813,7 +813,7 @@ fn drawing_quick_colors_parse_ordered_entries_with_hex_and_rgb() {
     let palette = QuickColorPalette::from_config(&config.drawing.quick_colors);
     assert!(color_approx_eq(
         &palette.color_for_index(0).unwrap(),
-        &crate::draw::Color {
+        &crate::domain::Color {
             r: 1.0,
             g: 179.0 / 255.0,
             b: 186.0 / 255.0,
@@ -822,7 +822,7 @@ fn drawing_quick_colors_parse_ordered_entries_with_hex_and_rgb() {
     ));
     assert!(color_approx_eq(
         &palette.color_for_index(1).unwrap(),
-        &crate::draw::Color {
+        &crate::domain::Color {
             r: 1.0 / 255.0,
             g: 2.0 / 255.0,
             b: 3.0 / 255.0,
@@ -873,7 +873,7 @@ fn quick_colors_set_color_at_keeps_labels_and_materializes_defaults() {
     let mut config: Config =
         toml::from_str("[[drawing.quick_colors]]\nlabel = 'Only'\ncolor = 'blue'\n")
             .expect("short quick color list should parse");
-    let crimson = crate::draw::Color {
+    let crimson = crate::domain::Color {
         r: 220.0 / 255.0,
         g: 20.0 / 255.0,
         b: 60.0 / 255.0,
@@ -917,7 +917,7 @@ fn quick_colors_set_color_at_keeps_labels_and_materializes_defaults() {
 fn quick_colors_set_color_at_starts_from_defaults_when_unconfigured() {
     let mut config = Config::default();
     assert!(config.drawing.quick_colors.is_implicit_default());
-    let teal = crate::draw::Color {
+    let teal = crate::domain::Color {
         r: 0.0,
         g: 128.0 / 255.0,
         b: 128.0 / 255.0,
@@ -969,7 +969,7 @@ fn shipped_quick_color_defaults_cover_only_the_built_in_palette() {
 fn palette_set_color_for_index_recolors_in_place() {
     let mut palette = QuickColorPalette::default();
     let label = palette.entry(1).map(|entry| entry.label.clone());
-    let color = crate::draw::Color {
+    let color = crate::domain::Color {
         r: 0.25,
         g: 0.5,
         b: 0.75,
@@ -993,7 +993,7 @@ fn palette_set_color_for_index_recolors_in_place() {
 #[test]
 fn palette_cache_key_changes_when_only_a_slot_alpha_changes() {
     let mut palette = QuickColorPalette::default();
-    let opaque = crate::draw::Color {
+    let opaque = crate::domain::Color {
         r: 0.25,
         g: 0.5,
         b: 0.75,
@@ -1002,7 +1002,7 @@ fn palette_cache_key_changes_when_only_a_slot_alpha_changes() {
     assert!(palette.set_color_for_index(1, opaque));
     let before = palette.cache_key();
 
-    assert!(palette.set_color_for_index(1, crate::draw::Color { a: 0.4, ..opaque }));
+    assert!(palette.set_color_for_index(1, crate::domain::Color { a: 0.4, ..opaque }));
 
     assert_ne!(palette.cache_key(), before);
 }
@@ -1036,7 +1036,7 @@ fn drawing_quick_colors_default_palette_preserves_extended_toolbar_colors() {
     );
     assert!(color_approx_eq(
         &palette.color_for_index(8).unwrap(),
-        &crate::draw::Color {
+        &crate::domain::Color {
             r: 0.0,
             g: 1.0,
             b: 1.0,
@@ -1045,7 +1045,7 @@ fn drawing_quick_colors_default_palette_preserves_extended_toolbar_colors() {
     ));
     assert!(color_approx_eq(
         &palette.color_for_index(9).unwrap(),
-        &crate::draw::Color {
+        &crate::domain::Color {
             r: 153.0 / 255.0,
             g: 102.0 / 255.0,
             b: 204.0 / 255.0,
@@ -1054,7 +1054,7 @@ fn drawing_quick_colors_default_palette_preserves_extended_toolbar_colors() {
     ));
     assert!(color_approx_eq(
         &palette.color_for_index(10).unwrap(),
-        &crate::draw::Color {
+        &crate::domain::Color {
             r: 102.0 / 255.0,
             g: 102.0 / 255.0,
             b: 102.0 / 255.0,
@@ -1166,7 +1166,7 @@ fn drawing_quick_color_rendered_entries_are_capped_without_dropping_config() {
     let entries = (0..QUICK_COLOR_RENDER_LIMIT + 3)
         .map(|index| QuickColorPaletteEntry {
             label: format!("Color {index}"),
-            color: crate::draw::Color {
+            color: crate::domain::Color {
                 r: 0.0,
                 g: 0.0,
                 b: 0.0,
@@ -1245,11 +1245,11 @@ fn pdf_transparent_background_defaults_to_none() {
 
 /// Resolves one of the tuned built-in palette hex values exactly like
 /// `ColorSpec::to_color`, so assertions can compare with `==`.
-fn tuned_default(hex: &str) -> crate::draw::Color {
+fn tuned_default(hex: &str) -> crate::domain::Color {
     crate::util::parse_config_hex_color(hex).expect("tuned default hex is valid")
 }
 
-fn color_approx_eq(a: &crate::draw::Color, b: &crate::draw::Color) -> bool {
+fn color_approx_eq(a: &crate::domain::Color, b: &crate::domain::Color) -> bool {
     (a.r - b.r).abs() < 0.001
         && (a.g - b.g).abs() < 0.001
         && (a.b - b.b).abs() < 0.001
diff --git a/src/config/tests/validate.rs b/src/config/tests/validate.rs
index 844b16639..514cc4aa7 100644
--- a/src/config/tests/validate.rs
+++ b/src/config/tests/validate.rs
@@ -991,7 +991,7 @@ fn drawing_drag_tool_defaults_match_legacy_mapping() {
 #[test]
 fn opaque_colors_still_serialize_without_an_alpha_component() {
     use crate::config::ColorSpec;
-    use crate::draw::Color;
+    use crate::domain::Color;
 
     let opaque = Color {
         r: 1.0,
diff --git a/src/config/tests/write_lock.rs b/src/config/tests/write_lock.rs
index 6784fa5ed..088d404b7 100644
--- a/src/config/tests/write_lock.rs
+++ b/src/config/tests/write_lock.rs
@@ -13,7 +13,7 @@
 
 use super::super::io::{persist_preset_slot_at, persist_quick_color_at};
 use super::super::{ColorSpec, ToolPresetConfig};
-use crate::draw::Color;
+use crate::domain::Color;
 use std::fs::{self, File, OpenOptions};
 use std::path::{Path, PathBuf};
 use std::sync::Barrier;
diff --git a/src/config/tests/write_target.rs b/src/config/tests/write_target.rs
index 7db588656..03bb440c2 100644
--- a/src/config/tests/write_target.rs
+++ b/src/config/tests/write_target.rs
@@ -27,7 +27,7 @@
 
 use super::super::io::{is_stale_source_error, persist_preset_slot_at};
 use super::super::{ColorSpec, ConfigDocument, ToolPresetConfig};
-use crate::draw::Color;
+use crate::domain::Color;
 use std::fs::{self, File, OpenOptions};
 use std::os::unix::fs::{MetadataExt, symlink};
 use std::path::{Path, PathBuf};
diff --git a/src/env_vars.rs b/src/env_vars.rs
index 1e61e4283..ae6af1616 100644
--- a/src/env_vars.rs
+++ b/src/env_vars.rs
@@ -1,5 +1,3 @@
-#![allow(dead_code)]
-
 pub const APP_ID_ENV: &str = "WAYSCRIBER_APP_ID";
 pub const PORTAL_APP_ID_ENV: &str = "WAYSCRIBER_PORTAL_APP_ID";
 pub const PORTAL_SHORTCUT_ENV: &str = "WAYSCRIBER_PORTAL_SHORTCUT";
diff --git a/src/input/state/core/board_picker/appearance.rs b/src/input/state/core/board_picker/appearance.rs
index 8287f68a9..21e954981 100644
--- a/src/input/state/core/board_picker/appearance.rs
+++ b/src/input/state/core/board_picker/appearance.rs
@@ -633,13 +633,15 @@ impl InputState {
         true
     }
 
-    pub(crate) fn board_appearance_drag_to(&mut self, x: i32, y: i32) -> bool {
-        let dragging = self
-            .board_picker
+    pub(crate) fn board_appearance_is_size_dragging(&self) -> bool {
+        self.board_picker
             .appearance
             .as_ref()
-            .is_some_and(|edit| edit.size_dragging);
-        if !dragging {
+            .is_some_and(|edit| edit.size_dragging)
+    }
+
+    pub(crate) fn board_appearance_drag_to(&mut self, x: i32, y: i32) -> bool {
+        if !self.board_appearance_is_size_dragging() {
             return false;
         }
         let (Some(frame), Some(row)) = (
@@ -684,11 +686,6 @@ impl InputState {
         true
     }
 
-    pub(crate) fn board_appearance_click(&mut self, x: i32, y: i32) -> bool {
-        let measurer = TextMeasurer::default();
-        self.board_appearance_click_with_measurer(&measurer, x, y)
-    }
-
     pub(crate) fn board_appearance_click_with_measurer(
         &mut self,
         measurer: &TextMeasurer,
diff --git a/src/input/state/core/board_picker/appearance/tests.rs b/src/input/state/core/board_picker/appearance/tests.rs
index b96791cf7..e5e9c5013 100644
--- a/src/input/state/core/board_picker/appearance/tests.rs
+++ b/src/input/state/core/board_picker/appearance/tests.rs
@@ -223,7 +223,28 @@ fn dragging_the_size_slider_updates_the_draft_until_release() {
     let (track_x, track_y, track_width, track_height) = track;
     let middle_y = (track_y + track_height / 2.0) as i32;
 
-    assert!(input.board_appearance_press(track_x as i32 + 1, middle_y));
+    use crate::input::state::interaction::{
+        CanvasPoint, PointerPoints, PointerPress, ScreenPoint, route_pointer_press,
+    };
+    let measurer = crate::draw::TextMeasurer::default();
+    let ui_engine = crate::ui_text::UiTextEngine::default();
+    let start = (track_x as i32 + 1, middle_y);
+    let slider_press = route_pointer_press(
+        &mut input,
+        crate::input::state::InputTextResources {
+            measurer: &measurer,
+            ui_engine: &ui_engine,
+        },
+        PointerPress::new(
+            crate::input::MouseButton::Left,
+            PointerPoints::new(
+                ScreenPoint::new(start.0, start.1),
+                CanvasPoint::new(start.0, start.1),
+            ),
+        ),
+    );
+    // The drag keeps the pointer even where the inline strip would take hover.
+    assert!(slider_press.owns_pointer_motion(&input));
     assert_eq!(input.board_appearance_edit().unwrap().spacing, "8");
     assert!(input.board_appearance_drag_to((track_x + track_width) as i32, middle_y));
     assert_eq!(input.board_appearance_edit().unwrap().spacing, "200");
@@ -232,6 +253,7 @@ fn dragging_the_size_slider_updates_the_draft_until_release() {
     assert!(input.board_appearance_click(1, 1));
     let draft = input.board_appearance_edit().unwrap();
     assert!(!draft.size_dragging);
+    assert!(!slider_press.owns_pointer_motion(&input));
     assert_eq!(draft.spacing, "200");
     assert!(!input.board_appearance_drag_to(track_x as i32, middle_y));
     assert!(!input.is_session_dirty());
diff --git a/src/input/state/core/board_picker/layout/helpers.rs b/src/input/state/core/board_picker/layout/helpers.rs
index 5f3d61672..b19f53ebf 100644
--- a/src/input/state/core/board_picker/layout/helpers.rs
+++ b/src/input/state/core/board_picker/layout/helpers.rs
@@ -5,10 +5,6 @@ use super::super::{BoardPickerLayout, PAGE_NAME_HEIGHT, PAGE_NAME_PADDING, PAGE_
 pub(super) struct PagePanelInfo {
     pub page_count: usize,
     pub cols: usize,
-    pub rows: usize,
-    pub total_rows: usize,
-    pub scroll_row: usize,
-    pub max_scroll_row: usize,
     pub first_visible_page: usize,
     pub visible_pages: usize,
     pub visible_slots: usize,
@@ -42,10 +38,6 @@ impl InputState {
         Some(PagePanelInfo {
             page_count,
             cols,
-            rows,
-            total_rows: layout.page_total_rows,
-            scroll_row: layout.page_scroll_row,
-            max_scroll_row: layout.page_max_scroll_row,
             first_visible_page,
             visible_pages,
             visible_slots: layout.page_visible_slots.min(slot_count),
@@ -71,31 +63,6 @@ impl InputState {
         (page_index < info.page_count).then_some(page_index)
     }
 
-    pub(super) fn board_picker_page_index_to_slot(
-        &self,
-        layout: &BoardPickerLayout,
-        board_index: usize,
-        page_index: usize,
-    ) -> Option<usize> {
-        let info = self.board_picker_page_panel_info(layout, board_index)?;
-        if page_index < info.first_visible_page {
-            return None;
-        }
-        let slot = page_index - info.first_visible_page;
-        (slot < info.visible_slots && page_index < info.page_count).then_some(slot)
-    }
-
-    pub(super) fn board_picker_page_thumb_origin(
-        &self,
-        layout: &BoardPickerLayout,
-        board_index: usize,
-        page_index: usize,
-    ) -> Option<(PagePanelInfo, usize, usize, f64, f64)> {
-        let info = self.board_picker_page_panel_info(layout, board_index)?;
-        let slot = self.board_picker_page_index_to_slot(layout, board_index, page_index)?;
-        self.board_picker_page_thumb_origin_for_slot(layout, info, slot)
-    }
-
     pub(super) fn board_picker_page_thumb_origin_for_slot(
         &self,
         layout: &BoardPickerLayout,
diff --git a/src/input/state/core/board_picker/mod.rs b/src/input/state/core/board_picker/mod.rs
index 76142a4eb..433322474 100644
--- a/src/input/state/core/board_picker/mod.rs
+++ b/src/input/state/core/board_picker/mod.rs
@@ -1,5 +1,3 @@
-#![allow(dead_code)]
-
 pub(crate) mod appearance;
 mod layout;
 mod panel;
@@ -9,7 +7,6 @@ mod state;
 use std::time::Duration;
 
 use crate::draw::{BLACK, BLUE, Color, GREEN, ORANGE, PINK, RED, WHITE, YELLOW};
-use crate::input::runtime_contrast_pen_color;
 
 pub use panel::BoardPickerPanel;
 
@@ -65,7 +62,6 @@ const PAGE_PANEL_MAX_ROWS: usize = 3;
 const PAGE_PANEL_HEADER_HEIGHT: f64 = 32.0;
 const PAGE_PANEL_ADD_BUTTON_HEIGHT: f64 = 24.0;
 const PAGE_PANEL_ADD_BUTTON_GAP: f64 = 8.0;
-pub(crate) const PAGE_HEADER_ICON_SIZE: f64 = 12.0;
 pub(crate) const PAGE_DELETE_ICON_SIZE: f64 = 14.0;
 pub(crate) const PAGE_DELETE_ICON_MARGIN: f64 = 5.0;
 pub(crate) const PAGE_NAME_HEIGHT: f64 = 14.0;
@@ -236,10 +232,6 @@ fn color_to_hex(color: Color) -> String {
     )
 }
 
-fn contrast_color(background: Color) -> Color {
-    runtime_contrast_pen_color(background)
-}
-
 const BOARD_PALETTE: [Color; 11] = [
     RED,
     GREEN,
@@ -348,28 +340,4 @@ mod tests {
 
         assert_eq!(color_to_hex(color), "#336699");
     }
-
-    #[test]
-    fn contrast_color_prefers_black_for_light_backgrounds() {
-        let contrast = contrast_color(Color {
-            r: 0.9,
-            g: 0.9,
-            b: 0.9,
-            a: 1.0,
-        });
-
-        assert_eq!(contrast, crate::domain::color::PALETTE_BLACK);
-    }
-
-    #[test]
-    fn contrast_color_prefers_white_for_dark_backgrounds() {
-        let contrast = contrast_color(Color {
-            r: 0.1,
-            g: 0.1,
-            b: 0.1,
-            a: 1.0,
-        });
-
-        assert_eq!(contrast, crate::domain::color::PALETTE_WHITE);
-    }
 }
diff --git a/src/input/state/core/board_picker/state/ordering.rs b/src/input/state/core/board_picker/state/ordering.rs
index f089f9482..dc2ab9e08 100644
--- a/src/input/state/core/board_picker/state/ordering.rs
+++ b/src/input/state/core/board_picker/state/ordering.rs
@@ -2,10 +2,6 @@ use super::super::super::base::InputState;
 use super::super::BoardPickerMode;
 
 impl InputState {
-    fn board_picker_board_order(&self) -> Vec<usize> {
-        self.board_picker_board_order_for_mode(self.board_picker_mode())
-    }
-
     fn board_picker_board_order_for_mode(&self, _mode: BoardPickerMode) -> Vec<usize> {
         let board_count = self.boards.board_count();
         let mut order = Vec::with_capacity(board_count);
diff --git a/src/input/state/core/mod.rs b/src/input/state/core/mod.rs
index 8c1835ae1..108655464 100644
--- a/src/input/state/core/mod.rs
+++ b/src/input/state/core/mod.rs
@@ -60,6 +60,8 @@ pub(crate) mod utility;
 mod view;
 mod zoom_chip;
 
+#[cfg(test)]
+mod test_support;
 #[cfg(test)]
 mod top_menu_tests;
 
diff --git a/src/input/state/core/selection/clipboard.rs b/src/input/state/core/selection/clipboard.rs
index a320132df..211deab3a 100644
--- a/src/input/state/core/selection/clipboard.rs
+++ b/src/input/state/core/selection/clipboard.rs
@@ -127,14 +127,6 @@ impl SelectionClipboard {
             .is_none_or(|clipboard| clipboard.is_empty())
     }
 
-    pub(in crate::input::state::core) fn shapes(&self) -> Option<Vec<Shape>> {
-        self.shapes.clone().filter(|shapes| !shapes.is_empty())
-    }
-
-    pub(in crate::input::state::core) fn generation(&self) -> u64 {
-        self.generation
-    }
-
     pub(in crate::input::state::core) fn active_paste_request_id(&self) -> Option<u64> {
         self.active_paste_request_id
     }
@@ -204,35 +196,6 @@ impl SelectionClipboard {
         }
     }
 
-    pub(in crate::input::state::core) fn failed_after_fingerprint_probe(
-        &mut self,
-        request_generation: Option<u64>,
-        current: Option<ClipboardFingerprint>,
-    ) -> Option<Vec<Shape>> {
-        let request_generation = request_generation?;
-        let SelectionPublishState::Failed {
-            generation,
-            clipboard_fingerprint_at_failure,
-        } = &self.publish_state
-        else {
-            return None;
-        };
-        if *generation != request_generation || *generation != self.generation {
-            return None;
-        }
-
-        match (clipboard_fingerprint_at_failure.as_ref(), current.as_ref()) {
-            (Some(previous), Some(current)) if previous == current => {}
-            (None, None) => return None,
-            _ => {
-                self.mark_superseded(Some(*generation));
-                return None;
-            }
-        }
-
-        self.shapes()
-    }
-
     pub(in crate::input::state::core) fn mark_superseded(&mut self, generation: Option<u64>) {
         if generation == Some(self.generation) && !self.is_empty() {
             self.publish_state = SelectionPublishState::Superseded {
@@ -492,38 +455,4 @@ mod tests {
         clipboard.finish_paste_request(second.id);
         assert_eq!(clipboard.active_paste_request_id(), None);
     }
-
-    #[test]
-    fn changed_failure_fingerprint_supersedes_the_local_fallback() {
-        let mut clipboard = SelectionClipboard::default();
-        let publish = clipboard.copy_shapes(vec![rectangle(10)]).expect("publish");
-        let original = ClipboardFingerprint {
-            offered_mime_types: vec!["image/png".to_string()],
-            selected_mime_type: Some("image/png".to_string()),
-            bounded_content_hash: Some(1),
-            bounded_content_len: Some(128),
-            bounded_content_truncated: false,
-        };
-        assert!(clipboard.complete_publish(publish.generation, Some(original.clone()), false,));
-        assert!(
-            clipboard
-                .failed_after_fingerprint_probe(Some(publish.generation), Some(original))
-                .is_some()
-        );
-
-        let changed = ClipboardFingerprint {
-            bounded_content_hash: Some(2),
-            ..clipboard
-                .snapshot()
-                .failed_probe(Some(publish.generation))
-                .and_then(|(_, fingerprint)| fingerprint)
-                .expect("failed fingerprint")
-        };
-        assert!(
-            clipboard
-                .failed_after_fingerprint_probe(Some(publish.generation), Some(changed))
-                .is_none()
-        );
-        assert!(!clipboard.snapshot().fallback_allowed());
-    }
 }
diff --git a/src/input/state/core/selection_actions/clipboard.rs b/src/input/state/core/selection_actions/clipboard.rs
index 46b8953df..d33860d5c 100644
--- a/src/input/state/core/selection_actions/clipboard.rs
+++ b/src/input/state/core/selection_actions/clipboard.rs
@@ -1,4 +1,4 @@
-use super::super::base::{ClipboardFingerprint, ClipboardPasteRequest, InputState, PasteAnchor};
+use super::super::base::{ClipboardPasteRequest, InputState, PasteAnchor};
 use super::super::selection::LocalSelectionContext;
 use crate::draw::Shape;
 use crate::draw::TextMeasurer;
@@ -9,7 +9,6 @@ use crate::util::Rect;
 mod duplicate;
 mod image_paste;
 
-#[allow(dead_code)]
 impl InputState {
     pub(crate) fn copy_selection(&mut self) -> usize {
         let copied = {
@@ -41,78 +40,6 @@ impl InputState {
         count
     }
 
-    pub(crate) fn paste_selection_with(&mut self, measurer: &TextMeasurer) -> usize {
-        let Some(shapes) = self.selection_clipboard.shapes() else {
-            return 0;
-        };
-        if shapes.is_empty() {
-            return 0;
-        }
-
-        let total = shapes.len();
-        let (dx, dy) = shape_paste_translation(measurer, &shapes, self.paste_anchor());
-        let mut created = Vec::new();
-        let mut new_ids = Vec::new();
-        let mut limit_hit = false;
-
-        let max_shapes = self.max_shapes_per_frame();
-        for shape in shapes {
-            let mut cloned_shape = shape;
-            cloned_shape.translate(dx, dy);
-            let new_id = {
-                let frame = self.boards.active_frame_mut();
-                frame.try_add_shape_with_id(cloned_shape, max_shapes)
-            };
-
-            let Some(new_id) = new_id else {
-                limit_hit = true;
-                break;
-            };
-
-            if let Some((index, stored)) = {
-                let frame = self.boards.active_frame();
-                frame
-                    .find_index(new_id)
-                    .and_then(|idx| frame.shape(new_id).map(|s| (idx, s.clone())))
-            } {
-                self.mark_selection_dirty_region(stored.bounding_box_with(measurer));
-                self.invalidate_hit_cache_for_with(measurer, new_id);
-                created.push((index, stored));
-                new_ids.push(new_id);
-            }
-        }
-
-        if created.is_empty() {
-            if limit_hit {
-                self.push_toast(
-                    ToastPriority::Info,
-                    "selection.clipboard",
-                    Toast::warning("Shape limit reached; nothing pasted."),
-                );
-            }
-            return 0;
-        }
-
-        let created_len = created.len();
-        self.boards.active_frame_mut().push_undo_action(
-            UndoAction::Create { shapes: created },
-            self.history_limits.undo_stack_limit(),
-        );
-        self.mark_session_dirty();
-        self.needs_redraw = true;
-        self.set_selection_with(measurer, new_ids);
-        if limit_hit {
-            self.push_toast(
-                ToastPriority::Info,
-                "selection.clipboard",
-                Toast::warning(format!(
-                    "Shape limit reached; pasted {created_len} of {total}."
-                )),
-            );
-        }
-        created_len
-    }
-
     /// Records that a capture just put an image on the system clipboard.
     pub(crate) fn note_capture_image_on_clipboard(&mut self) {
         self.selection_clipboard.note_capture_image_published();
@@ -150,20 +77,6 @@ impl InputState {
         self.selection_clipboard.snapshot()
     }
 
-    pub(crate) fn failed_local_selection_after_fingerprint_probe(
-        &mut self,
-        request_generation: Option<u64>,
-        current: Option<ClipboardFingerprint>,
-    ) -> Option<Vec<Shape>> {
-        self.selection_clipboard
-            .failed_after_fingerprint_probe(request_generation, current)
-    }
-
-    pub(crate) fn mark_selection_clipboard_superseded(&mut self) {
-        let generation = self.selection_clipboard.generation();
-        self.selection_clipboard.mark_superseded(Some(generation));
-    }
-
     pub(crate) fn mark_selection_clipboard_superseded_for_generation(
         &mut self,
         generation: Option<u64>,
diff --git a/src/input/state/core/selection_actions/clipboard/duplicate.rs b/src/input/state/core/selection_actions/clipboard/duplicate.rs
index 8a8941f61..31dcb05d7 100644
--- a/src/input/state/core/selection_actions/clipboard/duplicate.rs
+++ b/src/input/state/core/selection_actions/clipboard/duplicate.rs
@@ -4,7 +4,6 @@ use crate::draw::frame::UndoAction;
 
 const DUPLICATE_OFFSET: i32 = 12;
 
-#[allow(dead_code)]
 impl InputState {
     pub(crate) fn duplicate_selection_with(&mut self, measurer: &TextMeasurer) -> bool {
         let ids_len = self.selected_shape_ids().len();
diff --git a/src/input/state/core/session.rs b/src/input/state/core/session.rs
index 656eae59f..9c83227af 100644
--- a/src/input/state/core/session.rs
+++ b/src/input/state/core/session.rs
@@ -6,7 +6,6 @@ use crate::input::BoardManager;
 use crate::input::state::highlight::ClickHighlightState;
 use std::path::{Path, PathBuf};
 
-#[allow(dead_code)]
 struct ActiveInteractionRollback {
     boards: BoardManager,
     state: DrawingState,
@@ -28,7 +27,6 @@ struct ActiveInteractionRollback {
     canvas_index: super::CanvasIndex,
 }
 
-#[allow(dead_code)]
 impl ActiveInteractionRollback {
     fn capture(input: &InputState) -> Self {
         Self {
@@ -88,19 +86,16 @@ impl InputState {
     }
 
     /// Returns true if session data was marked dirty since the last check.
-    #[allow(dead_code)]
     pub(crate) fn take_session_dirty(&mut self) -> bool {
         self.session_flags.take_dirty()
     }
 
     /// Clears session dirtiness after loading persisted state into memory.
-    #[allow(dead_code)]
     pub(crate) fn clear_session_dirty(&mut self) {
         self.session_flags.clear_dirty();
     }
 
     /// Returns whether session data is dirty without clearing the dirty flag.
-    #[allow(dead_code)]
     pub(crate) fn is_session_dirty(&self) -> bool {
         self.session_flags.is_dirty()
     }
@@ -109,18 +104,15 @@ impl InputState {
         self.session_flags.set_dirty(dirty);
     }
 
-    #[allow(dead_code)]
     pub(crate) fn pending_save_as_overwrite(&self) -> Option<&Path> {
         self.session_flags.pending_save_as_overwrite()
     }
 
-    #[allow(dead_code)]
     pub(crate) fn set_pending_save_as_overwrite(&mut self, path: PathBuf) {
         self.session_flags.set_pending_save_as_overwrite(path);
         self.needs_redraw = true;
     }
 
-    #[allow(dead_code)]
     pub(crate) fn clear_pending_save_as_overwrite(&mut self) -> Option<PathBuf> {
         let previous = self.session_flags.take_pending_save_as_overwrite();
         if previous.is_some() {
@@ -130,7 +122,6 @@ impl InputState {
     }
 
     /// Returns true while pointer-driven work is in progress and autosave should wait.
-    #[allow(dead_code)]
     pub(crate) fn has_active_pointer_interaction(&self) -> bool {
         self.keymap.pointer_drag_active()
             || matches!(
@@ -173,7 +164,6 @@ impl InputState {
             || self.is_color_picker_popup_open()
     }
 
-    #[allow(dead_code)]
     pub(crate) fn with_active_interaction_canceled_for_capture_with<T>(
         &mut self,
         measurer: &crate::draw::TextMeasurer,
diff --git a/src/input/state/core/test_support.rs b/src/input/state/core/test_support.rs
new file mode 100644
index 000000000..89abb0f9d
--- /dev/null
+++ b/src/input/state/core/test_support.rs
@@ -0,0 +1,71 @@
+//! Test conveniences that read state private to `input::state::core`.
+//! Production drains the ordered input effect stream instead.
+
+use super::base::{
+    InputEffect, InputEffectKind, InputState, KeybindingEditRequest, TextClipboardRequest,
+    TextPasteTarget,
+};
+use crate::draw::TextMeasurer;
+use crate::input::boards::PendingBoardRuntimeUiAction;
+
+impl InputState {
+    /// Test convenience for inspecting shortcut edits. Production drains the
+    /// ordered InputEffect stream and forwards edits to the config worker.
+    pub(crate) fn take_pending_keybinding_edits(&mut self) -> Vec<KeybindingEditRequest> {
+        self.input_effects
+            .drain_all(InputEffectKind::KeybindingEdit)
+            .into_iter()
+            .filter_map(|effect| match effect {
+                InputEffect::KeybindingEdit(request) => Some(request),
+                _ => None,
+            })
+            .collect()
+    }
+
+    /// Test convenience for inspecting board actions in the InputEffect stream.
+    pub(crate) fn take_pending_board_runtime_ui_actions(
+        &mut self,
+    ) -> Vec<PendingBoardRuntimeUiAction> {
+        self.input_effects
+            .drain_all(InputEffectKind::BoardRuntimeUi)
+            .into_iter()
+            .filter_map(|effect| match effect {
+                InputEffect::BoardRuntimeUi(action) => Some(action),
+                _ => None,
+            })
+            .collect()
+    }
+
+    pub(crate) fn take_pending_eyedropper_toggle(&mut self) -> bool {
+        self.input_effects
+            .drain_one(InputEffectKind::EyedropperToggle)
+            .is_some()
+    }
+
+    pub(crate) fn take_pending_ocr_request(&mut self) -> bool {
+        match self.input_effects.drain_one(InputEffectKind::OcrPass) {
+            Some(InputEffect::OcrPass { requested, .. }) => requested,
+            Some(effect) => unreachable!("OCR drain returned {effect:?}"),
+            None => false,
+        }
+    }
+
+    pub(crate) fn take_pending_text_copy(&mut self) -> Option<TextClipboardRequest> {
+        match self.input_effects.drain_one(InputEffectKind::TextCopy) {
+            Some(InputEffect::TextCopy(request)) => Some(request),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn take_pending_text_paste(&mut self) -> Option<TextPasteTarget> {
+        match self.input_effects.drain_one(InputEffectKind::TextPaste) {
+            Some(InputEffect::TextPaste(target)) => Some(target),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn board_appearance_click(&mut self, x: i32, y: i32) -> bool {
+        let measurer = TextMeasurer::default();
+        self.board_appearance_click_with_measurer(&measurer, x, y)
+    }
+}
diff --git a/src/input/state/core/utility/pending.rs b/src/input/state/core/utility/pending.rs
index cb5cb59fe..f61e7a705 100644
--- a/src/input/state/core/utility/pending.rs
+++ b/src/input/state/core/utility/pending.rs
@@ -1,15 +1,11 @@
 use super::super::base::{
     ClipboardFingerprint, ClipboardPasteRequest, InputEffect, InputEffectDrain, InputEffectKind,
-    InputState, KeybindingEditRequest, OutputFocusAction, PendingBackendAction,
-    PendingSelectionClipboardPublish, PendingToolbarPersistence, PresetAction, QuickColorEdit,
-    ZoomAction, ZoomAnchor, ZoomRequest,
+    InputState, OutputFocusAction, PendingBackendAction, PendingSelectionClipboardPublish,
+    PendingToolbarPersistence, ZoomAction, ZoomAnchor, ZoomRequest,
 };
-use super::super::base::{TextClipboardRequest, TextPasteTarget};
 use crate::draw::Color;
-use crate::input::boards::PendingBoardRuntimeUiAction;
 use crate::input::state::HexPasteTarget;
 
-#[allow(dead_code)]
 impl InputState {
     pub(crate) fn emit_input_effect(&mut self, effect: InputEffect) {
         self.input_effects.emit(effect);
@@ -132,23 +128,6 @@ impl InputState {
             .contains(InputEffectKind::ToolbarPersistence)
     }
 
-    /// Takes every shortcut edit recorded since the last drain, oldest first.
-    ///
-    /// The backend hands each one to the config-edit worker, which answers them
-    /// in the same order. They are drained together rather than one per pass
-    /// because two edits can be recorded from a single batch of input events,
-    /// and the second must not cost the first its write or its toast.
-    pub(crate) fn take_pending_keybinding_edits(&mut self) -> Vec<KeybindingEditRequest> {
-        self.input_effects
-            .drain_all(InputEffectKind::KeybindingEdit)
-            .into_iter()
-            .filter_map(|effect| match effect {
-                InputEffect::KeybindingEdit(request) => Some(request),
-                _ => None,
-            })
-            .collect()
-    }
-
     /// Stores an output focus action for retrieval by the backend.
     pub(crate) fn request_output_focus_action(&mut self, action: OutputFocusAction) {
         self.emit_input_effect(InputEffect::OutputFocus(action));
@@ -191,36 +170,6 @@ impl InputState {
         }
     }
 
-    /// Takes and clears any pending preset save/clear action.
-    pub fn take_pending_preset_action(&mut self) -> Option<PresetAction> {
-        match self.input_effects.drain_one(InputEffectKind::Preset) {
-            Some(InputEffect::Preset(action)) => Some(action),
-            _ => None,
-        }
-    }
-
-    /// Takes and clears any accepted quick-color recolor awaiting its config
-    /// write. The runtime palette already shows the new color.
-    pub fn take_pending_quick_color_edit(&mut self) -> Option<QuickColorEdit> {
-        match self.input_effects.drain_one(InputEffectKind::QuickColor) {
-            Some(InputEffect::QuickColor(edit)) => Some(edit),
-            _ => None,
-        }
-    }
-
-    pub(crate) fn take_pending_board_runtime_ui_actions(
-        &mut self,
-    ) -> Vec<PendingBoardRuntimeUiAction> {
-        self.input_effects
-            .drain_all(InputEffectKind::BoardRuntimeUi)
-            .into_iter()
-            .filter_map(|effect| match effect {
-                InputEffect::BoardRuntimeUi(action) => Some(action),
-                _ => None,
-            })
-            .collect()
-    }
-
     pub(crate) fn take_pending_selection_clipboard_publish(
         &mut self,
     ) -> Option<PendingSelectionClipboardPublish> {
@@ -269,20 +218,6 @@ impl InputState {
         self.input_effects.contains(InputEffectKind::FrozenToggle)
     }
 
-    pub(crate) fn take_pending_eyedropper_toggle(&mut self) -> bool {
-        self.input_effects
-            .drain_one(InputEffectKind::EyedropperToggle)
-            .is_some()
-    }
-
-    pub(crate) fn take_pending_ocr_request(&mut self) -> bool {
-        match self.input_effects.drain_one(InputEffectKind::OcrPass) {
-            Some(InputEffect::OcrPass { requested, .. }) => requested,
-            Some(effect) => unreachable!("OCR drain returned {effect:?}"),
-            None => false,
-        }
-    }
-
     pub(crate) fn take_pending_copy_hex_request(&mut self) -> Option<Color> {
         match self.input_effects.drain_one(InputEffectKind::CopyHex) {
             Some(InputEffect::CopyHex(color)) => Some(color),
@@ -297,20 +232,6 @@ impl InputState {
         }
     }
 
-    pub(crate) fn take_pending_text_copy(&mut self) -> Option<TextClipboardRequest> {
-        match self.input_effects.drain_one(InputEffectKind::TextCopy) {
-            Some(InputEffect::TextCopy(request)) => Some(request),
-            _ => None,
-        }
-    }
-
-    pub(crate) fn take_pending_text_paste(&mut self) -> Option<TextPasteTarget> {
-        match self.input_effects.drain_one(InputEffectKind::TextPaste) {
-            Some(InputEffect::TextPaste(target)) => Some(target),
-            _ => None,
-        }
-    }
-
     pub(crate) fn discard_pending_color_picker_paste(&mut self) {
         self.input_effects
             .retain_kind(InputEffectKind::PasteHex, |effect| {
@@ -344,6 +265,7 @@ mod tests {
     use crate::draw::{BLACK, WHITE};
     use crate::input::state::KeybindingEditOperation;
     use crate::input::state::core::base::{InputEffect, InputEffectDrain};
+    use crate::input::state::core::base::{KeybindingEditRequest, PresetAction, QuickColorEdit};
 
     fn make_state() -> InputState {
         crate::input::state::test_support::make_test_input_state()
diff --git a/src/input/state/interaction/adapters/pointer.rs b/src/input/state/interaction/adapters/pointer.rs
index 6f4d80b9c..31903eae0 100644
--- a/src/input/state/interaction/adapters/pointer.rs
+++ b/src/input/state/interaction/adapters/pointer.rs
@@ -202,6 +202,11 @@ pub(crate) fn handle_tool_button_press(
     let after = active_interaction_kind(state);
     match (before, after) {
         (None, Some(kind)) => Some(RoutingOutcome::Started(kind)),
+        (Some(ActiveInteractionKind::TextInput), Some(ActiveInteractionKind::TextInput))
+            if state.pointer_drag_active() =>
+        {
+            Some(RoutingOutcome::Continued(ActiveInteractionKind::TextInput))
+        }
         (Some(ActiveInteractionKind::TextInput), Some(ActiveInteractionKind::TextInput)) => {
             Some(RoutingOutcome::Consumed(ConsumedBy::TextInput))
         }
diff --git a/src/input/state/interaction/mod.rs b/src/input/state/interaction/mod.rs
index 75cc58a10..4e189cfa3 100644
--- a/src/input/state/interaction/mod.rs
+++ b/src/input/state/interaction/mod.rs
@@ -12,6 +12,7 @@ pub(crate) use event::{
     CanvasPoint, PointerMotion, PointerPoints, PointerPress, PointerRelease, ScreenPoint,
 };
 pub(crate) use keyboard::{route_key_press_with_resources, route_key_repeat_with_resources};
+pub(crate) use outcome::RoutingOutcome;
 pub(crate) use pointer::{route_pointer_motion, route_pointer_press, route_pointer_release};
 
 #[cfg(test)]
diff --git a/src/input/state/interaction/outcome.rs b/src/input/state/interaction/outcome.rs
index 257a150ed..579c715d0 100644
--- a/src/input/state/interaction/outcome.rs
+++ b/src/input/state/interaction/outcome.rs
@@ -95,3 +95,43 @@ pub(crate) enum ActionRoute {
     CaptureZoom,
     Preset,
 }
+
+impl RoutingOutcome {
+    pub(crate) fn owns_pointer_motion(self, state: &crate::input::InputState) -> bool {
+        match self {
+            Self::Started(_) | Self::Continued(_) => state.has_active_pointer_interaction(),
+            Self::Consumed(ConsumedBy::RadialMenu | ConsumedBy::RadialMenuToggle) => {
+                state.is_radial_menu_open()
+            }
+            Self::Consumed(ConsumedBy::ColorPickerPopup) => state.color_picker_popup_is_dragging(),
+            Self::Consumed(ConsumedBy::BoardPicker) => {
+                state.board_picker_is_dragging()
+                    || state.board_picker_is_page_dragging()
+                    || state.board_appearance_is_size_dragging()
+            }
+            Self::Consumed(ConsumedBy::PropertiesPanel) => state.is_properties_slider_dragging(),
+            _ => false,
+        }
+    }
+
+    /// A popup button can own a release without owning motion. Its ownership
+    /// ends if that popup closes, so a late Up cannot finish a later stroke.
+    pub(crate) fn owns_pointer_release(self, state: &crate::input::InputState) -> bool {
+        match self {
+            Self::Started(_) | Self::Continued(_) => state.has_active_pointer_interaction(),
+            Self::Consumed(ConsumedBy::RadialMenu | ConsumedBy::RadialMenuToggle) => {
+                state.is_radial_menu_open()
+            }
+            Self::Consumed(ConsumedBy::ColorPickerPopup) => state.is_color_picker_popup_open(),
+            Self::Consumed(ConsumedBy::BoardPicker) => state.is_board_picker_open(),
+            Self::Consumed(ConsumedBy::PropertiesPanel) => state.is_properties_panel_open(),
+            Self::Consumed(ConsumedBy::FontPicker) => state.is_font_picker_open(),
+            Self::Consumed(ConsumedBy::ContextMenu | ConsumedBy::RightClickContextMenu) => {
+                state.is_context_menu_open()
+            }
+            Self::Consumed(ConsumedBy::StatusHud) => state.status_hud.press_pending,
+            Self::Consumed(ConsumedBy::ZoomChip) => state.zoom_chip.press_pending.is_pending(),
+            _ => false,
+        }
+    }
+}
diff --git a/src/input/state/mouse/press.rs b/src/input/state/mouse/press.rs
index 6b3260340..cb2273502 100644
--- a/src/input/state/mouse/press.rs
+++ b/src/input/state/mouse/press.rs
@@ -152,7 +152,7 @@ impl InputState {
         screen_y: i32,
         canvas_x: i32,
         canvas_y: i32,
-    ) {
+    ) -> super::super::interaction::RoutingOutcome {
         // Any press ends a wheel adjustment of a loupe, so the burst lands in
         // history as its own entry rather than merging with what follows.
         self.flush_spotlight_magnification_gesture();
@@ -161,8 +161,9 @@ impl InputState {
             CanvasPoint::new(canvas_x, canvas_y),
         );
         self.note_session_interaction_activity();
-        let _ = route_pointer_press(self, resources, PointerPress::new(button, points));
+        let outcome = route_pointer_press(self, resources, PointerPress::new(button, points));
         self.note_session_interaction_activity();
+        outcome
     }
 
     pub(in crate::input::state) fn tool_for_button_press(
diff --git a/src/input/state/tests/selection/duplicate.rs b/src/input/state/tests/selection/duplicate.rs
index dc059fa23..eab564663 100644
--- a/src/input/state/tests/selection/duplicate.rs
+++ b/src/input/state/tests/selection/duplicate.rs
@@ -209,158 +209,6 @@ fn stale_publish_completion_is_ignored_for_newer_copy() {
     );
 }
 
-#[test]
-fn failed_local_clipboard_precedence_clears_when_fingerprint_changes() {
-    let test_text_measurer = crate::draw::TextMeasurer::default();
-    let test_ui_engine = crate::ui_text::UiTextEngine::default();
-    let test_text_resources = crate::input::state::InputTextResources {
-        measurer: &test_text_measurer,
-        ui_engine: &test_ui_engine,
-    };
-
-    let mut state = create_test_input_state();
-    let original_id = state.boards.active_frame_mut().add_shape(Shape::Rect {
-        x: 10,
-        y: 20,
-        w: 100,
-        h: 80,
-        fill: false,
-        fill_color: None,
-        color: state.style.current_color,
-        thick: state.style.current_thickness,
-    });
-    state.set_selection(vec![original_id]);
-    state.handle_action_with_resources(test_text_resources, Action::CopySelection);
-    let publish = state
-        .take_pending_selection_clipboard_publish()
-        .expect("pending private clipboard publish");
-    let initial_fingerprint = ClipboardFingerprint {
-        offered_mime_types: vec!["image/png".to_string()],
-        selected_mime_type: Some("image/png".to_string()),
-        bounded_content_hash: Some(1),
-        bounded_content_len: Some(4096),
-        bounded_content_truncated: true,
-    };
-    state.complete_selection_clipboard_publish(
-        publish.generation,
-        Some(initial_fingerprint.clone()),
-        false,
-    );
-
-    assert!(
-        state
-            .failed_local_selection_after_fingerprint_probe(
-                Some(publish.generation),
-                Some(initial_fingerprint),
-            )
-            .is_some()
-    );
-
-    let changed_fingerprint = ClipboardFingerprint {
-        offered_mime_types: vec!["image/png".to_string()],
-        selected_mime_type: Some("image/png".to_string()),
-        bounded_content_hash: Some(2),
-        bounded_content_len: Some(4096),
-        bounded_content_truncated: true,
-    };
-    assert!(
-        state
-            .failed_local_selection_after_fingerprint_probe(
-                Some(publish.generation),
-                Some(changed_fingerprint),
-            )
-            .is_none()
-    );
-    assert!(!state.selection_clipboard_snapshot().fallback_allowed());
-    assert_eq!(
-        state.selection_clipboard_snapshot().fallback_generation(),
-        None
-    );
-}
-
-#[test]
-fn failed_local_clipboard_without_failure_fingerprint_supersedes_when_current_is_readable() {
-    let test_text_measurer = crate::draw::TextMeasurer::default();
-    let test_ui_engine = crate::ui_text::UiTextEngine::default();
-    let test_text_resources = crate::input::state::InputTextResources {
-        measurer: &test_text_measurer,
-        ui_engine: &test_ui_engine,
-    };
-
-    let mut state = create_test_input_state();
-    let original_id = state.boards.active_frame_mut().add_shape(Shape::Rect {
-        x: 10,
-        y: 20,
-        w: 100,
-        h: 80,
-        fill: false,
-        fill_color: None,
-        color: state.style.current_color,
-        thick: state.style.current_thickness,
-    });
-    state.set_selection(vec![original_id]);
-    state.handle_action_with_resources(test_text_resources, Action::CopySelection);
-    let publish = state
-        .take_pending_selection_clipboard_publish()
-        .expect("pending private clipboard publish");
-    state.complete_selection_clipboard_publish(publish.generation, None, false);
-
-    let current_fingerprint = ClipboardFingerprint {
-        offered_mime_types: vec!["image/png".to_string()],
-        selected_mime_type: Some("image/png".to_string()),
-        bounded_content_hash: Some(1),
-        bounded_content_len: Some(4096),
-        bounded_content_truncated: true,
-    };
-    assert!(
-        state
-            .failed_local_selection_after_fingerprint_probe(
-                Some(publish.generation),
-                Some(current_fingerprint),
-            )
-            .is_none()
-    );
-    assert!(!state.selection_clipboard_snapshot().fallback_allowed());
-}
-
-#[test]
-fn failed_local_clipboard_without_current_fingerprint_does_not_fast_path() {
-    let test_text_measurer = crate::draw::TextMeasurer::default();
-    let test_ui_engine = crate::ui_text::UiTextEngine::default();
-    let test_text_resources = crate::input::state::InputTextResources {
-        measurer: &test_text_measurer,
-        ui_engine: &test_ui_engine,
-    };
-
-    let mut state = create_test_input_state();
-    let original_id = state.boards.active_frame_mut().add_shape(Shape::Rect {
-        x: 10,
-        y: 20,
-        w: 100,
-        h: 80,
-        fill: false,
-        fill_color: None,
-        color: state.style.current_color,
-        thick: state.style.current_thickness,
-    });
-    state.set_selection(vec![original_id]);
-    state.handle_action_with_resources(test_text_resources, Action::CopySelection);
-    let publish = state
-        .take_pending_selection_clipboard_publish()
-        .expect("pending private clipboard publish");
-    state.complete_selection_clipboard_publish(publish.generation, None, false);
-
-    assert!(
-        state
-            .failed_local_selection_after_fingerprint_probe(Some(publish.generation), None)
-            .is_none()
-    );
-    assert!(
-        state.selection_clipboard_snapshot().fallback_allowed(),
-        "transport failure fallback remains available after normal resolution"
-    );
-}
-
 #[test]
 fn published_selection_allows_local_fallback_until_superseded() {
     let test_text_measurer = crate::draw::TextMeasurer::default();
@@ -400,7 +248,7 @@ fn published_selection_allows_local_fallback_until_superseded() {
             .is_some()
     );
 
-    state.mark_selection_clipboard_superseded();
+    state.mark_selection_clipboard_superseded_for_generation(Some(generation));
     assert!(!state.selection_clipboard_snapshot().fallback_allowed());
     assert!(
         state
@@ -596,7 +444,7 @@ fn same_instance_private_payload_with_no_fallback_generation_uses_payload() {
     let payload: WayscriberClipboardSelection =
         serde_json::from_str(&publish.payload_json).expect("payload json");
 
-    state.mark_selection_clipboard_superseded();
+    state.mark_selection_clipboard_superseded_for_generation(Some(publish.generation));
     state.handle_action_with_resources(test_text_resources, Action::PasteSelection);
     let request = state
         .take_pending_clipboard_paste_request()
@@ -672,87 +520,6 @@ fn request_generation_supersede_ignores_newer_local_copy() {
     assert!(state.selection_clipboard_snapshot().fallback_allowed());
 }
 
-#[test]
-fn failed_local_fast_path_rejects_newer_generation() {
-    let test_text_measurer = crate::draw::TextMeasurer::default();
-    let test_ui_engine = crate::ui_text::UiTextEngine::default();
-    let test_text_resources = crate::input::state::InputTextResources {
-        measurer: &test_text_measurer,
-        ui_engine: &test_ui_engine,
-    };
-
-    let mut state = create_test_input_state();
-    let first_id = state.boards.active_frame_mut().add_shape(Shape::Rect {
-        x: 10,
-        y: 20,
-        w: 100,
-        h: 80,
-        fill: false,
-        fill_color: None,
-        color: state.style.current_color,
-        thick: state.style.current_thickness,
-    });
-    state.set_selection(vec![first_id]);
-    state.handle_action_with_resources(test_text_resources, Action::CopySelection);
-    let first_publish = state
-        .take_pending_selection_clipboard_publish()
-        .expect("pending first private clipboard publish");
-    let fingerprint = ClipboardFingerprint {
-        offered_mime_types: vec!["image/png".to_string()],
-        selected_mime_type: Some("image/png".to_string()),
-        bounded_content_hash: Some(1),
-        bounded_content_len: Some(4096),
-        bounded_content_truncated: true,
-    };
-    state.complete_selection_clipboard_publish(
-        first_publish.generation,
-        Some(fingerprint.clone()),
-        false,
-    );
-    state.handle_action_with_resources(test_text_resources, Action::PasteSelection);
-    let request = state
-        .take_pending_clipboard_paste_request()
-        .expect("pending paste request");
-    let request_generation = request.local_selection_fallback_generation;
-
-    let second_id = state.boards.active_frame_mut().add_shape(Shape::Rect {
-        x: 200,
-        y: 220,
-        w: 90,
-        h: 70,
-        fill: false,
-        fill_color: None,
-        color: state.style.current_color,
-        thick: state.style.current_thickness,
-    });
-    state.set_selection(vec![second_id]);
-    state.handle_action_with_resources(test_text_resources, Action::CopySelection);
-    let second_publish = state
-        .take_pending_selection_clipboard_publish()
-        .expect("pending second private clipboard publish");
-    state.complete_selection_clipboard_publish(
-        second_publish.generation,
-        Some(fingerprint.clone()),
-        false,
-    );
-
-    assert!(
-        state
-            .selection_clipboard_snapshot()
-            .failed_probe(request_generation)
-            .is_none()
-    );
-    assert!(
-        state
-            .failed_local_selection_after_fingerprint_probe(request_generation, Some(fingerprint))
-            .is_none()
-    );
-    assert_eq!(
-        state.selection_clipboard_snapshot().fallback_generation(),
-        Some(second_publish.generation)
-    );
-}
-
 #[test]
 fn duplicate_selection_skips_locked_shapes() {
     let test_text_measurer = crate::draw::TextMeasurer::default();
@@ -845,9 +612,9 @@ fn repeated_paste_selection_uses_current_pointer_anchor() {
     assert_eq!(state.copy_selection(), 1);
 
     state.update_pointer_positions(100, 120, 100, 120);
-    assert_eq!(state.paste_selection_with(&measurer), 1);
+    assert_eq!(paste_local_clipboard(&mut state, &measurer), 1);
     state.update_pointer_positions(200, 220, 200, 220);
-    assert_eq!(state.paste_selection_with(&measurer), 1);
+    assert_eq!(paste_local_clipboard(&mut state, &measurer), 1);
 
     let frame = state.boards.active_frame();
     assert_eq!(frame.shapes.len(), 3);
@@ -877,7 +644,7 @@ fn paste_selection_warns_when_shape_limit_prevents_any_paste() {
     assert_eq!(state.copy_selection(), 1);
     state.set_max_shapes_per_frame_for_test(1);
 
-    assert_eq!(state.paste_selection_with(&measurer), 0);
+    assert_eq!(paste_local_clipboard(&mut state, &measurer), 0);
     assert_eq!(
         state.active_toast().map(|toast| toast.message.as_str()),
         Some("Shape limit reached; nothing pasted.")
@@ -912,7 +679,7 @@ fn paste_selection_warns_when_shape_limit_allows_only_partial_paste() {
     assert_eq!(state.copy_selection(), 2);
     state.set_max_shapes_per_frame_for_test(3);
 
-    assert_eq!(state.paste_selection_with(&measurer), 1);
+    assert_eq!(paste_local_clipboard(&mut state, &measurer), 1);
     assert_eq!(state.boards.active_frame().shapes.len(), 3);
     assert_eq!(state.selected_shape_ids().len(), 1);
     assert_eq!(
@@ -920,3 +687,15 @@ fn paste_selection_warns_when_shape_limit_allows_only_partial_paste() {
         Some("Shape limit reached; pasted 1 of 2.")
     );
 }
+
+fn paste_local_clipboard(
+    state: &mut crate::input::InputState,
+    measurer: &crate::draw::TextMeasurer,
+) -> usize {
+    let request = state.request_clipboard_paste();
+    let shapes = state
+        .selection_clipboard_snapshot()
+        .shapes_for_pending_publish(Some(request.selection_clipboard_generation_at_request))
+        .unwrap();
+    state.paste_clipboard_shapes_from_request_with(measurer, &request, shapes)
+}
diff --git a/src/onboarding.rs b/src/onboarding.rs
index 03dd6a56b..b3278c55b 100644
--- a/src/onboarding.rs
+++ b/src/onboarding.rs
@@ -399,7 +399,7 @@ impl OnboardingStore {
         Self::load_from_path(path)
     }
 
-    fn load_from_path(path: PathBuf) -> Self {
+    pub(crate) fn load_from_path(path: PathBuf) -> Self {
         match fs::read_to_string(&path) {
             Ok(raw) => match toml::from_str::<OnboardingState>(&raw) {
                 Ok(mut state) => {
diff --git a/src/palette_recents.rs b/src/palette_recents.rs
index 7d9fee25a..00633b01e 100644
--- a/src/palette_recents.rs
+++ b/src/palette_recents.rs
@@ -64,7 +64,7 @@ impl PaletteRecentsStore {
         Self::load_from_path(path)
     }
 
-    fn load_from_path(path: PathBuf) -> Self {
+    pub(crate) fn load_from_path(path: PathBuf) -> Self {
         let (recents, persisted) = match fs::read_to_string(&path) {
             // Loaded (or absent): the in-memory view matches disk, so a later
             // identical `set_recents` can early-return without rewriting.
diff --git a/src/session/AGENTS.md b/src/session/AGENTS.md
index cb4b633b7..bca5b6b3e 100644
--- a/src/session/AGENTS.md
+++ b/src/session/AGENTS.md
@@ -15,6 +15,11 @@
 - Preserve lock behavior, backup/recovery behavior, clear boundaries, rollback on artifact moves, and named-session catalog identity.
 - Reject symlinks, directories, and special files where forbidden by named-session rules.
 - Runtime session open/save-as/clear behavior must validate paths before mutating active state.
+- Corrupt artifacts use independent `.corrupt-N` copies (up to three regular files per artifact); never overwrite a rotation backup with corrupt bytes.
+- Restoring a corrupt named primary replaces only the exact corrupt file that was read, and never writes bytes above `max_file_size_bytes` into the primary.
+- Keep all artifact ordering in `snapshot/generation.rs`. Loaders and cleanup still pass unknown generations and preserve their legacy mtime rules until generation-aware loading is deliberately introduced.
+- Session format 7's optional `save_generation` must remain immediately after `version` for bounded header probes. Normal saves allocate under the exclusive session lock; Save As prepares before locking and quarantines target sidecars on commit.
+- Marker format 1 and the 1..=2^53-1 counter range are persistence contracts. Malformed or legacy generation metadata stays unknown; it does not make valid drawings corrupt.
 
 ## Coupled Changes
 - Session changes may affect `src/backend/wayland/session.rs`, input session preflight, daemon named-session switching, configurator session catalog operations, and `src/paths/`.
diff --git a/src/session/artifacts.rs b/src/session/artifacts.rs
index f4f380503..3eb3e39bb 100644
--- a/src/session/artifacts.rs
+++ b/src/session/artifacts.rs
@@ -1,3 +1,5 @@
+mod corrupt_copies;
+mod kind;
 mod move_file;
 mod save_as_quarantine;
 
@@ -17,6 +19,12 @@ use super::primary::open_session_artifact_for_read;
 pub(crate) const PRESERVED_SESSION_MARKER: &str = "-preserved-";
 pub(crate) const PRESERVED_SESSION_MOVED_SUFFIX: &str = "-moved";
 
+pub(crate) use corrupt_copies::{
+    MAX_CORRUPT_COPIES_PER_ARTIFACT, corrupt_copies_of, corrupt_copy_path, parse_corrupt_copy_name,
+    remove_corrupt_copies,
+};
+pub(crate) use kind::is_recovery_variant;
+pub use kind::{SessionArtifactKind, named_session_artifact_kind};
 pub(crate) use move_file::rename_artifact_no_replace;
 pub use move_file::{
     NamedSessionMoveOutcome, NamedSessionMovedArtifact, move_named_session_non_lock_artifacts,
@@ -117,6 +125,7 @@ pub fn named_session_non_lock_artifact_paths(path: &Path) -> Result<Vec<PathBuf>
     ];
     collect_recovery_variants(&artifacts.recovery, &mut paths)?;
     collect_preserved_newer_version_copies(path, &mut paths)?;
+    corrupt_copies::collect_corrupt_copies(path, &mut paths)?;
     dedupe_paths(&mut paths);
     Ok(paths)
 }
@@ -206,8 +215,11 @@ pub fn clear_named_session_non_lock_artifacts(path: &Path) -> Result<NamedSessio
     let mut preserved_newer_versions = Vec::new();
     collect_preserved_newer_version_copies(path, &mut preserved_newer_versions)?;
     let removed_preserved_newer_versions = remove_artifacts(&preserved_newer_versions)?;
-    let removed_primary =
-        remove_artifact_if_exists(&artifacts.primary)? || removed_preserved_newer_versions;
+    let removed_primary_copies = remove_corrupt_copies(&artifacts.primary)?;
+    let removed_backup_copies = remove_corrupt_copies(&artifacts.backup)?;
+    let removed_primary = remove_artifact_if_exists(&artifacts.primary)?
+        || removed_preserved_newer_versions
+        || removed_primary_copies;
     let removed_clear_marker = remove_artifact_if_exists(&artifacts.clear_marker)?;
     let removed_backup = remove_artifact_if_exists(&artifacts.backup)?;
     let removed_backup_marker = remove_artifact_if_exists(&artifacts.backup_recovery_marker)?;
@@ -217,7 +229,7 @@ pub fn clear_named_session_non_lock_artifacts(path: &Path) -> Result<NamedSessio
 
     Ok(NamedSessionClearOutcome {
         removed_primary,
-        removed_backup: removed_backup || removed_backup_marker,
+        removed_backup: removed_backup || removed_backup_marker || removed_backup_copies,
         removed_recovery: removed_recovery || removed_recovery_marker,
         removed_clear_marker,
     })
@@ -294,7 +306,7 @@ pub fn duplicate_named_session_primary(
 
 #[allow(dead_code)]
 fn collect_recovery_variants(recovery_path: &Path, paths: &mut Vec<PathBuf>) -> Result<()> {
-    let Some(recovery_name) = recovery_path.file_name().and_then(|name| name.to_str()) else {
+    let Some(recovery_name) = recovery_path.file_name() else {
         return Ok(());
     };
     let Some(parent) = recovery_path.parent() else {
@@ -313,7 +325,6 @@ fn collect_recovery_variants(recovery_path: &Path, paths: &mut Vec<PathBuf>) ->
         }
     };
 
-    let recovery_prefix = format!("{recovery_name}.");
     for entry in entries {
         let entry = entry.with_context(|| {
             format!(
@@ -322,10 +333,10 @@ fn collect_recovery_variants(recovery_path: &Path, paths: &mut Vec<PathBuf>) ->
             )
         })?;
         let path = entry.path();
-        let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+        let Some(name) = path.file_name() else {
             continue;
         };
-        if name == recovery_name || name.starts_with(&recovery_prefix) {
+        if is_recovery_variant(name, recovery_name) {
             paths.push(path);
         }
     }
@@ -334,7 +345,7 @@ fn collect_recovery_variants(recovery_path: &Path, paths: &mut Vec<PathBuf>) ->
 
 #[allow(dead_code)]
 fn removable_recovery_artifact_paths(recovery_path: &Path) -> Result<Vec<PathBuf>> {
-    let Some(recovery_name) = recovery_path.file_name().and_then(|name| name.to_str()) else {
+    let Some(recovery_name) = recovery_path.file_name() else {
         return removable_artifact_path(recovery_path).map(|path| path.into_iter().collect());
     };
     let Some(parent) = recovery_path.parent() else {
@@ -356,7 +367,6 @@ fn removable_recovery_artifact_paths(recovery_path: &Path) -> Result<Vec<PathBuf
         }
     };
 
-    let recovery_prefix = format!("{recovery_name}.");
     let mut paths = Vec::new();
     for entry in entries {
         let entry = entry.with_context(|| {
@@ -366,10 +376,10 @@ fn removable_recovery_artifact_paths(recovery_path: &Path) -> Result<Vec<PathBuf
             )
         })?;
         let path = entry.path();
-        let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+        let Some(name) = path.file_name() else {
             continue;
         };
-        if (name == recovery_name || name.starts_with(&recovery_prefix))
+        if is_recovery_variant(name, recovery_name)
             && let Some(path) = removable_artifact_path(&path)?
         {
             paths.push(path);
diff --git a/src/session/artifacts/corrupt_copies.rs b/src/session/artifacts/corrupt_copies.rs
new file mode 100644
index 000000000..bd10e92d0
--- /dev/null
+++ b/src/session/artifacts/corrupt_copies.rs
@@ -0,0 +1,104 @@
+//! Side files containing unreadable artifacts, independent of rotation backups.
+use super::*;
+use std::ffi::OsStr;
+use std::os::unix::ffi::OsStrExt;
+
+pub(crate) const MAX_CORRUPT_COPIES_PER_ARTIFACT: usize = 3;
+const CORRUPT_COPY_MARKER: &str = ".corrupt-";
+
+pub(crate) struct CorruptCopy {
+    pub(crate) path: PathBuf,
+    pub(crate) seq: u64,
+    pub(crate) regular_file: bool,
+}
+
+pub(crate) fn parse_corrupt_copy_name(name: &OsStr) -> Option<(&OsStr, u64)> {
+    let bytes = name.as_bytes();
+    let marker = CORRUPT_COPY_MARKER.as_bytes();
+    let offset = bytes
+        .windows(marker.len())
+        .rposition(|part| part == marker)?;
+    let artifact = &bytes[..offset];
+    let seq = &bytes[offset + marker.len()..];
+    if artifact.is_empty()
+        || seq.is_empty()
+        || seq.starts_with(b"0")
+        || !seq.iter().all(u8::is_ascii_digit)
+    {
+        return None;
+    }
+    Some((
+        OsStr::from_bytes(artifact),
+        std::str::from_utf8(seq).ok()?.parse().ok()?,
+    ))
+}
+
+pub(crate) fn corrupt_copy_path(artifact: &Path, seq: u64) -> PathBuf {
+    append_path_suffix(artifact, &format!("{CORRUPT_COPY_MARKER}{seq}"))
+}
+
+/// Include occupied non-regular names in sequence allocation, never in pruning.
+pub(crate) fn corrupt_copies_of(artifact: &Path) -> Result<Vec<CorruptCopy>> {
+    let Some(name) = artifact.file_name() else {
+        return Ok(Vec::new());
+    };
+    let parent = artifact
+        .parent()
+        .filter(|path| !path.as_os_str().is_empty())
+        .unwrap_or(Path::new("."));
+    let entries = match fs::read_dir(parent) {
+        Ok(entries) => entries,
+        Err(err) if err.kind() == ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(err) => {
+            return Err(err)
+                .with_context(|| format!("failed to scan corrupt copies in {}", parent.display()));
+        }
+    };
+    let mut copies = Vec::new();
+    for entry in entries {
+        let entry = entry?;
+        let file_name = entry.file_name();
+        let Some((source, seq)) = parse_corrupt_copy_name(&file_name) else {
+            continue;
+        };
+        if source != name {
+            continue;
+        }
+        let path = entry.path();
+        let regular_file = match fs::symlink_metadata(&path) {
+            Ok(metadata) => metadata.file_type().is_file(),
+            Err(error) if error.kind() == ErrorKind::NotFound => continue,
+            Err(error) => return Err(error.into()),
+        };
+        copies.push(CorruptCopy {
+            path,
+            seq,
+            regular_file,
+        });
+    }
+
+    copies.sort_by_key(|copy| copy.seq);
+    Ok(copies)
+}
+
+pub(super) fn collect_corrupt_copies(primary: &Path, paths: &mut Vec<PathBuf>) -> Result<()> {
+    for artifact in [primary.to_path_buf(), append_path_suffix(primary, ".bak")] {
+        paths.extend(
+            corrupt_copies_of(&artifact)?
+                .into_iter()
+                .map(|copy| copy.path),
+        );
+    }
+    Ok(())
+}
+
+pub(crate) fn remove_corrupt_copies(artifact: &Path) -> Result<bool> {
+    let mut removed = false;
+    for copy in corrupt_copies_of(artifact)?
+        .into_iter()
+        .filter(|copy| copy.regular_file)
+    {
+        removed = remove_artifact_if_exists(&copy.path)? || removed;
+    }
+    Ok(removed)
+}
diff --git a/src/session/artifacts/kind.rs b/src/session/artifacts/kind.rs
new file mode 100644
index 000000000..8d91d9e49
--- /dev/null
+++ b/src/session/artifacts/kind.rs
@@ -0,0 +1,49 @@
+//! What each file of a named session holds.
+use std::ffi::OsStr;
+use std::os::unix::ffi::OsStrExt;
+use std::path::Path;
+
+use super::{named_session_artifact_paths, parse_corrupt_copy_name};
+
+/// What a named session's artifact holds.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SessionArtifactKind {
+    Primary,
+    Backup,
+    Recovery,
+    /// Bytes that could not be read, preserved as a `.corrupt-N` copy of the
+    /// primary, the backup or a recovery file. Nothing can restore from it.
+    UnreadableCopy,
+}
+
+pub fn named_session_artifact_kind(primary: &Path, path: &Path) -> Option<SessionArtifactKind> {
+    let artifacts = named_session_artifact_paths(primary);
+    let name = path.file_name()?;
+    let (source, copy) =
+        parse_corrupt_copy_name(name).map_or((name, false), |(source, _)| (source, true));
+    let kind = if source == artifacts.primary.file_name()? {
+        SessionArtifactKind::Primary
+    } else if source == artifacts.backup.file_name()? {
+        SessionArtifactKind::Backup
+    } else if is_recovery_variant(source, artifacts.recovery.file_name()?) {
+        SessionArtifactKind::Recovery
+    } else {
+        return None;
+    };
+
+    Some(if copy {
+        SessionArtifactKind::UnreadableCopy
+    } else {
+        kind
+    })
+}
+
+/// The recovery file itself or one of its `.`-suffixed variants.
+pub(crate) fn is_recovery_variant(name: &OsStr, recovery_name: &OsStr) -> bool {
+    let name = name.as_bytes();
+    let recovery = recovery_name.as_bytes();
+    name == recovery
+        || name
+            .strip_prefix(recovery)
+            .is_some_and(|suffix| suffix.starts_with(b"."))
+}
diff --git a/src/session/artifacts/move_file.rs b/src/session/artifacts/move_file.rs
index 39036546e..effe74404 100644
--- a/src/session/artifacts/move_file.rs
+++ b/src/session/artifacts/move_file.rs
@@ -1,8 +1,9 @@
 use anyhow::{Context, Result, anyhow};
-use std::ffi::OsString;
+use std::ffi::{OsStr, OsString};
 use std::fs::{self, File};
 use std::io;
 use std::io::ErrorKind;
+use std::os::unix::ffi::OsStrExt;
 use std::path::{Path, PathBuf};
 
 use crate::session::lock::{lock_exclusive, open_runtime_lock_file, unlock};
@@ -234,8 +235,19 @@ fn target_path_for_source_artifact(
     }
 
     if source.parent() == source_artifacts.primary.parent() {
-        let source_name = source.file_name()?.to_str()?;
-        if let Some(suffix) = preserved_newer_version_suffix(&source_artifacts.primary, source_name)
+        let source_name = source.file_name()?;
+        for (source_slot, target_slot) in [
+            (&source_artifacts.primary, &target_artifacts.primary),
+            (&source_artifacts.backup, &target_artifacts.backup),
+        ] {
+            if let Some((artifact, seq)) = super::parse_corrupt_copy_name(source_name)
+                && Some(artifact) == source_slot.file_name()
+            {
+                return Some(super::corrupt_copy_path(target_slot, seq));
+            }
+        }
+        if let Some(name) = source_name.to_str()
+            && let Some(suffix) = preserved_newer_version_suffix(&source_artifacts.primary, name)
         {
             return Some(crate::session::append_path_suffix(
                 &target_artifacts.primary,
@@ -259,16 +271,15 @@ fn target_recovery_variant_path(
     if source.parent() != source_recovery.parent() {
         return None;
     }
-    let source_name = source.file_name()?.to_str()?;
-    let source_recovery_name = source_recovery.file_name()?.to_str()?;
-    if !source_name.starts_with(&format!("{source_recovery_name}.")) {
+    let source_name = source.file_name()?.as_bytes();
+    let source_recovery_name = source_recovery.file_name()?.as_bytes();
+    let suffix = source_name.strip_prefix(source_recovery_name)?;
+    if !suffix.starts_with(b".") {
         return None;
     }
 
-    let target_recovery_name = target_recovery.file_name()?.to_str()?;
-    let suffix = &source_name[source_recovery_name.len()..];
-    let mut target_name = OsString::from(target_recovery_name);
-    target_name.push(suffix);
+    let mut target_name = OsString::from(target_recovery.file_name()?);
+    target_name.push(OsStr::from_bytes(suffix));
     Some(match target_recovery.parent() {
         Some(parent) => parent.join(target_name),
         None => PathBuf::from(target_name),
diff --git a/src/session/artifacts/tests.rs b/src/session/artifacts/tests.rs
index 568c31630..5fd70c75f 100644
--- a/src/session/artifacts/tests.rs
+++ b/src/session/artifacts/tests.rs
@@ -2,6 +2,58 @@ use std::path::{Path, PathBuf};
 
 use super::*;
 
+#[test]
+fn corrupt_copies_move_with_session_and_clear_without_touching_siblings() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let source = temp.path().join("board.wayscriber-session");
+    let target = temp.path().join("archive.wayscriber-session");
+    std::fs::write(&source, b"primary").unwrap();
+    let suffixes = [".corrupt-1", ".bak.corrupt-2", ".recovery.corrupt-3"];
+    for suffix in suffixes {
+        std::fs::write(append_path_suffix(&source, suffix), suffix.as_bytes()).unwrap();
+    }
+    let invalid_suffixes = [
+        ".corrupt-0",
+        ".corrupt-01",
+        ".corrupt-",
+        ".corrupt-+1",
+        ".corrupt--1",
+        ".corrupt-18446744073709551616",
+        ".other.corrupt-1",
+        ".bak.corrupt-2-more",
+    ];
+    for suffix in invalid_suffixes {
+        std::fs::write(append_path_suffix(&source, suffix), b"not our name").unwrap();
+    }
+
+    move_named_session_non_lock_artifacts(&source, &target).unwrap();
+    for suffix in suffixes {
+        assert!(!append_path_suffix(&source, suffix).exists());
+        assert_eq!(
+            std::fs::read(append_path_suffix(&target, suffix)).unwrap(),
+            suffix.as_bytes()
+        );
+    }
+
+    assert!(duplicate_named_session_primary(&target, &source).is_ok());
+    std::fs::remove_file(&source).unwrap();
+    std::fs::write(append_path_suffix(&source, ".corrupt-4"), b"old diagnostic").unwrap();
+    assert!(duplicate_named_session_primary(&target, &source).is_err());
+
+    clear_named_session_non_lock_artifacts(&target).unwrap();
+    for suffix in suffixes {
+        assert!(!append_path_suffix(&target, suffix).exists());
+    }
+    for suffix in invalid_suffixes {
+        assert_eq!(
+            std::fs::read(append_path_suffix(&source, suffix)).unwrap(),
+            b"not our name",
+            "{suffix}"
+        );
+        assert!(!append_path_suffix(&target, suffix).exists());
+    }
+}
+
 #[test]
 fn named_session_artifact_paths_use_exact_primary_suffixes() {
     let path = Path::new("/tmp/lecture.wayscriber-session");
@@ -189,3 +241,43 @@ fn duplicate_named_session_primary_rejects_symlink_source() {
     assert!(format!("{err:#}").contains("symlink"));
     assert!(!target.exists());
 }
+
+#[test]
+fn non_utf8_diagnostics_are_reused_pruned_moved_and_removed_by_core_clear() {
+    use std::ffi::OsStr;
+    use std::os::unix::ffi::OsStrExt;
+    let temp = crate::test_temp::tempdir().unwrap();
+    let source = temp
+        .path()
+        .join(OsStr::from_bytes(b"board-\xff.wayscriber-session"));
+    let target = temp
+        .path()
+        .join(OsStr::from_bytes(b"archive-\xfe.wayscriber-session"));
+    let mut options = crate::session::SessionOptions::new(temp.path().to_path_buf(), "nonutf");
+    options.set_named_file_target(source.clone());
+    for index in 0..5 {
+        std::fs::write(&source, format!("broken {index}")).unwrap();
+        let outcome = crate::session::load_snapshot_with_outcome(&options).unwrap();
+        assert!(matches!(
+            outcome,
+            crate::session::LoadSnapshotOutcome::EmptyAfterCorruption { .. }
+        ));
+        // The same unreadable primary reuses its diagnostic, rather than allocating again.
+        crate::session::load_snapshot_with_outcome(&options).unwrap();
+        assert_eq!(
+            corrupt_copies_of(&source).unwrap().len(),
+            (index + 1).min(3)
+        );
+    }
+    for suffix in [".bak.corrupt-1", ".recovery.corrupt-1"] {
+        std::fs::write(append_path_suffix(&source, suffix), b"side diagnostic").unwrap();
+    }
+    let before = named_session_non_lock_artifact_paths(&source).unwrap();
+    move_named_session_non_lock_artifacts(&source, &target).unwrap();
+    assert!(before.iter().all(|path| !path.exists()));
+    options.set_named_file_target(target.clone());
+    let moved = named_session_non_lock_artifact_paths(&target).unwrap();
+    assert_eq!(moved.len(), before.len());
+    crate::session::clear_session(&options).unwrap();
+    assert!(moved.iter().all(|path| !path.exists()));
+}
diff --git a/src/session/mod.rs b/src/session/mod.rs
index fda6006cc..8f0373fdd 100644
--- a/src/session/mod.rs
+++ b/src/session/mod.rs
@@ -15,8 +15,9 @@ mod storage;
 #[allow(unused_imports)]
 pub use artifacts::{
     NamedSessionClearOutcome, NamedSessionDuplicateOutcome, NamedSessionMoveOutcome,
-    NamedSessionMovedArtifact, SessionArtifactPaths, clear_named_session_non_lock_artifacts,
-    duplicate_named_session_primary, move_named_session_non_lock_artifacts,
+    NamedSessionMovedArtifact, SessionArtifactKind, SessionArtifactPaths,
+    clear_named_session_non_lock_artifacts, duplicate_named_session_primary,
+    move_named_session_non_lock_artifacts, named_session_artifact_kind,
     named_session_artifact_paths, named_session_non_lock_artifact_paths,
     rollback_named_session_non_lock_artifacts_move,
 };
@@ -36,21 +37,21 @@ pub use snapshot::{
     BoardAppearanceSnapshot, BoardPagesSnapshot, BoardSnapshot, SessionSnapshot, ToolStateSnapshot,
     apply_snapshot, load_snapshot, save_snapshot, snapshot_from_input,
 };
+pub(crate) use snapshot::{
+    CorruptArtifactPreservationFailed, LoadSnapshotOutcome, RestoredArtifact,
+    apply_snapshot_replacing_boards, apply_tool_state_snapshot, load_named_session_candidate,
+    load_snapshot_with_outcome,
+};
 #[allow(unused_imports)]
 pub(crate) use snapshot::{
-    DEFAULT_MAX_EXPANDED_SESSION_BYTES, SaveAsOverwrite, SaveLimitExceeded, SaveSnapshotOutcome,
-    SaveSnapshotReport, SnapshotPayloadEstimate, SnapshotSaveEstimate, estimate_snapshot_payload,
-    estimate_snapshot_save, estimate_snapshot_without_history_payload,
+    DEFAULT_MAX_EXPANDED_SESSION_BYTES, SaveAsOverwrite, SaveLimitExceeded, SavePayloadTooLarge,
+    SaveSnapshotOutcome, SaveSnapshotReport, SnapshotPayloadEstimate, SnapshotSaveEstimate,
+    estimate_snapshot_payload, estimate_snapshot_save, estimate_snapshot_without_history_payload,
     save_snapshot_as_requires_overwrite, save_snapshot_as_with_report,
     save_snapshot_autosave_with_report, save_snapshot_autosave_with_report_and_clear_boundary,
     save_snapshot_with_report, save_snapshot_with_report_and_clear_boundary,
 };
 #[allow(unused_imports)]
-pub(crate) use snapshot::{
-    LoadSnapshotOutcome, apply_snapshot_replacing_boards, apply_tool_state_snapshot,
-    load_named_session_candidate, load_snapshot_with_outcome,
-};
-#[allow(unused_imports)]
 pub use storage::{ClearOutcome, FrameCounts, SessionInspection, clear_session, inspect_session};
 pub use storage::{ClearToolStateOutcome, clear_tool_state};
 
diff --git a/src/session/options/types.rs b/src/session/options/types.rs
index f39070a2a..0fe8c7e71 100644
--- a/src/session/options/types.rs
+++ b/src/session/options/types.rs
@@ -181,20 +181,6 @@ impl SessionOptions {
         }
     }
 
-    pub(crate) fn recovery_backup_file_path(&self) -> PathBuf {
-        append_path_suffix(&self.recovery_file_path(), ".bak")
-    }
-
-    pub(crate) fn corrupt_artifact_backup_file_path(&self, artifact_path: &Path) -> PathBuf {
-        if artifact_path == self.session_file_path().as_path() {
-            return self.backup_file_path();
-        }
-        if artifact_path == self.recovery_file_path().as_path() {
-            return self.recovery_backup_file_path();
-        }
-        replace_path_extension(artifact_path, "recovery.bak")
-    }
-
     pub fn file_prefix(&self) -> String {
         format!("session-{}", self.display_id)
     }
@@ -241,9 +227,3 @@ pub(crate) fn append_path_suffix(path: &Path, suffix: &str) -> PathBuf {
     raw.push(suffix);
     PathBuf::from(raw)
 }
-
-fn replace_path_extension(path: &Path, extension: &str) -> PathBuf {
-    let mut path = path.to_path_buf();
-    path.set_extension(extension);
-    path
-}
diff --git a/src/session/primary.rs b/src/session/primary.rs
index d7b746ecc..cdacadd99 100644
--- a/src/session/primary.rs
+++ b/src/session/primary.rs
@@ -137,6 +137,41 @@ pub(crate) fn open_session_artifact_for_read(path: &Path, no_follow: bool) -> Re
     Ok(file)
 }
 
+/// Bounded probes never block on a FIFO raced into a session slot.
+pub(crate) fn open_session_artifact_for_probe(
+    path: &Path,
+    no_follow: bool,
+) -> Result<Option<File>> {
+    let mut options = OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    options.custom_flags(libc::O_NONBLOCK | if no_follow { libc::O_NOFOLLOW } else { 0 });
+    let file = match options.open(path) {
+        Ok(file) => file,
+        Err(err) if err.kind() == ErrorKind::NotFound => return Ok(None),
+        Err(err) if no_follow && open_error_is_symlink(&err) => {
+            return Err(NonRegularSessionArtifact::new(path, PrimaryTargetKind::Symlink).into());
+        }
+        Err(err) => {
+            if let Ok(metadata) =
+                raw_metadata(path, no_follow).or_else(|_| fs::symlink_metadata(path))
+            {
+                let kind = classify_metadata(&metadata);
+                if kind != PrimaryTargetKind::Regular && kind != PrimaryTargetKind::Symlink {
+                    return Err(NonRegularSessionArtifact::new(path, kind).into());
+                }
+                if kind == PrimaryTargetKind::Symlink && open_error_is_symlink(&err) {
+                    return Err(NonRegularSessionArtifact::new(path, kind).into());
+                }
+            }
+            return Err(err)
+                .with_context(|| format!("failed to probe session artifact {}", path.display()));
+        }
+    };
+    ensure_regular_session_artifact(path, file.metadata()?)?;
+    Ok(Some(file))
+}
+
 /// Restrict an existing regular session artifact to its owner without
 /// following a symlink that raced into its path.
 #[cfg(unix)]
diff --git a/src/session/snapshot/compat_tests.rs b/src/session/snapshot/compat_tests.rs
new file mode 100644
index 000000000..4530213ff
--- /dev/null
+++ b/src/session/snapshot/compat_tests.rs
@@ -0,0 +1,467 @@
+//! Files written by real historical writers, without edits to the artifact bytes.
+//! Sources: tag v0.9.25 and commit a2bb723a. The generator below was added to
+//! each archive as an integration test and run alone with
+//! `cargo test --locked --no-default-features -- --ignored --exact --test-threads=1`.
+//! COMPAT_FIXTURE_OUT selected an empty output directory. The v0.9.25 generator omits
+//! BoardSnapshot.appearance because that revision does not have the field.
+//!
+//! Historical fixture generator:
+//! ```rust,ignore
+//! use std::fs;
+//! use std::path::{Path, PathBuf};
+//! use wayscriber::draw::{Color, Frame, Shape};
+//! use wayscriber::session::{
+//!     BoardPagesSnapshot, BoardSnapshot, CompressionMode, SessionOptions, SessionSnapshot,
+//!     ToolStateSnapshot, save_snapshot,
+//! };
+//!
+//! const TOOL_STATE: &str = r#"{"current_color":{"r":0.0,"g":0.0,"b":1.0,"a":1.0},"current_thickness":3.0,"current_font_size":24.0,"text_background_enabled":false,"arrow_length":20.0,"arrow_angle":30.0,"board_previous_color":null}"#;
+//!
+//! fn lines(count: i32) -> SessionSnapshot {
+//!     let mut frame = Frame::new();
+//!     for index in 0..count {
+//!         frame.add_shape(Shape::Line {
+//!             x1: 0,
+//!             y1: index * 10,
+//!             x2: 100,
+//!             y2: index * 10,
+//!             color: Color { r: 1.0, g: 0.0, b: 0.0, a: 1.0 },
+//!             thick: 2.0,
+//!         });
+//!     }
+//!     SessionSnapshot {
+//!         active_board_id: "transparent".to_string(),
+//!         boards: vec![BoardSnapshot {
+//!             id: "transparent".to_string(),
+//!             appearance: None,
+//!             pages: BoardPagesSnapshot { pages: vec![frame], active: 0 },
+//!         }],
+//!         tool_state: None,
+//!     }
+//! }
+//!
+//! fn blank() -> SessionSnapshot {
+//!     let tool_state: ToolStateSnapshot = serde_json::from_str(TOOL_STATE).unwrap();
+//!     SessionSnapshot { active_board_id: "transparent".to_string(), boards: Vec::new(), tool_state: Some(tool_state) }
+//! }
+//!
+//! fn cleared() -> SessionSnapshot {
+//!     SessionSnapshot { active_board_id: "transparent".to_string(), boards: Vec::new(), tool_state: None }
+//! }
+//!
+//! fn options(root: &Path, name: &str, compression: CompressionMode) -> SessionOptions {
+//!     let mut options = SessionOptions::new(root.join(name), "fixture");
+//!     options.persist_transparent = true;
+//!     options.restore_tool_state = true;
+//!     options.per_output = false;
+//!     options.compression = compression;
+//!     options
+//! }
+//!
+//! fn keep(from: PathBuf, out: &Path, name: &str) {
+//!     fs::copy(&from, out.join(name)).unwrap_or_else(|err| panic!("{}: {err}", from.display()));
+//! }
+//!
+//! #[test]
+//! #[ignore = "writes the compatibility fixtures; run explicitly"]
+//! fn generate_compat_fixtures() {
+//!     let out = PathBuf::from(std::env::var("COMPAT_FIXTURE_OUT").expect("COMPAT_FIXTURE_OUT"));
+//!     let root = out.join("work");
+//!     fs::create_dir_all(&root).unwrap();
+//!
+//!     let plain = options(&root, "plain", CompressionMode::Off);
+//!     save_snapshot(&lines(1), &plain).unwrap();
+//!     keep(plain.session_file_path(), &out, "lines-1.json");
+//!     save_snapshot(&lines(2), &plain).unwrap();
+//!     keep(plain.session_file_path(), &out, "lines-2.json");
+//!     keep(plain.backup_file_path(), &out, "backup-lines-1.json");
+//!
+//!     let gzip = options(&root, "gzip", CompressionMode::On);
+//!     save_snapshot(&lines(4), &gzip).unwrap();
+//!     keep(gzip.session_file_path(), &out, "lines-4.json.gz");
+//!
+//!     let blank_set = options(&root, "blank", CompressionMode::Off);
+//!     save_snapshot(&lines(1), &blank_set).unwrap();
+//!     save_snapshot(&blank(), &blank_set).unwrap();
+//!     keep(blank_set.session_file_path(), &out, "blank.json");
+//!     keep(blank_set.backup_recovery_marker_file_path(), &out, "backup-recoverable.marker");
+//!
+//!     let mut recovery = options(&root, "recovery", CompressionMode::Off);
+//!     recovery.max_file_size_bytes = 64;
+//!     save_snapshot(&lines(3), &recovery).expect_err("the oversized save must fail");
+//!     keep(recovery.recovery_file_path(), &out, "recovery-lines-3.json");
+//!     recovery.max_file_size_bytes = 50 * 1024 * 1024;
+//!     save_snapshot(&blank(), &recovery).unwrap();
+//!     keep(recovery.recovery_recoverable_marker_file_path(), &out, "recovery-recoverable.marker");
+//!
+//!     let clear = options(&root, "clear", CompressionMode::Off);
+//!     save_snapshot(&lines(1), &clear).unwrap();
+//!     save_snapshot(&cleared(), &clear).unwrap();
+//!     keep(clear.clear_marker_file_path(), &out, "cleared.marker");
+//!
+//!     fs::remove_dir_all(&root).unwrap();
+//! }
+//! ```
+use super::ToolStateSnapshot;
+use super::types::BoardFile;
+use super::{
+    compression::DEFAULT_MAX_EXPANDED_SESSION_BYTES,
+    generation::{self, Generation},
+    load::{self, LoadSnapshotOutcome},
+    save,
+    tests::{sample_snapshot, set_modified},
+};
+use crate::draw::Frame;
+use crate::session::{CompressionMode, SessionOptions};
+use crate::test_temp::tempdir;
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::Path;
+use std::time::{Duration, SystemTime};
+
+macro_rules! fixtures {
+    ($era:literal) => {
+        [
+            include_bytes!(concat!("fixtures/compat/", $era, "/lines-1.json")).as_slice(),
+            include_bytes!(concat!("fixtures/compat/", $era, "/lines-2.json")).as_slice(),
+            include_bytes!(concat!("fixtures/compat/", $era, "/lines-4.json.gz")).as_slice(),
+            include_bytes!(concat!("fixtures/compat/", $era, "/recovery-lines-3.json")).as_slice(),
+            include_bytes!(concat!("fixtures/compat/", $era, "/backup-lines-1.json")).as_slice(),
+            include_bytes!(concat!("fixtures/compat/", $era, "/blank.json")).as_slice(),
+            include_bytes!(concat!("fixtures/compat/", $era, "/cleared.marker")).as_slice(),
+            include_bytes!(concat!(
+                "fixtures/compat/",
+                $era,
+                "/backup-recoverable.marker"
+            ))
+            .as_slice(),
+            include_bytes!(concat!(
+                "fixtures/compat/",
+                $era,
+                "/recovery-recoverable.marker"
+            ))
+            .as_slice(),
+        ]
+    };
+}
+
+const ERAS: [(&str, [&[u8]; 9]); 2] = [
+    ("v0.9.25", fixtures!("v0.9.25")),
+    ("main-a2bb723a", fixtures!("main-a2bb723a")),
+];
+
+fn line_count(snapshot: &super::SessionSnapshot) -> usize {
+    snapshot
+        .boards
+        .iter()
+        .flat_map(|b| &b.pages.pages)
+        .map(|page| page.shapes.len())
+        .sum()
+}
+
+fn options(path: &Path) -> SessionOptions {
+    let mut options = SessionOptions::new(path.to_path_buf(), "compat");
+    options.persist_transparent = true;
+    options.restore_tool_state = true;
+    options.per_output = false;
+    options.compression = CompressionMode::Off;
+    options
+}
+
+fn files(path: &Path, include_lock: bool) -> BTreeMap<String, Vec<u8>> {
+    fs::read_dir(path)
+        .unwrap()
+        .map(|e| e.unwrap().path())
+        .filter(|p| p.is_file() && (include_lock || !p.to_string_lossy().ends_with(".lock")))
+        .map(|p| {
+            (
+                p.file_name().unwrap().to_str().unwrap().to_string(),
+                fs::read(p).unwrap(),
+            )
+        })
+        .collect()
+}
+
+#[test]
+fn real_legacy_fixtures_decode_and_carry_no_generation() {
+    for (era, fixtures) in ERAS {
+        let temp = tempdir().unwrap();
+        let options = options(temp.path());
+        for (index, expected) in [(0, 1), (1, 2), (2, 4), (3, 3), (4, 1), (5, 0)] {
+            fs::write(options.session_file_path(), fixtures[index]).unwrap();
+            let loaded = load::load_snapshot_inner(&options.session_file_path(), &options)
+                .unwrap()
+                .unwrap();
+            assert_eq!(
+                line_count(&loaded.snapshot),
+                expected,
+                "{era}, fixture {index}"
+            );
+            assert_eq!(loaded.compressed, index == 2);
+            assert_eq!(
+                loaded.version,
+                if era == "v0.9.25" { 6 } else { 7 },
+                "{era}"
+            );
+            assert_eq!(
+                generation::payload_prefix_generation(fixtures[index]),
+                Generation::Unknown
+            );
+            if index == 5 {
+                assert!(loaded.snapshot.tool_state.is_some());
+            }
+        }
+        for (index, kind) in [
+            (6, generation::MarkerKind::Cleared),
+            (7, generation::MarkerKind::BackupRecoverable),
+            (8, generation::MarkerKind::RecoveryRecoverable),
+        ] {
+            assert_eq!(fixtures[index].len(), 20, "legacy timestamp marker {era}");
+            let path = match kind {
+                generation::MarkerKind::Cleared => options.clear_marker_file_path(),
+                generation::MarkerKind::BackupRecoverable => {
+                    options.backup_recovery_marker_file_path()
+                }
+                generation::MarkerKind::RecoveryRecoverable => {
+                    options.recovery_recoverable_marker_file_path()
+                }
+            };
+            fs::write(path, fixtures[index]).unwrap();
+            // Allocation uses the real marker reader as part of the artifact view.
+            assert_eq!(
+                generation::ArtifactSetView::probe(&options)
+                    .next_generation(generation::UnreadablePolicy::Warn)
+                    .unwrap(),
+                Some(1),
+                "{era} {kind:?}"
+            );
+        }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+enum Expect {
+    Empty,
+    Primary(usize),
+    Backup(usize),
+    Recovery(usize),
+    Blank,
+}
+
+fn classify(outcome: LoadSnapshotOutcome) -> Expect {
+    match outcome {
+        LoadSnapshotOutcome::Empty => Expect::Empty,
+        LoadSnapshotOutcome::Loaded(snapshot) if !snapshot.has_board_data() => Expect::Blank,
+        LoadSnapshotOutcome::Loaded(snapshot) => Expect::Primary(line_count(&snapshot)),
+        LoadSnapshotOutcome::LoadedFromBackup(snapshot) => Expect::Backup(line_count(&snapshot)),
+        LoadSnapshotOutcome::LoadedFromRecovery(snapshot) => {
+            Expect::Recovery(line_count(&snapshot))
+        }
+        other => panic!("unexpected fixture result: {other:?}"),
+    }
+}
+
+#[derive(Clone, Copy)]
+enum Slot {
+    P,
+    B,
+    R,
+    C,
+    Br,
+    Rr,
+}
+
+impl Slot {
+    fn path(self, o: &SessionOptions) -> std::path::PathBuf {
+        match self {
+            Self::P => o.session_file_path(),
+            Self::B => o.backup_file_path(),
+            Self::R => o.recovery_file_path(),
+            Self::C => o.clear_marker_file_path(),
+            Self::Br => o.backup_recovery_marker_file_path(),
+            Self::Rr => o.recovery_recoverable_marker_file_path(),
+        }
+    }
+}
+
+#[test]
+fn legacy_precedence_matrix_remains_identical_on_runtime_and_read_only_candidates() {
+    use Expect::*;
+    use Slot::*;
+    type Scenario = (&'static str, &'static [(Slot, usize)], [Expect; 4]);
+    let scenarios: [Scenario; 7] = [
+        ("S1", &[(C, 6), (P, 1)], [Primary(2), Empty, Empty, Empty]),
+        (
+            "S2",
+            &[(P, 2), (R, 3)],
+            [Recovery(3), Recovery(3), Primary(4), Recovery(3)],
+        ),
+        (
+            "S3",
+            &[(R, 3), (P, 1)],
+            [Primary(2), Recovery(3), Recovery(3), Recovery(3)],
+        ),
+        (
+            "S4",
+            &[(B, 4), (P, 1), (C, 6)],
+            [Empty, Empty, Primary(2), Empty],
+        ),
+        ("S5", &[(B, 4), (P, 5)], [Blank, Blank, Backup(1), Blank]),
+        (
+            "S6",
+            &[(C, 6), (B, 4), (Br, 7), (P, 5)],
+            [Backup(1), Blank, Blank, Blank],
+        ),
+        (
+            "S7",
+            &[(C, 6), (R, 3), (Rr, 8), (P, 5)],
+            [Recovery(3), Blank, Blank, Blank],
+        ),
+    ];
+    for (era, fixtures) in ERAS {
+        for (scenario, slots, expected) in scenarios {
+            for (assignment, expect) in expected.into_iter().enumerate() {
+                for named_candidate in [false, true] {
+                    let temp = tempdir().unwrap();
+                    let mut options = options(temp.path());
+                    if named_candidate {
+                        options.set_named_file_target(temp.path().join("board.wayscriber-session"));
+                    }
+                    for (i, (slot, fixture)) in slots.iter().enumerate() {
+                        let path = slot.path(&options);
+                        fs::write(&path, fixtures[*fixture]).unwrap();
+                        let seconds = match assignment {
+                            0 => i as u64 * 3,
+                            1 => 0,
+                            2 => (slots.len() - i) as u64 * 3,
+                            _ => i as u64 / 2 * 2,
+                        };
+                        set_modified(&path, SystemTime::UNIX_EPOCH + Duration::from_secs(seconds));
+                    }
+                    let before = files(temp.path(), named_candidate);
+                    let result = if named_candidate {
+                        load::load_named_session_candidate_with_expanded_limit(
+                            &options,
+                            DEFAULT_MAX_EXPANDED_SESSION_BYTES,
+                        )
+                    } else {
+                        load::load_snapshot_with_expanded_limit(
+                            &options,
+                            DEFAULT_MAX_EXPANDED_SESSION_BYTES,
+                        )
+                    }
+                    .unwrap();
+                    assert_eq!(
+                        classify(result),
+                        expect,
+                        "{era}, {scenario}, assignment {assignment}, candidate={named_candidate}"
+                    );
+                    assert_eq!(
+                        files(temp.path(), named_candidate),
+                        before,
+                        "read path must preserve fixture bytes {era}, {scenario}"
+                    );
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn legacy_clear_cleanup_retains_only_backups_strictly_newer_than_marker() {
+    for (era, fixtures) in ERAS {
+        for assignment in 0..4 {
+            let temp = tempdir().unwrap();
+            let options = options(temp.path());
+            fs::write(options.backup_file_path(), fixtures[4]).unwrap();
+            fs::write(options.clear_marker_file_path(), fixtures[6]).unwrap();
+            let (backup, clear) = match assignment {
+                0 => (0, 3),
+                1 | 3 => (0, 0),
+                _ => (3, 0),
+            };
+            set_modified(
+                &options.backup_file_path(),
+                SystemTime::UNIX_EPOCH + Duration::from_secs(backup),
+            );
+            set_modified(
+                &options.clear_marker_file_path(),
+                SystemTime::UNIX_EPOCH + Duration::from_secs(clear),
+            );
+            save::save_snapshot_with_report(&sample_snapshot(), &options).unwrap();
+            assert!(!options.clear_marker_file_path().exists());
+            assert_eq!(
+                options.backup_file_path().exists(),
+                assignment == 2,
+                "{era} assignment {assignment}"
+            );
+            assert_eq!(
+                line_count(
+                    &load::load_snapshot_inner(&options.session_file_path(), &options)
+                        .unwrap()
+                        .unwrap()
+                        .snapshot
+                ),
+                1
+            );
+        }
+    }
+}
+
+// Verbatim pre-generation SessionFile schema from a2bb723a, renamed for this test.
+#[derive(Debug, Serialize, Deserialize)]
+struct LegacySessionFileA2bb723a {
+    #[serde(default = "legacy_file_version")]
+    pub version: u32,
+    pub last_modified: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub active_board_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub active_mode: Option<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub boards: Vec<BoardFile>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub transparent: Option<Frame>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub whiteboard: Option<Frame>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub blackboard: Option<Frame>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub transparent_pages: Option<Vec<Frame>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub whiteboard_pages: Option<Vec<Frame>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub blackboard_pages: Option<Vec<Frame>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub transparent_active_page: Option<usize>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub whiteboard_active_page: Option<usize>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub blackboard_active_page: Option<usize>,
+    #[serde(default)]
+    pub tool_state: Option<ToolStateSnapshot>,
+}
+
+fn legacy_file_version() -> u32 {
+    1
+}
+
+#[test]
+fn pre_generation_reader_accepts_new_files_and_resaves_without_the_optional_member() {
+    let temp = tempdir().unwrap();
+    let options = options(temp.path());
+    save::save_snapshot_with_report(&sample_snapshot(), &options).unwrap();
+    let legacy: LegacySessionFileA2bb723a =
+        serde_json::from_slice(&fs::read(options.session_file_path()).unwrap()).unwrap();
+    let bytes = serde_json::to_vec_pretty(&legacy).unwrap();
+    assert_eq!(
+        generation::payload_prefix_generation(&bytes),
+        Generation::Unknown
+    );
+    fs::write(options.session_file_path(), bytes).unwrap();
+    let loaded = load::load_snapshot_inner(&options.session_file_path(), &options)
+        .unwrap()
+        .unwrap();
+    assert_eq!(line_count(&loaded.snapshot), 1);
+}
diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/backup-lines-1.json b/src/session/snapshot/fixtures/compat/main-a2bb723a/backup-lines-1.json
new file mode 100644
index 000000000..ebd5c23c5
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/main-a2bb723a/backup-lines-1.json
@@ -0,0 +1,38 @@
+{
+  "version": 7,
+  "last_modified": "2026-10-05T12:32:40Z",
+  "active_board_id": "transparent",
+  "boards": [
+    {
+      "id": "transparent",
+      "pages": [
+        {
+          "shapes": [
+            {
+              "id": 1,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 0,
+                  "x2": 100,
+                  "y2": 0,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203560674,
+              "locked": false
+            }
+          ]
+        }
+      ],
+      "active_page": 0
+    }
+  ],
+  "tool_state": null
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/backup-recoverable.marker b/src/session/snapshot/fixtures/compat/main-a2bb723a/backup-recoverable.marker
new file mode 100644
index 000000000..6c754f799
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/main-a2bb723a/backup-recoverable.marker
@@ -0,0 +1 @@
+2026-10-05T12:32:40Z
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/blank.json b/src/session/snapshot/fixtures/compat/main-a2bb723a/blank.json
new file mode 100644
index 000000000..d8d088b11
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/main-a2bb723a/blank.json
@@ -0,0 +1,29 @@
+{
+  "version": 7,
+  "last_modified": "2026-10-05T12:32:40Z",
+  "active_board_id": "transparent",
+  "tool_state": {
+    "current_color": {
+      "r": 0.0,
+      "g": 0.0,
+      "b": 1.0,
+      "a": 1.0
+    },
+    "current_thickness": 3.0,
+    "eraser_size": 12.0,
+    "eraser_kind": "Circle",
+    "eraser_mode": "brush",
+    "blur_style": "gaussian",
+    "marker_opacity": null,
+    "fill_enabled": null,
+    "tool_override": null,
+    "current_font_size": 24.0,
+    "text_background_enabled": false,
+    "arrow_length": 20.0,
+    "arrow_angle": 30.0,
+    "arrow_head_at_end": null,
+    "arrow_label_enabled": null,
+    "polygon_sides": 5,
+    "board_previous_color": null
+  }
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/cleared.marker b/src/session/snapshot/fixtures/compat/main-a2bb723a/cleared.marker
new file mode 100644
index 000000000..6c754f799
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/main-a2bb723a/cleared.marker
@@ -0,0 +1 @@
+2026-10-05T12:32:40Z
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/lines-1.json b/src/session/snapshot/fixtures/compat/main-a2bb723a/lines-1.json
new file mode 100644
index 000000000..ebd5c23c5
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/main-a2bb723a/lines-1.json
@@ -0,0 +1,38 @@
+{
+  "version": 7,
+  "last_modified": "2026-10-05T12:32:40Z",
+  "active_board_id": "transparent",
+  "boards": [
+    {
+      "id": "transparent",
+      "pages": [
+        {
+          "shapes": [
+            {
+              "id": 1,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 0,
+                  "x2": 100,
+                  "y2": 0,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203560674,
+              "locked": false
+            }
+          ]
+        }
+      ],
+      "active_page": 0
+    }
+  ],
+  "tool_state": null
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/lines-2.json b/src/session/snapshot/fixtures/compat/main-a2bb723a/lines-2.json
new file mode 100644
index 000000000..97f146a33
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/main-a2bb723a/lines-2.json
@@ -0,0 +1,58 @@
+{
+  "version": 7,
+  "last_modified": "2026-10-05T12:32:40Z",
+  "active_board_id": "transparent",
+  "boards": [
+    {
+      "id": "transparent",
+      "pages": [
+        {
+          "shapes": [
+            {
+              "id": 1,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 0,
+                  "x2": 100,
+                  "y2": 0,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203560674,
+              "locked": false
+            },
+            {
+              "id": 2,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 10,
+                  "x2": 100,
+                  "y2": 10,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203560674,
+              "locked": false
+            }
+          ]
+        }
+      ],
+      "active_page": 0
+    }
+  ],
+  "tool_state": null
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/lines-4.json.gz b/src/session/snapshot/fixtures/compat/main-a2bb723a/lines-4.json.gz
new file mode 100644
index 0000000000000000000000000000000000000000..fafdece66cb994bc937576028fd7e6b854180fa9
GIT binary patch
literal 335
zcmV-V0kHlbiwFP!00000|LvARZi6roMfaQnd7V_Y37~R@F1u<KAqSkqii?r$MyVq1
z-m%j*5jCkqC01;ZX5Rnf5&DZcM{$gfTpOVpRK)qh)sh)ozNuPl1+SrtD5lwx;3ZC<
z2`v&@tndr+QdU`U<mE;&U6;a(t!9mBndXhXXgoB4UZINPv;RUrEcd8oJAQTCx;!>}
z*7kT`bA5p<`fYCq($@oe5>1!@I}spw5keos=tSKPc)&*oeU*|*53B;%A@UHk0^PZ>
zgLHG3vdiQE?1GEhy{Hc0p#e`9{V@SmnlsDml3Dj`{zxcJ(hO&L`b#QRb?|xIGHG~p
zXKpwMbgCebu}L6v6sCznGF24l*eK9B3e!YkHB}Unu~A6oDEvPPH`O}och^6M$JagM
h?hp45qHmQ~Agh!tjfH&xHt$kK-6yE{Y_LHI008nKnr8q2

literal 0
HcmV?d00001

diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/recovery-lines-3.json b/src/session/snapshot/fixtures/compat/main-a2bb723a/recovery-lines-3.json
new file mode 100644
index 000000000..9dadfb9c6
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/main-a2bb723a/recovery-lines-3.json
@@ -0,0 +1,78 @@
+{
+  "version": 7,
+  "last_modified": "2026-10-05T12:32:40Z",
+  "active_board_id": "transparent",
+  "boards": [
+    {
+      "id": "transparent",
+      "pages": [
+        {
+          "shapes": [
+            {
+              "id": 1,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 0,
+                  "x2": 100,
+                  "y2": 0,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203560675,
+              "locked": false
+            },
+            {
+              "id": 2,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 10,
+                  "x2": 100,
+                  "y2": 10,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203560675,
+              "locked": false
+            },
+            {
+              "id": 3,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 20,
+                  "x2": 100,
+                  "y2": 20,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203560675,
+              "locked": false
+            }
+          ]
+        }
+      ],
+      "active_page": 0
+    }
+  ],
+  "tool_state": null
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/main-a2bb723a/recovery-recoverable.marker b/src/session/snapshot/fixtures/compat/main-a2bb723a/recovery-recoverable.marker
new file mode 100644
index 000000000..6c754f799
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/main-a2bb723a/recovery-recoverable.marker
@@ -0,0 +1 @@
+2026-10-05T12:32:40Z
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/backup-lines-1.json b/src/session/snapshot/fixtures/compat/v0.9.25/backup-lines-1.json
new file mode 100644
index 000000000..fedc825b4
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/v0.9.25/backup-lines-1.json
@@ -0,0 +1,38 @@
+{
+  "version": 6,
+  "last_modified": "2026-10-05T12:32:20Z",
+  "active_board_id": "transparent",
+  "boards": [
+    {
+      "id": "transparent",
+      "pages": [
+        {
+          "shapes": [
+            {
+              "id": 1,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 0,
+                  "x2": 100,
+                  "y2": 0,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203540999,
+              "locked": false
+            }
+          ]
+        }
+      ],
+      "active_page": 0
+    }
+  ],
+  "tool_state": null
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/backup-recoverable.marker b/src/session/snapshot/fixtures/compat/v0.9.25/backup-recoverable.marker
new file mode 100644
index 000000000..85c83f21d
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/v0.9.25/backup-recoverable.marker
@@ -0,0 +1 @@
+2026-10-05T12:32:21Z
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/blank.json b/src/session/snapshot/fixtures/compat/v0.9.25/blank.json
new file mode 100644
index 000000000..1f70cb5b1
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/v0.9.25/blank.json
@@ -0,0 +1,29 @@
+{
+  "version": 6,
+  "last_modified": "2026-10-05T12:32:21Z",
+  "active_board_id": "transparent",
+  "tool_state": {
+    "current_color": {
+      "r": 0.0,
+      "g": 0.0,
+      "b": 1.0,
+      "a": 1.0
+    },
+    "current_thickness": 3.0,
+    "eraser_size": 12.0,
+    "eraser_kind": "Circle",
+    "eraser_mode": "brush",
+    "blur_style": "gaussian",
+    "marker_opacity": null,
+    "fill_enabled": null,
+    "tool_override": null,
+    "current_font_size": 24.0,
+    "text_background_enabled": false,
+    "arrow_length": 20.0,
+    "arrow_angle": 30.0,
+    "arrow_head_at_end": null,
+    "arrow_label_enabled": null,
+    "polygon_sides": 5,
+    "board_previous_color": null
+  }
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/cleared.marker b/src/session/snapshot/fixtures/compat/v0.9.25/cleared.marker
new file mode 100644
index 000000000..85c83f21d
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/v0.9.25/cleared.marker
@@ -0,0 +1 @@
+2026-10-05T12:32:21Z
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/lines-1.json b/src/session/snapshot/fixtures/compat/v0.9.25/lines-1.json
new file mode 100644
index 000000000..fedc825b4
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/v0.9.25/lines-1.json
@@ -0,0 +1,38 @@
+{
+  "version": 6,
+  "last_modified": "2026-10-05T12:32:20Z",
+  "active_board_id": "transparent",
+  "boards": [
+    {
+      "id": "transparent",
+      "pages": [
+        {
+          "shapes": [
+            {
+              "id": 1,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 0,
+                  "x2": 100,
+                  "y2": 0,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203540999,
+              "locked": false
+            }
+          ]
+        }
+      ],
+      "active_page": 0
+    }
+  ],
+  "tool_state": null
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/lines-2.json b/src/session/snapshot/fixtures/compat/v0.9.25/lines-2.json
new file mode 100644
index 000000000..a4b9d8245
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/v0.9.25/lines-2.json
@@ -0,0 +1,58 @@
+{
+  "version": 6,
+  "last_modified": "2026-10-05T12:32:20Z",
+  "active_board_id": "transparent",
+  "boards": [
+    {
+      "id": "transparent",
+      "pages": [
+        {
+          "shapes": [
+            {
+              "id": 1,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 0,
+                  "x2": 100,
+                  "y2": 0,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203540999,
+              "locked": false
+            },
+            {
+              "id": 2,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 10,
+                  "x2": 100,
+                  "y2": 10,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203540999,
+              "locked": false
+            }
+          ]
+        }
+      ],
+      "active_page": 0
+    }
+  ],
+  "tool_state": null
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/lines-4.json.gz b/src/session/snapshot/fixtures/compat/v0.9.25/lines-4.json.gz
new file mode 100644
index 0000000000000000000000000000000000000000..4371c397bfbc89e609b7ae37c0015c9215eadc67
GIT binary patch
literal 335
zcmV-V0kHlbiwFP!00000|LvARYQr!PMfW;|(K;!ToTS)i=(4MpU=&+PL{!U2YDfvb
zdq+y!1XoVM1+Tm@%)I|cgZYa&qa?vcVXV|O&Xd*5*NR(Lyy;4ArKq5b8DXnAC3CWT
zrYuic&d3W6QeHZF6vak!Qx!6Zo#C}@xDmCxXacl=UZF~obNE6(E)S^TJ8^Z~x&pR)
z-gJ0ZbA5r%y6s>G($xccl69N_J5eBH7DFHX=*0XEq{qj4eWg~~^sEBdBl-}v0^Rws
zy>xSz^2_81Y@>_1y(|ylVG&P@{+NJEBe)Y)!JU8hF{6y6%LU1@?3YyO@(}X4<;n_l
zXKp+QY^)&Ap-G@q6vl}{I#v|e&?vAe3gbj!F;*1Pp;1VuDEvPPH`N+-yX&9B<LjRB
h_lN%n=vx&O*lDc_>tG*%^}AB2{RDi{EJ;BL002N-qA&me

literal 0
HcmV?d00001

diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/recovery-lines-3.json b/src/session/snapshot/fixtures/compat/v0.9.25/recovery-lines-3.json
new file mode 100644
index 000000000..dee50412f
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/v0.9.25/recovery-lines-3.json
@@ -0,0 +1,78 @@
+{
+  "version": 6,
+  "last_modified": "2026-10-05T12:32:21Z",
+  "active_board_id": "transparent",
+  "boards": [
+    {
+      "id": "transparent",
+      "pages": [
+        {
+          "shapes": [
+            {
+              "id": 1,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 0,
+                  "x2": 100,
+                  "y2": 0,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203541000,
+              "locked": false
+            },
+            {
+              "id": 2,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 10,
+                  "x2": 100,
+                  "y2": 10,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203541000,
+              "locked": false
+            },
+            {
+              "id": 3,
+              "shape": {
+                "Line": {
+                  "x1": 0,
+                  "y1": 20,
+                  "x2": 100,
+                  "y2": 20,
+                  "color": {
+                    "r": 1.0,
+                    "g": 0.0,
+                    "b": 0.0,
+                    "a": 1.0
+                  },
+                  "thick": 2.0
+                }
+              },
+              "created_at": 1791203541000,
+              "locked": false
+            }
+          ]
+        }
+      ],
+      "active_page": 0
+    }
+  ],
+  "tool_state": null
+}
\ No newline at end of file
diff --git a/src/session/snapshot/fixtures/compat/v0.9.25/recovery-recoverable.marker b/src/session/snapshot/fixtures/compat/v0.9.25/recovery-recoverable.marker
new file mode 100644
index 000000000..85c83f21d
--- /dev/null
+++ b/src/session/snapshot/fixtures/compat/v0.9.25/recovery-recoverable.marker
@@ -0,0 +1 @@
+2026-10-05T12:32:21Z
\ No newline at end of file
diff --git a/src/session/snapshot/generation.rs b/src/session/snapshot/generation.rs
new file mode 100644
index 000000000..7d16ef5fc
--- /dev/null
+++ b/src/session/snapshot/generation.rs
@@ -0,0 +1,96 @@
+//! Write order of session artifacts.
+//!
+//! Every "which artifact was written later" decision of the session loader and
+//! of the post-save cleanup goes through this module. An artifact carries a
+//! save generation once a generation-aware build writes it. When either side of
+//! a comparison has none, the decision falls back to the exact mtime rule the
+//! loader used before generations existed.
+
+use std::fs;
+use std::time::SystemTime;
+
+mod marker;
+mod probe;
+mod view;
+
+pub(super) use marker::{MarkerKind, marker_record_bytes};
+pub(super) use probe::payload_prefix_generation;
+pub(super) use view::{ArtifactSetView, UnreadablePolicy};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum Generation {
+    /// Written by a generation-aware save of this artifact set.
+    Known(u64),
+    /// Written by an older build, re-saved by one, out of range, or unreadable.
+    Unknown,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub(super) struct ArtifactStamp {
+    pub(super) generation: Generation,
+    /// Last-modified time. Only the legacy fallback reads it.
+    pub(super) modified: Option<SystemTime>,
+}
+
+impl ArtifactStamp {
+    /// A stamp for an artifact whose generation has not been read.
+    pub(super) fn without_generation(metadata: &fs::Metadata) -> Self {
+        Self {
+            generation: Generation::Unknown,
+            modified: metadata.modified().ok(),
+        }
+    }
+}
+
+/// How a comparison behaves when either side has no generation. Each variant
+/// reproduces one rule from before generations existed exactly.
+#[derive(Clone, Copy, Debug)]
+pub(super) enum LegacyOrder {
+    /// `a > b`; an unreadable mtime answers false.
+    Strict,
+    /// `a >= b`; an unreadable mtime answers true.
+    NonStrictTrue,
+}
+
+/// Whether `a` holds bytes from a later save than `b`.
+pub(super) fn written_after(a: ArtifactStamp, b: ArtifactStamp, legacy: LegacyOrder) -> bool {
+    match (a.generation, b.generation) {
+        (Generation::Known(a), Generation::Known(b)) => a > b,
+        _ => match (a.modified, b.modified, legacy) {
+            (Some(a), Some(b), LegacyOrder::Strict) => a > b,
+            (Some(a), Some(b), LegacyOrder::NonStrictTrue) => a >= b,
+            (_, _, LegacyOrder::Strict) => false,
+            (_, _, LegacyOrder::NonStrictTrue) => true,
+        },
+    }
+}
+
+/// Whether the clear marker `clear` hides `artifact`.
+pub(super) fn cleared_by(artifact: ArtifactStamp, clear: ArtifactStamp) -> bool {
+    match (artifact.generation, clear.generation) {
+        (Generation::Known(artifact), Generation::Known(clear)) => artifact < clear,
+        _ => !written_after(artifact, clear, LegacyOrder::Strict),
+    }
+}
+
+pub(super) const MAX_GENERATION: u64 = (1 << 53) - 1;
+
+impl Generation {
+    pub(super) fn from_raw(value: u64) -> Self {
+        if (1..=MAX_GENERATION).contains(&value) {
+            Self::Known(value)
+        } else {
+            Self::Unknown
+        }
+    }
+
+    pub(super) fn known(self) -> Option<u64> {
+        match self {
+            Self::Known(value) => Some(value),
+            Self::Unknown => None,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src/session/snapshot/generation/marker.rs b/src/session/snapshot/generation/marker.rs
new file mode 100644
index 000000000..0109505b3
--- /dev/null
+++ b/src/session/snapshot/generation/marker.rs
@@ -0,0 +1,68 @@
+use super::Generation;
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+use std::fs::File;
+use std::io::{self, Read};
+
+/// Marker record format. Change a field's meaning only with a new number.
+pub(in crate::session::snapshot) const MARKER_FORMAT: u32 = 1;
+/// Largest marker this build reads. A record is about 80 bytes.
+const MAX_MARKER_BYTES: u64 = 1024;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub(in crate::session::snapshot) enum MarkerKind {
+    Cleared,
+    BackupRecoverable,
+    RecoveryRecoverable,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct MarkerRecord {
+    format: u32,
+    /// Must match the path the record was read from.
+    kind: MarkerKind,
+    generation: u64,
+    /// RFC 3339 wall-clock time, for people only. Never used for ordering.
+    #[serde(default)]
+    written: String,
+}
+
+/// One line of JSON: {"format":1,"kind":"cleared","generation":42,"written":"..."}\n
+pub(in crate::session::snapshot) fn marker_record_bytes(
+    kind: MarkerKind,
+    generation: u64,
+    written: String,
+) -> Result<Vec<u8>> {
+    let record = MarkerRecord {
+        format: MARKER_FORMAT,
+        kind,
+        generation,
+        written,
+    };
+    let mut bytes = serde_json::to_vec(&record).context("failed to serialise session marker")?;
+    bytes.push(b'\n');
+    Ok(bytes)
+}
+
+/// Legacy timestamp content, another format, a kind mismatch, a parse error,
+/// or more than 1 KiB all read as `Unknown`. Unknown extra fields are ignored,
+/// so format 1 can grow. Only the read can fail.
+pub(in crate::session::snapshot) fn read_marker_generation(
+    file: &File,
+    expected: MarkerKind,
+) -> io::Result<Generation> {
+    let mut bytes = Vec::new();
+    file.take(MAX_MARKER_BYTES + 1).read_to_end(&mut bytes)?;
+    if bytes.len() as u64 > MAX_MARKER_BYTES {
+        return Ok(Generation::Unknown);
+    }
+
+    let Ok(record) = serde_json::from_slice::<MarkerRecord>(&bytes) else {
+        return Ok(Generation::Unknown);
+    };
+    if record.format != MARKER_FORMAT || record.kind != expected {
+        return Ok(Generation::Unknown);
+    }
+    Ok(Generation::from_raw(record.generation))
+}
diff --git a/src/session/snapshot/generation/probe.rs b/src/session/snapshot/generation/probe.rs
new file mode 100644
index 000000000..1e13ca976
--- /dev/null
+++ b/src/session/snapshot/generation/probe.rs
@@ -0,0 +1,170 @@
+use super::Generation;
+use crate::session::snapshot::compression::is_gzip;
+use flate2::bufread::GzDecoder;
+use std::fs::File;
+use std::io::{self, Read};
+use std::os::unix::fs::FileExt;
+
+/// Bytes read from the start of a payload, whatever its size.
+pub(super) const PROBE_READ_BYTES: usize = 16 * 1024;
+/// Decoded bytes scanned for the header. The header is about 60 bytes.
+pub(super) const PROBE_SCAN_BYTES: usize = 4 * 1024;
+
+const MAX_HEADER_MEMBERS: usize = 4;
+const MAX_KEY_BYTES: usize = 64;
+const MAX_SKIPPED_STRING_BYTES: usize = 256;
+const MAX_INTEGER_DIGITS: usize = 16;
+
+/// Reads the generation of a payload artifact. Only the read can fail; a
+/// payload without a readable header returns `Unknown`. Uses `pread`, so the
+/// file position stays at 0 for a later full load.
+pub(super) fn probe_payload_header(file: &File) -> io::Result<Generation> {
+    let window = read_probe_window(file)?;
+    Ok(payload_prefix_generation(&window))
+}
+
+pub(super) fn read_probe_window(file: &File) -> io::Result<Vec<u8>> {
+    let mut window = vec![0; PROBE_READ_BYTES];
+    let mut filled = 0;
+    while filled < window.len() {
+        match file.read_at(&mut window[filled..], filled as u64) {
+            Ok(0) => break,
+            Ok(read) => filled += read,
+            Err(err) if err.kind() == io::ErrorKind::Interrupted => continue,
+            Err(err) => return Err(err),
+        }
+    }
+    window.truncate(filled);
+    Ok(window)
+}
+
+/// Generation named by the first bytes of a plain or gzip payload.
+pub(in crate::session::snapshot) fn payload_prefix_generation(bytes: &[u8]) -> Generation {
+    let window = &bytes[..bytes.len().min(PROBE_READ_BYTES)];
+    let decoded;
+    let json = if is_gzip(window) {
+        decoded = inflate_probe_prefix(window);
+        &decoded[..]
+    } else {
+        &window[..window.len().min(PROBE_SCAN_BYTES)]
+    };
+    scan_header(json).map_or(Generation::Unknown, Generation::from_raw)
+}
+
+pub(super) fn inflate_probe_prefix(window: &[u8]) -> Vec<u8> {
+    let mut decoded = Vec::with_capacity(PROBE_SCAN_BYTES);
+    // A stream cut at the window end ends in an error. read_to_end keeps the
+    // bytes decoded before it, and those are all the header scan needs.
+    let _ = GzDecoder::new(window)
+        .take(PROBE_SCAN_BYTES as u64)
+        .read_to_end(&mut decoded);
+    decoded
+}
+
+/// A deliberately small JSON header grammar. Never scans drawing data for a key.
+fn scan_header(bytes: &[u8]) -> Option<u64> {
+    let mut cursor = HeaderCursor { bytes, offset: 0 };
+    cursor.expect(b'{')?;
+    let mut found = None;
+    for _ in 0..MAX_HEADER_MEMBERS {
+        cursor.space();
+        if cursor.peek() == Some(b'}') {
+            return found;
+        }
+        let key = match cursor.string(MAX_KEY_BYTES, true) {
+            Some(key) => key,
+            None => return found,
+        };
+        if cursor.expect(b':').is_none() {
+            return found;
+        }
+        if key == b"save_generation" {
+            if found.is_some() {
+                return None;
+            }
+            found = Some(cursor.integer()?);
+        } else if key == b"version" {
+            if cursor.integer().is_none() {
+                return found;
+            }
+        } else if cursor.string(MAX_SKIPPED_STRING_BYTES, false).is_none() {
+            return found;
+        }
+        cursor.space();
+        match cursor.peek() {
+            Some(b',') => cursor.offset += 1,
+            Some(b'}') => return found,
+            _ => return found,
+        }
+    }
+    found
+}
+
+struct HeaderCursor<'a> {
+    bytes: &'a [u8],
+    offset: usize,
+}
+
+impl<'a> HeaderCursor<'a> {
+    fn peek(&self) -> Option<u8> {
+        self.bytes.get(self.offset).copied()
+    }
+
+    fn space(&mut self) {
+        while self
+            .peek()
+            .is_some_and(|b| matches!(b, b' ' | b'\t' | b'\r' | b'\n'))
+        {
+            self.offset += 1;
+        }
+    }
+
+    fn expect(&mut self, byte: u8) -> Option<()> {
+        self.space();
+        if self.peek()? != byte {
+            return None;
+        }
+        self.offset += 1;
+        Some(())
+    }
+
+    fn string(&mut self, limit: usize, key: bool) -> Option<&'a [u8]> {
+        self.expect(b'"')?;
+        let start = self.offset;
+        while let Some(byte) = self.peek() {
+            if byte == b'"' {
+                let value = &self.bytes[start..self.offset];
+                self.offset += 1;
+                return (!key || !value.is_empty()).then_some(value);
+            }
+            if self.offset - start >= limit
+                || byte == b'\\'
+                || byte < 0x20
+                || (key && !byte.is_ascii_alphanumeric() && byte != b'_')
+            {
+                return None;
+            }
+            self.offset += 1;
+        }
+        None
+    }
+
+    fn integer(&mut self) -> Option<u64> {
+        self.space();
+        let start = self.offset;
+        while self.peek().is_some_and(|b| b.is_ascii_digit()) {
+            self.offset += 1;
+        }
+        let digits = &self.bytes[start..self.offset];
+        if digits.is_empty()
+            || digits.len() > MAX_INTEGER_DIGITS
+            || (digits.len() > 1 && digits[0] == b'0')
+            || !self
+                .peek()
+                .is_some_and(|b| matches!(b, b' ' | b'\t' | b'\r' | b'\n' | b',' | b'}'))
+        {
+            return None;
+        }
+        std::str::from_utf8(digits).ok()?.parse().ok()
+    }
+}
diff --git a/src/session/snapshot/generation/tests.rs b/src/session/snapshot/generation/tests.rs
new file mode 100644
index 000000000..8af483b6d
--- /dev/null
+++ b/src/session/snapshot/generation/tests.rs
@@ -0,0 +1,626 @@
+use super::marker::read_marker_generation;
+use super::probe::{
+    PROBE_READ_BYTES, PROBE_SCAN_BYTES, inflate_probe_prefix, probe_payload_header,
+    read_probe_window,
+};
+
+use super::*;
+use crate::session::snapshot::{load, save, tests::sample_snapshot};
+use crate::session::{CompressionMode, SessionOptions};
+use crate::test_temp::tempdir;
+use std::fs::{self, File};
+use std::io::{Seek, Write};
+use std::path::Path;
+use std::time::{Duration, SystemTime};
+
+#[test]
+fn ordering_preserves_each_legacy_rule_and_known_generations_override_clocks() {
+    let time = |n| Some(SystemTime::UNIX_EPOCH + Duration::from_secs(n));
+    for a_gen in [Generation::Unknown, Generation::Known(1)] {
+        for b_gen in [Generation::Unknown, Generation::Known(2)] {
+            for a_time in [None, time(1), time(2), time(3)] {
+                for b_time in [None, time(1), time(2), time(3)] {
+                    let a = ArtifactStamp {
+                        generation: a_gen,
+                        modified: a_time,
+                    };
+                    let b = ArtifactStamp {
+                        generation: b_gen,
+                        modified: b_time,
+                    };
+                    let known =
+                        matches!((a_gen, b_gen), (Generation::Known(_), Generation::Known(_)));
+                    let strict = match (a_time, b_time) {
+                        (Some(a), Some(b)) => a > b,
+                        _ => false,
+                    };
+                    let inclusive = match (a_time, b_time) {
+                        (Some(a), Some(b)) => a >= b,
+                        _ => true,
+                    };
+                    assert_eq!(written_after(a, b, LegacyOrder::Strict), !known && strict);
+                    assert_eq!(
+                        written_after(a, b, LegacyOrder::NonStrictTrue),
+                        !known && inclusive
+                    );
+                    assert_eq!(cleared_by(a, b), known || !strict);
+                }
+            }
+        }
+    }
+    let same = ArtifactStamp {
+        generation: Generation::Known(2),
+        modified: None,
+    };
+    assert!(
+        !cleared_by(same, same),
+        "a clear boundary preserves tool state written by the same save"
+    );
+}
+
+#[test]
+fn bounded_header_probe_rejects_ambiguous_or_non_integer_generations() {
+    for header in [
+        r#"{"version":7,"save_generation":42,"boards":[]}"#,
+        r#"{"save_generation":42}"#,
+        r#"{"name":"x","time":"y","version":7,"save_generation":42}"#,
+    ] {
+        assert_eq!(
+            payload_prefix_generation(header.as_bytes()),
+            Generation::Known(42)
+        );
+    }
+    for value in [
+        "0",
+        "9007199254740992",
+        "12345678901234567",
+        "042",
+        "-1",
+        "4.2",
+        "4e1",
+        r#""42""#,
+        "null",
+        "{}",
+    ] {
+        let header = format!("{{\"version\":7,\"save_generation\":{value},\"boards\":[]}}");
+        assert_eq!(
+            payload_prefix_generation(header.as_bytes()),
+            Generation::Unknown,
+            "{header}"
+        );
+    }
+    for header in [
+        r#"{"save_generation":42,"save_generation":43}"#,
+        r#"{"a":{},"save_generation":42}"#,
+        r#"{"a":[],"save_generation":42}"#,
+        r#"{"a":"x\ny","save_generation":42}"#,
+        r#"{"na\me":"x","save_generation":42}"#,
+        r#"{"a":"x","b":"x","c":"x","d":"x","save_generation":42}"#,
+        r#""save_generation":42"#,
+        "",
+        r#"{"version":1,"transparent":{}}"#,
+    ] {
+        assert_eq!(
+            payload_prefix_generation(header.as_bytes()),
+            Generation::Unknown,
+            "{header}"
+        );
+    }
+    let long = format!("{{\"a\":\"{}\",\"save_generation\":42}}", "x".repeat(257));
+    assert_eq!(
+        payload_prefix_generation(long.as_bytes()),
+        Generation::Unknown
+    );
+}
+
+#[test]
+fn probes_are_bounded_and_do_not_consume_file_position() {
+    let temp = tempdir().unwrap();
+    let mut file = File::options()
+        .read(true)
+        .write(true)
+        .create_new(true)
+        .open(temp.path().join("large"))
+        .unwrap();
+    file.write_all(b"{\"version\":7,\"save_generation\":42,")
+        .unwrap();
+    file.set_len(64 * 1024 * 1024).unwrap();
+    file.rewind().unwrap();
+    assert_eq!(probe_payload_header(&file).unwrap(), Generation::Known(42));
+    assert_eq!(file.stream_position().unwrap(), 0);
+    assert_eq!(read_probe_window(&file).unwrap().len(), PROBE_READ_BYTES);
+
+    let mut raw = b"{\"version\":7,\"save_generation\":42,".to_vec();
+    raw.resize(1024 * 1024, b' ');
+    let mut encoder = flate2::GzBuilder::new()
+        .filename("session.json")
+        .extra(vec![1, 2, 3])
+        .write(Vec::new(), flate2::Compression::default());
+    encoder.write_all(&raw).unwrap();
+    let gzip = encoder.finish().unwrap();
+    assert_eq!(payload_prefix_generation(&gzip), Generation::Known(42));
+    assert_eq!(inflate_probe_prefix(&gzip).len(), PROBE_SCAN_BYTES);
+    assert_eq!(
+        payload_prefix_generation(&gzip[..200.min(gzip.len())]),
+        Generation::Known(42)
+    );
+}
+
+#[test]
+fn marker_format_round_trips_and_rejects_wrong_kind_or_version() {
+    assert_eq!(marker_record_bytes(MarkerKind::Cleared,42,"2026-09-29T10:15:02Z".into()).unwrap(),b"{\"format\":1,\"kind\":\"cleared\",\"generation\":42,\"written\":\"2026-09-29T10:15:02Z\"}\n");
+    let temp = tempdir().unwrap();
+    let path = temp.path().join("marker");
+    for kind in [
+        MarkerKind::Cleared,
+        MarkerKind::BackupRecoverable,
+        MarkerKind::RecoveryRecoverable,
+    ] {
+        fs::write(&path, marker_record_bytes(kind, 42, String::new()).unwrap()).unwrap();
+        assert_eq!(
+            read_marker_generation(&File::open(&path).unwrap(), kind).unwrap(),
+            Generation::Known(42)
+        );
+    }
+    for bytes in [
+        b"2026-09-29T10:15:02Z".to_vec(),
+        br#"{"format":2,"kind":"cleared","generation":42}"#.to_vec(),
+        br#"{"format":1,"kind":"backup-recoverable","generation":42}"#.to_vec(),
+        br#"{"format":1,"kind":"cleared","generation":0}"#.to_vec(),
+        vec![b' '; 1025],
+    ] {
+        fs::write(&path, bytes).unwrap();
+        assert_eq!(
+            read_marker_generation(&File::open(&path).unwrap(), MarkerKind::Cleared).unwrap(),
+            Generation::Unknown
+        );
+    }
+}
+
+fn options(path: &std::path::Path) -> SessionOptions {
+    let mut options = SessionOptions::new(path.to_path_buf(), "generation");
+    options.persist_transparent = true;
+    options.compression = CompressionMode::Off;
+    options
+}
+fn generation(path: std::path::PathBuf) -> Generation {
+    payload_prefix_generation(&fs::read(path).unwrap())
+}
+
+#[test]
+fn writers_allocate_across_rotated_payloads_and_marker_records() {
+    let temp = tempdir().unwrap();
+    let options = options(temp.path());
+    let snapshot = sample_snapshot();
+    assert_eq!(
+        save::save_snapshot_with_report(&snapshot, &options)
+            .unwrap()
+            .unwrap()
+            .generation,
+        Some(1)
+    );
+    assert_eq!(
+        save::save_snapshot_with_report(&snapshot, &options)
+            .unwrap()
+            .unwrap()
+            .generation,
+        Some(2)
+    );
+    assert_eq!(generation(options.backup_file_path()), Generation::Known(1));
+    fs::write(
+        options.clear_marker_file_path(),
+        marker_record_bytes(MarkerKind::Cleared, 70, String::new()).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        save::save_snapshot_with_report(&snapshot, &options)
+            .unwrap()
+            .unwrap()
+            .generation,
+        Some(71)
+    );
+    assert_eq!(
+        generation(options.session_file_path()),
+        Generation::Known(71)
+    );
+    let empty = super::super::types::SessionSnapshot {
+        active_board_id: "transparent".into(),
+        boards: vec![],
+        tool_state: None,
+    };
+    let report = save::save_snapshot_with_report(&empty, &options)
+        .unwrap()
+        .unwrap();
+    assert_eq!(report.generation, Some(72));
+    assert_eq!(
+        read_marker_generation(
+            &File::open(options.clear_marker_file_path()).unwrap(),
+            MarkerKind::Cleared
+        )
+        .unwrap(),
+        Generation::Known(72)
+    );
+}
+
+#[test]
+fn ceiling_drops_generation_and_plain_estimates_bound_actual_size() {
+    let temp = tempdir().unwrap();
+    let options = options(temp.path());
+    let snapshot = sample_snapshot();
+    let estimate = save::estimate_snapshot_save(&snapshot, &options).unwrap();
+    let report = save::save_snapshot_with_report(&snapshot, &options)
+        .unwrap()
+        .unwrap();
+    assert!(estimate.full.written_size >= report.written_size);
+    assert!(estimate.full.written_size - report.written_size <= 15);
+    fs::write(
+        options.backup_file_path(),
+        format!("{{\"version\":7,\"save_generation\":{MAX_GENERATION}}}"),
+    )
+    .unwrap();
+    let report = save::save_snapshot_with_report(&snapshot, &options)
+        .unwrap()
+        .unwrap();
+    assert_eq!(report.generation, None);
+    assert_eq!(generation(options.session_file_path()), Generation::Unknown);
+}
+
+#[test]
+fn concurrent_writers_allocate_in_exclusive_lock_order() {
+    let temp = tempdir().unwrap();
+    let options = options(temp.path());
+    let mut threads = vec![];
+    for _ in 0..2 {
+        let options = options.clone();
+        threads.push(std::thread::spawn(move || {
+            (0..20)
+                .map(|_| {
+                    save::save_snapshot_with_report(&sample_snapshot(), &options)
+                        .unwrap()
+                        .unwrap()
+                        .generation
+                        .unwrap()
+                })
+                .collect::<Vec<_>>()
+        }));
+    }
+    let mut all = vec![];
+    for thread in threads {
+        let values = thread.join().unwrap();
+        assert!(values.windows(2).all(|p| p[0] < p[1]));
+        all.extend(values);
+    }
+    all.sort();
+    assert_eq!(all, (1..=40).collect::<Vec<_>>());
+}
+
+#[test]
+fn malformed_optional_generation_never_quarantines_a_valid_snapshot() {
+    let temp = tempdir().unwrap();
+    let options = options(temp.path());
+    save::save_snapshot_with_report(&sample_snapshot(), &options).unwrap();
+    let mut value: serde_json::Value =
+        serde_json::from_slice(&fs::read(options.session_file_path()).unwrap()).unwrap();
+    for invalid in [
+        serde_json::json!("x"),
+        serde_json::json!(-1),
+        serde_json::json!(1.5),
+        serde_json::json!(null),
+        serde_json::json!({}),
+        serde_json::json!(MAX_GENERATION + 1),
+    ] {
+        value["save_generation"] = invalid;
+        fs::write(
+            options.session_file_path(),
+            serde_json::to_vec(&value).unwrap(),
+        )
+        .unwrap();
+        assert!(matches!(
+            load::load_snapshot_with_expanded_limit(
+                &options,
+                super::super::compression::DEFAULT_MAX_EXPANDED_SESSION_BYTES
+            )
+            .unwrap(),
+            load::LoadSnapshotOutcome::Loaded(_)
+        ));
+        assert!(options.session_file_path().exists());
+        assert!(!options.backup_file_path().exists());
+    }
+}
+
+#[test]
+fn blank_recovery_and_clear_boundary_markers_share_their_payload_generation() {
+    let temp = tempdir().unwrap();
+    let mut options = options(temp.path());
+    let snapshot = sample_snapshot();
+    save::save_snapshot_with_report(&snapshot, &options).unwrap();
+    let mut blank = snapshot.clone();
+    blank.boards.clear();
+    blank.tool_state = Some(super::super::tests::sample_tool_state());
+    let blank_report = save::save_snapshot_with_report(&blank, &options)
+        .unwrap()
+        .unwrap();
+    assert_eq!(blank_report.generation, Some(2));
+    assert_eq!(generation(options.backup_file_path()), Generation::Known(1));
+    assert_eq!(
+        read_marker_generation(
+            &File::open(options.backup_recovery_marker_file_path()).unwrap(),
+            MarkerKind::BackupRecoverable
+        )
+        .unwrap(),
+        Generation::Known(2)
+    );
+
+    let boundary = save::save_snapshot_with_report_and_clear_boundary(&blank, &options, true)
+        .unwrap()
+        .unwrap();
+    assert_eq!(boundary.generation, Some(3));
+    assert_eq!(
+        generation(options.session_file_path()),
+        Generation::Known(3)
+    );
+    assert_eq!(
+        read_marker_generation(
+            &File::open(options.clear_marker_file_path()).unwrap(),
+            MarkerKind::Cleared
+        )
+        .unwrap(),
+        Generation::Known(3)
+    );
+    assert!(!options.backup_file_path().exists());
+
+    options.max_file_size_bytes = 64;
+    assert!(save::save_snapshot_with_report(&snapshot, &options).is_err());
+    assert_eq!(
+        generation(options.recovery_file_path()),
+        Generation::Known(4)
+    );
+    fs::remove_file(options.session_file_path()).unwrap();
+    options.max_file_size_bytes = 50 * 1024 * 1024;
+    let report = save::save_snapshot_with_report(&blank, &options)
+        .unwrap()
+        .unwrap();
+    assert_eq!(report.generation, Some(5));
+    assert_eq!(
+        read_marker_generation(
+            &File::open(options.recovery_recoverable_marker_file_path()).unwrap(),
+            MarkerKind::RecoveryRecoverable
+        )
+        .unwrap(),
+        Generation::Known(5)
+    );
+}
+
+#[test]
+fn save_as_and_gzip_preserve_the_allocated_header_generation() {
+    let temp = tempdir().unwrap();
+    let mut options = options(temp.path());
+    options.set_named_file_target(temp.path().join("named.wayscriber-session"));
+    options.compression = CompressionMode::On;
+    fs::write(
+        options.clear_marker_file_path(),
+        marker_record_bytes(MarkerKind::Cleared, 90, String::new()).unwrap(),
+    )
+    .unwrap();
+    let report = save::save_snapshot_as_with_report(
+        &sample_snapshot(),
+        &options,
+        save::SaveAsOverwrite::ConfirmReplace,
+    )
+    .unwrap();
+    assert_eq!(report.generation, Some(91));
+    assert!(report.compressed);
+    assert_eq!(
+        generation(options.session_file_path()),
+        Generation::Known(91)
+    );
+    assert!(!options.clear_marker_file_path().exists());
+}
+
+#[test]
+fn fifo_marker_probe_never_blocks_and_oversized_generations_do_not_raise_the_sequence() {
+    let temp = tempdir().unwrap();
+    let options = options(temp.path());
+    super::super::tests::make_fifo(&options.clear_marker_file_path());
+    assert_eq!(
+        ArtifactSetView::probe(&options)
+            .next_generation(UnreadablePolicy::Refuse)
+            .unwrap(),
+        Some(1)
+    );
+    fs::remove_file(options.clear_marker_file_path()).unwrap();
+    fs::write(
+        options.clear_marker_file_path(),
+        b"{\"format\":1,\"kind\":\"cleared\",\"generation\":1152921504606846976}",
+    )
+    .unwrap();
+    assert_eq!(
+        save::save_snapshot_with_report(&sample_snapshot(), &options)
+            .unwrap()
+            .unwrap()
+            .generation,
+        Some(1)
+    );
+}
+
+#[test]
+fn writer_header_restart_output_isolation_and_clear_reset_are_stable() {
+    let temp = tempdir().unwrap();
+    let mut first = options(temp.path());
+    first.per_output = true;
+    first.set_output_identity(Some("DP-1"));
+    let mut second = first.clone();
+    second.set_output_identity(Some("DP-2"));
+    let snapshot = sample_snapshot();
+    let report = save::save_snapshot_with_report(&snapshot, &first)
+        .unwrap()
+        .unwrap();
+    assert_eq!(report.generation, Some(1));
+    assert!(
+        fs::read(first.session_file_path())
+            .unwrap()
+            .starts_with(b"{\n  \"version\": 7,\n  \"save_generation\": 1,")
+    );
+    // Reconstruct options rather than retaining any writer state across saves.
+    let mut restarted = options(temp.path());
+    restarted.per_output = true;
+    restarted.set_output_identity(Some("DP-1"));
+    assert_eq!(
+        save::save_snapshot_with_report(&snapshot, &restarted)
+            .unwrap()
+            .unwrap()
+            .generation,
+        Some(2)
+    );
+    assert_eq!(
+        save::save_snapshot_with_report(&snapshot, &second)
+            .unwrap()
+            .unwrap()
+            .generation,
+        Some(1)
+    );
+    crate::session::clear_session(&first).unwrap();
+    assert_eq!(
+        save::save_snapshot_with_report(&snapshot, &first)
+            .unwrap()
+            .unwrap()
+            .generation,
+        Some(1)
+    );
+    assert_eq!(generation(second.session_file_path()), Generation::Known(1));
+}
+
+#[test]
+fn each_marker_slot_advances_the_next_real_save() {
+    for kind in [
+        MarkerKind::Cleared,
+        MarkerKind::BackupRecoverable,
+        MarkerKind::RecoveryRecoverable,
+    ] {
+        let temp = tempdir().unwrap();
+        let options = options(temp.path());
+        let path = match kind {
+            MarkerKind::Cleared => options.clear_marker_file_path(),
+            MarkerKind::BackupRecoverable => options.backup_recovery_marker_file_path(),
+            MarkerKind::RecoveryRecoverable => options.recovery_recoverable_marker_file_path(),
+        };
+        fs::write(path, marker_record_bytes(kind, 42, String::new()).unwrap()).unwrap();
+        let report = save::save_snapshot_with_report(&sample_snapshot(), &options)
+            .unwrap()
+            .unwrap();
+        assert_eq!(report.generation, Some(43), "{kind:?}");
+        assert_eq!(
+            generation(options.session_file_path()),
+            Generation::Known(43)
+        );
+    }
+}
+
+#[test]
+fn socket_and_symlink_sidecars_are_classified_without_blocking_autosave() {
+    use std::os::unix::{fs::symlink, net::UnixListener};
+    for slot in ["clear", "recovery", "backup"] {
+        for kind in ["socket", "socket link", "loop", "regular link"] {
+            let short_root = [Path::new("/tmp"), Path::new(".")]
+                .into_iter()
+                .find(|path| path.is_dir())
+                .unwrap();
+            let temp = tempfile::Builder::new()
+                .prefix("ws-")
+                .tempdir_in(short_root)
+                .unwrap();
+            let options = options(temp.path());
+            fs::create_dir_all(&options.base_dir).unwrap();
+            let path = match slot {
+                "clear" => options.clear_marker_file_path(),
+                "recovery" => options.recovery_file_path(),
+                _ => options.backup_file_path(),
+            };
+            let socket_path = temp.path().join("s");
+            let listener = if kind == "socket" || kind == "socket link" {
+                let listener = UnixListener::bind(&socket_path).unwrap();
+                if kind == "socket" {
+                    fs::rename(&socket_path, &path).unwrap();
+                } else {
+                    symlink(&socket_path, &path).unwrap();
+                }
+                Some(listener)
+            } else {
+                None
+            };
+            if kind == "loop" {
+                symlink(&path, &path).unwrap();
+            }
+            if kind == "regular link" {
+                let bytes = if slot == "clear" {
+                    marker_record_bytes(MarkerKind::Cleared, 42, String::new()).unwrap()
+                } else {
+                    br#"{"version":7,"save_generation":42,"boards":[]}"#.to_vec()
+                };
+                let regular = temp.path().join("regular");
+                fs::write(&regular, bytes).unwrap();
+                symlink(&regular, &path).unwrap();
+            }
+            let report = save::save_snapshot_autosave_with_report(&sample_snapshot(), &options)
+                .unwrap()
+                .unwrap();
+            let expected = if kind == "regular link" { 43 } else { 1 };
+            assert_eq!(report.generation, Some(expected), "{slot}, {kind}");
+            assert_eq!(
+                generation(options.session_file_path()),
+                Generation::Known(expected)
+            );
+            drop(listener);
+        }
+    }
+}
+
+#[test]
+fn unreadable_regular_sidecars_follow_autosave_and_normal_save_policy() {
+    use std::os::unix::fs::PermissionsExt;
+    for slot in ["clear", "recovery", "backup"] {
+        let temp = tempdir().unwrap();
+        let options = options(temp.path());
+        save::save_snapshot_with_report(&sample_snapshot(), &options).unwrap();
+        save::save_snapshot_with_report(&sample_snapshot(), &options).unwrap();
+        let primary = fs::read(options.session_file_path()).unwrap();
+        let backup = fs::read(options.backup_file_path()).unwrap();
+        let path = if slot == "clear" {
+            options.clear_marker_file_path()
+        } else if slot == "recovery" {
+            options.recovery_file_path()
+        } else {
+            options.backup_file_path()
+        };
+        if slot != "backup" {
+            fs::write(&path, b"regular sidecar").unwrap();
+        }
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o000)).unwrap();
+        // Root and privileged runners can bypass chmod; they cannot prove this denial.
+        if File::open(&path).is_ok() {
+            fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).unwrap();
+            eprintln!("Skipping chmod-denial contract: runner can read mode-000 files");
+            return;
+        }
+        let result = save::save_snapshot_autosave_with_report(&sample_snapshot(), &options);
+        if slot == "backup" {
+            result.expect("an unreadable backup cannot hide newer recovery or clear data");
+            assert_eq!(fs::read(options.backup_file_path()).unwrap(), primary);
+            continue;
+        }
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).unwrap();
+        let error = result.unwrap_err();
+        assert!(
+            format!("{error:#}").contains(&path.display().to_string()),
+            "{error:#}"
+        );
+        assert_eq!(fs::read(options.session_file_path()).unwrap(), primary);
+        assert_eq!(fs::read(options.backup_file_path()).unwrap(), backup);
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o000)).unwrap();
+        let normal = save::save_snapshot_with_report(&sample_snapshot(), &options);
+        if path.exists() {
+            fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).unwrap();
+        }
+        normal.expect("normal save warns and continues for unreadable generation sidecars");
+    }
+}
diff --git a/src/session/snapshot/generation/view.rs b/src/session/snapshot/generation/view.rs
new file mode 100644
index 000000000..5be5bcf7c
--- /dev/null
+++ b/src/session/snapshot/generation/view.rs
@@ -0,0 +1,167 @@
+use super::marker::{MarkerKind, read_marker_generation};
+use super::probe::probe_payload_header;
+use super::{Generation, MAX_GENERATION};
+use crate::session::{
+    SessionOptions,
+    primary::{is_non_regular_session_artifact, open_session_artifact_for_probe},
+};
+use anyhow::{Result, anyhow};
+use log::warn;
+use std::path::{Path, PathBuf};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::session::snapshot) enum Slot {
+    Primary,
+    Backup,
+    Recovery,
+    Cleared,
+    BackupRecoverable,
+    RecoveryRecoverable,
+}
+
+impl Slot {
+    const ALL: [Self; 6] = [
+        Self::Primary,
+        Self::Backup,
+        Self::Recovery,
+        Self::Cleared,
+        Self::BackupRecoverable,
+        Self::RecoveryRecoverable,
+    ];
+
+    fn path(self, options: &SessionOptions) -> PathBuf {
+        match self {
+            Self::Primary => options.session_file_path(),
+            Self::Backup => options.backup_file_path(),
+            Self::Recovery => options.recovery_file_path(),
+            Self::Cleared => options.clear_marker_file_path(),
+            Self::BackupRecoverable => options.backup_recovery_marker_file_path(),
+            Self::RecoveryRecoverable => options.recovery_recoverable_marker_file_path(),
+        }
+    }
+
+    fn label(self) -> &'static str {
+        match self {
+            Self::Primary => "primary session",
+            Self::Backup => "session backup",
+            Self::Recovery => "session recovery",
+            Self::Cleared => "clear marker",
+            Self::BackupRecoverable => "backup recoverable marker",
+            Self::RecoveryRecoverable => "recovery recoverable marker",
+        }
+    }
+
+    fn marker_kind(self) -> Option<MarkerKind> {
+        match self {
+            Self::Cleared => Some(MarkerKind::Cleared),
+            Self::BackupRecoverable => Some(MarkerKind::BackupRecoverable),
+            Self::RecoveryRecoverable => Some(MarkerKind::RecoveryRecoverable),
+            _ => None,
+        }
+    }
+
+    fn can_hide_newer_data(self) -> bool {
+        matches!(self, Self::Recovery | Self::Cleared)
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(in crate::session::snapshot) enum UnreadablePolicy {
+    Refuse,
+    Warn,
+}
+
+enum SlotState {
+    Absent,
+    Ignored,
+    Unreadable(anyhow::Error),
+    Present(Generation),
+}
+
+struct SlotProbe {
+    slot: Slot,
+    path: PathBuf,
+    state: SlotState,
+}
+
+pub(in crate::session::snapshot) struct ArtifactSetView {
+    slots: Vec<SlotProbe>,
+}
+
+impl ArtifactSetView {
+    /// Caller holds the exclusive save lock, or accepts the Save As preparation race.
+    pub(in crate::session::snapshot) fn probe(options: &SessionOptions) -> Self {
+        let slots = Slot::ALL
+            .into_iter()
+            .map(|slot| {
+                let path = slot.path(options);
+                let state = probe_slot(slot, &path, options.is_named_file());
+                SlotProbe { slot, path, state }
+            })
+            .collect();
+        Self { slots }
+    }
+
+    pub(in crate::session::snapshot) fn next_generation(
+        &self,
+        policy: UnreadablePolicy,
+    ) -> Result<Option<u64>> {
+        for probe in &self.slots {
+            let SlotState::Unreadable(err) = &probe.state else {
+                continue;
+            };
+            if probe.slot.can_hide_newer_data() && policy == UnreadablePolicy::Refuse {
+                return Err(anyhow!(
+                    "not saving: cannot read the save generation of {} {}: {err:#}",
+                    probe.slot.label(),
+                    probe.path.display()
+                ));
+            }
+            warn!(
+                "Allocating a session save generation without unreadable {} {}: {err:#}",
+                probe.slot.label(),
+                probe.path.display()
+            );
+        }
+        let max = self
+            .slots
+            .iter()
+            .filter_map(|probe| match probe.state {
+                SlotState::Present(g) => g.known(),
+                _ => None,
+            })
+            .max()
+            .unwrap_or(0);
+        if max >= MAX_GENERATION {
+            warn!(
+                "Session save generation is at its ceiling; saving without one until that artifact rotates out"
+            );
+            return Ok(None);
+        }
+        Ok(Some(max + 1))
+    }
+}
+
+fn probe_slot(slot: Slot, path: &Path, no_follow: bool) -> SlotState {
+    let file = match open_session_artifact_for_probe(path, no_follow) {
+        Ok(None) => return SlotState::Absent,
+        Ok(Some(file)) => file,
+        Err(err) if is_non_regular_session_artifact(&err) => {
+            warn!(
+                "Ignoring non-regular {} {}: {err}",
+                slot.label(),
+                path.display()
+            );
+            return SlotState::Ignored;
+        }
+        Err(err) => return SlotState::Unreadable(err),
+    };
+    let result = match slot.marker_kind() {
+        Some(kind) => read_marker_generation(&file, kind),
+        None => probe_payload_header(&file),
+    };
+    match result {
+        Ok(g) => SlotState::Present(g),
+        Err(err) => SlotState::Unreadable(err.into()),
+    }
+}
diff --git a/src/session/snapshot/load.rs b/src/session/snapshot/load.rs
index 8c71cb2c1..df4d56fa1 100644
--- a/src/session/snapshot/load.rs
+++ b/src/session/snapshot/load.rs
@@ -26,13 +26,16 @@ use std::fs;
 use std::io::Read;
 use std::path::{Path, PathBuf};
 
+mod artifact_outcome;
 mod corrupt;
 mod fallback;
 mod markers;
 mod named_candidate;
 mod payload;
 
-use corrupt::{backup_corrupt_session, preserve_newer_version_session};
+pub(crate) use artifact_outcome::CorruptArtifactPreservationFailed;
+use artifact_outcome::{CorruptLoadAction, artifact_load_outcome};
+use corrupt::{preserve_newer_version_session, quarantine_corrupt_artifact};
 use fallback::load_normal_session_or_empty;
 use markers::{
     backup_is_newer_than_primary, clear_marker_metadata, clear_marker_suppresses_artifact,
@@ -56,12 +59,17 @@ pub(crate) enum LoadSnapshotOutcome {
     Loaded(Box<SessionSnapshot>),
     LoadedFromBackup(Box<SessionSnapshot>),
     LoadedFromRecovery(Box<SessionSnapshot>),
+    RestoredAfterCorruption {
+        snapshot: Box<SessionSnapshot>,
+        source: RestoredArtifact,
+        corrupt_copy: PathBuf,
+    },
     Empty,
     /// Nothing was restored because the stored session could not be read. Its
-    /// bytes are preserved at `backup_path`; the caller is expected to say so
+    /// bytes are preserved at `corrupt_copy`; the caller is expected to say so
     /// rather than let a silent empty canvas stand in for lost drawings.
     EmptyAfterCorruption {
-        backup_path: PathBuf,
+        corrupt_copy: PathBuf,
     },
     NonRegularArtifact {
         path: PathBuf,
@@ -72,6 +80,12 @@ pub(crate) enum LoadSnapshotOutcome {
     },
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum RestoredArtifact {
+    Backup,
+    Recovery,
+}
+
 /// A too-new session could be read, but no durable copy could be established.
 ///
 /// This is deliberately distinct from a malformed session: the generic load
@@ -103,6 +117,7 @@ impl LoadSnapshotOutcome {
         match self {
             Self::Loaded(snapshot)
             | Self::LoadedFromBackup(snapshot)
+            | Self::RestoredAfterCorruption { snapshot, .. }
             | Self::LoadedFromRecovery(snapshot) => snapshot.has_board_data(),
             Self::Empty
             | Self::EmptyAfterCorruption { .. }
@@ -117,6 +132,7 @@ pub fn load_snapshot(options: &SessionOptions) -> Result<Option<SessionSnapshot>
     match load_snapshot_with_outcome(options)? {
         LoadSnapshotOutcome::Loaded(snapshot)
         | LoadSnapshotOutcome::LoadedFromBackup(snapshot)
+        | LoadSnapshotOutcome::RestoredAfterCorruption { snapshot, .. }
         | LoadSnapshotOutcome::LoadedFromRecovery(snapshot) => Ok(Some(*snapshot)),
         LoadSnapshotOutcome::Empty
         | LoadSnapshotOutcome::EmptyAfterCorruption { .. }
@@ -132,7 +148,7 @@ pub(crate) fn load_snapshot_with_outcome(options: &SessionOptions) -> Result<Loa
 pub(crate) fn load_snapshot_for_offline_edit(
     options: &SessionOptions,
 ) -> Result<LoadSnapshotOutcome> {
-    load_snapshot_with_expanded_limit_inner(options, DEFAULT_MAX_EXPANDED_SESSION_BYTES)
+    load_snapshot_with_expanded_limit_inner(options, DEFAULT_MAX_EXPANDED_SESSION_BYTES, false)
 }
 
 #[allow(dead_code)]
@@ -200,7 +216,7 @@ pub(super) fn load_snapshot_with_expanded_limit(
     options: &SessionOptions,
     max_expanded_size: u64,
 ) -> Result<LoadSnapshotOutcome> {
-    let outcome = load_snapshot_with_expanded_limit_inner(options, max_expanded_size)?;
+    let outcome = load_snapshot_with_expanded_limit_inner(options, max_expanded_size, true)?;
     record_named_session_opened_for_outcome(options, &outcome);
     Ok(outcome)
 }
@@ -208,6 +224,7 @@ pub(super) fn load_snapshot_with_expanded_limit(
 fn load_snapshot_with_expanded_limit_inner(
     options: &SessionOptions,
     max_expanded_size: u64,
+    restore_named_primary: bool,
 ) -> Result<LoadSnapshotOutcome> {
     if !options.any_enabled() && !options.restore_tool_state {
         info!(
@@ -262,6 +279,7 @@ fn load_snapshot_with_expanded_limit_inner(
                 clear_marker_metadata.as_ref(),
                 backup_recovery_marker_metadata.as_ref(),
                 recovery_recoverable_marker_metadata.as_ref(),
+                restore_named_primary,
             );
         }
         info!(
@@ -275,12 +293,13 @@ fn load_snapshot_with_expanded_limit_inner(
             max_expanded_size,
             false,
             "session recovery",
-            CorruptLoadAction::Backup,
+            CorruptLoadAction::Quarantine,
         )?;
         match recovery_outcome {
             LoadSnapshotOutcome::Loaded(snapshot) => {
                 return Ok(LoadSnapshotOutcome::LoadedFromRecovery(snapshot));
             }
+            loaded @ LoadSnapshotOutcome::RestoredAfterCorruption { .. } => return Ok(loaded),
             loaded @ LoadSnapshotOutcome::LoadedFromBackup(_) => return Ok(loaded),
             loaded @ LoadSnapshotOutcome::LoadedFromRecovery(_) => return Ok(loaded),
             LoadSnapshotOutcome::Empty | LoadSnapshotOutcome::EmptyAfterCorruption { .. } => {
@@ -321,6 +340,7 @@ fn load_snapshot_with_expanded_limit_inner(
         clear_marker_metadata.as_ref(),
         backup_recovery_marker_metadata.as_ref(),
         recovery_recoverable_marker_metadata.as_ref(),
+        restore_named_primary,
     )
 }
 
@@ -377,107 +397,34 @@ fn load_snapshot_path_with_outcome(
         return Ok(outcome);
     }
 
+    with_shared_session_lock(options, || {
+        let result =
+            load_snapshot_inner_with_expanded_limit(session_path, options, max_expanded_size);
+        artifact_load_outcome(
+            result,
+            session_path,
+            options,
+            max_expanded_size,
+            label,
+            corrupt_load_action,
+        )
+    })
+}
+
+fn with_shared_session_lock<T>(
+    options: &SessionOptions,
+    operation: impl FnOnce() -> Result<T>,
+) -> Result<T> {
     let lock_path = options.lock_file_path();
-    let lock_file = open_runtime_lock_file(&lock_path, options.is_named_file())
+    let file = open_runtime_lock_file(&lock_path, options.is_named_file())
         .with_context(|| format!("failed to open session lock file {}", lock_path.display()))?;
-    lock_shared(&lock_file)
+    lock_shared(&file)
         .with_context(|| format!("failed to acquire shared lock {}", lock_path.display()))?;
-
-    let result = load_snapshot_inner_with_expanded_limit(session_path, options, max_expanded_size);
-
-    if let Err(err) = unlock(&lock_file) {
-        warn!(
-            "failed to unlock session file {}: {}",
-            lock_path.display(),
-            err
-        );
-    }
-
-    match result {
-        Ok(Some(loaded)) => {
-            let tool_state = loaded.snapshot.tool_state.is_some();
-            info!(
-                "Loaded {} from {} (version {}, compressed={}, boards={}, active_board={}, tool_state={})",
-                label,
-                session_path.display(),
-                loaded.version,
-                loaded.compressed,
-                loaded.snapshot.boards.len(),
-                loaded.snapshot.active_board_id,
-                tool_state
-            );
-            Ok(LoadSnapshotOutcome::Loaded(Box::new(loaded.snapshot)))
-        }
-        Ok(None) => {
-            info!(
-                "{} file {} contained no usable data; continuing with defaults",
-                label,
-                session_path.display()
-            );
-            Ok(LoadSnapshotOutcome::Empty)
-        }
-        Err(err) if err.downcast_ref::<ExpandedSessionTooLarge>().is_some() => {
-            warn!(
-                "Refusing to load session {}; expanded payload exceeds safety limit ({} bytes). The session file is left unchanged; clear the session or move the file if it is no longer needed: {}",
-                session_path.display(),
-                max_expanded_size,
-                err
-            );
-            Ok(LoadSnapshotOutcome::ExpandedTooLarge {
-                path: session_path.to_path_buf(),
-                max_expanded_size,
-            })
-        }
-        Err(err) if is_non_regular_session_artifact(&err) => {
-            warn!(
-                "Refusing to load non-regular {} {}; continuing with defaults: {}",
-                label,
-                session_path.display(),
-                err
-            );
-            Ok(LoadSnapshotOutcome::NonRegularArtifact {
-                path: session_path.to_path_buf(),
-            })
-        }
-        Err(err)
-            if err
-                .downcast_ref::<NewerVersionPreservationFailed>()
-                .is_some() =>
-        {
-            // Fail closed. Treating this as corruption would back it up and
-            // then continue with an empty, saveable session — exactly the
-            // destructive downgrade path this error reports.
-            Err(err)
-        }
-        Err(err) => {
-            warn!(
-                "Failed to load {} {}; continuing with defaults: {}",
-                label,
-                session_path.display(),
-                err
-            );
-            match corrupt_load_action {
-                CorruptLoadAction::Backup => match backup_corrupt_session(session_path, options) {
-                    Ok(backup_path) => {
-                        return Ok(LoadSnapshotOutcome::EmptyAfterCorruption { backup_path });
-                    }
-                    Err(backup_err) => warn!(
-                        "Failed to back up corrupt session {}: {}",
-                        session_path.display(),
-                        backup_err
-                    ),
-                },
-                CorruptLoadAction::Preserve => {
-                    debug!(
-                        "Leaving unloadable {} {} in place because it is suppressed by the session clear marker",
-                        label,
-                        session_path.display()
-                    );
-                }
-            }
-            Ok(LoadSnapshotOutcome::Empty)
-        }
+    let result = operation();
+    if let Err(err) = unlock(&file) {
+        warn!("failed to unlock session {}: {err}", lock_path.display());
     }
+    result
 }
 
 fn reject_oversized_snapshot(
@@ -532,18 +479,13 @@ fn record_named_session_opened_for_outcome(
             LoadSnapshotOutcome::Loaded(_)
                 | LoadSnapshotOutcome::LoadedFromBackup(_)
                 | LoadSnapshotOutcome::LoadedFromRecovery(_)
+                | LoadSnapshotOutcome::RestoredAfterCorruption { .. }
         )
     {
         crate::session::catalog::record_named_session_opened(options);
     }
 }
 
-#[derive(Clone, Copy)]
-enum CorruptLoadAction {
-    Backup,
-    Preserve,
-}
-
 /// What to do with a session file written by a newer wayscriber than this one.
 #[derive(Clone, Copy)]
 enum NewerVersionAction {
diff --git a/src/session/snapshot/load/artifact_outcome.rs b/src/session/snapshot/load/artifact_outcome.rs
new file mode 100644
index 000000000..9c14a3d7d
--- /dev/null
+++ b/src/session/snapshot/load/artifact_outcome.rs
@@ -0,0 +1,129 @@
+//! What one artifact's load result means: a snapshot, an empty session, a
+//! preserved unreadable copy, or a refusal to continue.
+use super::*;
+
+#[derive(Debug)]
+pub(crate) struct CorruptArtifactPreservationFailed {
+    pub(crate) path: PathBuf,
+    pub(crate) session_path: PathBuf,
+    cause: anyhow::Error,
+}
+
+impl fmt::Display for CorruptArtifactPreservationFailed {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            formatter,
+            "could not preserve unreadable session {}; automatic writes are refused to keep its backup intact: {:#}",
+            self.path.display(),
+            self.cause
+        )
+    }
+}
+
+impl std::error::Error for CorruptArtifactPreservationFailed {}
+
+#[derive(Clone, Copy)]
+pub(super) enum CorruptLoadAction {
+    Quarantine,
+    Preserve,
+}
+
+pub(super) fn artifact_load_outcome(
+    result: Result<Option<LoadedSnapshot>>,
+    session_path: &Path,
+    options: &SessionOptions,
+    max_expanded_size: u64,
+    label: &str,
+    corrupt_load_action: CorruptLoadAction,
+) -> Result<LoadSnapshotOutcome> {
+    match result {
+        Ok(Some(loaded)) => {
+            let tool_state = loaded.snapshot.tool_state.is_some();
+            info!(
+                "Loaded {} from {} (version {}, compressed={}, boards={}, active_board={}, tool_state={})",
+                label,
+                session_path.display(),
+                loaded.version,
+                loaded.compressed,
+                loaded.snapshot.boards.len(),
+                loaded.snapshot.active_board_id,
+                tool_state
+            );
+            Ok(LoadSnapshotOutcome::Loaded(Box::new(loaded.snapshot)))
+        }
+        Ok(None) => {
+            info!(
+                "{} file {} contained no usable data; continuing with defaults",
+                label,
+                session_path.display()
+            );
+            Ok(LoadSnapshotOutcome::Empty)
+        }
+        Err(err) if err.downcast_ref::<ExpandedSessionTooLarge>().is_some() => {
+            warn!(
+                "Refusing to load session {}; expanded payload exceeds safety limit ({} bytes). The session file is left unchanged; clear the session or move the file if it is no longer needed: {}",
+                session_path.display(),
+                max_expanded_size,
+                err
+            );
+            Ok(LoadSnapshotOutcome::ExpandedTooLarge {
+                path: session_path.to_path_buf(),
+                max_expanded_size,
+            })
+        }
+        Err(err) if is_non_regular_session_artifact(&err) => {
+            warn!(
+                "Refusing to load non-regular {} {}; continuing with defaults: {}",
+                label,
+                session_path.display(),
+                err
+            );
+            Ok(LoadSnapshotOutcome::NonRegularArtifact {
+                path: session_path.to_path_buf(),
+            })
+        }
+        Err(err)
+            if err
+                .downcast_ref::<NewerVersionPreservationFailed>()
+                .is_some() =>
+        {
+            // Fail closed. Treating this as corruption would back it up and
+            // then continue with an empty, saveable session — exactly the
+            // destructive downgrade path this error reports.
+            Err(err)
+        }
+        Err(err) => {
+            warn!(
+                "Failed to load {} {}; continuing with defaults: {}",
+                label,
+                session_path.display(),
+                err
+            );
+            match corrupt_load_action {
+                CorruptLoadAction::Quarantine => {
+                    match quarantine_corrupt_artifact(session_path, options, max_expanded_size) {
+                        Ok(corrupt_copy) => {
+                            return Ok(LoadSnapshotOutcome::EmptyAfterCorruption { corrupt_copy });
+                        }
+                        Err(cause) => {
+                            return Err(CorruptArtifactPreservationFailed {
+                                path: session_path.to_path_buf(),
+                                session_path: options.session_file_path(),
+                                cause,
+                            }
+                            .into());
+                        }
+                    }
+                }
+                CorruptLoadAction::Preserve => {
+                    debug!(
+                        "Leaving unloadable {} {} in place because it is suppressed by the session clear marker",
+                        label,
+                        session_path.display()
+                    );
+                }
+            }
+            Ok(LoadSnapshotOutcome::Empty)
+        }
+    }
+}
diff --git a/src/session/snapshot/load/corrupt.rs b/src/session/snapshot/load/corrupt.rs
index 9ef8ec1be..c47371ea2 100644
--- a/src/session/snapshot/load/corrupt.rs
+++ b/src/session/snapshot/load/corrupt.rs
@@ -1,47 +1,216 @@
 use super::*;
+use crate::durable_io::{
+    AtomicWriteOptions, DestinationExpectation, DurableIoError, FileIdentity, OverwriteMode,
+    PermissionPolicy, SymlinkPolicy, sync_parent_dir, write_atomic,
+    write_atomic_reporting_identity,
+};
 use std::io::ErrorKind;
 
-/// Preserves an unreadable session's bytes and reports where they went, so
-/// the caller can tell the user rather than leaving the loss to the log.
-pub(super) fn backup_corrupt_session(
-    session_path: &Path,
+/// Keeps unreadable bytes away from rotation backups. Called under the session lock.
+pub(super) fn quarantine_corrupt_artifact(
+    artifact: &Path,
     options: &SessionOptions,
+    max_expanded_size: u64,
 ) -> Result<PathBuf> {
-    let named_primary = is_named_primary_path(session_path, options);
-    let bytes = read_session_artifact_bytes(session_path, named_primary)?;
-    let primary_path = options.session_file_path();
-    let backup_path = if session_path == primary_path.as_path() {
-        options.backup_file_path()
+    let copies = crate::session::artifacts::corrupt_copies_of(artifact)?;
+    let named_bytes = if is_named_primary_path(artifact, options) {
+        read_artifact_bounded(artifact, max_expanded_size.max(options.max_file_size_bytes)).ok()
     } else {
-        options.corrupt_artifact_backup_file_path(session_path)
+        None
     };
-    crate::durable_io::write_atomic(
-        &backup_path,
-        &bytes,
-        crate::durable_io::AtomicWriteOptions {
-            overwrite: crate::durable_io::OverwriteMode::Replace,
-            permissions: crate::durable_io::PermissionPolicy::FixedMode(0o600),
-            symlink: crate::durable_io::SymlinkPolicy::Reject,
-            sync_file: true,
-            sync_parent: true,
-        },
-    )
-    .with_context(|| format!("failed to write session backup {}", backup_path.display()))?;
-    if named_primary {
-        debug!(
-            "Backed up corrupt named session primary {} to {}; leaving the selected primary in place",
-            session_path.display(),
-            backup_path.display()
+    if let Some(bytes) = &named_bytes {
+        for copy in copies.iter().filter(|copy| copy.regular_file) {
+            if preserved_already_holds(&copy.path, bytes) {
+                if let Err(error) =
+                    crate::session::primary::make_session_artifact_private(&copy.path)
+                {
+                    warn!(
+                        "Diagnostic bytes are preserved at {}, but permissions could not be restricted: {error}",
+                        copy.path.display()
+                    );
+                }
+                prune_corrupt_copies(artifact, &copy.path);
+                return Ok(copy.path.clone());
+            }
+        }
+    }
+
+    let last_seq = copies.last().map_or(0, |copy| copy.seq);
+    for attempt in 1..=4 {
+        let seq = last_seq
+            .checked_add(attempt)
+            .ok_or_else(|| anyhow!("corrupt copy sequence exhausted"))?;
+        let target = crate::session::artifacts::corrupt_copy_path(artifact, seq);
+        if let Some(bytes) = &named_bytes {
+            match write_atomic(
+                &target,
+                bytes,
+                AtomicWriteOptions {
+                    overwrite: OverwriteMode::CreateNew,
+                    permissions: PermissionPolicy::FixedMode(0o600),
+                    symlink: SymlinkPolicy::Reject,
+                    sync_file: true,
+                    sync_parent: true,
+                },
+            ) {
+                Ok(()) => {
+                    prune_corrupt_copies(artifact, &target);
+                    return Ok(target);
+                }
+                Err(
+                    DurableIoError::AlreadyExists { .. } | DurableIoError::SymlinkRejected { .. },
+                ) => continue,
+                Err(err) => warn!("Could not copy unreadable session; moving it aside: {err}"),
+            }
+        }
+        match crate::session::artifacts::rename_artifact_no_replace(artifact, &target) {
+            Ok(()) => {
+                if let Err(err) = crate::session::primary::make_session_artifact_private(&target) {
+                    warn!(
+                        "Could not restrict corrupt copy {}: {err}",
+                        target.display()
+                    );
+                }
+                if let Err(err) = sync_parent_dir(&target) {
+                    warn!("Could not sync corrupt copy {}: {err}", target.display());
+                }
+                prune_corrupt_copies(artifact, &target);
+                return Ok(target);
+            }
+            Err(err) if err.kind() == ErrorKind::AlreadyExists => continue,
+            Err(err) => return Err(err).context("failed to move unreadable artifact aside"),
+        }
+    }
+
+    Err(anyhow!("could not find a free corrupt-copy name"))
+}
+
+fn prune_corrupt_copies(artifact: &Path, keep: &Path) {
+    let Ok(copies) = crate::session::artifacts::corrupt_copies_of(artifact) else {
+        return;
+    };
+    let mut count = copies.iter().filter(|copy| copy.regular_file).count();
+    for copy in copies
+        .into_iter()
+        .filter(|copy| copy.regular_file && copy.path != keep)
+    {
+        if count <= crate::session::artifacts::MAX_CORRUPT_COPIES_PER_ARTIFACT {
+            break;
+        }
+        match fs::remove_file(&copy.path) {
+            Ok(()) => count -= 1,
+            Err(err) => warn!(
+                "Could not prune corrupt copy {}: {err}",
+                copy.path.display()
+            ),
+        }
+    }
+}
+
+/// Atomically install restored ink before a remembered load can finish or abort.
+/// The exclusive lock and a replace conditional on the corrupt file it read
+/// keep a concurrent primary intact. Ink larger than a session file may be
+/// stays where it was restored from until a save writes the primary.
+pub(super) fn restore_named_primary_after_corruption(
+    options: &SessionOptions,
+    copy: &Path,
+    source: RestoredArtifact,
+    max_expanded_size: u64,
+) -> Result<Option<Box<SessionSnapshot>>> {
+    use std::io::{Seek, SeekFrom};
+    let lock = open_runtime_lock_file(&options.lock_file_path(), true)?;
+    crate::session::lock::lock_exclusive(&lock)?;
+    let result = (|| {
+        let primary = options.session_file_path();
+        let copy_len = session_artifact_metadata(copy, true)?.len();
+        let corrupt = match session_artifact_metadata_if_exists(&primary, true)? {
+            Some(metadata) if metadata.len() != copy_len => return Ok(None),
+            Some(metadata) => {
+                let bytes = read_artifact_bounded(&primary, copy_len)?;
+                if !preserved_already_holds(copy, &bytes) {
+                    return Ok(None);
+                }
+                Some((FileIdentity::of(&metadata), bytes))
+            }
+            None => None,
+        };
+        let source_path = match source {
+            RestoredArtifact::Backup => options.backup_file_path(),
+            RestoredArtifact::Recovery => options.recovery_file_path(),
+        };
+        let mut source_file = open_session_artifact_for_read(&source_path, true)?;
+        let loaded = payload::load_snapshot_opened_with_expanded_limit(
+            &source_path,
+            options,
+            source_file.try_clone()?,
+            max_expanded_size,
+            None,
+            NewerVersionAction::LeaveUntouched,
+        )?
+        .ok_or_else(|| anyhow!("restored artifact changed before primary repair"))?;
+        source_file.seek(SeekFrom::Start(0))?;
+        let mut bytes = Vec::new();
+        (&mut source_file)
+            .take(max_expanded_size.saturating_add(1))
+            .read_to_end(&mut bytes)?;
+        if bytes.len() as u64 > max_expanded_size {
+            return Err(anyhow!("restored artifact exceeds bounded repair limit"));
+        }
+        if bytes.len() as u64 > options.max_file_size_bytes {
+            warn!(
+                "Restored {} is larger than a session file may be; {} is written by the next save",
+                source_path.display(),
+                primary.display()
+            );
+            return Ok(Some(Box::new(loaded.snapshot)));
+        }
+
+        let (overwrite, expected) = match &corrupt {
+            Some((identity, contents)) => (
+                OverwriteMode::Replace,
+                DestinationExpectation::Present {
+                    identity: *identity,
+                    contents,
+                },
+            ),
+            None => (OverwriteMode::CreateNew, DestinationExpectation::Absent),
+        };
+        match write_atomic_reporting_identity(
+            &primary,
+            &bytes,
+            AtomicWriteOptions {
+                overwrite,
+                permissions: PermissionPolicy::FixedMode(0o600),
+                symlink: SymlinkPolicy::Reject,
+                sync_file: true,
+                sync_parent: false,
+            },
+            Some(expected),
+        ) {
+            Ok(_) => {}
+            Err(DurableIoError::DestinationChanged { .. }) => return Ok(None),
+            Err(error) => return Err(error.into()),
+        }
+
+        // The restored file is in place; a failed directory sync only makes
+        // the rename less durable, so it must not discard the restore.
+        if let Err(error) = sync_parent_dir(&primary) {
+            warn!(
+                "Could not sync the directory of restored {}: {error}",
+                primary.display()
+            );
+        }
+
+        info!(
+            "Restored primary atomically; unreadable bytes remain at {}",
+            copy.display()
         );
-        return Ok(backup_path);
+        Ok(Some(Box::new(loaded.snapshot)))
+    })();
+    if let Err(error) = unlock(&lock) {
+        warn!("Could not unlock restored session: {error}");
     }
-    fs::remove_file(session_path).with_context(|| {
-        format!(
-            "failed to remove corrupt session {}",
-            session_path.display()
-        )
-    })?;
-    Ok(backup_path)
+    result
 }
 
 /// Copy a session written by a newer wayscriber to a content-addressed side
@@ -91,13 +260,13 @@ pub(super) fn preserve_newer_version_session(
             return Ok(preserved_path);
         }
 
-        match crate::durable_io::write_atomic(
+        match write_atomic(
             &preserved_path,
             bytes,
-            crate::durable_io::AtomicWriteOptions {
-                overwrite: crate::durable_io::OverwriteMode::CreateNew,
-                permissions: crate::durable_io::PermissionPolicy::FixedMode(0o600),
-                symlink: crate::durable_io::SymlinkPolicy::Reject,
+            AtomicWriteOptions {
+                overwrite: OverwriteMode::CreateNew,
+                permissions: PermissionPolicy::FixedMode(0o600),
+                symlink: SymlinkPolicy::Reject,
                 sync_file: true,
                 sync_parent: true,
             },
@@ -105,7 +274,7 @@ pub(super) fn preserve_newer_version_session(
             Ok(()) => return Ok(preserved_path),
             // Something else is at that name and did not match our bytes:
             // step over it rather than claim a preservation we did not make.
-            Err(crate::durable_io::DurableIoError::AlreadyExists { .. }) => continue,
+            Err(DurableIoError::AlreadyExists { .. }) => continue,
             Err(err) => {
                 last_error = Some(err);
                 break;
@@ -148,7 +317,7 @@ pub(super) fn preserve_newer_version_session(
         match crate::session::artifacts::rename_artifact_no_replace(session_path, &fallback_path) {
             Ok(()) => {
                 crate::session::primary::make_session_artifact_private(&fallback_path)?;
-                crate::durable_io::sync_parent_dir(&fallback_path).with_context(|| {
+                sync_parent_dir(&fallback_path).with_context(|| {
                     format!(
                         "moved newer-version session to {}, but failed to sync its directory",
                         fallback_path.display()
@@ -187,7 +356,8 @@ fn preserved_already_holds(preserved_path: &Path, bytes: &[u8]) -> bool {
     if !metadata.is_file() || metadata.len() != bytes.len() as u64 {
         return false;
     }
-    fs::read(preserved_path).is_ok_and(|existing| existing == bytes)
+    read_artifact_bounded(preserved_path, bytes.len() as u64)
+        .is_ok_and(|existing| existing == bytes)
 }
 
 /// FNV-1a over the loaded bytes: stable across processes and builds, which
@@ -202,15 +372,123 @@ fn content_digest(bytes: &[u8]) -> u64 {
     hash
 }
 
-fn read_session_artifact_bytes(session_path: &Path, no_follow: bool) -> Result<Vec<u8>> {
-    if !no_follow {
-        return fs::read(session_path)
-            .with_context(|| format!("failed to read session {}", session_path.display()));
-    }
-
-    let mut file = open_session_artifact_for_read(session_path, true)?;
+fn read_artifact_bounded(path: &Path, limit: u64) -> Result<Vec<u8>> {
+    let file = open_session_artifact_for_read(path, true)?;
     let mut bytes = Vec::new();
-    file.read_to_end(&mut bytes)
-        .with_context(|| format!("failed to read session {}", session_path.display()))?;
+    file.take(limit.saturating_add(1)).read_to_end(&mut bytes)?;
+    if bytes.len() as u64 > limit {
+        return Err(anyhow!(
+            "unreadable artifact exceeds preservation read limit"
+        ));
+    }
     Ok(bytes)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn restored_backup_cleanup_does_not_remove_a_changed_named_primary() {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let mut options = SessionOptions::new(temp.path().to_path_buf(), "named");
+        options.persist_transparent = true;
+        options.set_named_file_target(temp.path().join("board.wayscriber-session"));
+        let replacement = saved_session_bytes(temp.path());
+        let corrupt_bytes = vec![b'{'; replacement.len()];
+        fs::write(options.session_file_path(), &corrupt_bytes).unwrap();
+        let corrupt_copy = with_shared_session_lock(&options, || {
+            quarantine_corrupt_artifact(&options.session_file_path(), &options, 4096)
+        })
+        .unwrap();
+        // Another cooperating writer can run between preservation and restoration.
+        fs::write(options.session_file_path(), &replacement).unwrap();
+        fs::write(options.backup_file_path(), b"saved backup").unwrap();
+
+        assert!(
+            restore_named_primary_after_corruption(
+                &options,
+                &corrupt_copy,
+                RestoredArtifact::Backup,
+                4096
+            )
+            .unwrap()
+            .is_none()
+        );
+        assert_eq!(fs::read(options.session_file_path()).unwrap(), replacement);
+        assert_eq!(
+            fs::read(options.backup_file_path()).unwrap(),
+            b"saved backup"
+        );
+        assert_eq!(fs::read(corrupt_copy).unwrap(), corrupt_bytes);
+    }
+
+    /// Session bytes as this build writes them.
+    fn saved_session_bytes(dir: &Path) -> Vec<u8> {
+        let mut scratch = SessionOptions::new(dir.to_path_buf(), "scratch");
+        scratch.persist_transparent = true;
+        scratch.set_named_file_target(dir.join("scratch.wayscriber-session"));
+        crate::session::save_snapshot(&super::super::super::tests::sample_snapshot(), &scratch)
+            .unwrap();
+        fs::read(scratch.session_file_path()).unwrap()
+    }
+
+    fn quarantined_named_session(temp: &Path) -> (SessionOptions, PathBuf, Vec<u8>) {
+        let mut options = SessionOptions::new(temp.to_path_buf(), "named");
+        options.persist_transparent = true;
+        options.set_named_file_target(temp.join("board.wayscriber-session"));
+        let corrupt_bytes = vec![b'{'; 40];
+        fs::write(options.session_file_path(), &corrupt_bytes).unwrap();
+        let corrupt_copy = with_shared_session_lock(&options, || {
+            quarantine_corrupt_artifact(&options.session_file_path(), &options, 4096)
+        })
+        .unwrap();
+        (options, corrupt_copy, corrupt_bytes)
+    }
+
+    #[test]
+    fn restored_ink_too_large_for_a_session_file_is_not_written_into_the_primary() {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let (mut options, corrupt_copy, corrupt_bytes) = quarantined_named_session(temp.path());
+        let backup = saved_session_bytes(temp.path());
+        fs::write(options.backup_file_path(), &backup).unwrap();
+        options.max_file_size_bytes = backup.len() as u64 - 1;
+
+        let restored = restore_named_primary_after_corruption(
+            &options,
+            &corrupt_copy,
+            RestoredArtifact::Backup,
+            4096,
+        )
+        .unwrap()
+        .expect("the restored ink is still loaded");
+
+        assert!(restored.has_board_data());
+        assert_eq!(
+            fs::read(options.session_file_path()).unwrap(),
+            corrupt_bytes
+        );
+        assert_eq!(fs::read(options.backup_file_path()).unwrap(), backup);
+    }
+
+    #[test]
+    fn restore_creates_a_primary_that_was_moved_aside() {
+        let temp = crate::test_temp::tempdir().unwrap();
+        let (options, corrupt_copy, _) = quarantined_named_session(temp.path());
+        fs::remove_file(options.session_file_path()).unwrap();
+        let backup = saved_session_bytes(temp.path());
+        fs::write(options.backup_file_path(), &backup).unwrap();
+
+        let restored = restore_named_primary_after_corruption(
+            &options,
+            &corrupt_copy,
+            RestoredArtifact::Backup,
+            4096,
+        )
+        .unwrap()
+        .expect("restored");
+
+        assert!(restored.has_board_data());
+        assert_eq!(fs::read(options.session_file_path()).unwrap(), backup);
+    }
+}
diff --git a/src/session/snapshot/load/fallback.rs b/src/session/snapshot/load/fallback.rs
index c9c0ef9b9..0983ea1c5 100644
--- a/src/session/snapshot/load/fallback.rs
+++ b/src/session/snapshot/load/fallback.rs
@@ -1,5 +1,7 @@
 use super::*;
 
+// These arguments carry the loader artifact view and its preservation/size policy.
+#[allow(clippy::too_many_arguments)]
 pub(super) fn load_normal_session_or_empty(
     options: &SessionOptions,
     session_path: &Path,
@@ -8,6 +10,7 @@ pub(super) fn load_normal_session_or_empty(
     clear_marker_metadata: Option<&fs::Metadata>,
     backup_recovery_marker_metadata: Option<&fs::Metadata>,
     recovery_recoverable_marker_metadata: Option<&fs::Metadata>,
+    restore_named_primary: bool,
 ) -> Result<LoadSnapshotOutcome> {
     let Some(primary_metadata) = session_metadata.as_ref() else {
         if let Some(backup) = load_contentful_backup(
@@ -49,7 +52,8 @@ pub(super) fn load_normal_session_or_empty(
             | LoadSnapshotOutcome::EmptyAfterCorruption { .. }
             | LoadSnapshotOutcome::NonRegularArtifact { .. }
             | LoadSnapshotOutcome::ExpandedTooLarge { .. } => {}
-            LoadSnapshotOutcome::LoadedFromBackup(_)
+            LoadSnapshotOutcome::RestoredAfterCorruption { .. }
+            | LoadSnapshotOutcome::LoadedFromBackup(_)
             | LoadSnapshotOutcome::LoadedFromRecovery(_) => {}
         }
 
@@ -72,10 +76,22 @@ pub(super) fn load_normal_session_or_empty(
         max_expanded_size,
         true,
         "session",
-        CorruptLoadAction::Backup,
+        CorruptLoadAction::Quarantine,
     )?;
-    let LoadSnapshotOutcome::Loaded(snapshot) = outcome else {
-        return Ok(outcome);
+    let snapshot = match outcome {
+        LoadSnapshotOutcome::Loaded(snapshot) => snapshot,
+        LoadSnapshotOutcome::EmptyAfterCorruption { corrupt_copy } => {
+            return load_after_corrupt_primary(
+                options,
+                max_expanded_size,
+                clear_marker_metadata,
+                backup_recovery_marker_metadata,
+                recovery_recoverable_marker_metadata,
+                corrupt_copy,
+                restore_named_primary,
+            );
+        }
+        other => return Ok(other),
     };
 
     if snapshot.has_board_data() {
@@ -147,7 +163,7 @@ fn load_contentful_backup(
         );
     } else {
         warn!(
-            "Primary session {} is missing; checking backup {} for recoverable board data",
+            "Checking recoverable backup for primary {} at {}",
             options.session_file_path().display(),
             backup_path.display()
         );
@@ -159,7 +175,7 @@ fn load_contentful_backup(
         max_expanded_size,
         true,
         "session backup",
-        CorruptLoadAction::Backup,
+        CorruptLoadAction::Quarantine,
     )? {
         LoadSnapshotOutcome::Loaded(snapshot) if snapshot.has_board_data() => {
             warn!(
@@ -186,14 +202,14 @@ fn load_contentful_backup(
             );
             Ok(None)
         }
-        LoadSnapshotOutcome::LoadedFromBackup(_) | LoadSnapshotOutcome::LoadedFromRecovery(_) => {
-            load_contentful_recovery(
-                options,
-                max_expanded_size,
-                clear_marker_metadata,
-                recovery_recoverable_marker_metadata,
-            )
-        }
+        LoadSnapshotOutcome::RestoredAfterCorruption { .. }
+        | LoadSnapshotOutcome::LoadedFromBackup(_)
+        | LoadSnapshotOutcome::LoadedFromRecovery(_) => load_contentful_recovery(
+            options,
+            max_expanded_size,
+            clear_marker_metadata,
+            recovery_recoverable_marker_metadata,
+        ),
     }
 }
 
@@ -226,7 +242,7 @@ fn load_contentful_recovery(
         max_expanded_size,
         false,
         "session recovery",
-        CorruptLoadAction::Backup,
+        CorruptLoadAction::Quarantine,
     )? {
         LoadSnapshotOutcome::Loaded(snapshot) if snapshot.has_board_data() => Ok(Some(snapshot)),
         LoadSnapshotOutcome::Loaded(_)
@@ -237,8 +253,54 @@ fn load_contentful_recovery(
             preserve_unloadable_recovery(&path, "too-large");
             Ok(None)
         }
-        LoadSnapshotOutcome::LoadedFromBackup(_) | LoadSnapshotOutcome::LoadedFromRecovery(_) => {
-            Ok(None)
+        LoadSnapshotOutcome::RestoredAfterCorruption { .. }
+        | LoadSnapshotOutcome::LoadedFromBackup(_)
+        | LoadSnapshotOutcome::LoadedFromRecovery(_) => Ok(None),
+    }
+}
+
+/// An unreadable primary is not an intentional blank: try older usable artifacts.
+fn load_after_corrupt_primary(
+    options: &SessionOptions,
+    max_expanded_size: u64,
+    clear_marker: Option<&fs::Metadata>,
+    backup_marker: Option<&fs::Metadata>,
+    recovery_marker: Option<&fs::Metadata>,
+    corrupt_copy: PathBuf,
+    restore_named_primary: bool,
+) -> Result<LoadSnapshotOutcome> {
+    let restored = match load_contentful_backup(
+        options,
+        max_expanded_size,
+        None,
+        clear_marker,
+        backup_marker,
+        recovery_marker,
+    )? {
+        Some(snapshot) => Some((snapshot, RestoredArtifact::Backup)),
+        None => {
+            load_contentful_recovery(options, max_expanded_size, clear_marker, recovery_marker)?
+                .map(|snapshot| (snapshot, RestoredArtifact::Recovery))
         }
+    };
+    let Some((mut snapshot, source)) = restored else {
+        return Ok(LoadSnapshotOutcome::EmptyAfterCorruption { corrupt_copy });
+    };
+
+    if options.is_named_file() && restore_named_primary {
+        snapshot = corrupt::restore_named_primary_after_corruption(
+            options,
+            &corrupt_copy,
+            source,
+            max_expanded_size,
+        )?
+        .ok_or_else(|| {
+            anyhow!("named primary changed during restoration; retry the load without replacing it")
+        })?;
     }
+    Ok(LoadSnapshotOutcome::RestoredAfterCorruption {
+        snapshot,
+        source,
+        corrupt_copy,
+    })
 }
diff --git a/src/session/snapshot/load/markers.rs b/src/session/snapshot/load/markers.rs
index 283d1d473..c1d986c62 100644
--- a/src/session/snapshot/load/markers.rs
+++ b/src/session/snapshot/load/markers.rs
@@ -1,10 +1,12 @@
 use super::*;
+use crate::session::snapshot::generation::{ArtifactStamp, LegacyOrder, cleared_by, written_after};
 
 pub(super) fn backup_is_newer_than_primary(backup: &fs::Metadata, primary: &fs::Metadata) -> bool {
-    match (backup.modified(), primary.modified()) {
-        (Ok(backup_modified), Ok(primary_modified)) => backup_modified > primary_modified,
-        _ => false,
-    }
+    written_after(
+        ArtifactStamp::without_generation(backup),
+        ArtifactStamp::without_generation(primary),
+        LegacyOrder::Strict,
+    )
 }
 
 pub(super) fn recoverable_backup_marker_metadata(
@@ -85,14 +87,11 @@ pub(super) fn clear_marker_suppresses_artifact(
     let Some(clear_marker_metadata) = clear_marker_metadata else {
         return false;
     };
-    let artifact_newer_than_marker = match (
-        artifact_metadata.modified(),
-        clear_marker_metadata.modified(),
-    ) {
-        (Ok(artifact_modified), Ok(marker_modified)) => artifact_modified > marker_modified,
-        _ => false,
-    };
-    if artifact_newer_than_marker {
+    let cleared = cleared_by(
+        ArtifactStamp::without_generation(artifact_metadata),
+        ArtifactStamp::without_generation(clear_marker_metadata),
+    );
+    if !cleared {
         return false;
     }
     info!(
@@ -144,8 +143,9 @@ pub(super) fn should_prefer_recovery(
     let Some(session_metadata) = session_metadata else {
         return true;
     };
-    match (recovery_metadata.modified(), session_metadata.modified()) {
-        (Ok(recovery_modified), Ok(session_modified)) => recovery_modified >= session_modified,
-        _ => true,
-    }
+    written_after(
+        ArtifactStamp::without_generation(recovery_metadata),
+        ArtifactStamp::without_generation(session_metadata),
+        LegacyOrder::NonStrictTrue,
+    )
 }
diff --git a/src/session/snapshot/load/named_candidate.rs b/src/session/snapshot/load/named_candidate.rs
index eb42c5f6f..fc773098a 100644
--- a/src/session/snapshot/load/named_candidate.rs
+++ b/src/session/snapshot/load/named_candidate.rs
@@ -3,7 +3,8 @@ use super::*;
 pub(super) fn log_named_candidate_outcome(session_path: &Path, outcome: &LoadSnapshotOutcome) {
     let (source, snapshot) = match outcome {
         LoadSnapshotOutcome::Loaded(snapshot) => ("primary", snapshot),
-        LoadSnapshotOutcome::LoadedFromBackup(snapshot) => ("backup", snapshot),
+        LoadSnapshotOutcome::RestoredAfterCorruption { snapshot, .. }
+        | LoadSnapshotOutcome::LoadedFromBackup(snapshot) => ("backup", snapshot),
         LoadSnapshotOutcome::LoadedFromRecovery(snapshot) => ("recovery", snapshot),
         LoadSnapshotOutcome::Empty
         | LoadSnapshotOutcome::EmptyAfterCorruption { .. }
@@ -71,7 +72,8 @@ pub(super) fn load_named_candidate_with_fallbacks(
             LoadSnapshotOutcome::Empty
             | LoadSnapshotOutcome::EmptyAfterCorruption { .. }
             | LoadSnapshotOutcome::NonRegularArtifact { .. } => {}
-            LoadSnapshotOutcome::LoadedFromBackup(_)
+            LoadSnapshotOutcome::RestoredAfterCorruption { .. }
+            | LoadSnapshotOutcome::LoadedFromBackup(_)
             | LoadSnapshotOutcome::LoadedFromRecovery(_) => {}
         }
     }
@@ -246,7 +248,9 @@ fn load_named_candidate_suppressed_primary(
             | LoadSnapshotOutcome::ExpandedTooLarge { .. },
         ) => Ok(None),
         Ok(
-            LoadSnapshotOutcome::LoadedFromBackup(_) | LoadSnapshotOutcome::LoadedFromRecovery(_),
+            LoadSnapshotOutcome::RestoredAfterCorruption { .. }
+            | LoadSnapshotOutcome::LoadedFromBackup(_)
+            | LoadSnapshotOutcome::LoadedFromRecovery(_),
         ) => Ok(None),
         Err(err) => {
             warn!(
@@ -316,9 +320,9 @@ fn load_named_candidate_contentful_backup(
             "named session backup is too large to open without mutating candidate artifacts: {}",
             path.display()
         )),
-        LoadSnapshotOutcome::LoadedFromBackup(_) | LoadSnapshotOutcome::LoadedFromRecovery(_) => {
-            Ok(None)
-        }
+        LoadSnapshotOutcome::RestoredAfterCorruption { .. }
+        | LoadSnapshotOutcome::LoadedFromBackup(_)
+        | LoadSnapshotOutcome::LoadedFromRecovery(_) => Ok(None),
     }
 }
 
@@ -362,9 +366,9 @@ fn load_named_candidate_contentful_recovery(
             "named session recovery is too large to open without mutating candidate artifacts: {}",
             path.display()
         )),
-        LoadSnapshotOutcome::LoadedFromBackup(_) | LoadSnapshotOutcome::LoadedFromRecovery(_) => {
-            Ok(None)
-        }
+        LoadSnapshotOutcome::RestoredAfterCorruption { .. }
+        | LoadSnapshotOutcome::LoadedFromBackup(_)
+        | LoadSnapshotOutcome::LoadedFromRecovery(_) => Ok(None),
     }
 }
 
diff --git a/src/session/snapshot/mod.rs b/src/session/snapshot/mod.rs
index 33a66c927..f3a135535 100644
--- a/src/session/snapshot/mod.rs
+++ b/src/session/snapshot/mod.rs
@@ -3,11 +3,14 @@ mod apply;
 pub use appearance::BoardAppearanceSnapshot;
 mod capture;
 mod compression;
+mod generation;
 mod history;
 mod load;
 mod save;
 mod types;
 
+#[cfg(test)]
+mod compat_tests;
 #[cfg(test)]
 mod tests;
 
@@ -17,13 +20,14 @@ pub use capture::snapshot_from_input;
 pub(crate) use compression::DEFAULT_MAX_EXPANDED_SESSION_BYTES;
 pub use load::load_snapshot;
 pub(crate) use load::{
-    LoadSnapshotOutcome, LoadedSnapshot, load_named_session_candidate,
-    load_snapshot_for_offline_edit, load_snapshot_inner, load_snapshot_with_outcome,
+    CorruptArtifactPreservationFailed, LoadSnapshotOutcome, LoadedSnapshot, RestoredArtifact,
+    load_named_session_candidate, load_snapshot_for_offline_edit, load_snapshot_inner,
+    load_snapshot_with_outcome,
 };
 pub use save::save_snapshot;
 pub(crate) use save::{
-    SaveAsOverwrite, SaveLimitExceeded, SaveSnapshotOutcome, SaveSnapshotReport,
-    SnapshotPayloadEstimate, SnapshotSaveEstimate, estimate_snapshot_payload,
+    SaveAsOverwrite, SaveLimitExceeded, SavePayloadTooLarge, SaveSnapshotOutcome,
+    SaveSnapshotReport, SnapshotPayloadEstimate, SnapshotSaveEstimate, estimate_snapshot_payload,
     estimate_snapshot_save, estimate_snapshot_without_history_payload,
     save_snapshot_as_requires_overwrite, save_snapshot_as_with_report,
     save_snapshot_autosave_with_report, save_snapshot_autosave_with_report_and_clear_boundary,
diff --git a/src/session/snapshot/save.rs b/src/session/snapshot/save.rs
index 26139aced..f0f699686 100644
--- a/src/session/snapshot/save.rs
+++ b/src/session/snapshot/save.rs
@@ -1,4 +1,5 @@
 use super::compression::{DEFAULT_MAX_EXPANDED_SESSION_BYTES, compress_bytes, temp_path};
+use super::generation::{ArtifactSetView, UnreadablePolicy};
 use super::types::{
     BoardFile, BoardPagesSnapshot, BoardSnapshot, CURRENT_VERSION, SessionFile, SessionSnapshot,
 };
@@ -7,6 +8,7 @@ use crate::session::options::{CompressionMode, SessionOptions};
 use crate::time_utils::now_rfc3339;
 use anyhow::{Context, Result, anyhow};
 use log::{debug, info, warn};
+use payload::PayloadStamp;
 use std::fs::{self, OpenOptions};
 use std::io::Write;
 use std::os::unix::fs::OpenOptionsExt;
@@ -15,26 +17,31 @@ use std::time::{Duration, Instant};
 
 const AUTOSAVE_HISTORY_FALLBACK_DEPTH: usize = 1;
 
+mod estimate;
 mod payload;
 mod recovery;
 mod save_as;
 #[cfg(test)]
 mod tests;
 
+pub(crate) use estimate::{
+    estimate_snapshot_payload, estimate_snapshot_save, estimate_snapshot_without_history_payload,
+};
 pub(super) use payload::snapshot_without_history;
 use payload::{PayloadCandidate, estimate_from_candidate, payload_candidate, payload_within_limit};
 use recovery::{
-    remove_backup_file, remove_backup_recovery_marker_file, remove_clear_marker_file,
-    remove_recoverable_artifacts_suppressed_by_clear_marker, remove_recovery_file,
-    remove_recovery_files, remove_recovery_recoverable_marker_file,
-    remove_session_file_after_clear_marker, save_recovery_snapshot, write_backup_recovery_marker,
-    write_clear_marker, write_recovery_recoverable_marker,
+    preserve_oversized_recovery, remove_backup_file, remove_backup_recovery_marker_file,
+    remove_clear_marker_file, remove_recoverable_artifacts_suppressed_by_clear_marker,
+    remove_recovery_file, remove_recovery_files, remove_recovery_recoverable_marker_file,
+    remove_session_file_after_clear_marker, write_backup_recovery_marker, write_clear_marker,
+    write_recovery_recoverable_marker,
 };
 pub(crate) use save_as::{save_snapshot_as_requires_overwrite, save_snapshot_as_with_report};
 
 mod model;
 
-use model::{HistoryFallbackStrategy, SavePayloadTooLarge, log_near_limit};
+pub(crate) use model::SavePayloadTooLarge;
+use model::{HistoryFallbackStrategy, log_near_limit};
 pub use model::{
     SaveAsOverwrite, SaveLimitExceeded, SaveSnapshotOutcome, SaveSnapshotReport,
     SnapshotPayloadEstimate, SnapshotSaveEstimate,
@@ -92,75 +99,6 @@ pub(crate) fn save_snapshot_autosave_with_report_and_clear_boundary(
     )
 }
 
-#[allow(dead_code)]
-pub(crate) fn estimate_snapshot_save(
-    snapshot: &SessionSnapshot,
-    options: &SessionOptions,
-) -> Result<SnapshotSaveEstimate> {
-    estimate_snapshot_save_with_expanded_limit(
-        snapshot,
-        options,
-        DEFAULT_MAX_EXPANDED_SESSION_BYTES,
-    )
-}
-
-#[allow(dead_code)]
-pub(super) fn estimate_snapshot_save_with_expanded_limit(
-    snapshot: &SessionSnapshot,
-    options: &SessionOptions,
-    max_expanded_size: u64,
-) -> Result<SnapshotSaveEstimate> {
-    let last_modified = now_rfc3339();
-    let full = payload_candidate(snapshot, options, &last_modified)?;
-    let visible_only = snapshot_without_history(snapshot);
-    let visible_without_history = payload_candidate(&visible_only, options, &last_modified)?;
-
-    Ok(SnapshotSaveEstimate {
-        full: estimate_from_candidate(&full, options, max_expanded_size),
-        visible_without_history: estimate_from_candidate(
-            &visible_without_history,
-            options,
-            max_expanded_size,
-        ),
-    })
-}
-
-#[allow(dead_code)]
-pub(crate) fn estimate_snapshot_payload(
-    snapshot: &SessionSnapshot,
-    options: &SessionOptions,
-) -> Result<SnapshotPayloadEstimate> {
-    estimate_snapshot_payload_with_expanded_limit(
-        snapshot,
-        options,
-        DEFAULT_MAX_EXPANDED_SESSION_BYTES,
-    )
-}
-
-#[allow(dead_code)]
-pub(crate) fn estimate_snapshot_without_history_payload(
-    snapshot: &SessionSnapshot,
-    options: &SessionOptions,
-) -> Result<SnapshotPayloadEstimate> {
-    let visible_only = snapshot_without_history(snapshot);
-    estimate_snapshot_payload(&visible_only, options)
-}
-
-#[allow(dead_code)]
-pub(super) fn estimate_snapshot_payload_with_expanded_limit(
-    snapshot: &SessionSnapshot,
-    options: &SessionOptions,
-    max_expanded_size: u64,
-) -> Result<SnapshotPayloadEstimate> {
-    let last_modified = now_rfc3339();
-    let candidate = payload_candidate(snapshot, options, &last_modified)?;
-    Ok(estimate_from_candidate(
-        &candidate,
-        options,
-        max_expanded_size,
-    ))
-}
-
 #[allow(dead_code)]
 pub(super) fn save_snapshot_with_expanded_limit(
     snapshot: &SessionSnapshot,
@@ -212,13 +150,14 @@ fn save_snapshot_with_expanded_limit_and_strategy(
     );
     match &result {
         Ok(Some(report)) => info!(
-            "Session save pipeline finished for {} in {:?}: outcome={:?}, written={} bytes, raw={} bytes, compression={}",
+            "Session save pipeline finished for {} in {:?}: outcome={:?}, written={} bytes, raw={} bytes, compression={}, generation={:?}",
             report.path.display(),
             save_started.elapsed(),
             report.outcome,
             report.written_size,
             report.raw_size,
-            report.compressed
+            report.compressed,
+            report.generation
         ),
         Ok(None) => info!(
             "Session save pipeline finished in {:?}: no file write needed",
@@ -342,42 +281,30 @@ fn save_snapshot_inner(
     let snapshot_has_board_data = snapshot.has_board_data();
     let contentless_clear_boundary = !snapshot_has_board_data && contentless_clear_boundary;
     let last_modified = now_rfc3339();
+    let generation = allocate_save_generation(options, history_fallback)?;
+    let stamp = PayloadStamp {
+        last_modified: &last_modified,
+        generation,
+    };
 
     let prepare_started = Instant::now();
     let prepared = match payload_within_limit(
         snapshot,
         options,
-        &last_modified,
+        stamp,
         max_expanded_size,
         history_fallback,
     ) {
         Ok(prepared) => prepared,
-        Err(err) => {
+        Err(mut err) => {
             if session_path.exists() {
                 warn!(
                     "Session save failed before replacing {}; existing session file is unchanged",
                     session_path.display()
                 );
             }
-            if err.downcast_ref::<SavePayloadTooLarge>().is_some()
-                && matches!(history_fallback, HistoryFallbackStrategy::LargestFitting)
-            {
-                match save_recovery_snapshot(snapshot, options, max_expanded_size, &last_modified) {
-                    Ok(Some(report)) => warn!(
-                        "Wrote oversized session recovery artifact to {} ({} bytes written, raw={} bytes, compression={}, outcome={:?})",
-                        report.path.display(),
-                        report.written_size,
-                        report.raw_size,
-                        report.compressed,
-                        report.outcome
-                    ),
-                    Ok(None) => {}
-                    Err(recovery_err) => warn!(
-                        "Failed to write oversized session recovery artifact {}: {}",
-                        options.recovery_file_path().display(),
-                        recovery_err
-                    ),
-                }
+            if matches!(history_fallback, HistoryFallbackStrategy::LargestFitting) {
+                preserve_oversized_recovery(&mut err, snapshot, options, max_expanded_size, stamp);
             }
             return Err(err);
         }
@@ -398,6 +325,7 @@ fn save_snapshot_inner(
 
     let Some(payload) = prepared.payload else {
         let report = SaveSnapshotReport {
+            generation,
             path: session_path.clone(),
             outcome: prepared.outcome,
             raw_size: prepared.raw_size,
@@ -406,7 +334,7 @@ fn save_snapshot_inner(
             compressed: prepared.compressed,
         };
         if matches!(prepared.outcome, SaveSnapshotOutcome::ClearedEmpty) {
-            write_clear_marker(options)?;
+            write_clear_marker(options, generation)?;
             remove_session_file_after_clear_marker(&session_path);
             remove_backup_file(options);
             remove_backup_recovery_marker_file(options);
@@ -451,7 +379,7 @@ fn save_snapshot_inner(
     let write_elapsed = write_started.elapsed();
 
     if contentless_clear_boundary {
-        write_clear_marker(options)?;
+        write_clear_marker(options, generation)?;
     }
 
     let replace_started = Instant::now();
@@ -500,10 +428,10 @@ fn save_snapshot_inner(
     }
 
     if should_mark_backup_recoverable {
-        write_backup_recovery_marker(options)?;
+        write_backup_recovery_marker(options, generation)?;
     }
     if should_mark_recovery_recoverable {
-        write_recovery_recoverable_marker(options)?;
+        write_recovery_recoverable_marker(options, generation)?;
     }
 
     replace_session_file(&tmp_path, &session_path).with_context(|| {
@@ -534,6 +462,7 @@ fn save_snapshot_inner(
     );
 
     let report = SaveSnapshotReport {
+        generation,
         path: session_path,
         outcome: prepared.outcome,
         raw_size,
@@ -581,3 +510,17 @@ fn cleanup_snapshot_artifacts_after_save(
         remove_recovery_recoverable_marker_file(options);
     }
 }
+
+/// Called under the exclusive normal-save lock, before touching any artifact.
+fn allocate_save_generation(
+    options: &SessionOptions,
+    strategy: HistoryFallbackStrategy,
+) -> Result<Option<u64>> {
+    // Autosave can retain drawings and retry. A final save must not lose them
+    // solely because another artifact could not be read.
+    let policy = match strategy {
+        HistoryFallbackStrategy::Bounded { .. } => UnreadablePolicy::Refuse,
+        HistoryFallbackStrategy::LargestFitting => UnreadablePolicy::Warn,
+    };
+    ArtifactSetView::probe(options).next_generation(policy)
+}
diff --git a/src/session/snapshot/save/estimate.rs b/src/session/snapshot/save/estimate.rs
new file mode 100644
index 000000000..f9bb016ba
--- /dev/null
+++ b/src/session/snapshot/save/estimate.rs
@@ -0,0 +1,67 @@
+//! Size estimates for a save that has not happened yet.
+use super::*;
+
+pub(crate) fn estimate_snapshot_save(
+    snapshot: &SessionSnapshot,
+    options: &SessionOptions,
+) -> Result<SnapshotSaveEstimate> {
+    estimate_snapshot_save_with_expanded_limit(
+        snapshot,
+        options,
+        DEFAULT_MAX_EXPANDED_SESSION_BYTES,
+    )
+}
+
+fn estimate_snapshot_save_with_expanded_limit(
+    snapshot: &SessionSnapshot,
+    options: &SessionOptions,
+    max_expanded_size: u64,
+) -> Result<SnapshotSaveEstimate> {
+    let last_modified = now_rfc3339();
+    let full = payload_candidate(snapshot, options, PayloadStamp::widest(&last_modified))?;
+    let visible_only = snapshot_without_history(snapshot);
+    let visible_without_history =
+        payload_candidate(&visible_only, options, PayloadStamp::widest(&last_modified))?;
+
+    Ok(SnapshotSaveEstimate {
+        full: estimate_from_candidate(&full, options, max_expanded_size),
+        visible_without_history: estimate_from_candidate(
+            &visible_without_history,
+            options,
+            max_expanded_size,
+        ),
+    })
+}
+
+pub(crate) fn estimate_snapshot_payload(
+    snapshot: &SessionSnapshot,
+    options: &SessionOptions,
+) -> Result<SnapshotPayloadEstimate> {
+    estimate_snapshot_payload_with_expanded_limit(
+        snapshot,
+        options,
+        DEFAULT_MAX_EXPANDED_SESSION_BYTES,
+    )
+}
+
+pub(crate) fn estimate_snapshot_without_history_payload(
+    snapshot: &SessionSnapshot,
+    options: &SessionOptions,
+) -> Result<SnapshotPayloadEstimate> {
+    let visible_only = snapshot_without_history(snapshot);
+    estimate_snapshot_payload(&visible_only, options)
+}
+
+fn estimate_snapshot_payload_with_expanded_limit(
+    snapshot: &SessionSnapshot,
+    options: &SessionOptions,
+    max_expanded_size: u64,
+) -> Result<SnapshotPayloadEstimate> {
+    let last_modified = now_rfc3339();
+    let candidate = payload_candidate(snapshot, options, PayloadStamp::widest(&last_modified))?;
+    Ok(estimate_from_candidate(
+        &candidate,
+        options,
+        max_expanded_size,
+    ))
+}
diff --git a/src/session/snapshot/save/model.rs b/src/session/snapshot/save/model.rs
index 6105c3d43..efe2aa3f7 100644
--- a/src/session/snapshot/save/model.rs
+++ b/src/session/snapshot/save/model.rs
@@ -24,6 +24,8 @@ pub enum SaveSnapshotOutcome {
 /// Details about a completed session save.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct SaveSnapshotReport {
+    /// Generation written into this save's artifacts; absent at the ceiling.
+    pub generation: Option<u64>,
     pub path: PathBuf,
     pub outcome: SaveSnapshotOutcome,
     pub raw_size: usize,
@@ -59,7 +61,6 @@ pub struct SnapshotPayloadEstimate {
     pub limit_exceeded: Option<SaveLimitExceeded>,
 }
 
-#[allow(dead_code)]
 impl SnapshotPayloadEstimate {
     pub fn is_near_limit(&self) -> bool {
         is_near_limit(self.written_size as u64, self.max_file_size_bytes)
@@ -107,11 +108,12 @@ impl SaveLimitExceeded {
 }
 
 #[derive(Debug)]
-pub(super) struct SavePayloadTooLarge {
-    pub(super) limit: SaveLimitExceeded,
-    pub(super) written_size: usize,
-    pub(super) raw_size: usize,
-    pub(super) compressed: bool,
+pub(crate) struct SavePayloadTooLarge {
+    pub(crate) limit: SaveLimitExceeded,
+    pub(crate) recovery_path: Option<PathBuf>,
+    pub(crate) written_size: usize,
+    pub(crate) raw_size: usize,
+    pub(crate) compressed: bool,
 }
 
 impl fmt::Display for SavePayloadTooLarge {
diff --git a/src/session/snapshot/save/payload.rs b/src/session/snapshot/save/payload.rs
index 7be60772c..b4a5b0c05 100644
--- a/src/session/snapshot/save/payload.rs
+++ b/src/session/snapshot/save/payload.rs
@@ -1,4 +1,22 @@
 use super::*;
+use crate::session::snapshot::generation::{MAX_GENERATION, payload_prefix_generation};
+
+#[derive(Clone, Copy)]
+pub(super) struct PayloadStamp<'a> {
+    pub(super) last_modified: &'a str,
+    pub(super) generation: Option<u64>,
+}
+
+impl<'a> PayloadStamp<'a> {
+    /// The widest stamp a save can write, for estimates made before a
+    /// generation is allocated.
+    pub(super) fn widest(last_modified: &'a str) -> Self {
+        Self {
+            last_modified,
+            generation: Some(MAX_GENERATION),
+        }
+    }
+}
 
 const NEAR_LIMIT_PERCENT: u64 = 90;
 
@@ -82,7 +100,7 @@ impl PreparedPayload {
 pub(super) fn payload_within_limit(
     snapshot: &SessionSnapshot,
     options: &SessionOptions,
-    last_modified: &str,
+    stamp: PayloadStamp<'_>,
     max_expanded_size: u64,
     history_fallback: HistoryFallbackStrategy,
 ) -> Result<PreparedPayload> {
@@ -91,7 +109,7 @@ pub(super) fn payload_within_limit(
     }
 
     let full_started = Instant::now();
-    let full_payload = payload_candidate(snapshot, options, last_modified)?;
+    let full_payload = payload_candidate(snapshot, options, stamp)?;
     log_payload_candidate("full", &full_payload, full_started.elapsed());
     let Some(full_limit) = full_payload.limit_exceeded(options, max_expanded_size) else {
         return Ok(PreparedPayload::write(
@@ -118,10 +136,11 @@ pub(super) fn payload_within_limit(
     }
 
     let visible_started = Instant::now();
-    let visible_payload = payload_candidate(&visible_only, options, last_modified)?;
+    let visible_payload = payload_candidate(&visible_only, options, stamp)?;
     log_payload_candidate("visible-only", &visible_payload, visible_started.elapsed());
     if let Some(visible_limit) = visible_payload.limit_exceeded(options, max_expanded_size) {
         return Err(SavePayloadTooLarge {
+            recovery_path: None,
             limit: visible_limit,
             written_size: visible_payload.final_size(),
             raw_size: visible_payload.raw_size,
@@ -138,7 +157,7 @@ pub(super) fn payload_within_limit(
         );
         let depth_one_started = Instant::now();
         let depth_one_candidate = snapshot_with_history_depth(snapshot, 1);
-        let depth_one_payload = payload_candidate(&depth_one_candidate, options, last_modified)?;
+        let depth_one_payload = payload_candidate(&depth_one_candidate, options, stamp)?;
         log_payload_candidate(
             "history-depth 1",
             &depth_one_payload,
@@ -169,7 +188,7 @@ pub(super) fn payload_within_limit(
                     snapshot,
                     history_depth,
                     options,
-                    last_modified,
+                    stamp,
                     max_expanded_size,
                     history_fallback,
                 )?
@@ -216,7 +235,7 @@ fn fitting_history_payload(
     snapshot: &SessionSnapshot,
     history_depth: usize,
     options: &SessionOptions,
-    last_modified: &str,
+    stamp: PayloadStamp<'_>,
     max_expanded_size: u64,
     history_fallback: HistoryFallbackStrategy,
 ) -> Result<Option<(usize, PayloadCandidate)>> {
@@ -226,7 +245,7 @@ fn fitting_history_payload(
             2,
             history_depth,
             options,
-            last_modified,
+            stamp,
             max_expanded_size,
         ),
         HistoryFallbackStrategy::Bounded { max_depth } => {
@@ -244,7 +263,7 @@ fn fitting_history_payload(
                 2,
                 max_depth,
                 options,
-                last_modified,
+                stamp,
                 max_expanded_size,
             )
         }
@@ -256,7 +275,7 @@ fn largest_fitting_history_payload(
     min_depth: usize,
     max_depth: usize,
     options: &SessionOptions,
-    last_modified: &str,
+    stamp: PayloadStamp<'_>,
     max_expanded_size: u64,
 ) -> Result<Option<(usize, PayloadCandidate)>> {
     if min_depth > max_depth {
@@ -269,7 +288,7 @@ fn largest_fitting_history_payload(
         attempts += 1;
         let candidate_started = Instant::now();
         let candidate = snapshot_with_history_depth(snapshot, depth);
-        let payload = payload_candidate(&candidate, options, last_modified)?;
+        let payload = payload_candidate(&candidate, options, stamp)?;
         debug!(
             "Prepared history-depth session payload candidate depth={} in {:?}: written={} bytes, raw={} bytes, compression={}",
             depth,
@@ -314,9 +333,9 @@ pub(super) fn log_payload_candidate(label: &str, payload: &PayloadCandidate, ela
 pub(super) fn payload_candidate(
     snapshot: &SessionSnapshot,
     options: &SessionOptions,
-    last_modified: &str,
+    stamp: PayloadStamp<'_>,
 ) -> Result<PayloadCandidate> {
-    let raw_bytes = serialize_payload(snapshot, last_modified)?;
+    let raw_bytes = serialize_payload(snapshot, stamp)?;
     let raw_size = raw_bytes.len();
     let compressed = should_compress_payload(raw_size, options);
     let bytes = if compressed {
@@ -325,6 +344,15 @@ pub(super) fn payload_candidate(
         raw_bytes
     };
 
+    debug_assert_eq!(
+        payload_prefix_generation(&bytes),
+        stamp.generation.map_or(
+            super::super::generation::Generation::Unknown,
+            super::super::generation::Generation::from_raw
+        ),
+        "written payload must expose its generation within the probe window"
+    );
+
     Ok(PayloadCandidate {
         bytes,
         raw_size,
@@ -340,10 +368,11 @@ fn should_compress_payload(raw_size: usize, options: &SessionOptions) -> bool {
     }
 }
 
-fn serialize_payload(snapshot: &SessionSnapshot, last_modified: &str) -> Result<Vec<u8>> {
+fn serialize_payload(snapshot: &SessionSnapshot, stamp: PayloadStamp<'_>) -> Result<Vec<u8>> {
     let file_payload = SessionFile {
         version: CURRENT_VERSION,
-        last_modified: last_modified.to_string(),
+        save_generation: stamp.generation,
+        last_modified: stamp.last_modified.to_string(),
         active_board_id: Some(snapshot.active_board_id.clone()),
         active_mode: None,
         boards: snapshot
diff --git a/src/session/snapshot/save/recovery.rs b/src/session/snapshot/save/recovery.rs
index f4dfefbbe..934dc8b48 100644
--- a/src/session/snapshot/save/recovery.rs
+++ b/src/session/snapshot/save/recovery.rs
@@ -1,14 +1,14 @@
 use super::payload::{log_payload_candidate, snapshot_without_history};
 use super::*;
+use crate::session::snapshot::generation::{ArtifactStamp, MarkerKind, cleared_by};
 
 pub(super) fn save_recovery_snapshot(
     snapshot: &SessionSnapshot,
     options: &SessionOptions,
     max_expanded_size: u64,
-    last_modified: &str,
+    stamp: payload::PayloadStamp<'_>,
 ) -> Result<Option<SaveSnapshotReport>> {
-    let Some((payload, outcome)) =
-        recovery_payload(snapshot, options, max_expanded_size, last_modified)?
+    let Some((payload, outcome)) = recovery_payload(snapshot, options, max_expanded_size, stamp)?
     else {
         return Ok(None);
     };
@@ -43,6 +43,7 @@ pub(super) fn save_recovery_snapshot(
     );
 
     Ok(Some(SaveSnapshotReport {
+        generation: stamp.generation,
         path: recovery_path,
         outcome,
         raw_size: payload.raw_size,
@@ -56,14 +57,14 @@ fn recovery_payload(
     snapshot: &SessionSnapshot,
     options: &SessionOptions,
     max_expanded_size: u64,
-    last_modified: &str,
+    stamp: payload::PayloadStamp<'_>,
 ) -> Result<Option<(PayloadCandidate, SaveSnapshotOutcome)>> {
     if snapshot.is_empty() && snapshot.tool_state.is_none() {
         return Ok(None);
     }
 
     let full_started = Instant::now();
-    let full_payload = payload_candidate(snapshot, options, last_modified)?;
+    let full_payload = payload_candidate(snapshot, options, stamp)?;
     log_payload_candidate("recovery full", &full_payload, full_started.elapsed());
     let Some(full_limit) = full_payload.expanded_limit_exceeded(max_expanded_size) else {
         return Ok(Some((full_payload, SaveSnapshotOutcome::Full)));
@@ -81,7 +82,7 @@ fn recovery_payload(
         return Ok(None);
     }
     let visible_started = Instant::now();
-    let visible_payload = payload_candidate(&visible_only, options, last_modified)?;
+    let visible_payload = payload_candidate(&visible_only, options, stamp)?;
     log_payload_candidate(
         "recovery visible-only",
         &visible_payload,
@@ -172,21 +173,31 @@ fn artifact_is_newer_than_marker(
     artifact_metadata: &fs::Metadata,
     marker_metadata: &fs::Metadata,
 ) -> bool {
-    match (artifact_metadata.modified(), marker_metadata.modified()) {
-        (Ok(artifact_modified), Ok(marker_modified)) => artifact_modified > marker_modified,
-        _ => false,
-    }
+    !cleared_by(
+        ArtifactStamp::without_generation(artifact_metadata),
+        ArtifactStamp::without_generation(marker_metadata),
+    )
 }
 
 /// Writes a marker file through `durable_io`, which owns the whole
 /// temp-write/fsync/rename/parent-sync dance and removes its temporary file on
-/// every failure path. Markers hold only a timestamp, but the load side decides
-/// what to restore from whether they exist, so their durability is part of the
-/// save contract.
-fn write_session_marker(marker_path: &Path, label: &str) -> Result<()> {
+/// every failure path. Markers carry a format-1 generation record, or a legacy
+/// timestamp at the counter ceiling. Loaders still use marker presence and
+/// modification times, so marker durability remains part of the save contract.
+fn write_session_marker(
+    marker_path: &Path,
+    kind: MarkerKind,
+    generation: Option<u64>,
+    label: &str,
+) -> Result<()> {
+    let written = now_rfc3339();
+    let content = match generation {
+        Some(g) => super::super::generation::marker_record_bytes(kind, g, written)?,
+        None => written.into_bytes(),
+    };
     crate::durable_io::write_atomic(
         marker_path,
-        now_rfc3339().as_bytes(),
+        &content,
         crate::durable_io::AtomicWriteOptions {
             overwrite: crate::durable_io::OverwriteMode::Replace,
             permissions: crate::durable_io::PermissionPolicy::FixedMode(0o600),
@@ -198,9 +209,17 @@ fn write_session_marker(marker_path: &Path, label: &str) -> Result<()> {
     .with_context(|| format!("failed to write {label} {}", marker_path.display()))
 }
 
-pub(super) fn write_backup_recovery_marker(options: &SessionOptions) -> Result<()> {
+pub(super) fn write_backup_recovery_marker(
+    options: &SessionOptions,
+    generation: Option<u64>,
+) -> Result<()> {
     let marker_path = options.backup_recovery_marker_file_path();
-    write_session_marker(&marker_path, "backup recovery marker")?;
+    write_session_marker(
+        &marker_path,
+        MarkerKind::BackupRecoverable,
+        generation,
+        "backup recovery marker",
+    )?;
     info!(
         "Wrote backup recovery marker {} for contentless non-clear session save",
         marker_path.display()
@@ -208,9 +227,17 @@ pub(super) fn write_backup_recovery_marker(options: &SessionOptions) -> Result<(
     Ok(())
 }
 
-pub(super) fn write_recovery_recoverable_marker(options: &SessionOptions) -> Result<()> {
+pub(super) fn write_recovery_recoverable_marker(
+    options: &SessionOptions,
+    generation: Option<u64>,
+) -> Result<()> {
     let marker_path = options.recovery_recoverable_marker_file_path();
-    write_session_marker(&marker_path, "recovery recoverable marker")?;
+    write_session_marker(
+        &marker_path,
+        MarkerKind::RecoveryRecoverable,
+        generation,
+        "recovery recoverable marker",
+    )?;
     info!(
         "Wrote recovery recoverable marker {} for contentless non-clear session save",
         marker_path.display()
@@ -218,9 +245,14 @@ pub(super) fn write_recovery_recoverable_marker(options: &SessionOptions) -> Res
     Ok(())
 }
 
-pub(super) fn write_clear_marker(options: &SessionOptions) -> Result<()> {
+pub(super) fn write_clear_marker(options: &SessionOptions, generation: Option<u64>) -> Result<()> {
     let marker_path = options.clear_marker_file_path();
-    write_session_marker(&marker_path, "session clear marker")?;
+    write_session_marker(
+        &marker_path,
+        MarkerKind::Cleared,
+        generation,
+        "session clear marker",
+    )?;
     info!(
         "Wrote session clear marker {} for empty saved session",
         marker_path.display()
@@ -377,3 +409,36 @@ pub(super) fn remove_recovery_file(options: &SessionOptions) {
         ),
     }
 }
+
+pub(super) fn preserve_oversized_recovery(
+    error: &mut anyhow::Error,
+    snapshot: &SessionSnapshot,
+    options: &SessionOptions,
+    max_expanded_size: u64,
+    stamp: payload::PayloadStamp<'_>,
+) {
+    if error.downcast_ref::<SavePayloadTooLarge>().is_none() {
+        return;
+    }
+    match save_recovery_snapshot(snapshot, options, max_expanded_size, stamp) {
+        Ok(Some(report)) => {
+            if let Some(limit) = error.downcast_mut::<SavePayloadTooLarge>() {
+                limit.recovery_path = Some(report.path.clone());
+            }
+            warn!(
+                "Wrote oversized session recovery artifact to {} ({} bytes written, raw={} bytes, compression={}, outcome={:?})",
+                report.path.display(),
+                report.written_size,
+                report.raw_size,
+                report.compressed,
+                report.outcome
+            );
+        }
+        Ok(None) => {}
+        Err(recovery_err) => warn!(
+            "Failed to write oversized session recovery artifact {}: {}",
+            options.recovery_file_path().display(),
+            recovery_err
+        ),
+    }
+}
diff --git a/src/session/snapshot/save/save_as.rs b/src/session/snapshot/save/save_as.rs
index 8e164e177..9166b5b63 100644
--- a/src/session/snapshot/save/save_as.rs
+++ b/src/session/snapshot/save/save_as.rs
@@ -27,12 +27,17 @@ pub(crate) fn save_snapshot_as_with_report(
     let initial_artifacts = collect_save_as_artifacts(options)?;
     ensure_save_as_overwrite_allowed(&initial_artifacts, overwrite, &session_path)?;
 
+    // Prepared before locking; commit quarantines all target sidecars.
+    let generation = ArtifactSetView::probe(options).next_generation(UnreadablePolicy::Warn)?;
     let last_modified = now_rfc3339();
     let prepare_started = Instant::now();
     let prepared = payload_within_limit(
         snapshot,
         options,
-        &last_modified,
+        PayloadStamp {
+            last_modified: &last_modified,
+            generation,
+        },
         DEFAULT_MAX_EXPANDED_SESSION_BYTES,
         HistoryFallbackStrategy::LargestFitting,
     )?;
@@ -144,6 +149,7 @@ pub(crate) fn save_snapshot_as_with_report(
     }
 
     let report = SaveSnapshotReport {
+        generation,
         path: session_path,
         outcome: prepared.outcome,
         raw_size,
diff --git a/src/session/snapshot/tests.rs b/src/session/snapshot/tests.rs
index bdebf1ba7..eff8cba44 100644
--- a/src/session/snapshot/tests.rs
+++ b/src/session/snapshot/tests.rs
@@ -44,7 +44,7 @@ fn sample_frame() -> Frame {
     frame
 }
 
-fn sample_snapshot() -> SessionSnapshot {
+pub(super) fn sample_snapshot() -> SessionSnapshot {
     SessionSnapshot {
         active_board_id: "transparent".to_string(),
         boards: vec![BoardSnapshot {
@@ -59,7 +59,142 @@ fn sample_snapshot() -> SessionSnapshot {
     }
 }
 
-fn sample_tool_state() -> ToolStateSnapshot {
+#[test]
+fn corrupt_primary_restores_backup_without_destroying_its_bytes() {
+    for named in [false, true] {
+        let temp = tempdir().unwrap();
+        let mut options = SessionOptions::new(temp.path().to_path_buf(), "corrupt-restore");
+        options.persist_transparent = true;
+        options.compression = CompressionMode::Off;
+        if named {
+            options.set_named_file_target(temp.path().join("board.wayscriber-session"));
+        }
+
+        save_snapshot(&sample_snapshot(), &options).unwrap();
+        let good_bytes = std::fs::read(options.session_file_path()).unwrap();
+        std::fs::copy(options.session_file_path(), options.backup_file_path()).unwrap();
+        std::fs::write(options.session_file_path(), b"{broken primary").unwrap();
+
+        let restored = load_snapshot(&options)
+            .unwrap()
+            .expect("restore the backup");
+        assert!(restored.has_board_data());
+        assert_eq!(
+            std::fs::read(options.backup_file_path()).unwrap(),
+            good_bytes
+        );
+        if named {
+            assert_eq!(
+                std::fs::read(options.session_file_path()).unwrap(),
+                good_bytes
+            );
+        } else {
+            assert!(!options.session_file_path().exists());
+        }
+
+        save_snapshot(&restored, &options).unwrap();
+        assert_eq!(
+            std::fs::read(options.backup_file_path()).unwrap(),
+            good_bytes
+        );
+    }
+}
+
+#[test]
+fn corrupt_artifacts_have_separate_copies_and_only_marked_recovery_restores() {
+    for recoverable in [false, true] {
+        let temp = tempdir().unwrap();
+        let mut options = SessionOptions::new(temp.path().to_path_buf(), "corrupt-recovery");
+        options.persist_transparent = true;
+        save_snapshot(&sample_snapshot(), &options).unwrap();
+        std::fs::rename(options.session_file_path(), options.recovery_file_path()).unwrap();
+        set_modified(
+            &options.recovery_file_path(),
+            SystemTime::UNIX_EPOCH + Duration::from_secs(10),
+        );
+        if recoverable {
+            std::fs::write(
+                options.recovery_recoverable_marker_file_path(),
+                b"recoverable",
+            )
+            .unwrap();
+        }
+        std::fs::write(options.backup_file_path(), b"broken backup").unwrap();
+        std::fs::write(options.session_file_path(), b"broken primary").unwrap();
+        set_modified(
+            &options.session_file_path(),
+            SystemTime::UNIX_EPOCH + Duration::from_secs(20),
+        );
+
+        let outcome = load_snapshot_with_expanded_limit(&options, 64 * 1024).unwrap();
+        if recoverable {
+            assert!(matches!(
+                outcome,
+                LoadSnapshotOutcome::RestoredAfterCorruption {
+                    source: super::load::RestoredArtifact::Recovery,
+                    ..
+                }
+            ));
+        } else {
+            assert!(matches!(
+                outcome,
+                LoadSnapshotOutcome::EmptyAfterCorruption { .. }
+            ));
+        }
+        for (slot, expected) in [
+            (options.session_file_path(), b"broken primary".as_slice()),
+            (options.backup_file_path(), b"broken backup".as_slice()),
+        ] {
+            assert_eq!(
+                std::fs::read(crate::session::append_path_suffix(&slot, ".corrupt-1")).unwrap(),
+                expected
+            );
+        }
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn corrupt_copy_retention_skips_foreign_entries_and_named_loads_reuse_bytes() {
+    let temp = tempdir().unwrap();
+    let mut options = SessionOptions::new(temp.path().to_path_buf(), "copy-retention");
+    let primary = temp.path().join("board.wayscriber-session");
+    options.set_named_file_target(primary.clone());
+    options.persist_transparent = true;
+    let copy = |n| crate::session::append_path_suffix(&primary, &format!(".corrupt-{n}"));
+    std::fs::create_dir(copy(1)).unwrap();
+    let foreign = temp.path().join("foreign");
+    std::fs::write(&foreign, b"unrelated").unwrap();
+    symlink(&foreign, copy(2)).unwrap();
+
+    for n in 3..=7 {
+        std::fs::write(&primary, format!("broken {n}")).unwrap();
+        let outcome = load_snapshot_with_expanded_limit(&options, 64 * 1024).unwrap();
+        assert!(matches!(
+            outcome,
+            LoadSnapshotOutcome::EmptyAfterCorruption { .. }
+        ));
+        load_snapshot_with_expanded_limit(&options, 64 * 1024).unwrap();
+        assert_eq!(
+            std::fs::read(copy(n)).unwrap(),
+            format!("broken {n}").as_bytes()
+        );
+        assert!(!copy(n + 1).exists());
+    }
+    assert!(!copy(3).exists());
+    assert!(!copy(4).exists());
+    assert!(copy(5).exists() && copy(6).exists() && copy(7).exists());
+    assert!(copy(1).is_dir());
+    assert!(
+        std::fs::symlink_metadata(copy(2))
+            .unwrap()
+            .file_type()
+            .is_symlink()
+    );
+    assert_eq!(std::fs::read(foreign).unwrap(), b"unrelated");
+}
+
+pub(super) fn sample_tool_state() -> ToolStateSnapshot {
     ToolStateSnapshot {
         current_color: Color {
             r: 1.0,
@@ -95,6 +230,7 @@ fn sample_tool_state() -> ToolStateSnapshot {
 
 fn contentless_session_file() -> SessionFile {
     SessionFile {
+        save_generation: None,
         version: CURRENT_VERSION,
         last_modified: now_rfc3339(),
         active_board_id: Some("transparent".to_string()),
@@ -115,6 +251,7 @@ fn contentless_session_file() -> SessionFile {
 
 fn sample_session_file() -> SessionFile {
     SessionFile {
+        save_generation: None,
         version: CURRENT_VERSION,
         last_modified: now_rfc3339(),
         active_board_id: Some("transparent".to_string()),
@@ -147,7 +284,7 @@ fn write_contentless_session(path: &Path) {
 }
 
 #[cfg(unix)]
-fn make_fifo(path: &Path) {
+pub(super) fn make_fifo(path: &Path) {
     let raw_path = CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL bytes");
     // SAFETY: raw_path is a valid, NUL-terminated filesystem path for this process.
     let result = unsafe { libc::mkfifo(raw_path.as_ptr(), 0o600) };
@@ -160,7 +297,7 @@ fn make_fifo(path: &Path) {
     );
 }
 
-fn set_modified(path: &Path, modified: SystemTime) {
+pub(super) fn set_modified(path: &Path, modified: SystemTime) {
     std::fs::File::options()
         .write(true)
         .open(path)
@@ -657,7 +794,7 @@ fn load_named_primary_rejects_symlink_without_following_target() {
 }
 
 #[test]
-fn load_named_corrupt_primary_backs_up_without_removing_selected_file() {
+fn load_named_corrupt_primary_preserves_diagnostics_without_removing_selected_file() {
     use std::os::unix::fs::PermissionsExt;
 
     let temp = tempdir().unwrap();
@@ -678,12 +815,12 @@ fn load_named_corrupt_primary_backs_up_without_removing_selected_file() {
     let outcome = load_snapshot_with_expanded_limit(&options, 64 * 1024)
         .expect("corrupt named primary should be handled");
 
-    let LoadSnapshotOutcome::EmptyAfterCorruption { backup_path } = &outcome else {
+    let LoadSnapshotOutcome::EmptyAfterCorruption { corrupt_copy } = &outcome else {
         panic!("an unreadable session must report where its bytes went, got {outcome:?}");
     };
     assert_eq!(
-        backup_path,
-        &options.backup_file_path(),
+        corrupt_copy,
+        &crate::session::append_path_suffix(&named_path, ".corrupt-1"),
         "the reported path is the one holding the preserved bytes"
     );
     assert_eq!(
@@ -692,13 +829,13 @@ fn load_named_corrupt_primary_backs_up_without_removing_selected_file() {
         "named corrupt backup must not remove the selected primary path"
     );
     assert_eq!(
-        std::fs::read(options.backup_file_path()).expect("backup bytes"),
+        std::fs::read(corrupt_copy).expect("corrupt copy bytes"),
         b"{not valid json",
         "named corrupt primary should still be backed up for diagnostics"
     );
     assert_eq!(
-        std::fs::metadata(options.backup_file_path())
-            .expect("backup metadata")
+        std::fs::metadata(corrupt_copy)
+            .expect("corrupt copy metadata")
             .permissions()
             .mode()
             & 0o777,
@@ -1341,7 +1478,7 @@ fn load_snapshot_falls_back_to_normal_when_recovery_is_corrupt() {
         "corrupt recovery should be moved out of the recovery path"
     );
     assert!(
-        recovery_path.with_extension("recovery.bak").exists(),
+        crate::session::append_path_suffix(&recovery_path, ".corrupt-1").exists(),
         "corrupt recovery should be backed up for inspection"
     );
 }
@@ -1356,6 +1493,7 @@ fn load_snapshot_falls_back_to_normal_when_recovery_is_empty() {
     save_snapshot(&snapshot, &options).expect("normal session should save");
 
     let empty_file = SessionFile {
+        save_generation: None,
         version: CURRENT_VERSION,
         last_modified: now_rfc3339(),
         active_board_id: Some("transparent".to_string()),
@@ -2025,6 +2163,7 @@ fn load_snapshot_inner_skips_newer_versions() {
     let session_path = temp.path().join("session.json");
 
     let file = SessionFile {
+        save_generation: None,
         version: CURRENT_VERSION + 1,
         last_modified: now_rfc3339(),
         active_board_id: Some("transparent".to_string()),
@@ -2513,6 +2652,7 @@ fn load_snapshot_inner_migrates_legacy_frame_to_pages() {
     });
 
     let file = SessionFile {
+        save_generation: None,
         version: CURRENT_VERSION,
         last_modified: now_rfc3339(),
         active_board_id: None,
@@ -2553,6 +2693,7 @@ fn load_snapshot_inner_falls_back_when_active_board_is_missing() {
     let session_path = temp.path().join("session.json");
 
     let file = SessionFile {
+        save_generation: None,
         version: CURRENT_VERSION,
         last_modified: now_rfc3339(),
         active_board_id: Some("missing".to_string()),
@@ -2591,6 +2732,7 @@ fn load_snapshot_inner_normalizes_empty_legacy_page_lists() {
     let session_path = temp.path().join("session.json");
 
     let file = SessionFile {
+        save_generation: None,
         version: CURRENT_VERSION,
         last_modified: now_rfc3339(),
         active_board_id: None,
@@ -2778,3 +2920,39 @@ fn maximum_admitted_image_and_create_history_fit_actual_default_session_budget()
         "create history survives full save/load"
     );
 }
+
+#[test]
+fn offline_tool_clear_reports_corruption_instead_of_silently_rewriting_restored_ink() {
+    for named in [false, true] {
+        let temp = tempdir().unwrap();
+        let mut options = SessionOptions::new(temp.path().to_path_buf(), "offline-corrupt");
+        options.persist_transparent = true;
+        if named {
+            options.set_named_file_target(temp.path().join("named.wayscriber-session"));
+        }
+        let snapshot = sample_snapshot();
+        save_snapshot(&snapshot, &options).unwrap();
+        std::fs::rename(options.session_file_path(), options.backup_file_path()).unwrap();
+        let backup = std::fs::read(options.backup_file_path()).unwrap();
+        std::fs::write(options.session_file_path(), b"unreadable primary").unwrap();
+        let error = crate::session::clear_tool_state(&options).unwrap_err();
+        assert!(format!("{error:#}").contains("diagnostic bytes were preserved"));
+        assert_eq!(std::fs::read(options.backup_file_path()).unwrap(), backup);
+        assert_eq!(
+            std::fs::read(crate::session::append_path_suffix(
+                &options.session_file_path(),
+                ".corrupt-1"
+            ))
+            .unwrap(),
+            b"unreadable primary"
+        );
+        if named {
+            assert_eq!(
+                std::fs::read(options.session_file_path()).unwrap(),
+                b"unreadable primary"
+            );
+        } else {
+            assert!(!options.session_file_path().exists());
+        }
+    }
+}
diff --git a/src/session/snapshot/types.rs b/src/session/snapshot/types.rs
index 54c9a05b9..b6ea7d4bf 100644
--- a/src/session/snapshot/types.rs
+++ b/src/session/snapshot/types.rs
@@ -190,6 +190,13 @@ fn default_polygon_sides_for_snapshot() -> u8 {
 pub(super) struct SessionFile {
     #[serde(default = "default_file_version")]
     pub version: u32,
+    // Keep immediately after version so bounded probes find the header.
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "deserialize_save_generation"
+    )]
+    pub save_generation: Option<u64>,
     pub last_modified: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub active_board_id: Option<String>,
@@ -235,3 +242,12 @@ pub(super) struct BoardFile {
 fn default_file_version() -> u32 {
     1
 }
+
+fn deserialize_save_generation<'de, D: serde::Deserializer<'de>>(
+    deserializer: D,
+) -> Result<Option<u64>, D::Error> {
+    let value = serde_json::Value::deserialize(deserializer)?;
+    Ok(value
+        .as_u64()
+        .filter(|g| (1..=super::generation::MAX_GENERATION).contains(g)))
+}
diff --git a/src/session/storage/clear.rs b/src/session/storage/clear.rs
index 862938750..aeb5d6d18 100644
--- a/src/session/storage/clear.rs
+++ b/src/session/storage/clear.rs
@@ -1,5 +1,7 @@
+use crate::session::artifacts::{parse_corrupt_copy_name, remove_corrupt_copies};
 use anyhow::{Context, Result};
 use std::fs;
+use std::io::ErrorKind;
 use std::path::Path;
 
 use super::types::ClearOutcome;
@@ -21,6 +23,8 @@ pub fn clear_session(options: &SessionOptions) -> Result<ClearOutcome> {
     let removed_clear_marker = remove_file_if_exists(&clear_marker_path)?;
     let mut removed_session = removed_primary_session || removed_clear_marker;
     let mut removed_backup = remove_file_if_exists(&backup_path)?;
+    removed_session = remove_corrupt_copies(&session_path)? || removed_session;
+    removed_backup = remove_corrupt_copies(&backup_path)? || removed_backup;
     removed_backup = remove_file_if_exists(&backup_recovery_marker_path)? || removed_backup;
     let mut removed_recovery = remove_recovery_files(&recovery_path)?;
     let mut removed_lock = remove_file_if_exists(&lock_path)?;
@@ -28,20 +32,28 @@ pub fn clear_session(options: &SessionOptions) -> Result<ClearOutcome> {
     if options.per_output && options.output_identity().is_none() {
         let prefix = options.file_prefix();
         let base_dir = &options.base_dir;
+        // Every output's files carry this session's suffixes after the prefix.
+        let session_suffix = suffix_after_prefix(&session_path, &prefix)?;
+        let backup_suffix = suffix_after_prefix(&backup_path, &prefix)?;
 
-        let removed_matching_sessions = remove_matching_files(base_dir, &prefix, ".json")?;
+        let removed_matching_sessions = remove_matching_files(base_dir, &prefix, &session_suffix)?;
         let removed_matching_clear_markers =
             remove_matching_files(base_dir, &prefix, ".json.cleared")?;
         removed_session =
             removed_matching_sessions || removed_matching_clear_markers || removed_session;
 
-        removed_backup = remove_matching_files(base_dir, &prefix, ".json.bak")? || removed_backup;
+        removed_backup =
+            remove_matching_files(base_dir, &prefix, &backup_suffix)? || removed_backup;
         removed_backup =
             remove_matching_files(base_dir, &prefix, ".json.bak.recoverable")? || removed_backup;
 
         removed_recovery = remove_matching_recovery_files(base_dir, &prefix)? || removed_recovery;
 
         removed_lock = remove_matching_files(base_dir, &prefix, ".lock")? || removed_lock;
+        let (copied_session, copied_backup) =
+            remove_matching_corrupt_copies(base_dir, &prefix, &session_suffix, &backup_suffix)?;
+        removed_session = copied_session || removed_session;
+        removed_backup = copied_backup || removed_backup;
     }
 
     Ok(ClearOutcome {
@@ -62,11 +74,7 @@ fn remove_file_if_exists(path: &Path) -> Result<bool> {
 }
 
 fn remove_recovery_files(recovery_path: &Path) -> Result<bool> {
-    let Some(recovery_name) = recovery_path
-        .file_name()
-        .and_then(|name| name.to_str())
-        .map(str::to_string)
-    else {
+    let Some(recovery_name) = recovery_path.file_name() else {
         return remove_file_if_exists(recovery_path);
     };
     let Some(parent) = recovery_path.parent() else {
@@ -81,10 +89,10 @@ fn remove_recovery_files(recovery_path: &Path) -> Result<bool> {
             if !path.is_file() {
                 continue;
             }
-            let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+            let Some(name) = path.file_name() else {
                 continue;
             };
-            if name == recovery_name || name.starts_with(&format!("{recovery_name}.")) {
+            if crate::session::artifacts::is_recovery_variant(name, recovery_name) {
                 fs::remove_file(&path)
                     .with_context(|| format!("failed to remove {}", path.display()))?;
                 removed = true;
@@ -141,6 +149,59 @@ fn remove_matching_recovery_files(dir: &Path, prefix: &str) -> Result<bool> {
     Ok(removed)
 }
 
+fn suffix_after_prefix(path: &Path, prefix: &str) -> Result<String> {
+    path.file_name()
+        .and_then(|name| name.to_str())
+        .and_then(|name| name.strip_prefix(prefix))
+        .map(str::to_owned)
+        .with_context(|| format!("{} is not named after {prefix}", path.display()))
+}
+
+/// Removes the `.corrupt-N` copies of every output's session and backup files,
+/// reporting whether any of each were removed.
+fn remove_matching_corrupt_copies(
+    dir: &Path,
+    prefix: &str,
+    session_suffix: &str,
+    backup_suffix: &str,
+) -> Result<(bool, bool)> {
+    let entries = match fs::read_dir(dir) {
+        Ok(entries) => entries,
+        Err(error) if error.kind() == ErrorKind::NotFound => return Ok((false, false)),
+        Err(error) => {
+            return Err(error).with_context(|| format!("failed to list {}", dir.display()));
+        }
+    };
+
+    let (mut removed_session, mut removed_backup) = (false, false);
+    for entry in entries {
+        let entry = entry?;
+        let name = entry.file_name();
+        let Some(artifact) =
+            parse_corrupt_copy_name(&name).and_then(|(artifact, _)| artifact.to_str())
+        else {
+            continue;
+        };
+        let backup = artifact.ends_with(backup_suffix);
+        if !name_matches_session_prefix(artifact, prefix)
+            || !(backup || artifact.ends_with(session_suffix))
+            || !entry.file_type()?.is_file()
+        {
+            continue;
+        }
+
+        let path = entry.path();
+        fs::remove_file(&path).with_context(|| format!("failed to remove {}", path.display()))?;
+        if backup {
+            removed_backup = true;
+        } else {
+            removed_session = true;
+        }
+    }
+
+    Ok((removed_session, removed_backup))
+}
+
 fn name_matches_session_prefix(name: &str, prefix: &str) -> bool {
     name.strip_prefix(prefix)
         .is_some_and(|rest| rest.starts_with('.') || rest.starts_with('-'))
diff --git a/src/session/storage/tests.rs b/src/session/storage/tests.rs
index 7268bf808..2b74dcf1f 100644
--- a/src/session/storage/tests.rs
+++ b/src/session/storage/tests.rs
@@ -186,6 +186,36 @@ fn clear_session_removes_all_variants_for_prefix() {
     // so we only assert that the primary files are gone.
 }
 
+#[test]
+fn clear_session_removes_every_outputs_unreadable_copies_and_no_neighbors() {
+    let temp = crate::test_temp::tempdir().unwrap();
+    let mut options = SessionOptions::new(temp.path().to_path_buf(), "display-1");
+    options.per_output = true;
+    let base_dir = &options.base_dir;
+    let removed = [
+        "session-display_1-DP_1.json.corrupt-1",
+        "session-display_1-DP_1.json.bak.corrupt-2",
+    ];
+    let kept = [
+        "session-display_10-DP_1.json.corrupt-1",
+        "session-display_1-DP_1.json.corrupt-01",
+    ];
+    for name in removed.iter().chain(&kept) {
+        std::fs::write(base_dir.join(name), b"unreadable").unwrap();
+    }
+
+    let outcome = clear_session(&options).unwrap();
+
+    assert!(outcome.removed_session);
+    assert!(outcome.removed_backup);
+    for name in removed {
+        assert!(!base_dir.join(name).exists(), "{name}");
+    }
+    for name in kept {
+        assert!(base_dir.join(name).exists(), "{name}");
+    }
+}
+
 #[test]
 fn clear_session_keeps_neighbor_display_prefix_variants() {
     let temp = crate::test_temp::tempdir().unwrap();
diff --git a/src/session/storage/tool_state.rs b/src/session/storage/tool_state.rs
index 5fb5d6a7c..b562c69f8 100644
--- a/src/session/storage/tool_state.rs
+++ b/src/session/storage/tool_state.rs
@@ -1,4 +1,4 @@
-use anyhow::{Result, anyhow};
+use anyhow::{Context, Result, anyhow};
 use std::collections::BTreeSet;
 use std::fs;
 
@@ -16,14 +16,22 @@ pub fn clear_tool_state(options: &SessionOptions) -> Result<ClearToolStateOutcom
     let mut found_session = false;
     let mut cleared = false;
     let mut preserved_board_data = false;
+    let mut edited_paths = Vec::new();
 
     for edit_options in targets {
-        match clear_tool_state_for_target(&edit_options)? {
+        match clear_tool_state_for_target(&edit_options).with_context(|| {
+            format!(
+                "Saved tool-state edit stopped at {}; targets already edited: {:?}",
+                edit_options.session_file_path().display(),
+                edited_paths
+            )
+        })? {
             ClearToolStateOutcome::NoSession => {}
             ClearToolStateOutcome::NoToolState => found_session = true,
             ClearToolStateOutcome::Cleared {
                 preserved_board_data: target_preserved_board_data,
             } => {
+                edited_paths.push(edit_options.session_file_path());
                 found_session = true;
                 cleared = true;
                 preserved_board_data |= target_preserved_board_data;
@@ -47,7 +55,14 @@ fn clear_tool_state_for_target(edit_options: &SessionOptions) -> Result<ClearToo
         LoadSnapshotOutcome::Loaded(snapshot)
         | LoadSnapshotOutcome::LoadedFromBackup(snapshot)
         | LoadSnapshotOutcome::LoadedFromRecovery(snapshot) => *snapshot,
-        LoadSnapshotOutcome::Empty | LoadSnapshotOutcome::EmptyAfterCorruption { .. } => {
+        LoadSnapshotOutcome::RestoredAfterCorruption { corrupt_copy, .. }
+        | LoadSnapshotOutcome::EmptyAfterCorruption { corrupt_copy } => {
+            return Err(anyhow!(
+                "the session was unreadable; diagnostic bytes were preserved at {}. No saved tool-state edit was performed for this target",
+                corrupt_copy.display()
+            ));
+        }
+        LoadSnapshotOutcome::Empty => {
             return Ok(ClearToolStateOutcome::NoSession);
         }
         LoadSnapshotOutcome::NonRegularArtifact { path } => {
diff --git a/src/session/tests/limits.rs b/src/session/tests/limits.rs
index fca821330..4a0d97d1d 100644
--- a/src/session/tests/limits.rs
+++ b/src/session/tests/limits.rs
@@ -508,6 +508,21 @@ fn save_snapshot_keeps_largest_recent_history_depth_that_fits() {
         SaveSnapshotOutcome::TrimmedHistory { depth: 2 }
     );
 
+    assert_eq!(report.generation, Some(1));
+    let written = fs::read(options.session_file_path()).unwrap();
+    let json = if written.starts_with(&[0x1f, 0x8b]) {
+        use std::io::Read;
+        let mut decoded = Vec::new();
+        flate2::read::GzDecoder::new(written.as_slice())
+            .read_to_end(&mut decoded)
+            .unwrap();
+        decoded
+    } else {
+        written
+    };
+    let payload: serde_json::Value = serde_json::from_slice(&json).unwrap();
+    assert_eq!(payload["save_generation"], 1);
+
     let loaded = load_snapshot(&options)
         .expect("load_snapshot should succeed")
         .expect("snapshot should be present");
@@ -729,6 +744,7 @@ fn save_snapshot_keeps_depth_one_when_visible_payload_is_near_limit() {
 #[test]
 fn save_snapshot_report_marks_near_limit_at_ninety_percent() {
     let report = SaveSnapshotReport {
+        generation: None,
         path: Path::new("/tmp/session.json").to_path_buf(),
         outcome: SaveSnapshotOutcome::Full,
         raw_size: 90,
diff --git a/src/session/tests/roundtrip.rs b/src/session/tests/roundtrip.rs
index baa45e6dd..be0b6849a 100644
--- a/src/session/tests/roundtrip.rs
+++ b/src/session/tests/roundtrip.rs
@@ -243,9 +243,9 @@ fn corrupt_session_is_backed_up_and_reset() {
     let loaded = load_snapshot(&options).expect("load should not error");
     assert!(loaded.is_none());
 
-    let backup_path = options.backup_file_path();
-    let backup = fs::read(&backup_path).expect("backup file present");
-    assert_eq!(backup, b"not json");
+    let copy = crate::session::append_path_suffix(&session_path, ".corrupt-1");
+    assert_eq!(fs::read(copy).expect("corrupt copy present"), b"not json");
+    assert!(!options.backup_file_path().exists());
     assert!(
         !session_path.exists(),
         "corrupt session file should be removed after backup"
diff --git a/tests/repository_guards/shared_dependencies.rs b/tests/repository_guards/shared_dependencies.rs
index 0a14655f6..8d82c3dd3 100644
--- a/tests/repository_guards/shared_dependencies.rs
+++ b/tests/repository_guards/shared_dependencies.rs
@@ -9,12 +9,48 @@ use std::path::Path;
 
 use super::source::{Tree, is_word_char, mask_non_code};
 
-const BOUNDARIES: [(&str, &[&str]); 2] = [
+const BOUNDARIES: [(&str, &[&str]); 3] = [
     (
         "src/domain",
         &["config", "input", "draw", "backend", "ui", "session"],
     ),
     ("src/config/validate", &["input", "backend"]),
+    ("src/config", &["draw", "ui"]),
+];
+
+// Stable drawing values have not all moved to domain yet. Exact spellings
+// keep the exception narrow: another runtime import still fails the guard.
+const CONFIG_DRAW_VALUES: &[(&str, &str)] = &[
+    ("src/config/types/arrow.rs", "crate::draw::ArrowStyle"),
+    ("src/config/types/presets.rs", "crate::draw::EraserKind"),
+    (
+        "src/config/types/drawing.rs",
+        "crate::draw::shape::{BlurStyle, REGULAR_POLYGON_DEFAULT_SIDES}",
+    ),
+    (
+        "src/config/validate/presets.rs",
+        "crate::draw::{REGULAR_POLYGON_MAX_SIDES, REGULAR_POLYGON_MIN_SIDES, clamp_regular_sides}",
+    ),
+    (
+        "src/config/validate/drawing.rs",
+        "crate::draw::shape::{MAX_PEN_SMOOTHING, REGULAR_POLYGON_MAX_SIDES, REGULAR_POLYGON_MIN_SIDES}",
+    ),
+    (
+        "src/config/types/spotlight.rs",
+        "crate::draw::DEFAULT_SPOTLIGHT_MAGNIFICATION",
+    ),
+    (
+        "src/config/validate/spotlight.rs",
+        "crate::draw::MIN_SPOTLIGHT_MAGNIFICATION",
+    ),
+    (
+        "src/config/validate/spotlight.rs",
+        "crate::draw::MAX_SPOTLIGHT_MAGNIFICATION",
+    ),
+    (
+        "src/config/validate/spotlight.rs",
+        "crate::draw::normalize_spotlight_magnification",
+    ),
 ];
 
 /// Public-path compatibility assertions only.
@@ -30,7 +66,35 @@ fn check(tree: &Tree) -> Vec<String> {
             }
 
             let source = tree.read(path).expect("listed path");
-            if has_upward_path(source, path, forbidden) {
+            // Config integration tests deliberately construct runtime consumers.
+            if directory == "src/config"
+                && (path.starts_with("src/config/tests") || path.ends_with("tests.rs"))
+            {
+                continue;
+            }
+            let mut checked = tokens(source);
+            if directory == "src/config" {
+                for (owner, allowed) in CONFIG_DRAW_VALUES {
+                    if path == Path::new(owner) {
+                        let allowed = tokens(allowed);
+                        let mut index = 0;
+                        while index + allowed.len() <= checked.len() {
+                            if checked[index..index + allowed.len()] == allowed
+                                && checked
+                                    .get(index + allowed.len())
+                                    .is_none_or(|token| token != "::")
+                            {
+                                checked.splice(
+                                    index..index + allowed.len(),
+                                    ["domain_value".to_owned()],
+                                );
+                            }
+                            index += 1;
+                        }
+                    }
+                }
+            }
+            if has_upward_path(&checked, path, forbidden) {
                 errors.push(format!(
                     "{}: upward dependency in shared layer",
                     path.display()
@@ -96,14 +160,13 @@ fn module_path(path: &Path) -> Vec<String> {
     parts
 }
 
-fn has_upward_path(source: &str, path: &Path, forbidden: &[&str]) -> bool {
-    let tokens = tokens(source);
+fn has_upward_path(tokens: &[String], path: &Path, forbidden: &[&str]) -> bool {
     let module = module_path(path);
 
     (0..tokens.len().saturating_sub(1)).any(|index| {
         matches!(tokens[index].as_str(), "crate" | "super" | "self")
             && tokens[index + 1] == "::"
-            && use_tree(&tokens, index, module.clone(), forbidden).0
+            && use_tree(tokens, index, module.clone(), forbidden).0
     })
 }
 
@@ -199,3 +262,17 @@ fn shared_dependency_syntax_corpus_matches_its_expectations() {
         );
     }
 }
+
+#[test]
+fn config_draw_value_exceptions_are_still_used_in_code() {
+    let tree = Tree::checkout(&["src"]);
+    for (owner, allowed) in CONFIG_DRAW_VALUES {
+        let code = tokens(tree.read(Path::new(owner)).expect("exception owner"));
+        let allowed_tokens = tokens(allowed);
+        assert!(
+            code.windows(allowed_tokens.len())
+                .any(|window| window == allowed_tokens),
+            "stale config exception: {owner}: {allowed}"
+        );
+    }
+}
diff --git a/tests/repository_guards/shared_dependency_fixtures.json b/tests/repository_guards/shared_dependency_fixtures.json
index df4c4523a..8123f04ac 100644
--- a/tests/repository_guards/shared_dependency_fixtures.json
+++ b/tests/repository_guards/shared_dependency_fixtures.json
@@ -172,5 +172,41 @@
     "path": "src/domain/probe.rs",
     "source": "use crate::domain::{r#input};",
     "reject": false
+  },
+  {
+    "name": "config grouped draw import",
+    "path": "src/config/types/probe.rs",
+    "source": "use crate::{draw::Frame};",
+    "reject": true
+  },
+  {
+    "name": "config relative UI import",
+    "path": "src/config/types/probe.rs",
+    "source": "use super::super::super::ui::Toolbar;",
+    "reject": true
+  },
+  {
+    "name": "config named value exception stays narrow",
+    "path": "src/config/types/arrow.rs",
+    "source": "use crate::draw::ArrowStyle; use crate::draw::Frame;",
+    "reject": true
+  },
+  {
+    "name": "config shared domain values",
+    "path": "src/config/types/probe.rs",
+    "source": "use crate::domain::Color;",
+    "reject": false
+  },
+  {
+    "name": "config exception does not hide an identifier prefix",
+    "path": "src/config/types/arrow.rs",
+    "source": "use crate::draw::ArrowStyleFactory;",
+    "reject": true
+  },
+  {
+    "name": "config exception does not hide a longer path",
+    "path": "src/config/types/arrow.rs",
+    "source": "use crate::draw::ArrowStyle::runtime;",
+    "reject": true
   }
 ]